fix: 设计原则审查修复 — DIP/ISP, LoD, DRY, OCP, URL, 301缓存

- P0 DIP+ISP: 全链路注入接口，消除零接口紧耦合
- P0 URL: auth 301→302，修复登出后浏览器缓存陷阱
- P1 DRY: JWT 认证逻辑收敛至 TokenService+中间件
- P2 DRY: 前后端角色/状态映射统一为 model 常量
- P2 LoD: 新增 SettingsController，router 不再跨层调 repo
- P2 URL: settings ?tab= → /settings/:tab 伪静态
- P3 OCP: 角色权限 map 化，告别硬编码 switch

internal/repository/user_repo.go

@@ -139,8 +139,8 @@ func (r *UserRepo) Restore(uid uint) error {
 	return r.db.Unscoped().Model(&model.User{}).Where("uid = ?", uid).Update("deleted_at", nil).Error
 }
 
-// SearchUsers 综合搜索（含软删除用户）
-func (r *UserRepo) SearchUsers(keyword, role, status string, offset, limit int) ([]model.User, error) {
+// buildSearchQuery 构建搜索/筛选的公共查询条件
+func (r *UserRepo) buildSearchQuery(keyword, role, status string) *gorm.DB {
 	query := r.db.Unscoped().Model(&model.User{})
 	if keyword != "" {
 		like := "%" + keyword + "%"
@@ -152,26 +152,21 @@ func (r *UserRepo) SearchUsers(keyword, role, status string, offset, limit int)
 	if status != "" {
 		query = query.Where("status = ?", status)
 	}
+	return query
+}
+
+// SearchUsers 综合搜索（含软删除用户）
+func (r *UserRepo) SearchUsers(keyword, role, status string, offset, limit int) ([]model.User, error) {
 	var users []model.User
-	err := query.Order("uid ASC").Offset(offset).Limit(limit).Find(&users).Error
+	err := r.buildSearchQuery(keyword, role, status).
+		Order("uid ASC").Offset(offset).Limit(limit).Find(&users).Error
 	return users, err
 }
 
 // CountSearchUsers 搜索结果总数（含软删除用户）
 func (r *UserRepo) CountSearchUsers(keyword, role, status string) (int64, error) {
-	query := r.db.Unscoped().Model(&model.User{})
-	if keyword != "" {
-		like := "%" + keyword + "%"
-		query = query.Where("email LIKE ? OR username LIKE ?", like, like)
-	}
-	if role != "" {
-		query = query.Where("role = ?", role)
-	}
-	if status != "" {
-		query = query.Where("status = ?", status)
-	}
 	var count int64
-	err := query.Count(&count).Error
+	err := r.buildSearchQuery(keyword, role, status).Count(&count).Error
 	return count, err
 }