refactor: CSP nonce替代unsafe-inline, HSTS始终启用, router/api拆分, 管理后台+用户设置页拆分, DB健康降级, 时区配置, UID统一解析, CI接入

审计修复:
- CSP: unsafe-inline移除, nonce替代; unsafe-eval保留供Vditor使用
- HSTS: 始终启用(不再依赖release模式)
- Controller Exp: common.GetGinExp包装, 不再直接读context
- UID解析: common.ParseUIDParam统一, follow/admin controller改用

重构:
- router/api.go(198行)拆为7个域文件: auth/settings/posts/comments/reactions/social/studio
- 管理后台站点设置: 单页拆为4个子页(brand/security/registration/content)+子菜单
- 前台用户设置页: 1201行拆为6个独立模板+6个独立JS文件

新增:
- DB健康检测中间件(middleware/db_health.go): 5s ping+降级页面
- 时区配置: config.yaml server.timezone→time.Local初始化
- .gitea/workflows/ci.yml: strict模式CI流水线

internal/controller/admin/admin_controller.go

@@ -134,11 +134,7 @@ func (ac *AdminController) ResetToken(c *gin.Context) {
 
 // parseUIDParam 从 URL 路径参数解析 uid
 func parseUIDParam(c *gin.Context) (uint, error) {
-	uid, err := strconv.ParseUint(c.Param("uid"), 10, 64)
-	if err != nil {
-		return 0, err
-	}
-	return uint(uid), nil
+	return common.ParseUIDParam(c, "uid")
 }
 
 // handleServiceError 统一处理 service 层返回的错误

internal/controller/admin/site_setting_controller.go

@@ -21,12 +21,48 @@ func NewSiteSettingController(settingService siteSettingUseCase, defaults *servi
 	return &SiteSettingController{settingService: settingService, defaults: defaults}
 }
 
-// SiteSettingsPage 站点设置管理页面
+// SiteSettingsPage 旧站点设置页 — 301 重定向到品牌页
 func (sc *SiteSettingController) SiteSettingsPage(c *gin.Context) {
-	c.HTML(http.StatusOK, "admin/site-settings/index.html", common.BuildAdminPageData(c, gin.H{
-		"Title":    "站点设置",
-		"ExtraCSS": "/admin/static/css/site-settings.css",
-		"ExtraJS":  "/admin/static/js/site-settings.js",
+	c.Redirect(http.StatusMovedPermanently, "/admin/settings/brand")
+}
+
+// BrandPage 品牌与合规设置页
+func (sc *SiteSettingController) BrandPage(c *gin.Context) {
+	c.HTML(http.StatusOK, "admin/site-settings/brand.html", common.BuildAdminPageData(c, gin.H{
+		"Title":         "站点设置 - 品牌与合规",
+		"ExtraCSS":      "/admin/static/css/site-settings.css",
+		"ExtraJS":       "/admin/static/js/site-settings.js",
+		"ActiveSetting": "brand",
+	}))
+}
+
+// SecurityPage 安全与维护设置页
+func (sc *SiteSettingController) SecurityPage(c *gin.Context) {
+	c.HTML(http.StatusOK, "admin/site-settings/security.html", common.BuildAdminPageData(c, gin.H{
+		"Title":         "站点设置 - 安全与维护",
+		"ExtraCSS":      "/admin/static/css/site-settings.css",
+		"ExtraJS":       "/admin/static/js/site-settings.js",
+		"ActiveSetting": "security",
+	}))
+}
+
+// RegistrationPage 注册策略设置页
+func (sc *SiteSettingController) RegistrationPage(c *gin.Context) {
+	c.HTML(http.StatusOK, "admin/site-settings/registration.html", common.BuildAdminPageData(c, gin.H{
+		"Title":         "站点设置 - 注册策略",
+		"ExtraCSS":      "/admin/static/css/site-settings.css",
+		"ExtraJS":       "/admin/static/js/site-settings.js",
+		"ActiveSetting": "registration",
+	}))
+}
+
+// ContentPage 审核与内容设置页
+func (sc *SiteSettingController) ContentPage(c *gin.Context) {
+	c.HTML(http.StatusOK, "admin/site-settings/content.html", common.BuildAdminPageData(c, gin.H{
+		"Title":         "站点设置 - 审核与内容",
+		"ExtraCSS":      "/admin/static/css/site-settings.css",
+		"ExtraJS":       "/admin/static/js/site-settings.js",
+		"ActiveSetting": "content",
 	}))
 }