feat: 帖子分级置顶（板块/全站）与板块管理员置顶权限、消息管理权限调整

backend/handler/moderation.go

@@ -246,3 +246,55 @@ func (h *Handlers) execModeration(c *gin.Context, fn func(*service.Actor, uint)
 	h.broadcastModerationChanged()
 	c.JSON(http.StatusOK, gin.H{"message": "操作成功"})
 }
+
+// ===== 置顶顺序配置 =====
+
+// AdminListPinnedPosts 列出指定层级（level=1 板块 / 2 全站）的置顶帖，供后台排序
+func (h *Handlers) AdminListPinnedPosts(c *gin.Context) {
+	level, _ := strconv.Atoi(c.Query("level"))
+	boardID, _ := strconv.ParseUint(c.Query("board_id"), 10, 64)
+	if level != model.PinBoard && level != model.PinGlobal {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "无效的置顶层级"})
+		return
+	}
+	items, err := h.Moderation.ListPinnedPosts(middleware.CurrentActor(c), level, uint(boardID))
+	if err != nil {
+		if errors.Is(err, service.ErrPinOrderForbidden) {
+			c.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "获取置顶列表失败"})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"posts": nonNilSlice(items)})
+}
+
+// AdminSavePinOrderRequest 置顶顺序保存请求
+type AdminSavePinOrderRequest struct {
+	Level   int    `json:"level" binding:"required"`
+	BoardID uint   `json:"board_id"`
+	IDs     []uint `json:"ids" binding:"required"`
+}
+
+// AdminSavePinOrder 保存置顶帖显示顺序（ids 数组顺序即展示顺序）
+func (h *Handlers) AdminSavePinOrder(c *gin.Context) {
+	var req AdminSavePinOrderRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "参数错误"})
+		return
+	}
+	if req.Level != model.PinBoard && req.Level != model.PinGlobal {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "无效的置顶层级"})
+		return
+	}
+	if err := h.Moderation.SavePinOrder(middleware.CurrentActor(c), req.Level, req.BoardID, req.IDs); err != nil {
+		if errors.Is(err, service.ErrPinOrderForbidden) {
+			c.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	h.broadcastFeedChanged("post", 0, req.BoardID, middleware.CurrentActor(c).ID)
+	c.JSON(http.StatusOK, gin.H{"message": "已保存"})
+}