refactor: Controller 不直接读 Session Exp，新增 CanCreatePost 方法

- 新增 userExpReader 最小接口（ISP），PostService 通过它读取用户经验值
- PostService 新增 CanCreatePost(userID uint) bool，封装 LV0 投稿权限判断
- StudioController 替换内联 c.Get("exp") 检查为调用 ctrl.postService.CanCreatePost(uid)
- 更新 DI 注入链：NewPostService 增加 userRepo 参数

internal/router/deps_extra.go

@@ -51,7 +51,7 @@ func buildDeps(db *gorm.DB, cfg *config.Config, siteSettings *config.SiteSetting
 	)
 
 	postRepo := repository.NewPostRepo(db)
-	postService := service.NewPostService(postRepo, siteSettings, notificationService)
+	postService := service.NewPostService(postRepo, siteSettings, notificationService, userRepo)
 	shortcodeSvc := service.NewShortcodeService()
 	postCtrl := controller.NewPostController(postService, shortcodeSvc)
 	adminPostCtrl := adminCtrl.NewAdminPostController(postService)