feat: 帖子分级置顶（板块/全站）与板块管理员置顶权限、消息管理权限调整

frontend/lib/api.ts

@@ -81,7 +81,7 @@ export interface User {
   role: string;
   // 板块管理员被授权的板块（仅 /api/me 返回；前端据此渲染审核入口/按钮）
   board_ids?: number[];
-  // 站点消息管理（站长授予；站长/超管固有监管不必依赖此字段）
+  // 站点消息管理（仅站长可授；超管亦需授予，站长固有监管不必依赖此字段）
   can_manage_messages?: boolean;
   // 生效权限码（角色默认 ∪ 账号级渠道授予；仅 /api/me 返回，用于后台入口显隐）
   perms?: string[];
@@ -2261,8 +2261,8 @@ export async function apiDeletePost(
   return res.json();
 }
 
-export async function apiTogglePin(postId: string): Promise<{ pinned: number }> {
-  const res = await fetchWithRefresh(`/api/posts/${postId}/pin`, {
+export async function apiTogglePin(postId: string, level: 0 | 1 | 2): Promise<{ pinned: number }> {
+  const res = await fetchWithRefresh(`/api/posts/${postId}/pin?level=${level}`, {
     method: "PUT",
     headers: clientHeaders(),
   });
@@ -4059,6 +4059,38 @@ export const apiAdminRestoreComment = (id: number) =>
 export const apiAdminPurgeComment = (id: number) =>
   contentAction(`/api/admin/content/comments/${id}/purge`, "DELETE");
 
+// ===== 置顶顺序配置 =====
+export interface AdminPinnedPost {
+  id: number;
+  title: string;
+  pinned: number;
+  pin_order: number;
+  board_id: number;
+  board_name: string;
+  created_at: string;
+}
+
+export async function apiAdminPinnedPosts(
+  level: 1 | 2,
+  boardId?: number
+): Promise<{ posts: AdminPinnedPost[] }> {
+  const params = new URLSearchParams({ level: String(level) });
+  if (boardId) params.set("board_id", String(boardId));
+  const res = await fetchWithRefresh(`/api/admin/pinned-posts?${params}`, {
+    headers: clientHeaders(),
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) throw new Error(data.error || "获取置顶列表失败");
+  return data;
+}
+
+export const apiAdminSavePinOrder = (level: 1 | 2, boardId: number, ids: number[]) =>
+  contentAction(`/api/admin/pinned-posts/order`, "PUT", {
+    level,
+    board_id: boardId,
+    ids,
+  });
+
 export interface CommentEditHistoryItem {
   id: number;
   editor: {