fix: 评论系统全量检查修复（7 项 Gap 全部修复）

- Delete 权限：新增 requesterID/isAdmin 参数，Service 层鉴权（仅本人/管理员可删）
- 通知内容：改用 GetUsernameByID 显示真实用户名，非数字 UID
- SearchUsers：Repository 返回 exp，Service 调用 GetLevelByExp 计算等级
- 通知高亮：Notification 新增 CommentID 字段，消息链接支持 #comment-{id}
- 已删除提示：前端 hash 检测 + 3 秒超时 Toast "该评论已不存在"
- Admin CSS：移除不存在的 comments.css 引用
- 错误哨兵：改用 common.ErrCommentNotFound/ErrCommentEmpty/PermissionDenied

internal/controller/admin/admin_comment_controller.go

@@ -23,8 +23,7 @@ func NewAdminCommentController(cs adminCommentUseCase) *AdminCommentController {
 // CommentsPage SSR 页面
 func (ctrl *AdminCommentController) CommentsPage(c *gin.Context) {
 	c.HTML(http.StatusOK, "admin/comments/index.html", common.BuildAdminPageData(c, gin.H{
-		"Title":    "评论管理",
-		"ExtraCSS": "/admin/static/css/comments.css",
+		"Title": "评论管理",
 	}))
 }
 
@@ -58,7 +57,7 @@ func (ctrl *AdminCommentController) Delete(c *gin.Context) {
 		common.Error(c, http.StatusBadRequest, "无效的评论ID")
 		return
 	}
-	if err := ctrl.commentService.Delete(uint(commentID)); err != nil {
+	if err := ctrl.commentService.Delete(uint(commentID), 0, true); err != nil {
 		common.Error(c, http.StatusBadRequest, err.Error())
 		return
 	}

internal/controller/admin/interfaces.go

@@ -50,5 +50,5 @@ type adminPostUseCase interface {
 // adminCommentUseCase AdminCommentController 对 CommentService 的最小依赖（ISP：2 个方法）
 type adminCommentUseCase interface {
 	ListAllComments(keyword string, showDeleted bool, page, pageSize int) ([]model.AdminCommentRow, int64, error)
-	Delete(commentID uint) error
+	Delete(commentID uint, requesterID uint, isAdmin bool) error
 }

internal/controller/comment_controller.go

@@ -2,6 +2,7 @@ package controller
 
 import (
 	"bytes"
+	"errors"
 	"image"
 	"image/jpeg"
 	"image/png"
@@ -147,14 +148,13 @@ func (ctrl *CommentController) Delete(c *gin.Context) {
 		return
 	}
 
-	// 权限检查：仅本人或管理员可删除
-	_ = uid
-	_ = role
-	// 此处权限在 service 层不做额外判断，允许任何人请求删除
-	// 后端检查在之前 FindByID 之后可判断 comment.user_id vs current uid
-	// 为简化，暂时信任前端权限，后续在 service 可增加
-
-	if err := ctrl.commentService.Delete(uint(commentID)); err != nil {
+	// 权限检查由 service 层统一处理
+	isAdmin := model.HasMinRole(role, model.RoleAdmin)
+	if err := ctrl.commentService.Delete(uint(commentID), uid, isAdmin); err != nil {
+		if errors.Is(err, common.ErrPermissionDenied) {
+			common.Error(c, http.StatusForbidden, err.Error())
+			return
+		}
 		common.Error(c, http.StatusBadRequest, err.Error())
 		return
 	}

internal/controller/interfaces.go

@@ -96,7 +96,7 @@ type energyAdminUseCase interface {
 type commentUseCase interface {
 	CreateRoot(userID, postID uint, body string) (*model.Comment, error)
 	CreateReply(userID, parentID uint, body string) (*model.Comment, error)
-	Delete(commentID uint) error
+	Delete(commentID uint, requesterID uint, isAdmin bool) error
 	ListRootComments(postID uint, page, pageSize int) ([]model.Comment, int64, error)
 	ListReplies(rootID uint) ([]model.Comment, error)
 	SearchUsers(keyword string) ([]model.UserSearchResult, error)