fix: CSP 策略移除 unsafe-inline，改用 nonce 机制

- SecurityHeaders 中间件生成随机 nonce，注入 context
- BuildPageData/BuildAdminPageData 将 CSPNonce 传递给模板
- 所有 19 个模板文件 <script> 标签添加 nonce 属性
- 移除所有内联事件处理（onclick/onerror），改用事件监听
- 移除所有 javascript:void(0) 链接，改用 # 号 + preventDefault
- utils.js 添加全局 avatar 图片加载失败回退处理
- common.js 登出按钮添加 preventDefault
- audit.js 关闭弹窗按钮改用事件监听

templates/MetaLab-2026/html/posts/show.html

@@ -146,10 +146,10 @@
 <textarea id="postMdContent" style="display:none">{{.Post.Body}}</textarea>
 
 <link rel="stylesheet" href="/static/vditor/dist/index.css?v={{assetV "/static/vditor/dist/index.css"}}">
-<script src="/static/vditor/dist/method.min.js?v={{assetV "/static/vditor/dist/method.min.js"}}"></script>
-<script src="/static/js/common.js?v={{assetV "/static/js/common.js"}}"></script>
-<script src="/static/js/shortcode.js?v={{assetV "/static/js/shortcode.js"}}"></script>
-<script>
+<script src="/static/vditor/dist/method.min.js?v={{assetV "/static/vditor/dist/method.min.js"}}" nonce="{{.CSPNonce}}"></script>
+<script src="/static/js/common.js?v={{assetV "/static/js/common.js"}}" nonce="{{.CSPNonce}}"></script>
+<script src="/static/js/shortcode.js?v={{assetV "/static/js/shortcode.js"}}" nonce="{{.CSPNonce}}"></script>
+<script nonce="{{.CSPNonce}}">
 (function() {
     var el = document.getElementById('postContent');
     var mdEl = document.getElementById('postMdContent');
@@ -180,7 +180,7 @@
 })();
 </script>
 
-<script>
+<script nonce="{{.CSPNonce}}">
 // 提交审核按钮
 (function() {
     var btn = document.getElementById('submitAuditBtn');
@@ -205,7 +205,7 @@
 })();
 </script>
 
-<script>
+<script nonce="{{.CSPNonce}}">
 // 赋能按钮 + 弹窗
 (function() {
     var btn = document.getElementById('energizeBtn');
@@ -287,7 +287,7 @@
 })();
 </script>
 
-<script>
+<script nonce="{{.CSPNonce}}">
 // ========== 赞/踩系统 ==========
 (function() {
     var container = document.getElementById('postReactions');
@@ -363,7 +363,7 @@
 })();
 </script>
 
-<script>
+<script nonce="{{.CSPNonce}}">
 // ========== 收藏按钮（弹窗选择收藏夹）==========
 (function() {
     var favBtn = document.getElementById('favBtn');
@@ -614,7 +614,7 @@
 })();
 </script>
 
-<script>
+<script nonce="{{.CSPNonce}}">
 // ========== 评论系统 ==========
 (function() {
     var commentsSection = document.getElementById('comments');