refactor: CSP nonce替代unsafe-inline, HSTS始终启用, router/api拆分, 管理后台+用户设置页拆分, DB健康降级, 时区配置, UID统一解析, CI接入

审计修复:
- CSP: unsafe-inline移除, nonce替代; unsafe-eval保留供Vditor使用
- HSTS: 始终启用(不再依赖release模式)
- Controller Exp: common.GetGinExp包装, 不再直接读context
- UID解析: common.ParseUIDParam统一, follow/admin controller改用

重构:
- router/api.go(198行)拆为7个域文件: auth/settings/posts/comments/reactions/social/studio
- 管理后台站点设置: 单页拆为4个子页(brand/security/registration/content)+子菜单
- 前台用户设置页: 1201行拆为6个独立模板+6个独立JS文件

新增:
- DB健康检测中间件(middleware/db_health.go): 5s ping+降级页面
- 时区配置: config.yaml server.timezone→time.Local初始化
- .gitea/workflows/ci.yml: strict模式CI流水线

templates/MetaLab-2026/static/js/settings-energy.js

@@ -0,0 +1,91 @@
+(function(){'use strict';
+<script nonce="{{.CSPNonce}}">
+(function () {
+    'use strict';
+
+    var toastEl = document.getElementById('settingsToast');
+    var toastTimer = null;
+
+    function showSettingsToast(msg, isError) {
+        if (!toastEl) return;
+        clearTimeout(toastTimer);
+        toastEl.textContent = msg;
+        toastEl.className = 'settings-toast' + (isError ? ' error' : '');
+        void toastEl.offsetWidth;
+        toastEl.classList.add('show');
+        toastTimer = setTimeout(function () {
+            toastEl.classList.remove('show');
+        }, 5000);
+    }
+    // ===== 域能 Tab =====
+    (function () {
+        var balanceEl = document.getElementById('energyBalance');
+        var expEl = document.getElementById('energyExp');
+        var levelEl = document.getElementById('energyLevel');
+        var logListEl = document.getElementById('energyLogList');
+        if (!balanceEl || !logListEl) return;
+
+        // 获取域能信息
+        fetch('/api/energy/info')
+            .then(function (r) { return r.json(); })
+            .then(function (d) {
+                if (d.success && d.data) {
+                    balanceEl.textContent = d.data.energy_display + ' 域能';
+                } else {
+                    balanceEl.textContent = '获取失败';
+                }
+            })
+            .catch(function () { balanceEl.textContent = '获取失败'; });
+
+        // 获取经验和等级
+        if (expEl && levelEl) {
+            fetch('/api/level/info')
+                .then(function (r) { return r.json(); })
+                .then(function (d) {
+                    if (d.success && d.data) {
+                        expEl.textContent = d.data.exp;
+                        levelEl.textContent = 'Lv' + d.data.level;
+                    } else {
+                        expEl.textContent = '获取失败';
+                        levelEl.textContent = '获取失败';
+                    }
+                })
+                .catch(function () {
+                    expEl.textContent = '获取失败';
+                    levelEl.textContent = '获取失败';
+                });
+        }
+
+        // 获取域能流水
+        fetch('/api/energy/logs?days=7&page=1&page_size=50')
+            .then(function (r) { return r.json(); })
+            .then(function (d) {
+                if (!d.success || !d.data || !d.data.items || d.data.items.length === 0) {
+                    logListEl.innerHTML = '<div class="energy-log-empty">近7天无变更记录</div>';
+                    return;
+                }
+
+                var html = '';
+                d.data.items.forEach(function (item) {
+                    var cls = item.amount > 0 ? 'energy-log-plus' : 'energy-log-minus';
+                    var sign = item.amount > 0 ? '+' : '';
+                    html += '<div class="energy-log-item ' + cls + '">'
+                        + '<div class="energy-log-meta">'
+                        + '<span class="energy-log-type">' + escapeHtml(item.type_name) + '</span>'
+                        + '<span class="energy-log-time">' + formatTime(item.created_at) + '</span>'
+                        + '</div>'
+                        + '<div class="energy-log-info">'
+                        + '<span class="energy-log-desc">' + escapeHtml(item.description) + '</span>'
+                        + '<span class="energy-log-amount">' + sign + item.amount_display + ' 域能</span>'
+                        + '</div>'
+                        + '</div>';
+                });
+                logListEl.innerHTML = html;
+            })
+            .catch(function () {
+                logListEl.innerHTML = '<div class="energy-log-empty">加载失败</div>';
+            });
+
+        // escapeHtml / formatTime 由 shared/utils.js 统一提供
+    })();
+})();