refactor: CSP nonce替代unsafe-inline, HSTS始终启用, router/api拆分, 管理后台+用户设置页拆分, DB健康降级, 时区配置, UID统一解析, CI接入

审计修复:
- CSP: unsafe-inline移除, nonce替代; unsafe-eval保留供Vditor使用
- HSTS: 始终启用(不再依赖release模式)
- Controller Exp: common.GetGinExp包装, 不再直接读context
- UID解析: common.ParseUIDParam统一, follow/admin controller改用

重构:
- router/api.go(198行)拆为7个域文件: auth/settings/posts/comments/reactions/social/studio
- 管理后台站点设置: 单页拆为4个子页(brand/security/registration/content)+子菜单
- 前台用户设置页: 1201行拆为6个独立模板+6个独立JS文件

新增:
- DB健康检测中间件(middleware/db_health.go): 5s ping+降级页面
- 时区配置: config.yaml server.timezone→time.Local初始化
- .gitea/workflows/ci.yml: strict模式CI流水线

internal/controller/settings_controller.go

@@ -68,6 +68,7 @@ func (sc *SettingsController) SettingsPage(c *gin.Context) {
 	data := gin.H{
 		"Title":              "个人设置",
 		"ExtraCSS":           "/static/css/settings.css",
+		"ExtraJS":            "/static/js/settings-" + tab + ".js",
 		"ActiveTab":          tab,
 		"User":               user,
 		"RoleName":           model.RoleDisplayNames[user.Role],
@@ -113,5 +114,22 @@ func (sc *SettingsController) SettingsPage(c *gin.Context) {
 		data["CurrentSID"] = currentSID
 	}
 
-	c.HTML(http.StatusOK, "settings/index.html", common.BuildPageData(c, data))
+	// 按 tab 渲染独立模板
+	tplName := "settings/index.html"
+	switch tab {
+	case "profile":
+		tplName = "settings/profile.html"
+	case "account":
+		tplName = "settings/account.html"
+	case "sessions":
+		tplName = "settings/sessions.html"
+	case "energy":
+		tplName = "settings/energy.html"
+	case "favorites":
+		tplName = "settings/favorites.html"
+	case "notify":
+		tplName = "settings/notify.html"
+	}
+
+	c.HTML(http.StatusOK, tplName, common.BuildPageData(c, data))
 }