fix: 审计问题全量修复 + RateLimiter 原子化重构 + CDN 本地化收紧

- 安全：移除 CSP 中 esm.sh/cdnjs.cloudflare.com，highlight.js 主题已本地化 73 个文件
- 安全：StatusBanned 分支补 dummy hash 防时序攻击
- 安全：手写 constantTimeEq 替换为 crypto/subtle.ConstantTimeCompare
- Bug：锁定操作消息已删除→已锁定
- YAGNI：删除 12 个空预留模板目录
- KISS：删除 common.CheckPassword 薄封装，统一用 bcrypt 调用
- KISS：删除 tokenCtrl 别名字段，api.go 统一用 authCtrl
- RateLimiter：check()+recordFail 闭包模式重构为 try() 原子操作，消除竞态
- RateLimiter：新增 ClearIP() 方法，注册成功时清除 IP 计数
- 文档：修正 audit_service.go 注释编号跳跃(3→5→4)
- 文档：修正 deps_core.go 过清理→过期清理

internal/service/auth_service.go

@@ -135,7 +135,7 @@ func (s *AuthService) Login(req model.LoginRequest, loginIP string) (*model.User
 
 	// 已注销（deleted）→ 验证密码后要求二次确认
 	if user.Status == model.StatusDeleted {
-		if !common.CheckPassword(req.Password, user.PasswordHash) {
+		if bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(req.Password)) != nil {
 			_ = bcrypt.CompareHashAndPassword(dummyHash, []byte(req.Password))
 			return nil, common.ErrInvalidCred
 		}
@@ -150,10 +150,11 @@ func (s *AuthService) Login(req model.LoginRequest, loginIP string) (*model.User
 
 	// 封禁
 	if user.Status == model.StatusBanned {
+		_ = bcrypt.CompareHashAndPassword(dummyHash, []byte(req.Password))
 		return nil, common.ErrUserBanned
 	}
 
-	if !common.CheckPassword(req.Password, user.PasswordHash) {
+	if bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(req.Password)) != nil {
 		return nil, common.ErrInvalidCred
 	}
 
@@ -180,7 +181,7 @@ func (s *AuthService) ConfirmRestore(req model.LoginRequest, loginIP string) (*m
 		return nil, common.ErrUserNotFound
 	}
 
-	if !common.CheckPassword(req.Password, user.PasswordHash) {
+	if bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(req.Password)) != nil {
 		return nil, common.ErrInvalidCred
 	}
 
@@ -215,7 +216,7 @@ func (s *AuthService) ChangePassword(userID uint, currentPassword, newPassword s
 		return common.ErrUserNotFound
 	}
 
-	if !common.CheckPassword(currentPassword, user.PasswordHash) {
+	if bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(currentPassword)) != nil {
 		return common.ErrIncorrectPassword
 	}
 
@@ -248,7 +249,7 @@ func (s *AuthService) DeleteAccount(userID uint, password, reason string) error
 		return common.ErrOwnerCannotDelete
 	}
 
-	if !common.CheckPassword(password, user.PasswordHash) {
+	if bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(password)) != nil {
 		return common.ErrIncorrectPassword
 	}