feat: 品牌CMS配置化 + cookie_secure配置

- config.yaml 新增 server.cookie_secure 配置项
- site_settings 新增 site_name/site_tagline/contact_email 站点信息
- SiteInfo 结构体扩展，支持运行时从 DB 读取站点品牌信息
- cookie.go 使用 cfg.Server.CookieSecure 替代 Mode!=debug 判断
- SetSessionCookie/ClearSessionCookie 支持 siteSettings 运行时覆盖
- 模板替换硬编码 MetaLab → {{.SiteName}}（nav/header/footer/home/login/register/guidelines/admin，12+处）
- 管理后台站点设置页新增站点名称/标语/联系邮箱输入项
- 页脚版权年份改为动态 CurrentYear
- 注册成功消息 CMS 化（后端+前端）

internal/middleware/auth.go

@@ -22,6 +22,7 @@ type AuthMiddleware struct {
 	cfg            *config.Config
 	sessionManager *session.Manager
 	levelSvc       autoCheckIner
+	siteSettings   *config.SiteSettings
 }
 
 // NewAuthMiddleware 构造函数
@@ -29,6 +30,12 @@ func NewAuthMiddleware(cfg *config.Config, sm *session.Manager) *AuthMiddleware
 	return &AuthMiddleware{cfg: cfg, sessionManager: sm}
 }
 
+// WithSiteSettings 链式注入站点设置（用于 cookie_secure 运行时覆盖）
+func (am *AuthMiddleware) WithSiteSettings(ss *config.SiteSettings) *AuthMiddleware {
+	am.siteSettings = ss
+	return am
+}
+
 // WithLevelService 链式注入等级服务（用于自动签到）
 func (am *AuthMiddleware) WithLevelService(svc autoCheckIner) *AuthMiddleware {
 	am.levelSvc = svc
@@ -60,7 +67,7 @@ func (am *AuthMiddleware) Required() gin.HandlerFunc {
 
 // abortUnauthorized 统一处理未认证：API 返回 JSON，页面请求跳转登录
 func (am *AuthMiddleware) abortUnauthorized(c *gin.Context) {
-	common.ClearSessionCookie(c, am.cfg)
+	common.ClearSessionCookie(c, am.cfg, am.siteSettings)
 	if strings.HasPrefix(c.Request.URL.Path, "/api/") {
 		c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
 			"success": false, "message": "登录已过期，请重新登录",
@@ -81,7 +88,7 @@ func (am *AuthMiddleware) Optional() gin.HandlerFunc {
 
 		s, err := am.sessionManager.Validate(sid)
 		if err != nil || s == nil {
-			common.ClearSessionCookie(c, am.cfg)
+			common.ClearSessionCookie(c, am.cfg, am.siteSettings)
 			c.Next()
 			return
 		}

internal/middleware/auth_admin.go

@@ -14,7 +14,7 @@ func (am *AuthMiddleware) AdminAuth() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		sid, err := c.Cookie(common.SessionCookieName)
 		if err != nil || sid == "" {
-			common.ClearSessionCookie(c, am.cfg)
+			common.ClearSessionCookie(c, am.cfg, am.siteSettings)
 			c.Redirect(http.StatusFound, "/")
 			c.Abort()
 			return
@@ -23,7 +23,7 @@ func (am *AuthMiddleware) AdminAuth() gin.HandlerFunc {
 		s, err := am.sessionManager.Validate(sid)
 		if err != nil || s == nil {
 			log.Printf("[AdminAuth] session invalid path=%s → 302", c.Request.URL.Path)
-			common.ClearSessionCookie(c, am.cfg)
+			common.ClearSessionCookie(c, am.cfg, am.siteSettings)
 			c.Redirect(http.StatusFound, "/")
 			c.Abort()
 			return

internal/middleware/site_info.go

@@ -11,6 +11,9 @@ import (
 func InjectSiteInfo(siteSettings *config.SiteSettings) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		info := siteSettings.SiteInfo()
+		c.Set("site_name", info.SiteName)
+		c.Set("site_tagline", info.SiteTagline)
+		c.Set("site_contact_email", info.ContactEmail)
 		c.Set("site_framework", info.Framework)
 		c.Set("site_copyright_start", info.CopyrightStart)
 		c.Set("is_maintenance", siteSettings.IsMaintenanceEnabled())