feat: 封禁用户允许登录但禁止写操作

- Session 结构体新增 Status 字段，Create/Validate 同步状态
- AuthService.Login 移除封禁检查，允许封禁用户登录
- 新增 BannedWriteGuard 中间件，拦截 POST/PUT/DELETE 写操作
- 封禁用户自动签到跳过
- 所有需登录的 API 路由组应用 BannedWriteGuard
- AdminService.UpdateUserStatus 保留 DestroyByUID 确保状态刷新

internal/router/admin.go

@@ -34,6 +34,7 @@ func setupAdminRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
 	adminAPI := r.Group("/api/admin")
 	adminAPI.Use(d.authMdw.Required())
 	adminAPI.Use(middleware.RequireMinRole(model.RoleAdmin))
+	adminAPI.Use(d.authMdw.BannedWriteGuard())
 	adminAPI.Use(middleware.CSRF(cfg))
 	{
 		adminAPI.GET("/users", d.adminCtrl.ListUsers)
@@ -48,6 +49,7 @@ func setupAdminRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
 	siteSettingsAPI := r.Group("/api/admin/site-settings")
 	siteSettingsAPI.Use(d.authMdw.Required())
 	siteSettingsAPI.Use(middleware.RequireMinRole(model.RoleOwner))
+	siteSettingsAPI.Use(d.authMdw.BannedWriteGuard())
 	siteSettingsAPI.Use(middleware.CSRF(cfg))
 	{
 		siteSettingsAPI.GET("", d.siteSettingCtrl.GetSettings)
@@ -60,6 +62,7 @@ func setupAdminRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
 	adminPostAPI := r.Group("/api/admin/posts")
 	adminPostAPI.Use(d.authMdw.Required())
 	adminPostAPI.Use(middleware.RequireMinRole(model.RoleAdmin))
+	adminPostAPI.Use(d.authMdw.BannedWriteGuard())
 	adminPostAPI.Use(middleware.CSRF(cfg))
 	{
 		adminPostAPI.POST("/:id/approve", d.adminPostCtrl.Approve)