refactor: 清理死代码 + 修复ISP接口注释

- 移除未使用的DTO类型(ChangePasswordRequest/DeleteAccountRequest)
- 移除service层未引用的错误重导出(auth_service/audit_service)
- 删除未使用的SiteSettingRepo(数据访问由config.SiteSettings直接处理)
- 删除未使用的FindByStatus方法(user_repo)
- 删除未使用的AutoMigrate方法(audit_repo/notification_repo)
- 删除未使用的PaginatedResult/NewPaginatedResult(pagination.go)
- 修复接口注释：notifProvider(5→4)、auditUseCase(4→3)、siteSettingUseCase(3→4)
- 移除auditStatusProvider未使用的FindByUsername方法
- 统一使用common.ErrXxx直接引用，消除跨service错误重导出耦合

internal/service/audit_service.go

@@ -59,14 +59,6 @@ func NewAuditService(auditRepo auditRepo, userRepo userProfileStore, settings si
 	}
 }
 
-// ErrXxx 重导出
-var (
-	ErrAuditNotFound   = common.ErrAuditNotFound
-	ErrAuditNotPending = common.ErrAuditNotPending
-	ErrAuditDisabled   = common.ErrAuditDisabled
-	ErrAuditTypeOff    = common.ErrAuditTypeOff
-)
-
 // ShouldAudit 判断指定用户是否需要走审核流程
 // 规则：admin 及以上角色免审
 func (s *AuditService) ShouldAudit(userID uint) (bool, error) {
@@ -85,12 +77,12 @@ func (s *AuditService) ShouldAudit(userID uint) (bool, error) {
 func (s *AuditService) Submit(userID uint, auditType, newValue string) error {
 	// 检查总开关
 	if !s.settings.IsAuditEnabled() {
-		return ErrAuditDisabled
+		return common.ErrAuditDisabled
 	}
 
 	// 检查类型开关
 	if !s.settings.IsAuditTypeEnabled(auditType, s.typeDefault(auditType)) {
-		return ErrAuditTypeOff
+		return common.ErrAuditTypeOff
 	}
 
 	// 用户名冲突检查（提交时即拦截，避免提交到后台后审核失败）
@@ -101,7 +93,7 @@ func (s *AuditService) Submit(userID uint, auditType, newValue string) error {
 			return err
 		}
 		if exists {
-			return ErrUsernameTaken
+			return common.ErrUsernameTaken
 		}
 		// 2) 审核表中已有其他用户提交了同名 pending
 		pendingExists, err := s.auditRepo.ExistsPendingByTypeAndValue(auditType, newValue, userID)
@@ -109,7 +101,7 @@ func (s *AuditService) Submit(userID uint, auditType, newValue string) error {
 			return err
 		}
 		if pendingExists {
-			return ErrUsernameTaken
+			return common.ErrUsernameTaken
 		}
 	}
 
@@ -164,14 +156,14 @@ func (s *AuditService) review(reviewerID uint, submissionID uint, approved bool,
 	submission, err := s.auditRepo.FindByID(submissionID)
 	if err != nil {
 		if err == gorm.ErrRecordNotFound {
-			return ErrAuditNotFound
+			return common.ErrAuditNotFound
 		}
 		return err
 	}
 
 	// 2. 必须 pending
 	if submission.Status != model.AuditStatusPending {
-		return ErrAuditNotPending
+		return common.ErrAuditNotPending
 	}
 
 	// 3. 查审核人信息
@@ -220,7 +212,7 @@ func (s *AuditService) applyApproval(submission *model.AuditSubmission) error {
 			return err
 		}
 		if exists {
-			return ErrUsernameTaken
+			return common.ErrUsernameTaken
 		}
 		user.Username = submission.NewValue
 	case model.AuditTypeAvatar:

internal/service/auth_service.go

@@ -25,24 +25,6 @@ func NewAuthService(userRepo userAuthStore, tokenSvc tokenProvider, cfg *config.
 	return &AuthService{userRepo: userRepo, tokenService: tokenSvc, cfg: cfg}
 }
 
-var (
-	ErrEmailExists        = common.ErrEmailExists
-	ErrUsernameTaken      = common.ErrUsernameTaken
-	ErrInvalidCred        = common.ErrInvalidCred
-	ErrUserNotFound       = common.ErrUserNotFound
-	ErrUserBanned         = common.ErrUserBanned
-	ErrUserLocked         = common.ErrUserLocked
-	ErrUserDeleted        = common.ErrUserDeleted
-	ErrWeakPassword       = common.ErrWeakPassword
-	ErrTokenExpired       = common.ErrTokenExpired
-	ErrTokenInvalid       = common.ErrTokenInvalid
-	ErrTokenRevoked       = common.ErrTokenRevoked
-	ErrPermissionDenied   = common.ErrPermissionDenied
-	ErrIncorrectPassword   = common.ErrIncorrectPassword
-	ErrNeedsConfirmRestore = common.ErrNeedsConfirmRestore
-	ErrOwnerCannotDelete   = common.ErrOwnerCannotDelete
-)
-
 var pwLetter = regexp.MustCompile(`[a-zA-Z]`)
 var pwDigit = regexp.MustCompile(`\d`)
 
@@ -64,7 +46,7 @@ func init() {
 // validatePassword 密码强度：至少 8 位 + 包含字母 + 包含数字
 func validatePassword(pw string) error {
 	if len(pw) < 8 || !pwLetter.MatchString(pw) || !pwDigit.MatchString(pw) {
-		return ErrWeakPassword
+		return common.ErrWeakPassword
 	}
 	return nil
 }
@@ -85,7 +67,7 @@ func (s *AuthService) Register(req model.RegisterRequest, regIP string) (string,
 		return "", "", nil, err
 	}
 	if exists {
-		return "", "", nil, ErrEmailExists
+		return "", "", nil, common.ErrEmailExists
 	}
 
 	// 3. 哈希密码
@@ -138,31 +120,31 @@ func (s *AuthService) Login(req model.LoginRequest, loginIP string) (string, str
 	user, err := s.userRepo.FindByEmail(req.Email)
 	if err != nil {
 		_ = bcrypt.CompareHashAndPassword(dummyHash, []byte(req.Password))
-		return "", "", nil, ErrInvalidCred
+		return "", "", nil, common.ErrInvalidCred
 	}
 
 	// 已注销（deleted）→ 验证密码后要求二次确认，不自动恢复
 	if user.Status == model.StatusDeleted {
 		if !common.CheckPassword(req.Password, user.PasswordHash) {
 			_ = bcrypt.CompareHashAndPassword(dummyHash, []byte(req.Password))
-			return "", "", nil, ErrInvalidCred
+			return "", "", nil, common.ErrInvalidCred
 		}
-		return "", "", nil, ErrNeedsConfirmRestore
+		return "", "", nil, common.ErrNeedsConfirmRestore
 	}
 
 	// 永久锁定
 	if user.Status == model.StatusLocked {
 		_ = bcrypt.CompareHashAndPassword(dummyHash, []byte(req.Password))
-		return "", "", nil, ErrUserLocked
+		return "", "", nil, common.ErrUserLocked
 	}
 
 	// 封禁
 	if user.Status == model.StatusBanned {
-		return "", "", nil, ErrUserBanned
+		return "", "", nil, common.ErrUserBanned
 	}
 
 	if !common.CheckPassword(req.Password, user.PasswordHash) {
-		return "", "", nil, ErrInvalidCred
+		return "", "", nil, common.ErrInvalidCred
 	}
 
 	// 记录登录 IP 和时间
@@ -194,16 +176,16 @@ func (s *AuthService) ConfirmRestore(req model.LoginRequest, loginIP string) (st
 	user, err := s.userRepo.FindByEmail(req.Email)
 	if err != nil {
 		_ = bcrypt.CompareHashAndPassword(dummyHash, []byte(req.Password))
-		return "", "", nil, ErrInvalidCred
+		return "", "", nil, common.ErrInvalidCred
 	}
 
 	// 仅 deleted 状态允许恢复
 	if user.Status != model.StatusDeleted {
-		return "", "", nil, ErrUserNotFound
+		return "", "", nil, common.ErrUserNotFound
 	}
 
 	if !common.CheckPassword(req.Password, user.PasswordHash) {
-		return "", "", nil, ErrInvalidCred
+		return "", "", nil, common.ErrInvalidCred
 	}
 
 	// 恢复账号
@@ -249,7 +231,7 @@ func (s *AuthService) ChangePassword(userID uint, currentPassword, newPassword s
 
 	// 验证当前密码
 	if !common.CheckPassword(currentPassword, user.PasswordHash) {
-		return ErrIncorrectPassword
+		return common.ErrIncorrectPassword
 	}
 
 	// 新密码强度校验
@@ -282,12 +264,12 @@ func (s *AuthService) DeleteAccount(userID uint, password, reason string) error
 
 	// 站长不允许自主注销（避免权限体系死锁）
 	if user.Role == model.RoleOwner {
-		return ErrOwnerCannotDelete
+		return common.ErrOwnerCannotDelete
 	}
 
 	// 验证当前密码（防止 CSRF 或未授权操作）
 	if !common.CheckPassword(password, user.PasswordHash) {
-		return ErrIncorrectPassword
+		return common.ErrIncorrectPassword
 	}
 
 	user.Status = model.StatusDeleted

internal/service/token_service.go

@@ -74,24 +74,24 @@ func (ts *TokenService) BuildRefreshToken(user *model.User, rememberMe bool) (st
 // 校验 token_version：若 DB 中版本已递增，拒绝刷新 → 即时吊销
 func (ts *TokenService) RefreshAccessToken(refreshTokenStr string) (string, *model.User, error) {
 	if refreshTokenStr == "" {
-		return "", nil, ErrTokenInvalid
+		return "", nil, common.ErrTokenInvalid
 	}
 
 	token, err := jwt.Parse(refreshTokenStr, func(t *jwt.Token) (interface{}, error) {
 		return []byte(ts.cfg.JWT.Secret), nil
 	})
 	if err != nil || !token.Valid {
-		return "", nil, ErrTokenExpired
+		return "", nil, common.ErrTokenExpired
 	}
 
 	claims, ok := token.Claims.(jwt.MapClaims)
 	if !ok {
-		return "", nil, ErrTokenInvalid
+		return "", nil, common.ErrTokenInvalid
 	}
 
 	// 只接受 refresh 用途的 token，防止 access token 被用于刷新
 	if purpose, _ := claims["purpose"].(string); purpose != "refresh" {
-		return "", nil, ErrTokenInvalid
+		return "", nil, common.ErrTokenInvalid
 	}
 
 	uid := uint(claims["uid"].(float64))