refactor: CSP nonce替代unsafe-inline, HSTS始终启用, router/api拆分, 管理后台+用户设置页拆分, DB健康降级, 时区配置, UID统一解析, CI接入

审计修复:
- CSP: unsafe-inline移除, nonce替代; unsafe-eval保留供Vditor使用
- HSTS: 始终启用(不再依赖release模式)
- Controller Exp: common.GetGinExp包装, 不再直接读context
- UID解析: common.ParseUIDParam统一, follow/admin controller改用

重构:
- router/api.go(198行)拆为7个域文件: auth/settings/posts/comments/reactions/social/studio
- 管理后台站点设置: 单页拆为4个子页(brand/security/registration/content)+子菜单
- 前台用户设置页: 1201行拆为6个独立模板+6个独立JS文件

新增:
- DB健康检测中间件(middleware/db_health.go): 5s ping+降级页面
- 时区配置: config.yaml server.timezone→time.Local初始化
- .gitea/workflows/ci.yml: strict模式CI流水线

templates/MetaLab-2026/html/settings/profile.html

@@ -0,0 +1,61 @@
+{{template "settings/_header.html" .}}
+        <!-- 个人资料 -->
+        <div class="settings-card">
+            <div class="settings-card-header">
+                <h2>个人资料</h2>
+                <p class="settings-card-desc">你的公开信息和基本资料</p>
+            </div>
+            {{if .PendingTypes}}
+            <div class="settings-audit-notice">
+                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" width="16" height="16">
+                    <circle cx="12" cy="12" r="10"/><line x1="12" y1="8" x2="12" y2="12"/><line x1="12" y1="16" x2="12.01" y2="16"/>
+                </svg>
+                <span>
+                    {{range $i, $t := .PendingTypes}}{{if $i}}、{{end}}{{index $.AuditTypes $t}}{{end}}审核中
+                </span>
+            </div>
+            {{end}}
+            <div class="settings-card-body">
+                <div class="info-row">
+                    <span class="info-label">用户名</span>
+                    <span class="info-value">
+                        <input type="text" id="usernameInput" class="settings-text-input" value="{{.User.Username}}" maxlength="16" autocomplete="off" data-has-completed-rename="{{.HasCompletedRename}}">
+                        <span class="char-counter" id="usernameCounter"></span>
+                    </span>
+                </div>
+                <div class="info-row">
+                    <span class="info-label">头像</span>
+                    <span class="info-value">
+                        <div class="avatar-upload-wrap" id="avatarWrap">
+                            {{if .User.Avatar}}
+                            <img src="{{.User.Avatar}}?v={{.User.UpdatedAt.Unix}}" alt="avatar" class="avatar-preview" id="avatarPreview">
+                            {{else}}
+                            <div class="avatar-placeholder" id="avatarPreview">
+                                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" width="24" height="24"><circle cx="12" cy="8" r="4"/><path d="M4 20c0-4 4-7 8-7s8 3 8 7"/></svg>
+                            </div>
+                            {{end}}
+                            <span class="avatar-hint">点击更换</span>
+                        </div>
+                        <input type="file" id="avatarInput" class="avatar-input-hidden" accept="image/jpeg,image/png,image/webp">
+                    </span>
+                </div>
+                <div class="info-row">
+                    <span class="info-label">个性签名</span>
+                    <span class="info-value">
+                        <textarea id="bioInput" class="settings-textarea" maxlength="128" placeholder="写一句话介绍自己...">{{.User.Bio}}</textarea>
+                        <div class="char-counter" id="bioCounter"></div>
+                    </span>
+                </div>
+                <div class="info-row">
+                    <span class="info-label">角色</span>
+                    <span class="info-value">
+                        <span class="role-tag role-{{.User.Role}}">{{.RoleName}}</span>
+                    </span>
+                </div>
+                <div class="settings-card-footer">
+                    <button id="saveProfileBtn" class="settings-save-btn">保存</button>
+                </div>
+            </div>
+        </div>
+{{template "settings/_footer.html" .}}
+<script src="/static/js/settings-profile.js?v={{assetV "/static/js/settings-profile.js"}}" nonce="{{.CSPNonce}}"></script>