refactor: CSP nonce替代unsafe-inline, HSTS始终启用, router/api拆分, 管理后台+用户设置页拆分, DB健康降级, 时区配置, UID统一解析, CI接入

审计修复:
- CSP: unsafe-inline移除, nonce替代; unsafe-eval保留供Vditor使用
- HSTS: 始终启用(不再依赖release模式)
- Controller Exp: common.GetGinExp包装, 不再直接读context
- UID解析: common.ParseUIDParam统一, follow/admin controller改用

重构:
- router/api.go(198行)拆为7个域文件: auth/settings/posts/comments/reactions/social/studio
- 管理后台站点设置: 单页拆为4个子页(brand/security/registration/content)+子菜单
- 前台用户设置页: 1201行拆为6个独立模板+6个独立JS文件

新增:
- DB健康检测中间件(middleware/db_health.go): 5s ping+降级页面
- 时区配置: config.yaml server.timezone→time.Local初始化
- .gitea/workflows/ci.yml: strict模式CI流水线

templates/MetaLab-2026/html/settings/sessions.html

@@ -0,0 +1,53 @@
+{{template "settings/_header.html" .}}
+        <!-- 登录管理 -->
+        <div class="settings-card">
+            <div class="settings-card-header">
+                <h2>登录管理</h2>
+                <p class="settings-card-desc">查看和管理你的登录设备，保护账号安全</p>
+            </div>
+            <div class="settings-card-body">
+                <div class="session-list" id="sessionList">
+                    {{range .Sessions}}
+                    <div class="session-item{{if .IsCurrent}} session-current{{end}}" data-sid="{{.ID}}">
+                        <div class="session-icon">
+                            {{if eq .DeviceInfo.Device "Mobile"}}<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" width="24" height="24"><rect x="5" y="2" width="14" height="20" rx="2" ry="2"/><line x1="12" y1="18" x2="12.01" y2="18"/></svg>
+                            {{else if eq .DeviceInfo.Device "Tablet"}}<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" width="24" height="24"><rect x="4" y="2" width="16" height="20" rx="2" ry="2"/><line x1="12" y1="18" x2="12.01" y2="18"/></svg>
+                            {{else}}<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" width="24" height="24"><rect x="2" y="3" width="20" height="14" rx="2" ry="2"/><line x1="8" y1="21" x2="16" y2="21"/><line x1="12" y1="17" x2="12" y2="21"/></svg>
+                            {{end}}
+                        </div>
+                        <div class="session-info">
+                            <div class="session-title">
+                                <span class="session-browser">{{.DeviceInfo.Browser}}</span>
+                                <span class="session-os">/ {{.DeviceInfo.OS}}</span>
+                                {{if .IsCurrent}}<span class="session-badge">当前设备</span>{{end}}
+                                {{if not .RememberMe}}<span class="session-badge session-badge-temp">临时会话</span>{{end}}
+                            </div>
+                            <div class="session-meta">
+                                <span class="session-ip">IP: {{.IP}}</span>
+                                <span class="session-time">登录于 {{.CreatedAt.Format "2006-01-02 15:04"}}</span>
+                                <span class="session-time">最后活动 {{.LastAccess.Format "2006-01-02 15:04"}}</span>
+                                {{if not .IsCurrent}}<span class="session-ttl">剩余约 {{formatTTL .TTLMinutes}}</span>{{end}}
+                            </div>
+                            <div class="session-remark-row">
+                                <input type="text" class="session-remark-input" value="{{.Remark}}" placeholder="添加备注（如 我的笔记本）" maxlength="32" data-sid="{{.ID}}" data-current="{{.IsCurrent}}">
+                            </div>
+                        </div>
+                        <div class="session-action">
+                            {{if not .IsCurrent}}
+                            <button class="session-kick-btn" data-sid="{{.ID}}">踢出</button>
+                            {{end}}
+                        </div>
+                    </div>
+                    {{end}}
+                    {{if not .Sessions}}
+                    <div class="session-empty">暂无活跃的登录会话</div>
+                    {{end}}
+                </div>
+            </div>
+            <div class="settings-card-footer">
+                <button id="kickOthersBtn" class="settings-danger-btn">一键踢出其他设备</button>
+                <span class="form-hint">将强制退出除当前设备外的所有登录会话</span>
+            </div>
+        </div>
+{{template "settings/_footer.html" .}}
+<script src="/static/js/settings-sessions.js?v={{assetV "/static/js/settings-sessions.js"}}" nonce="{{.CSPNonce}}"></script>