fix: 修复头像审核旧图裂开问题 + CSP 配置修复

- 头像提交审核不再删除旧文件，审核通过后才删除旧头像文件
- 头像审核被拒时删除已上传的新头像文件，保留旧头像
- CSP style-src 移除 nonce 以启用 unsafe-inline（JS 动态样式需要）
- CSP script-src 移除 nonce 改用 unsafe-inline + unsafe-eval（Vditor 编辑器和动态样式需要）

internal/service/audit_review.go

@@ -67,6 +67,11 @@ func (s *AuditService) review(reviewerID uint, submissionID uint, approved bool,
 			}
 			s.notifier.NotifyAuditRejected(submission.UserID, submission.AuditType, reasonMsg, submission.ID)
 		}
+
+		// 头像审核被拒 → 删除提交的新头像文件
+		if submission.AuditType == model.AuditTypeAvatar && s.avatarCleaner != nil {
+			_ = s.avatarCleaner.DeleteAvatarFile(submission.NewValue)
+		}
 	}
 	return s.auditRepo.Update(submission)
 }
@@ -90,7 +95,16 @@ func (s *AuditService) applyApproval(submission *model.AuditSubmission) error {
 		}
 		user.Username = submission.NewValue
 	case model.AuditTypeAvatar:
+		oldAvatar := user.Avatar
 		user.Avatar = submission.NewValue
+		if err := s.userRepo.Update(user); err != nil {
+			return err
+		}
+		// 审核通过，删除旧头像文件
+		if s.avatarCleaner != nil {
+			_ = s.avatarCleaner.DeleteAvatarFile(oldAvatar)
+		}
+		return nil
 	case model.AuditTypeBio:
 		user.Bio = submission.NewValue
 	}