refactor: CSP nonce替代unsafe-inline, HSTS始终启用, router/api拆分, 管理后台+用户设置页拆分, DB健康降级, 时区配置, UID统一解析, CI接入

审计修复:
- CSP: unsafe-inline移除, nonce替代; unsafe-eval保留供Vditor使用
- HSTS: 始终启用(不再依赖release模式)
- Controller Exp: common.GetGinExp包装, 不再直接读context
- UID解析: common.ParseUIDParam统一, follow/admin controller改用

重构:
- router/api.go(198行)拆为7个域文件: auth/settings/posts/comments/reactions/social/studio
- 管理后台站点设置: 单页拆为4个子页(brand/security/registration/content)+子菜单
- 前台用户设置页: 1201行拆为6个独立模板+6个独立JS文件

新增:
- DB健康检测中间件(middleware/db_health.go): 5s ping+降级页面
- 时区配置: config.yaml server.timezone→time.Local初始化
- .gitea/workflows/ci.yml: strict模式CI流水线

internal/router/api_settings.go

@@ -0,0 +1,51 @@
+package router
+
+import (
+	"metazone.cc/mce/internal/config"
+	"metazone.cc/mce/internal/middleware"
+
+	"github.com/gin-gonic/gin"
+)
+
+// setupSettingsAPIRoutes 注册设置、消息、等级相关 API 路由
+func setupSettingsAPIRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
+	// 设置页 API
+	settingsAPI := r.Group("/api/settings")
+	settingsAPI.Use(d.authMdw.Required())
+	settingsAPI.Use(d.authMdw.BannedWriteGuard())
+	settingsAPI.Use(middleware.CSRF(cfg))
+	{
+		settingsAPI.PUT("/profile", d.settingsCtrl.UpdateProfile)
+		settingsAPI.POST("/avatar", d.settingsCtrl.UploadAvatar)
+		settingsAPI.PUT("/password", middleware.SensitiveRateLimit(d.rateLimiter), d.settingsCtrl.ChangePassword)
+		settingsAPI.POST("/delete-account", middleware.SensitiveRateLimit(d.rateLimiter), d.settingsCtrl.DeleteAccount)
+		settingsAPI.GET("/audit-status", d.settingsCtrl.AuditStatus)
+		settingsAPI.GET("/sessions", d.settingsCtrl.ListSessions)
+		settingsAPI.DELETE("/sessions/:sid", d.settingsCtrl.DestroySession)
+		settingsAPI.POST("/sessions/destroy-others", d.settingsCtrl.DestroyOtherSessions)
+		settingsAPI.PUT("/sessions/:sid/remark", d.settingsCtrl.UpdateSessionRemark)
+		settingsAPI.GET("/notify-prefs", d.settingsCtrl.GetNotifyPrefs)
+		settingsAPI.PUT("/notify-prefs", d.settingsCtrl.UpdateNotifyPref)
+	}
+
+	// 消息中心 API
+	messagesAPI := r.Group("/api/messages")
+	messagesAPI.Use(d.authMdw.Required())
+	messagesAPI.Use(d.authMdw.BannedWriteGuard())
+	messagesAPI.Use(middleware.CSRF(cfg))
+	{
+		messagesAPI.GET("/unread", d.messageCtrl.UnreadCount)
+		messagesAPI.POST("/:id/read", d.messageCtrl.MarkRead)
+		messagesAPI.POST("/read-all", d.messageCtrl.MarkAllRead)
+	}
+
+	// 积分/等级 API
+	levelAPI := r.Group("/api/level")
+	levelAPI.Use(d.authMdw.Required())
+	levelAPI.Use(d.authMdw.BannedWriteGuard())
+	levelAPI.Use(middleware.CSRF(cfg))
+	{
+		levelAPI.POST("/checkin", middleware.SensitiveRateLimit(d.rateLimiter), d.levelCtrl.CheckIn)
+		levelAPI.GET("/info", d.levelCtrl.GetLevel)
+	}
+}