feat: 帖子分级置顶（板块/全站）与板块管理员置顶权限、消息管理权限调整

backend/handler/post.go

@@ -550,9 +550,12 @@ func (h *Handlers) DeletePost(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{"message": "已删除"})
 }
 
-// TogglePin 切换帖子置顶（管理员及以上，板块管理员无此权限）
+// TogglePin 切换帖子置顶：管理员及以上切全站置顶，板块管理员切本板板块置顶
 func (h *Handlers) TogglePin(c *gin.Context) {
-	if !h.requireAdminOrAbove(c) {
+	claims := middleware.CurrentUser(c)
+	actor, err := h.Auth.LoadActor(claims.ID)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "未登录"})
 		return
 	}
 	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
@@ -560,9 +563,17 @@ func (h *Handlers) TogglePin(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "无效的帖子 ID"})
 		return
 	}
-	pinned, err := h.Post.TogglePin(uint(id))
+	level, _ := strconv.Atoi(c.Query("level"))
+	pinned, err := h.Post.TogglePin(uint(id), actor, level)
 	if err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		switch {
+		case errors.Is(err, service.ErrPostNotFound):
+			c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		case errors.Is(err, service.ErrPostForbidden), errors.Is(err, service.ErrPinGlobalOnly):
+			c.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+		default:
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		}
 		return
 	}
 	c.JSON(http.StatusOK, gin.H{"pinned": pinned})