fix: CSP 策略移除 unsafe-inline，改用 nonce 机制

- SecurityHeaders 中间件生成随机 nonce，注入 context
- BuildPageData/BuildAdminPageData 将 CSPNonce 传递给模板
- 所有 19 个模板文件 <script> 标签添加 nonce 属性
- 移除所有内联事件处理（onclick/onerror），改用事件监听
- 移除所有 javascript:void(0) 链接，改用 # 号 + preventDefault
- utils.js 添加全局 avatar 图片加载失败回退处理
- common.js 登出按钮添加 preventDefault
- audit.js 关闭弹窗按钮改用事件监听

templates/MetaLab-2026/html/studio/analytics.html

@@ -86,8 +86,8 @@
 
 {{template "layout/footer.html" .}}
 
-<script src="/static/js/chart.umd.min.js?v={{assetV "/static/js/chart.umd.min.js"}}"></script>
-<script>
+<script src="/static/js/chart.umd.min.js?v={{assetV "/static/js/chart.umd.min.js"}}" nonce="{{.CSPNonce}}"></script>
+<script nonce="{{.CSPNonce}}">
 (function () {
     'use strict';
 

templates/MetaLab-2026/html/studio/drafts.html

@@ -28,8 +28,8 @@
                 </div>
                 <div class="post-item-actions">
                     <a href="/studio/write?id={{.ID}}" class="action-btn primary">继续编辑</a>
-                    <button class="action-btn" onclick="submitPost({{.ID}})" title="提交发布">提交</button>
-                    <button class="action-btn danger" onclick="deletePost({{.ID}})" title="删除">删除</button>
+                    <button class="action-btn" data-post-id="{{.ID}}" data-action="submit" title="提交发布">提交</button>
+                    <button class="action-btn danger" data-post-id="{{.ID}}" data-action="delete" title="删除">删除</button>
                 </div>
             </div>
             {{end}}
@@ -57,7 +57,7 @@
     </main>
 </div>
 
-<script>
+<script nonce="{{.CSPNonce}}">
 function submitPost(id) {
     if (!confirm('确定要提交这篇草稿进行审核吗？')) return;
 
@@ -97,6 +97,19 @@ function deletePost(id) {
         }
     });
 }
+
+// 事件委托代替内联 onclick（满足 CSP 无 unsafe-inline）
+document.addEventListener('click', function(e) {
+    var btn = e.target.closest('[data-action]');
+    if (!btn) return;
+    var id = btn.getAttribute('data-post-id');
+    var action = btn.getAttribute('data-action');
+    if (action === 'delete') {
+        deletePost(id);
+    } else if (action === 'submit') {
+        submitPost(id);
+    }
+});
 </script>
 
 {{template "layout/footer.html" .}}

templates/MetaLab-2026/html/studio/posts.html

@@ -49,7 +49,7 @@
                 <div class="post-item-actions">
                     {{if not .IsLocked}}<a href="/studio/write?id={{.ID}}" class="action-btn">编辑</a>{{end}}
                     <a href="/posts/{{.ID}}" target="_blank" class="action-btn">查看</a>
-                    <button class="action-btn danger" onclick="deletePost({{.ID}})" title="删除">删除</button>
+                    <button class="action-btn danger" data-post-id="{{.ID}}" data-action="delete" title="删除">删除</button>
                 </div>
             </div>
             {{end}}
@@ -78,7 +78,7 @@
     </main>
 </div>
 
-<script>
+<script nonce="{{.CSPNonce}}">
 function deletePost(id) {
     if (!confirm('确定要删除这篇文章吗？')) return;
 
@@ -98,6 +98,14 @@ function deletePost(id) {
         }
     });
 }
+
+// 事件委托代替内联 onclick（满足 CSP 无 unsafe-inline）
+document.addEventListener('click', function(e) {
+    var btn = e.target.closest('[data-action="delete"]');
+    if (btn) {
+        deletePost(btn.getAttribute('data-post-id'));
+    }
+});
 </script>
 
 {{template "layout/footer.html" .}}

templates/MetaLab-2026/html/studio/write.html

@@ -95,8 +95,8 @@
 {{template "layout/footer.html" .}}
 
 <link rel="stylesheet" href="/static/vditor/dist/index.css?v={{assetV "/static/vditor/dist/index.css"}}">
-<script src="/static/vditor/dist/index.min.js?v={{assetV "/static/vditor/dist/index.min.js"}}"></script>
-<script src="/static/js/common.js?v={{assetV "/static/js/common.js"}}"></script>
-<script src="/static/js/studio-editor.js?v={{assetV "/static/js/studio-editor.js"}}"></script>
+<script src="/static/vditor/dist/index.min.js?v={{assetV "/static/vditor/dist/index.min.js"}}" nonce="{{.CSPNonce}}"></script>
+<script src="/static/js/common.js?v={{assetV "/static/js/common.js"}}" nonce="{{.CSPNonce}}"></script>
+<script src="/static/js/studio-editor.js?v={{assetV "/static/js/studio-editor.js"}}" nonce="{{.CSPNonce}}"></script>
 </body>
 </html>