feat: 敏感操作增加IP维度限流

- RateLimiter 新增 AllowSensitive 方法（1分钟5次，超限封禁5分钟）
- 新增 SensitiveRateLimit Gin 中间件
- 改密（PUT /api/settings/password）增加限流保护
- 注销（POST /api/settings/delete-account）增加限流保护
- 签到（POST /api/level/checkin）增加限流保护

internal/router/api.go

@@ -17,8 +17,8 @@ func setupAPIRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
 	{
 		settingsAPI.PUT("/profile", d.settingsCtrl.UpdateProfile)
 		settingsAPI.POST("/avatar", d.settingsCtrl.UploadAvatar)
-		settingsAPI.PUT("/password", d.settingsCtrl.ChangePassword)
-		settingsAPI.POST("/delete-account", d.settingsCtrl.DeleteAccount)
+		settingsAPI.PUT("/password", middleware.SensitiveRateLimit(d.rateLimiter), d.settingsCtrl.ChangePassword)
+		settingsAPI.POST("/delete-account", middleware.SensitiveRateLimit(d.rateLimiter), d.settingsCtrl.DeleteAccount)
 		settingsAPI.GET("/audit-status", d.settingsCtrl.AuditStatus)
 		// 登录管理
 		settingsAPI.GET("/sessions", d.settingsCtrl.ListSessions)
@@ -47,7 +47,7 @@ func setupAPIRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
 	levelAPI.Use(d.authMdw.BannedWriteGuard())
 	levelAPI.Use(middleware.CSRF(cfg))
 	{
-		levelAPI.POST("/checkin", d.levelCtrl.CheckIn)
+		levelAPI.POST("/checkin", middleware.SensitiveRateLimit(d.rateLimiter), d.levelCtrl.CheckIn)
 		levelAPI.GET("/info", d.levelCtrl.GetLevel)
 	}
 

internal/router/deps_core.go

@@ -20,6 +20,7 @@ import (
 type dependencies struct {
 	authCtrl        *controller.AuthController
 	authMdw         *middleware.AuthMiddleware
+	rateLimiter     *middleware.RateLimiter
 	maintenanceMdw  *middleware.MaintenanceMiddleware
 	settingsCtrl    *controller.SettingsController
 	messageCtrl     *controller.MessageController

internal/router/deps_extra.go

@@ -16,7 +16,7 @@ import (
 )
 
 func buildDeps(db *gorm.DB, cfg *config.Config, siteSettings *config.SiteSettings, redisClient *redis.Client) *dependencies {
-	userRepo, sessionMgr, authService, _, authCtrl, avatarSvc, authMdw := buildDepsCore(db, cfg, siteSettings, redisClient)
+	userRepo, sessionMgr, authService, rateLimiter, authCtrl, avatarSvc, authMdw := buildDepsCore(db, cfg, siteSettings, redisClient)
 
 	auditRepo := repository.NewAuditRepo(db)
 	notificationRepo := repository.NewNotificationRepo(db)
@@ -107,7 +107,7 @@ func buildDeps(db *gorm.DB, cfg *config.Config, siteSettings *config.SiteSetting
 	postService.WithHomePageInvalidator(func() { homeCache.Invalidate() })
 
 	return &dependencies{
-		authCtrl: authCtrl, authMdw: authMdw, maintenanceMdw: maintenanceMdw,
+		authCtrl: authCtrl, authMdw: authMdw, rateLimiter: rateLimiter, maintenanceMdw: maintenanceMdw,
 		settingsCtrl: settingsCtrl,
 		messageCtrl:  messageController, postCtrl: postCtrl, postService: postService, spaceCtrl: spaceCtrl,
 		studioCtrl:    studioCtrl,