移除旧版 HTML 模板与兼容层，并完善私信、举报、媒体存储与 SEO。

Co-authored-by: Cursor <cursoragent@cursor.com>

handler/admin.go

@@ -1,245 +0,0 @@
-package handler
-
-import (
-	"net/http"
-	"path/filepath"
-	"strconv"
-	"strings"
-
-	"github.com/gin-gonic/gin"
-	"git.iioio.com/freefire/jiang13-forum/model"
-	"git.iioio.com/freefire/jiang13-forum/service"
-)
-
-// --- 后台管理页面 ---
-
-func (h *Handlers) adminPageData(c *gin.Context, title, activeNav string, data gin.H) gin.H {
-	if data == nil {
-		data = gin.H{}
-	}
-	data["ActiveNav"] = activeNav
-	return h.pageData(c, title, data)
-}
-
-func (h *Handlers) AdminLoginPage(c *gin.Context) {
-	c.HTML(http.StatusOK, "admin/login.html", h.pageData(c, "后台登录", gin.H{
-		"ActiveNav":   "login",
-		"QueryBanned": c.Query("banned"),
-	}))
-}
-
-func (h *Handlers) AdminDashboard(c *gin.Context) {
-	var userCount, postCount, boardCount, commentCount int64
-	model.DB.Model(&model.User{}).Count(&userCount)
-	model.DB.Model(&model.Post{}).Count(&postCount)
-	model.DB.Model(&model.Board{}).Count(&boardCount)
-	model.DB.Model(&model.Comment{}).Count(&commentCount)
-	recentPosts, _, _ := h.Post.List(service.PostListQuery{Page: 1, Size: 8})
-	c.HTML(http.StatusOK, "admin/dashboard.html", h.adminPageData(c, "仪表盘", "dashboard", gin.H{
-		"UserCount":    userCount,
-		"PostCount":    postCount,
-		"BoardCount":   boardCount,
-		"CommentCount": commentCount,
-		"RecentPosts":  recentPosts,
-	}))
-}
-
-func (h *Handlers) AdminBoardsPage(c *gin.Context) {
-	boards, _ := h.Board.ListWithStats()
-	c.HTML(http.StatusOK, "admin/boards.html", h.adminPageData(c, "板块管理", "boards", gin.H{
-		"Boards": boards,
-	}))
-}
-
-func (h *Handlers) AdminPostsPage(c *gin.Context) {
-	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
-	keyword := strings.TrimSpace(c.Query("keyword"))
-	posts, total, _ := h.Post.List(service.PostListQuery{Page: page, Size: 20, Keyword: keyword})
-	c.HTML(http.StatusOK, "admin/posts.html", h.adminPageData(c, "帖子管理", "posts", gin.H{
-		"Posts":     posts,
-		"Total":     total,
-		"Page":      page,
-		"Keyword":   keyword,
-		"TotalPages": calcTotalPages(total, 20),
-	}))
-}
-
-func (h *Handlers) AdminCommentsPage(c *gin.Context) {
-	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
-	comments, total, _ := h.Comment.ListRecent(page, 20)
-	c.HTML(http.StatusOK, "admin/comments.html", h.adminPageData(c, "评论管理", "comments", gin.H{
-		"Comments":   comments,
-		"Total":      total,
-		"Page":       page,
-		"TotalPages": calcTotalPages(total, 20),
-	}))
-}
-
-func (h *Handlers) AdminUsersPage(c *gin.Context) {
-	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
-	users, total, _ := h.User.ListUsers(page, 20)
-	c.HTML(http.StatusOK, "admin/users.html", h.adminPageData(c, "用户管理", "users", gin.H{
-		"Users":      users,
-		"Total":      total,
-		"Page":       page,
-		"TotalPages": calcTotalPages(total, 20),
-	}))
-}
-
-func (h *Handlers) AdminSettingsPage(c *gin.Context) {
-	c.HTML(http.StatusOK, "admin/settings.html", h.adminPageData(c, "系统设置", "settings", gin.H{
-		"FilterPath": h.Cfg.FilterWordsPath(),
-		"DataDir":    h.Cfg.DataDir,
-		"DBPath":     h.Cfg.DBPath(),
-		"Port":       h.Cfg.Port,
-	}))
-}
-
-func calcTotalPages(total int64, size int) int {
-	if total == 0 {
-		return 1
-	}
-	pages := int(total) / size
-	if int(total)%size > 0 {
-		pages++
-	}
-	if pages < 1 {
-		return 1
-	}
-	return pages
-}
-
-// --- 后台 API ---
-
-func (h *Handlers) AdminAPICreateBoard(c *gin.Context) {
-	sortOrder, _ := strconv.Atoi(c.PostForm("sort_order"))
-	colorIndex, _ := strconv.Atoi(c.PostForm("color_index"))
-	board, err := h.Board.Create(c.PostForm("name"), c.PostForm("description"), c.PostForm("icon"), colorIndex, sortOrder)
-	if err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-	c.JSON(http.StatusOK, gin.H{"message": "板块已创建", "id": board.ID})
-}
-
-func (h *Handlers) AdminAPIUpdateBoard(c *gin.Context) {
-	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
-	sortOrder, _ := strconv.Atoi(c.PostForm("sort_order"))
-	colorIndex, _ := strconv.Atoi(c.PostForm("color_index"))
-	if err := h.Board.Update(uint(id), c.PostForm("name"), c.PostForm("description"), c.PostForm("icon"), colorIndex, sortOrder); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-	c.JSON(http.StatusOK, gin.H{"message": "板块已更新"})
-}
-
-func (h *Handlers) AdminAPIDeleteBoard(c *gin.Context) {
-	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
-	if err := h.Board.Delete(uint(id)); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-	c.JSON(http.StatusOK, gin.H{"message": "板块已删除"})
-}
-
-func (h *Handlers) AdminAPIPinPost(c *gin.Context) {
-	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
-	pinned := c.PostForm("pinned") == "true" || c.PostForm("pinned") == "1"
-	if err := h.Post.SetPinned(uint(id), pinned); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-	msg := "已取消置顶"
-	if pinned {
-		msg = "已置顶"
-	}
-	c.JSON(http.StatusOK, gin.H{"message": msg, "pinned": pinned})
-}
-
-func (h *Handlers) AdminAPIDeletePost(c *gin.Context) {
-	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
-	if err := h.Post.Delete(0, uint(id), true); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-	c.JSON(http.StatusOK, gin.H{"message": "帖子已删除"})
-}
-
-func (h *Handlers) AdminAPIDeleteComment(c *gin.Context) {
-	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
-	if err := h.Comment.AdminDelete(uint(id)); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-	c.JSON(http.StatusOK, gin.H{"message": "评论已删除"})
-}
-
-func (h *Handlers) AdminAPIBanUser(c *gin.Context) {
-	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
-	banned := c.PostForm("banned") == "true" || c.PostForm("banned") == "1"
-	if err := h.User.BanUser(uint(id), banned); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-	msg := "已解除禁言"
-	if banned {
-		msg = "已禁言"
-	}
-	c.JSON(http.StatusOK, gin.H{"message": msg})
-}
-
-func (h *Handlers) AdminAPIBackup(c *gin.Context) {
-	path, err := h.Backup.ExportSQLite()
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
-		return
-	}
-	filename := filepath.Base(path)
-	c.JSON(http.StatusOK, gin.H{
-		"message":  "备份成功",
-		"path":     path,
-		"filename": filename,
-		"download": "/admin/api/backup/download/" + filename,
-	})
-}
-
-func (h *Handlers) AdminDownloadBackup(c *gin.Context) {
-	name := c.Param("name")
-	if !strings.HasPrefix(name, "jiang13_backup_") || !strings.HasSuffix(name, ".db") {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "无效的备份文件名"})
-		return
-	}
-	path := filepath.Join(h.Cfg.DataDir, name)
-	c.FileAttachment(path, name)
-}
-
-func (h *Handlers) AdminAPILogin(c *gin.Context) {
-	var req struct {
-		Username string `json:"username" form:"username" binding:"required"`
-		Password string `json:"password" form:"password" binding:"required"`
-	}
-	if err := c.ShouldBind(&req); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "参数错误"})
-		return
-	}
-	token, user, err := h.Auth.Login(req.Username, req.Password, c.ClientIP())
-	if err != nil {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
-		return
-	}
-	if user.Role != model.RoleAdmin {
-		c.JSON(http.StatusForbidden, gin.H{"error": "需要管理员账号才能登录后台"})
-		return
-	}
-	h.setAuthCookie(c, token)
-	c.JSON(http.StatusOK, gin.H{
-		"message": "登录成功",
-		"user": gin.H{
-			"id": user.ID, "nickname": user.Nickname, "role": user.Role,
-		},
-	})
-}
-
-func (h *Handlers) AdminAPILogout(c *gin.Context) {
-	h.APILogout(c)
-}

handler/api.go

@@ -4,7 +4,6 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
-	"os"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -52,7 +51,7 @@ func (h *Handlers) APIBoards(c *gin.Context) {
 func (h *Handlers) APIStats(c *gin.Context) {
 	var userCount, postCount, boardCount int64
 	model.DB.Model(&model.User{}).Count(&userCount)
-	model.DB.Model(&model.Post{}).Count(&postCount)
+	model.DB.Model(&model.Post{}).Where("status = ?", model.ContentStatusPublished).Count(&postCount)
 	model.DB.Model(&model.Board{}).Count(&boardCount)
 	c.JSON(http.StatusOK, gin.H{
 		"users": userCount, "posts": postCount, "boards": boardCount,
@@ -121,10 +120,12 @@ func (h *Handlers) APIAdminDeleteBoard(c *gin.Context) {
 func (h *Handlers) APIAdminDashboard(c *gin.Context) {
 	var userCount, postCount, boardCount, commentCount int64
 	model.DB.Model(&model.User{}).Count(&userCount)
-	model.DB.Model(&model.Post{}).Count(&postCount)
+	model.DB.Model(&model.Post{}).Where("status = ?", model.ContentStatusPublished).Count(&postCount)
 	model.DB.Model(&model.Board{}).Count(&boardCount)
-	model.DB.Model(&model.Comment{}).Count(&commentCount)
-	recentPosts, _, _ := h.Post.List(service.PostListQuery{Page: 1, Size: 8})
+	model.DB.Model(&model.Comment{}).Where("status = ?", model.ContentStatusPublished).Count(&commentCount)
+	recentPosts, _, _ := h.Post.List(service.PostListQuery{
+		Page: 1, Size: 8, ViewerIsAdmin: true, Status: "all",
+	})
 	if recentPosts == nil {
 		recentPosts = []model.Post{}
 	}
@@ -140,7 +141,11 @@ func (h *Handlers) APIAdminPosts(c *gin.Context) {
 	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
 	size, _ := strconv.Atoi(c.DefaultQuery("size", "20"))
 	keyword := strings.TrimSpace(c.Query("keyword"))
-	posts, total, err := h.Post.ListItems(service.PostListQuery{Page: page, Size: size, Keyword: keyword})
+	status := strings.TrimSpace(c.DefaultQuery("status", "all"))
+	posts, total, err := h.Post.ListItems(service.PostListQuery{
+		Page: page, Size: size, Keyword: keyword,
+		ViewerIsAdmin: true, Status: status,
+	})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -148,9 +153,12 @@ func (h *Handlers) APIAdminPosts(c *gin.Context) {
 	if posts == nil {
 		posts = []service.PostListItem{}
 	}
+	pending, _ := h.Post.PendingPostCount()
 	c.JSON(http.StatusOK, gin.H{
 		"posts": posts, "total": total, "page": page,
-		"total_pages": calcTotalPages(total, size),
+		"total_pages":   calcTotalPages(total, size),
+		"pending_count": pending,
+		"status":        status,
 	})
 }
 
@@ -196,21 +204,82 @@ func (h *Handlers) APIAdminPinPost(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{"message": msg, "pinned": req.Pinned})
 }
 
-// APIAdminDeletePost 管理员删除帖子
+// APIAdminFeaturePost 设为精华/取消精华（JSON）
+func (h *Handlers) APIAdminFeaturePost(c *gin.Context) {
+	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
+	var req struct {
+		Featured bool `json:"featured"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "参数错误"})
+		return
+	}
+	if err := h.Post.SetFeatured(uint(id), req.Featured); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	msg := "已取消精华"
+	if req.Featured {
+		msg = "已设为精华"
+	}
+	c.JSON(http.StatusOK, gin.H{"message": msg, "featured": req.Featured})
+}
+
+// APIAdminDeletePost 管理员软删除帖子（进入回收站）
 func (h *Handlers) APIAdminDeletePost(c *gin.Context) {
 	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
 	if err := h.Post.Delete(0, uint(id), true); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
-	c.JSON(http.StatusOK, gin.H{"message": "帖子已删除"})
+	c.JSON(http.StatusOK, gin.H{"message": "帖子已移入回收站"})
+}
+
+// APIAdminTrashPosts 回收站帖子列表
+func (h *Handlers) APIAdminTrashPosts(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	size, _ := strconv.Atoi(c.DefaultQuery("size", "20"))
+	keyword := strings.TrimSpace(c.Query("keyword"))
+	posts, total, err := h.Post.ListTrash(page, size, keyword)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	if posts == nil {
+		posts = []service.TrashPostItem{}
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"posts": posts, "total": total, "page": page,
+		"total_pages": calcTotalPages(total, size),
+	})
+}
+
+// APIAdminRestorePost 从回收站恢复帖子
+func (h *Handlers) APIAdminRestorePost(c *gin.Context) {
+	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err := h.Post.Restore(uint(id)); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"message": "帖子已恢复"})
+}
+
+// APIAdminPurgePost 永久删除回收站帖子
+func (h *Handlers) APIAdminPurgePost(c *gin.Context) {
+	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err := h.Post.Purge(uint(id)); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"message": "帖子已永久删除"})
 }
 
 // APIAdminComments 管理员评论列表
 func (h *Handlers) APIAdminComments(c *gin.Context) {
 	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
 	size, _ := strconv.Atoi(c.DefaultQuery("size", "20"))
-	comments, total, err := h.Comment.ListRecent(page, size)
+	status := strings.TrimSpace(c.DefaultQuery("status", "all"))
+	comments, total, err := h.Comment.ListRecent(page, size, status)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -218,12 +287,63 @@ func (h *Handlers) APIAdminComments(c *gin.Context) {
 	if comments == nil {
 		comments = []model.Comment{}
 	}
+	pending, _ := h.Comment.PendingCommentCount()
 	c.JSON(http.StatusOK, gin.H{
 		"comments": comments, "total": total, "page": page,
-		"total_pages": calcTotalPages(total, size),
+		"total_pages":   calcTotalPages(total, size),
+		"pending_count": pending,
+		"status":        status,
 	})
 }
 
+// APIAdminApproveComment 通过评论审核
+func (h *Handlers) APIAdminApproveComment(c *gin.Context) {
+	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err := h.Comment.SetStatus(uint(id), model.ContentStatusPublished); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"message": "评论已通过审核", "status": model.ContentStatusPublished})
+}
+
+// APIAdminRejectComment 拒绝评论并私信通知
+func (h *Handlers) APIAdminRejectComment(c *gin.Context) {
+	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
+	var req struct {
+		Reason string `json:"reason"`
+	}
+	_ = c.ShouldBindJSON(&req)
+	reason := strings.TrimSpace(req.Reason)
+	if reason == "" {
+		reason = "不符合社区规范"
+	}
+	comment, err := h.Comment.GetByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if err := h.Comment.SetStatus(uint(id), model.ContentStatusRejected); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if comment.UserID > 0 {
+		title := comment.Post.Title
+		if title == "" {
+			title = "未知帖子"
+		}
+		pid := comment.PostID
+		_, _ = h.Message.SendSystem(
+			comment.UserID,
+			"评论未通过审核",
+			service.FormatCommentRejectContent(title, comment.PostID, comment.Floor, reason),
+			model.MessageKindReject,
+			&pid,
+			nil,
+		)
+	}
+	c.JSON(http.StatusOK, gin.H{"message": "已拒绝该评论并通知作者", "status": model.ContentStatusRejected})
+}
+
 // APIAdminDeleteComment 管理员删除评论
 func (h *Handlers) APIAdminDeleteComment(c *gin.Context) {
 	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
@@ -234,6 +354,17 @@ func (h *Handlers) APIAdminDeleteComment(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{"message": "评论已删除"})
 }
 
+// APIAdminCommentRevisions 管理员查看评论编辑历史
+func (h *Handlers) APIAdminCommentRevisions(c *gin.Context) {
+	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
+	revs, err := h.Comment.ListRevisions(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"revisions": revs})
+}
+
 // APIAdminUsers 管理员用户列表
 func (h *Handlers) APIAdminUsers(c *gin.Context) {
 	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
@@ -314,6 +445,7 @@ func (h *Handlers) APIAdminSettings(c *gin.Context) {
 		"oidc":              h.Settings.OIDCConfigPublic(),
 		"oauth_clients":     clients,
 		"gitea":             h.Settings.GiteaSyncConfigPublic(),
+		"storage":           h.Settings.StorageConfigPublic(),
 		"branding":          h.Settings.SiteBranding(),
 		"filter_words":      filterContent,
 		"filter_word_count": service.CountFilterWords(filterContent),
@@ -342,11 +474,11 @@ func (h *Handlers) APIAdminUpdateBranding(c *gin.Context) {
 	})
 }
 
-// APIAdminUploadBrandingAsset 上传 Logo 或 Favicon（form: file + kind=logo|favicon）
+// APIAdminUploadBrandingAsset 上传 Logo / Favicon / 默认 OG 图（form: file + kind=logo|favicon|og_image）
 func (h *Handlers) APIAdminUploadBrandingAsset(c *gin.Context) {
 	kind := strings.TrimSpace(c.PostForm("kind"))
-	if kind != "logo" && kind != "favicon" {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "kind 须为 logo 或 favicon"})
+	if kind != "logo" && kind != "favicon" && kind != "og_image" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "kind 须为 logo、favicon 或 og_image"})
 		return
 	}
 	file, err := c.FormFile("file")
@@ -359,18 +491,22 @@ func (h *Handlers) APIAdminUploadBrandingAsset(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "图片不能超过 2MB"})
 		return
 	}
-	url, err := service.SaveUploadedImage(file, h.Cfg.SiteUploadDir(), "/uploads/site", kind)
+	url, err := service.SaveUploadedImage(h.Store, file, service.UploadCategorySite, kind)
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
 	prev := h.Settings.SiteBranding()
-	if kind == "logo" {
+	switch kind {
+	case "logo":
 		_ = h.Settings.SetSiteLogo(url)
-		h.removeSiteUploadIfLocal(prev.Logo)
-	} else {
+		h.Store.DeleteByURL(prev.Logo)
+	case "favicon":
 		_ = h.Settings.SetSiteFavicon(url)
-		h.removeSiteUploadIfLocal(prev.Favicon)
+		h.Store.DeleteByURL(prev.Favicon)
+	case "og_image":
+		_ = h.Settings.SetSiteOGImage(url)
+		h.Store.DeleteByURL(prev.OGImage)
 	}
 	c.JSON(http.StatusOK, gin.H{
 		"message":  "上传成功",
@@ -379,7 +515,7 @@ func (h *Handlers) APIAdminUploadBrandingAsset(c *gin.Context) {
 	})
 }
 
-// APIAdminClearBrandingAsset 清除 Logo 或 Favicon
+// APIAdminClearBrandingAsset 清除 Logo / Favicon / 默认 OG 图
 func (h *Handlers) APIAdminClearBrandingAsset(c *gin.Context) {
 	var req struct {
 		Kind string `json:"kind"`
@@ -393,12 +529,15 @@ func (h *Handlers) APIAdminClearBrandingAsset(c *gin.Context) {
 	switch kind {
 	case "logo":
 		_ = h.Settings.SetSiteLogo("")
-		h.removeSiteUploadIfLocal(brand.Logo)
+		h.Store.DeleteByURL(brand.Logo)
 	case "favicon":
 		_ = h.Settings.SetSiteFavicon("")
-		h.removeSiteUploadIfLocal(brand.Favicon)
+		h.Store.DeleteByURL(brand.Favicon)
+	case "og_image":
+		_ = h.Settings.SetSiteOGImage("")
+		h.Store.DeleteByURL(brand.OGImage)
 	default:
-		c.JSON(http.StatusBadRequest, gin.H{"error": "kind 须为 logo 或 favicon"})
+		c.JSON(http.StatusBadRequest, gin.H{"error": "kind 须为 logo、favicon 或 og_image"})
 		return
 	}
 	c.JSON(http.StatusOK, gin.H{
@@ -505,6 +644,27 @@ func (h *Handlers) APIAdminUpdateGiteaSettings(c *gin.Context) {
 	})
 }
 
+// APIAdminUpdateStorageSettings 更新上传存储（本地 / S3 兼容），保存后立即热切换
+func (h *Handlers) APIAdminUpdateStorageSettings(c *gin.Context) {
+	var req service.StorageConfig
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "参数错误"})
+		return
+	}
+	if err := h.Settings.UpdateStorageConfig(req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if err := h.Store.ReloadFromSettings(h.Settings); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "配置已保存，但初始化存储失败：" + err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"message": "存储设置已保存",
+		"storage": h.Settings.StorageConfigPublic(),
+	})
+}
+
 // APIAdminSyncGitea 立即同步 Gitea 公开仓库
 func (h *Handlers) APIAdminSyncGitea(c *gin.Context) {
 	if h.Gitea == nil {
@@ -666,12 +826,14 @@ func (h *Handlers) APIPosts(c *gin.Context) {
 	keyword := c.Query("keyword")
 
 	q := service.PostListQuery{
-		BoardID: uint(boardID),
-		UserID:  uint(userID),
-		Page:    page,
-		Size:    size,
-		Keyword: keyword,
-		Sort:    c.DefaultQuery("sort", "latest"),
+		BoardID:       uint(boardID),
+		UserID:        uint(userID),
+		Page:          page,
+		Size:          size,
+		Keyword:       keyword,
+		Sort:          c.DefaultQuery("sort", "latest"),
+		ViewerID:      h.currentUserID(c),
+		ViewerIsAdmin: h.isAdmin(c),
 	}
 	items, total, err := h.Post.ListItems(q)
 	if err != nil {
@@ -702,15 +864,19 @@ func (h *Handlers) APIPostDetail(c *gin.Context) {
 		c.JSON(http.StatusNotFound, gin.H{"error": "帖子不存在"})
 		return
 	}
-	if c.Query("skip_view") != "1" {
+	uid := h.currentUserID(c)
+	isAdmin := h.isAdmin(c)
+	if !service.CanViewPost(post, uid, isAdmin) {
+		c.JSON(http.StatusNotFound, gin.H{"error": "帖子不存在"})
+		return
+	}
+	if c.Query("skip_view") != "1" && post.Status == model.ContentStatusPublished {
 		h.Post.RecordView(uint(id))
 	}
-	uid := h.currentUserID(c)
 	if uid == 0 {
 		post.Content = service.RedactMembersOnlyHTML(post.Content)
 	}
-	comments, _ := h.Comment.ListByPost(uint(id), uid, h.isAdmin(c), post.UserID, h.parseGuestCommentIDs(c))
-	isAdmin := h.isAdmin(c)
+	comments, _ := h.Comment.ListByPost(uint(id), uid, isAdmin, post.UserID, h.parseGuestCommentIDs(c))
 	canEdit := h.Post.CanUserEdit(post, uid, isAdmin)
 	editReason := ""
 	if !canEdit && uid > 0 {
@@ -737,7 +903,13 @@ func (h *Handlers) APIPostComments(c *gin.Context) {
 		c.JSON(http.StatusNotFound, gin.H{"error": "帖子不存在"})
 		return
 	}
-	comments, err := h.Comment.ListByPost(uint(id), h.currentUserID(c), h.isAdmin(c), post.UserID, h.parseGuestCommentIDs(c))
+	uid := h.currentUserID(c)
+	isAdmin := h.isAdmin(c)
+	if !service.CanViewPost(post, uid, isAdmin) {
+		c.JSON(http.StatusNotFound, gin.H{"error": "帖子不存在"})
+		return
+	}
+	comments, err := h.Comment.ListByPost(uint(id), uid, isAdmin, post.UserID, h.parseGuestCommentIDs(c))
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -842,20 +1014,6 @@ func (h *Handlers) APIPostRevisionDetail(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{"revision": rev})
 }
 
-// removeSiteUploadIfLocal 删除本站 uploads/site 下的旧资源文件
-func (h *Handlers) removeSiteUploadIfLocal(urlPath string) {
-	urlPath = strings.TrimSpace(urlPath)
-	const prefix = "/uploads/site/"
-	if !strings.HasPrefix(urlPath, prefix) {
-		return
-	}
-	name := filepath.Base(urlPath)
-	if name == "" || name == "." || name == ".." {
-		return
-	}
-	_ = os.Remove(filepath.Join(h.Cfg.SiteUploadDir(), name))
-}
-
 func isClientLimitError(err error) bool {
 	return errors.Is(err, service.ErrSearchKeywordTooShort) ||
 		errors.Is(err, service.ErrSearchKeywordTooLong)

handler/handlers.go

@@ -17,11 +17,14 @@ import (
 // Handlers 聚合所有 HTTP 处理器
 type Handlers struct {
 	Cfg       *config.Config
+	Store     *service.UploadStore
 	Auth      *service.AuthService
 	User      *service.UserService
 	Board     *service.BoardService
 	Post      *service.PostService
 	Comment   *service.CommentService
+	Message   *service.MessageService
+	Report    *service.ReportService
 	Backup    *service.BackupService
 	Filter    *service.SensitiveFilter
 	Limiter   *service.RateLimiter
@@ -70,108 +73,18 @@ func (h *Handlers) parseGuestCommentIDs(c *gin.Context) []uint {
 	return ids
 }
 
-func (h *Handlers) pageData(c *gin.Context, title string, data gin.H) gin.H {
-	if data == nil {
-		data = gin.H{}
+func calcTotalPages(total int64, size int) int {
+	if total == 0 {
+		return 1
 	}
-	data["Title"] = title
-	brand := h.Settings.SiteBranding()
-	data["SiteName"] = brand.Name
-	data["SiteEN"] = brand.NameEN
-	if uid := h.currentUserID(c); uid > 0 {
-		data["CurrentUserID"] = uid
-		if u, err := h.User.GetByID(uid); err == nil {
-			data["CurrentUser"] = u
-		}
+	pages := int(total) / size
+	if int(total)%size > 0 {
+		pages++
 	}
-	data["IsAdmin"] = h.isAdmin(c)
-	return data
-}
-
-// --- 页面路由 ---
-
-func (h *Handlers) IndexPage(c *gin.Context) {
-	boards, _ := h.Board.List()
-	posts, _, _ := h.Post.List(service.PostListQuery{Page: 1, Size: 10})
-	c.HTML(http.StatusOK, "index.html", h.pageData(c, "首页", gin.H{
-		"Boards": boards, "Posts": posts,
-	}))
-}
-
-func (h *Handlers) LoginPage(c *gin.Context) {
-	c.HTML(http.StatusOK, "login.html", h.pageData(c, "登录", nil))
-}
-
-func (h *Handlers) RegisterPage(c *gin.Context) {
-	c.HTML(http.StatusOK, "register.html", h.pageData(c, "注册", nil))
-}
-
-func (h *Handlers) BoardPage(c *gin.Context) {
-	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
-	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
-	board, err := h.Board.GetByID(uint(id))
-	if err != nil {
-		c.HTML(http.StatusNotFound, "error.html", h.pageData(c, "板块不存在", gin.H{"Message": "板块不存在"}))
-		return
+	if pages < 1 {
+		return 1
 	}
-	posts, total, _ := h.Post.List(service.PostListQuery{BoardID: uint(id), Page: page, Size: 20})
-	c.HTML(http.StatusOK, "board.html", h.pageData(c, board.Name, gin.H{
-		"Board": board, "Posts": posts, "Total": total, "Page": page,
-	}))
-}
-
-func (h *Handlers) PostPage(c *gin.Context) {
-	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
-	post, err := h.Post.GetByID(uint(id))
-	if err != nil {
-		c.HTML(http.StatusNotFound, "error.html", h.pageData(c, "帖子不存在", gin.H{"Message": "帖子不存在"}))
-		return
-	}
-	comments, _ := h.Comment.ListByPost(uint(id), h.currentUserID(c), h.isAdmin(c), post.UserID, nil)
-	uid := h.currentUserID(c)
-	c.HTML(http.StatusOK, "post.html", h.pageData(c, post.Title, gin.H{
-		"Post": post, "Comments": comments,
-		"Liked": h.Post.IsLiked(uid, uint(id)),
-		"Favorited": h.Post.IsFavorited(uid, uint(id)),
-	}))
-}
-
-func (h *Handlers) PostNewPage(c *gin.Context) {
-	boards, _ := h.Board.List()
-	c.HTML(http.StatusOK, "post_new.html", h.pageData(c, "发帖", gin.H{"Boards": boards}))
-}
-
-func (h *Handlers) PostEditPage(c *gin.Context) {
-	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
-	post, err := h.Post.FindByID(uint(id))
-	if err != nil || (!h.isAdmin(c) && post.UserID != h.currentUserID(c)) {
-		c.Redirect(http.StatusFound, "/")
-		return
-	}
-	c.HTML(http.StatusOK, "post_edit.html", h.pageData(c, "编辑帖子", gin.H{"Post": post}))
-}
-
-func (h *Handlers) ProfilePage(c *gin.Context) {
-	user, _ := h.User.GetByID(h.currentUserID(c))
-	c.HTML(http.StatusOK, "profile.html", h.pageData(c, "个人主页", gin.H{"ProfileUser": user}))
-}
-
-func (h *Handlers) UserProfilePage(c *gin.Context) {
-	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
-	user, err := h.User.GetByID(uint(id))
-	if err != nil {
-		c.HTML(http.StatusNotFound, "error.html", h.pageData(c, "用户不存在", gin.H{"Message": "用户不存在"}))
-		return
-	}
-	c.HTML(http.StatusOK, "user_profile.html", h.pageData(c, user.Nickname, gin.H{"ProfileUser": user}))
-}
-
-func (h *Handlers) FavoritesPage(c *gin.Context) {
-	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
-	favs, total, _ := h.Post.ListFavorites(h.currentUserID(c), page, 20)
-	c.HTML(http.StatusOK, "favorites.html", h.pageData(c, "我的收藏", gin.H{
-		"Favorites": favs, "Total": total, "Page": page,
-	}))
+	return pages
 }
 
 // --- API ---
@@ -197,6 +110,7 @@ func (h *Handlers) APIRegisterConfig(c *gin.Context) {
 		"mail_ready":         mailReady,
 		"require_email_code": mailReady,
 		"register_open":      userCount == 0 || mailReady,
+		"email_code_len":     service.EmailCodeLen,
 	})
 }
 
@@ -366,7 +280,7 @@ func (h *Handlers) APIUploadAvatar(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "头像文件过大"})
 		return
 	}
-	url, err := h.User.UploadAvatar(h.currentUserID(c), file, h.Cfg.UploadDir())
+	url, err := h.User.UploadAvatar(h.currentUserID(c), file, h.Store)
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
@@ -382,9 +296,9 @@ func (h *Handlers) APIUploadPostImage(c *gin.Context) {
 	}
 	uid := h.currentUserID(c)
 	url, err := service.SaveUploadedImage(
+		h.Store,
 		file,
-		h.Cfg.PostImageUploadDir(),
-		"/uploads/posts",
+		service.UploadCategoryPosts,
 		fmt.Sprintf("%d", uid),
 	)
 	if err != nil {
@@ -399,18 +313,23 @@ func (h *Handlers) APICreatePost(c *gin.Context) {
 	title := c.PostForm("title")
 	content := c.PostForm("content")
 	tags := c.PostForm("tags")
-	post, err := h.Post.Create(h.currentUserID(c), uint(boardID), title, content, tags)
+	post, err := h.Post.Create(h.currentUserID(c), uint(boardID), title, content, tags, h.isAdmin(c))
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
-	c.JSON(http.StatusOK, gin.H{"message": "发帖成功", "post_id": post.ID})
+	msg := "发帖成功"
+	if post.Status == model.ContentStatusPending {
+		msg = "已提交审核，通过后将公开显示"
+	}
+	c.JSON(http.StatusOK, gin.H{"message": msg, "post_id": post.ID, "status": post.Status})
 }
 
 func (h *Handlers) APIUpdatePost(c *gin.Context) {
 	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
+	boardID, _ := strconv.ParseUint(c.PostForm("board_id"), 10, 64)
 	err := h.Post.Update(h.currentUserID(c), uint(id), h.isAdmin(c),
-		c.PostForm("title"), c.PostForm("content"), c.PostForm("tags"))
+		c.PostForm("title"), c.PostForm("content"), c.PostForm("tags"), uint(boardID))
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
@@ -424,7 +343,7 @@ func (h *Handlers) APIDeletePost(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
-	c.JSON(http.StatusOK, gin.H{"message": "帖子已删除"})
+	c.JSON(http.StatusOK, gin.H{"message": "帖子已移入回收站"})
 }
 
 func (h *Handlers) APIToggleLike(c *gin.Context) {
@@ -460,6 +379,10 @@ func (h *Handlers) APICreateComment(c *gin.Context) {
 	}
 	isPrivate := c.PostForm("is_private") == "1" || c.PostForm("is_private") == "true"
 	uid := h.currentUserID(c)
+	if uid == 0 {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "请登录后评论"})
+		return
+	}
 
 	in := service.CommentCreateInput{
 		UserID:    uid,
@@ -468,18 +391,17 @@ func (h *Handlers) APICreateComment(c *gin.Context) {
 		ReplyTo:   replyTo,
 		IsPrivate: isPrivate,
 	}
-	if uid == 0 {
-		in.GuestNick = c.PostForm("guest_nick")
-		in.GuestEmail = c.PostForm("guest_email")
-		in.GuestURL = c.PostForm("guest_url")
-	}
 
 	comment, err := h.Comment.Create(in)
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
-	c.JSON(http.StatusOK, gin.H{"message": "评论成功", "floor": comment.Floor, "id": comment.ID})
+	msg := "评论成功"
+	if comment.Status == model.ContentStatusPending {
+		msg = "评论已提交，审核通过后公开显示"
+	}
+	c.JSON(http.StatusOK, gin.H{"message": msg, "floor": comment.Floor, "id": comment.ID, "status": comment.Status})
 }
 
 func (h *Handlers) APIDeleteComment(c *gin.Context) {
@@ -499,5 +421,13 @@ func (h *Handlers) APIUpdateComment(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
-	c.JSON(http.StatusOK, gin.H{"message": "评论已更新", "content": saved})
+	msg := "评论已更新"
+	status := ""
+	if comment, e := h.Comment.GetByID(uint(id)); e == nil {
+		status = comment.Status
+		if status == model.ContentStatusPending && !h.isAdmin(c) {
+			msg = "评论已更新，审核通过后公开显示"
+		}
+	}
+	c.JSON(http.StatusOK, gin.H{"message": msg, "content": saved, "status": status})
 }

handler/media.go

@@ -0,0 +1,70 @@
+package handler
+
+import (
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+)
+
+// APIAdminMedia 列出媒体资源
+func (h *Handlers) APIAdminMedia(c *gin.Context) {
+	if h.Store == nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "上传存储未初始化"})
+		return
+	}
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	size, _ := strconv.Atoi(c.DefaultQuery("size", "24"))
+	category := c.DefaultQuery("category", "all")
+	query := c.Query("q")
+	result, err := h.Store.ListMedia(category, query, page, size)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, result)
+}
+
+// APIAdminDeleteMedia 批量删除媒体
+func (h *Handlers) APIAdminDeleteMedia(c *gin.Context) {
+	if h.Store == nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "上传存储未初始化"})
+		return
+	}
+	var req struct {
+		URLs []string `json:"urls"`
+		URL  string   `json:"url"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "参数错误"})
+		return
+	}
+	urls := make([]string, 0, len(req.URLs)+1)
+	for _, u := range req.URLs {
+		u = strings.TrimSpace(u)
+		if u != "" {
+			urls = append(urls, u)
+		}
+	}
+	if u := strings.TrimSpace(req.URL); u != "" {
+		urls = append(urls, u)
+	}
+	if len(urls) == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "请选择要删除的文件"})
+		return
+	}
+	if len(urls) > 100 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "单次最多删除 100 个文件"})
+		return
+	}
+	n, err := h.Store.DeleteMedia(urls)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"message": "已删除 " + strconv.Itoa(n) + " 项媒体",
+		"deleted": n,
+	})
+}

handler/message.go

@@ -0,0 +1,138 @@
+package handler
+
+import (
+	"net/http"
+	"strconv"
+
+	"github.com/gin-gonic/gin"
+	"git.iioio.com/freefire/jiang13-forum/model"
+	"git.iioio.com/freefire/jiang13-forum/service"
+)
+
+// APIMessageConversations 会话列表（按对方聚合）
+func (h *Handlers) APIMessageConversations(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	size, _ := strconv.Atoi(c.DefaultQuery("size", "30"))
+	list, total, err := h.Message.ListConversations(service.ConversationListQuery{
+		UserID: h.currentUserID(c),
+		Page:   page,
+		Size:   size,
+	})
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"conversations": list,
+		"total":         total,
+		"page":          page,
+	})
+}
+
+// APIConversationMessages 某会话内消息
+func (h *Handlers) APIConversationMessages(c *gin.Context) {
+	peerID, err := strconv.ParseUint(c.Param("peerId"), 10, 64)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "无效的会话"})
+		return
+	}
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	size, _ := strconv.Atoi(c.DefaultQuery("size", "50"))
+	before, _ := strconv.ParseUint(c.DefaultQuery("before", "0"), 10, 64)
+	uid := h.currentUserID(c)
+
+	list, total, err := h.Message.ListConversationMessages(service.ConversationMessagesQuery{
+		UserID: uid,
+		PeerID: uint(peerID),
+		Page:   page,
+		Size:   size,
+		Before: uint(before),
+	})
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	// 首次打开（非向上翻页）时标已读
+	if before == 0 {
+		_ = h.Message.MarkConversationRead(uid, uint(peerID))
+		for i := range list {
+			if list[i].ToUserID == uid {
+				list[i].IsRead = true
+			}
+		}
+	}
+
+	var peer *model.User
+	if peerID > 0 {
+		var u model.User
+		if err := model.DB.First(&u, uint(peerID)).Error; err == nil {
+			peer = &u
+		}
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"messages":     list,
+		"total":        total,
+		"peer_user_id": uint(peerID),
+		"peer_user":    peer,
+		"is_system":    peerID == 0,
+	})
+}
+
+// APIMarkConversationRead 将会话标为已读
+func (h *Handlers) APIMarkConversationRead(c *gin.Context) {
+	peerID, err := strconv.ParseUint(c.Param("peerId"), 10, 64)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "无效的会话"})
+		return
+	}
+	if err := h.Message.MarkConversationRead(h.currentUserID(c), uint(peerID)); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"message": "已标为已读"})
+}
+
+// APIMessageUnreadCount 未读私信数
+func (h *Handlers) APIMessageUnreadCount(c *gin.Context) {
+	n, err := h.Message.UnreadCount(h.currentUserID(c))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"count": n})
+}
+
+// APISendMessage 发送私信
+func (h *Handlers) APISendMessage(c *gin.Context) {
+	var req struct {
+		ToUserID uint   `json:"to_user_id"`
+		Subject  string `json:"subject"`
+		Content  string `json:"content"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "参数错误"})
+		return
+	}
+	msg, err := h.Message.Send(service.MessageSendInput{
+		FromUserID: h.currentUserID(c),
+		ToUserID:   req.ToUserID,
+		Subject:    req.Subject,
+		Content:    req.Content,
+	})
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"message": msg})
+}
+
+// APIMarkAllMessagesRead 全部已读
+func (h *Handlers) APIMarkAllMessagesRead(c *gin.Context) {
+	if err := h.Message.MarkAllRead(h.currentUserID(c)); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"message": "已全部标为已读"})
+}

handler/report.go

@@ -0,0 +1,144 @@
+package handler
+
+import (
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"git.iioio.com/freefire/jiang13-forum/model"
+	"git.iioio.com/freefire/jiang13-forum/service"
+)
+
+// APICreatePostReport 举报帖子
+func (h *Handlers) APICreatePostReport(c *gin.Context) {
+	postID, _ := strconv.ParseUint(c.Param("id"), 10, 64)
+	var req struct {
+		Reason string `json:"reason"`
+		Detail string `json:"detail"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "参数错误"})
+		return
+	}
+	rep, err := h.Report.Create(h.currentUserID(c), uint(postID), req.Reason, req.Detail)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"message": "举报已提交，感谢反馈", "report": rep})
+}
+
+// APIAdminReports 举报列表
+func (h *Handlers) APIAdminReports(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	size, _ := strconv.Atoi(c.DefaultQuery("size", "20"))
+	status := c.DefaultQuery("status", "pending")
+	list, total, err := h.Report.ListAdmin(service.ReportListQuery{
+		Status: status,
+		Page:   page,
+		Size:   size,
+	})
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	pending, _ := h.Report.PendingCount()
+	c.JSON(http.StatusOK, gin.H{
+		"reports":       list,
+		"total":         total,
+		"page":          page,
+		"pending_count": pending,
+		"status":        status,
+	})
+}
+
+// APIAdminHandleReport 处理举报
+func (h *Handlers) APIAdminHandleReport(c *gin.Context) {
+	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
+	var req struct {
+		Action       string `json:"action"`
+		HandleNote   string `json:"handle_note"`
+		RejectReason string `json:"reject_reason"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "参数错误"})
+		return
+	}
+	rep, err := h.Report.Handle(service.HandleReportInput{
+		ReportID:     uint(id),
+		HandlerID:    h.currentUserID(c),
+		Action:       req.Action,
+		HandleNote:   req.HandleNote,
+		RejectReason: req.RejectReason,
+	})
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"message": "处理完成", "report": rep})
+}
+
+// APIAdminApprovePost 通过帖子审核
+func (h *Handlers) APIAdminApprovePost(c *gin.Context) {
+	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err := h.Post.SetStatus(uint(id), model.ContentStatusPublished); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"message": "帖子已通过审核", "status": model.ContentStatusPublished})
+}
+
+// APIAdminRejectPost 拒绝帖子并私信通知作者（标记为 rejected，不进回收站）
+func (h *Handlers) APIAdminRejectPost(c *gin.Context) {
+	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
+	var req struct {
+		Reason string `json:"reason"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "参数错误"})
+		return
+	}
+	reason := strings.TrimSpace(req.Reason)
+	if reason == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "请填写拒绝原因"})
+		return
+	}
+
+	post, err := h.Post.FindByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	authorID := post.UserID
+	title := post.Title
+	postID := post.ID
+
+	if err := h.Post.SetStatus(postID, model.ContentStatusRejected); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	pid := postID
+	_, msgErr := h.Message.SendSystem(
+		authorID,
+		"帖子《"+title+"》未通过审核",
+		service.FormatRejectContent(title, postID, reason),
+		model.MessageKindReject,
+		&pid,
+		nil,
+	)
+	if msgErr != nil {
+		c.JSON(http.StatusOK, gin.H{
+			"message":  "帖子已拒绝，但私信通知失败：" + msgErr.Error(),
+			"notified": false,
+			"status":   model.ContentStatusRejected,
+		})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"message":  "已拒绝该帖并私信通知作者",
+		"notified": true,
+		"status":   model.ContentStatusRejected,
+	})
+}

handler/seo.go

@@ -0,0 +1,530 @@
+package handler
+
+import (
+	"encoding/json"
+	"net/http"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"git.iioio.com/freefire/jiang13-forum/embed_static"
+	"git.iioio.com/freefire/jiang13-forum/model"
+	"git.iioio.com/freefire/jiang13-forum/service"
+)
+
+var (
+	seoPostEditRe  = regexp.MustCompile(`^/post/(\d+)/edit/?$`)
+	seoBoardPathRe = regexp.MustCompile(`^/board/(\d+)/?$`)
+)
+
+const (
+	seoDescMax      = 160
+	seoPrerenderMax = 4000
+	seoSitemapLimit = 5000
+)
+
+// RobotsTxt 搜索引擎抓取规则
+func (h *Handlers) RobotsTxt(c *gin.Context) {
+	base := h.publicBaseURL(c)
+	var b strings.Builder
+	b.WriteString("User-agent: *\n")
+	b.WriteString("Allow: /\n")
+	b.WriteString("Disallow: /api/\n")
+	b.WriteString("Disallow: /admin\n")
+	b.WriteString("Disallow: /compose\n")
+	b.WriteString("Disallow: /login\n")
+	b.WriteString("Disallow: /register\n")
+	b.WriteString("Disallow: /profile\n")
+	b.WriteString("Disallow: /favorites\n")
+	b.WriteString("Disallow: /oauth/\n")
+	b.WriteString("Disallow: /media/\n")
+	b.WriteString("Disallow: /*/edit\n")
+	if base != "" {
+		b.WriteString("\nSitemap: ")
+		b.WriteString(base)
+		b.WriteString("/sitemap.xml\n")
+	}
+	c.Data(http.StatusOK, "text/plain; charset=utf-8", []byte(b.String()))
+}
+
+// SitemapXML 公开页面站点地图
+func (h *Handlers) SitemapXML(c *gin.Context) {
+	base := h.publicBaseURL(c)
+	if base == "" {
+		c.String(http.StatusServiceUnavailable, "未配置站点 ROOT_URL，无法生成 sitemap")
+		return
+	}
+
+	now := time.Now().UTC()
+	urls := []service.SitemapURL{
+		{Loc: base + "/", LastMod: now, ChangeFreq: "hourly", Priority: "1.0"},
+		{Loc: base + "/projects", LastMod: now, ChangeFreq: "daily", Priority: "0.6"},
+	}
+
+	if boards, err := h.Board.List(); err == nil {
+		for _, board := range boards {
+			urls = append(urls, service.SitemapURL{
+				Loc:        base + service.QueryBoardHome(board.ID),
+				LastMod:    board.UpdatedAt.UTC(),
+				ChangeFreq: "daily",
+				Priority:   "0.7",
+			})
+		}
+	}
+
+	permalink := h.Settings.Permalink()
+	if posts, err := h.Post.ListSitemap(seoSitemapLimit); err == nil {
+		for _, p := range posts {
+			lm := p.UpdatedAt
+			if lm.IsZero() {
+				lm = p.CreatedAt
+			}
+			urls = append(urls, service.SitemapURL{
+				Loc:        base + permalink.PostPath(p.ID),
+				LastMod:    lm.UTC(),
+				ChangeFreq: "weekly",
+				Priority:   "0.8",
+			})
+		}
+	}
+
+	if users, err := h.User.ListSitemap(seoSitemapLimit); err == nil {
+		for _, u := range users {
+			urls = append(urls, service.SitemapURL{
+				Loc:        base + permalink.UserPath(u.ID),
+				LastMod:    u.UpdatedAt.UTC(),
+				ChangeFreq: "weekly",
+				Priority:   "0.5",
+			})
+		}
+	}
+
+	var b strings.Builder
+	b.WriteString(`<?xml version="1.0" encoding="UTF-8"?>`)
+	b.WriteString(`<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">`)
+	for _, u := range urls {
+		b.WriteString("<url>")
+		b.WriteString("<loc>")
+		b.WriteString(xmlEscape(u.Loc))
+		b.WriteString("</loc>")
+		if !u.LastMod.IsZero() {
+			b.WriteString("<lastmod>")
+			b.WriteString(u.LastMod.Format("2006-01-02"))
+			b.WriteString("</lastmod>")
+		}
+		if u.ChangeFreq != "" {
+			b.WriteString("<changefreq>")
+			b.WriteString(u.ChangeFreq)
+			b.WriteString("</changefreq>")
+		}
+		if u.Priority != "" {
+			b.WriteString("<priority>")
+			b.WriteString(u.Priority)
+			b.WriteString("</priority>")
+		}
+		b.WriteString("</url>")
+	}
+	b.WriteString("</urlset>")
+	c.Data(http.StatusOK, "application/xml; charset=utf-8", []byte(b.String()))
+}
+
+// ServePublicSPA 公开页入口：
+// - 普通用户：干净 SPA + <head> meta（无正文预渲染，避免刷新闪屏）
+// - 搜索/社交爬虫：服务端 HTML（动态渲染）
+// - 伪静态：按后台配置的后缀做规范 URL，非规范路径 301
+func (h *Handlers) ServePublicSPA(c *gin.Context) {
+	path := c.Request.URL.Path
+
+	if m := seoBoardPathRe.FindStringSubmatch(path); len(m) == 2 {
+		c.Redirect(http.StatusMovedPermanently, "/?board="+m[1])
+		return
+	}
+
+	brand := h.Settings.SiteBranding()
+	base := h.publicBaseURL(c)
+	siteName := strings.TrimSpace(brand.Name)
+	if siteName == "" {
+		siteName = "姜十三论坛"
+	}
+	defaultImage := service.AbsoluteURL(base, brand.DefaultShareImage())
+	siteKeywords := brand.MetaKeywords()
+	permalink := h.Settings.Permalink()
+
+	isBot := service.IsSEOCrawler(c.Request.UserAgent())
+	if isBot {
+		c.Header("Vary", "User-Agent")
+	}
+
+	// 帖子详情（含可选伪静态后缀）
+	if pm := permalink.MatchPostPath(path); pm.OK {
+		if pm.NeedsCanonicalRedirect(path) {
+			c.Redirect(http.StatusMovedPermanently, pm.Canonical)
+			return
+		}
+		post, err := h.Post.FindByID(pm.ID)
+		if err != nil || !service.CanViewPost(post, h.currentUserID(c), h.isAdmin(c)) {
+			h.serveNotFound(c, base, siteName, siteKeywords, path, isBot)
+			return
+		}
+		postKeywords := service.JoinSEOKeywords(post.Board.Name, siteKeywords)
+		if isBot {
+			c.Data(http.StatusOK, "text/html; charset=utf-8", []byte(h.botPostHTML(base, siteName, defaultImage, postKeywords, post)))
+			return
+		}
+		embed_static.ServeSPAWithMeta(c, attachSiteSEO(h.postPageMeta(base, siteName, defaultImage, post), siteName, postKeywords))
+		return
+	}
+
+	// 用户主页
+	if um := permalink.MatchUserPath(path); um.OK {
+		if um.NeedsCanonicalRedirect(path) {
+			c.Redirect(http.StatusMovedPermanently, um.Canonical)
+			return
+		}
+		user, err := h.User.GetByID(um.ID)
+		if err != nil || user.Banned {
+			h.serveNotFound(c, base, siteName, siteKeywords, path, isBot)
+			return
+		}
+		if isBot {
+			c.Data(http.StatusOK, "text/html; charset=utf-8", []byte(h.botUserHTML(base, siteName, defaultImage, siteKeywords, user)))
+			return
+		}
+		embed_static.ServeSPAWithMeta(c, attachSiteSEO(h.userPageMeta(base, siteName, defaultImage, user), siteName, siteKeywords))
+		return
+	}
+
+	// 未知路径 → 404
+	if !isKnownPublicPath(path) {
+		h.serveNotFound(c, base, siteName, siteKeywords, path, isBot)
+		return
+	}
+
+	// 其余已知路由：SPA + head meta；首页对爬虫额外返回可读正文
+	meta := h.buildSPAPageMeta(c, path, brand, base, siteName, defaultImage)
+	if isBot && (path == "/" || path == "") {
+		c.Data(http.StatusOK, "text/html; charset=utf-8", []byte(h.botHomeHTML(meta, brand)))
+		return
+	}
+	embed_static.ServeSPAWithMeta(c, meta)
+}
+
+func (h *Handlers) serveNotFound(c *gin.Context, base, siteName, keywords, path string, isBot bool) {
+	if isBot {
+		c.Header("Vary", "User-Agent")
+		c.Data(http.StatusNotFound, "text/html; charset=utf-8", []byte(botNotFoundHTML(base, siteName, keywords, path)))
+		return
+	}
+	embed_static.ServeSPAWithMeta(c, notFoundPageMeta(base, siteName, keywords, path))
+}
+
+func notFoundPageMeta(base, siteName, keywords, path string) *embed_static.SPAPageMeta {
+	return attachSiteSEO(&embed_static.SPAPageMeta{
+		Title:       pageTitle("页面不存在", siteName),
+		Description: "您访问的页面不存在或已删除",
+		Canonical:   service.AbsoluteURL(base, path),
+		OGType:      "website",
+		Robots:      "noindex,follow",
+		Status:      http.StatusNotFound,
+	}, siteName, keywords)
+}
+
+// attachSiteSEO 填充站点级 keywords / og:site_name / og:locale
+func attachSiteSEO(meta *embed_static.SPAPageMeta, siteName, keywords string) *embed_static.SPAPageMeta {
+	if meta == nil {
+		return nil
+	}
+	meta.SiteName = strings.TrimSpace(siteName)
+	if strings.TrimSpace(meta.Keywords) == "" {
+		meta.Keywords = strings.TrimSpace(keywords)
+	}
+	meta.Locale = "zh_CN"
+	return meta
+}
+
+func isKnownPublicPath(path string) bool {
+	switch path {
+	case "/", "/login", "/register", "/compose", "/profile", "/favorites", "/projects", "/boards":
+		return true
+	}
+	if seoPostEditRe.MatchString(path) {
+		return true
+	}
+	return false
+}
+
+func (h *Handlers) buildSPAPageMeta(c *gin.Context, path string, brand service.SiteBranding, base, siteName, defaultImage string) *embed_static.SPAPageMeta {
+	siteTitle := brand.DocumentTitle()
+	homeDesc := service.TruncateRunes(brand.MetaDescription(), seoDescMax)
+	siteKeywords := brand.MetaKeywords()
+	meta := attachSiteSEO(&embed_static.SPAPageMeta{
+		Title:       siteTitle,
+		Description: homeDesc,
+		Keywords:    siteKeywords,
+		Canonical:   service.AbsoluteURL(base, pathWithQuery(c)),
+		OGType:      "website",
+		OGImage:     defaultImage,
+	}, siteName, siteKeywords)
+
+	if isNoIndexPath(path) {
+		meta.Robots = "noindex,nofollow"
+		meta.Title = pageTitle(pathLabel(path), siteName)
+		return meta
+	}
+
+	if path == "/" || path == "" {
+		boardID, _ := strconv.ParseUint(c.Query("board"), 10, 64)
+		if boardID > 0 {
+			if board, err := h.Board.GetByID(uint(boardID)); err == nil {
+				desc := strings.TrimSpace(board.Description)
+				if desc == "" {
+					desc = brand.MetaDescription()
+				}
+				meta.Title = pageTitle(board.Name, siteName)
+				meta.Description = service.TruncateRunes(desc, seoDescMax)
+				meta.Canonical = service.AbsoluteURL(base, service.QueryBoardHome(board.ID))
+				meta.Keywords = service.JoinSEOKeywords(board.Name, siteKeywords)
+				return meta
+			}
+			// 无效板块 id：仍显示首页，但可标记 noindex
+			meta.Robots = "noindex,follow"
+			return meta
+		}
+		meta.JSONLD = mustJSON(map[string]any{
+			"@context":    "https://schema.org",
+			"@type":       "WebSite",
+			"name":        siteName,
+			"description": meta.Description,
+			"url":         service.AbsoluteURL(base, "/"),
+		})
+	}
+
+	if path == "/projects" {
+		meta.Title = pageTitle("项目", siteName)
+		meta.Description = service.TruncateRunes(siteName+" 的公开项目列表", seoDescMax)
+		meta.Keywords = service.JoinSEOKeywords("项目", siteKeywords)
+	}
+
+	return meta
+}
+
+func (h *Handlers) postPageMeta(base, siteName, defaultImage string, post *model.Post) *embed_static.SPAPageMeta {
+	permalink := h.Settings.Permalink()
+	content := service.RedactMembersOnlyHTML(post.Content)
+	plain := post.ContentPlain
+	if plain == "" {
+		plain = service.StripHTMLForSearch(content)
+	}
+	desc := service.TruncateRunes(plain, seoDescMax)
+	author := service.DisplayName(&post.User)
+	canonical := service.AbsoluteURL(base, permalink.PostPath(post.ID))
+	ogImage := service.AbsoluteURL(base, service.FirstImageURL(content))
+	if ogImage == "" {
+		ogImage = service.AbsoluteURL(base, post.User.Avatar)
+	}
+	if ogImage == "" {
+		ogImage = defaultImage
+	}
+
+	jsonld := map[string]any{
+		"@context":         "https://schema.org",
+		"@type":            "DiscussionForumPosting",
+		"headline":         post.Title,
+		"description":      desc,
+		"datePublished":    post.CreatedAt.UTC().Format(time.RFC3339),
+		"dateModified":     post.UpdatedAt.UTC().Format(time.RFC3339),
+		"url":              canonical,
+		"mainEntityOfPage": canonical,
+		"author": map[string]any{
+			"@type": "Person",
+			"name":  author,
+			"url":   service.AbsoluteURL(base, permalink.UserPath(post.UserID)),
+		},
+		"interactionStatistic": map[string]any{
+			"@type":                "InteractionCounter",
+			"interactionType":      "https://schema.org/ViewAction",
+			"userInteractionCount": post.ViewCount,
+		},
+	}
+	if post.Board.Name != "" {
+		jsonld["articleSection"] = post.Board.Name
+	}
+	if ogImage != "" {
+		jsonld["image"] = []string{ogImage}
+	}
+	body := service.TruncateRunes(plain, seoPrerenderMax)
+	if body != "" {
+		jsonld["articleBody"] = body
+	}
+
+	return &embed_static.SPAPageMeta{
+		Title:       pageTitle(post.Title, siteName),
+		Description: desc,
+		Canonical:   canonical,
+		OGType:      "article",
+		OGImage:     ogImage,
+		JSONLD:      mustJSON(jsonld),
+	}
+}
+
+func (h *Handlers) userPageMeta(base, siteName, defaultImage string, user *model.User) *embed_static.SPAPageMeta {
+	permalink := h.Settings.Permalink()
+	name := service.DisplayName(user)
+	desc := strings.TrimSpace(user.Signature)
+	if desc == "" {
+		desc = name + " 的主页"
+	}
+	desc = service.TruncateRunes(desc, seoDescMax)
+	canonical := service.AbsoluteURL(base, permalink.UserPath(user.ID))
+	ogImage := service.AbsoluteURL(base, user.Avatar)
+	if ogImage == "" {
+		ogImage = defaultImage
+	}
+
+	jsonld := map[string]any{
+		"@context": "https://schema.org",
+		"@type":    "ProfilePage",
+		"url":      canonical,
+		"mainEntity": map[string]any{
+			"@type":       "Person",
+			"name":        name,
+			"description": desc,
+			"url":         canonical,
+		},
+	}
+	if ogImage != "" {
+		jsonld["mainEntity"].(map[string]any)["image"] = ogImage
+	}
+
+	return &embed_static.SPAPageMeta{
+		Title:       pageTitle(name+" 的主页", siteName),
+		Description: desc,
+		Canonical:   canonical,
+		OGType:      "profile",
+		OGImage:     ogImage,
+		JSONLD:      mustJSON(jsonld),
+	}
+}
+
+func (h *Handlers) publicBaseURL(c *gin.Context) string {
+	cfgRoot := ""
+	if h.Cfg != nil {
+		cfgRoot = h.Cfg.RootURL
+	}
+	origin := requestOrigin(c)
+	return h.Settings.SitePublicBaseURL(cfgRoot, origin)
+}
+
+func requestOrigin(c *gin.Context) string {
+	proto := c.GetHeader("X-Forwarded-Proto")
+	if proto == "" {
+		if c.Request.TLS != nil {
+			proto = "https"
+		} else {
+			proto = "http"
+		}
+	}
+	host := c.GetHeader("X-Forwarded-Host")
+	if host == "" {
+		host = c.Request.Host
+	}
+	if host == "" {
+		return ""
+	}
+	return proto + "://" + host
+}
+
+func pathWithQuery(c *gin.Context) string {
+	path := c.Request.URL.Path
+	if path == "" {
+		path = "/"
+	}
+	if q := c.Request.URL.RawQuery; q != "" {
+		// 首页排序/搜索不作为 canonical；板块筛选保留
+		if path == "/" {
+			board := c.Query("board")
+			if board != "" {
+				return service.QueryBoardHome(uint(parseUintOrZero(board)))
+			}
+			return "/"
+		}
+		return path + "?" + q
+	}
+	return path
+}
+
+func parseUintOrZero(s string) uint64 {
+	n, _ := strconv.ParseUint(s, 10, 64)
+	return n
+}
+
+func isNoIndexPath(path string) bool {
+	switch {
+	case path == "/login", path == "/register", path == "/compose",
+		path == "/profile", path == "/favorites":
+		return true
+	case strings.HasPrefix(path, "/admin"):
+		return true
+	case strings.HasSuffix(path, "/edit"):
+		return true
+	default:
+		return false
+	}
+}
+
+func pathLabel(path string) string {
+	switch {
+	case path == "/login":
+		return "登录"
+	case path == "/register":
+		return "注册"
+	case path == "/compose":
+		return "发帖"
+	case path == "/profile":
+		return "个人中心"
+	case path == "/favorites":
+		return "我的收藏"
+	case strings.HasSuffix(path, "/edit"):
+		return "编辑帖子"
+	case strings.HasPrefix(path, "/admin"):
+		return "管理后台"
+	default:
+		return ""
+	}
+}
+
+func pageTitle(page, siteName string) string {
+	page = strings.TrimSpace(page)
+	siteName = strings.TrimSpace(siteName)
+	switch {
+	case page == "" && siteName == "":
+		return "姜十三论坛"
+	case page == "":
+		return siteName
+	case siteName == "":
+		return page
+	default:
+		return page + " - " + siteName
+	}
+}
+
+func mustJSON(v any) string {
+	b, err := json.Marshal(v)
+	if err != nil {
+		return ""
+	}
+	return string(b)
+}
+
+func xmlEscape(s string) string {
+	r := strings.NewReplacer(
+		`&`, "&amp;",
+		`<`, "&lt;",
+		`>`, "&gt;",
+		`"`, "&quot;",
+		`'`, "&apos;",
+	)
+	return r.Replace(s)
+}

handler/seo_bot.go

@@ -0,0 +1,146 @@
+package handler
+
+import (
+	"fmt"
+	"html"
+	"strings"
+	"time"
+
+	"git.iioio.com/freefire/jiang13-forum/embed_static"
+	"git.iioio.com/freefire/jiang13-forum/model"
+	"git.iioio.com/freefire/jiang13-forum/service"
+)
+
+// 爬虫专用伪静态 HTML（无 SPA；仅 User-Agent 命中爬虫时返回，避免用户刷新闪屏）
+
+func renderBotHTML(meta *embed_static.SPAPageMeta, bodyInner string) string {
+	if meta == nil {
+		meta = &embed_static.SPAPageMeta{}
+	}
+	ogType := strings.TrimSpace(meta.OGType)
+	if ogType == "" {
+		ogType = "website"
+	}
+	locale := strings.TrimSpace(meta.Locale)
+	if locale == "" {
+		locale = "zh_CN"
+	}
+	var b strings.Builder
+	b.WriteString("<!DOCTYPE html><html lang=\"zh-CN\"><head>")
+	b.WriteString("<meta charset=\"UTF-8\"/>")
+	b.WriteString("<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\"/>")
+	writeEscapedTag(&b, "title", meta.Title)
+	writeEscapedMeta(&b, "name", "description", meta.Description)
+	writeEscapedMeta(&b, "name", "keywords", meta.Keywords)
+	if meta.Robots != "" {
+		writeEscapedMeta(&b, "name", "robots", meta.Robots)
+	}
+	if meta.Canonical != "" {
+		b.WriteString(`<link rel="canonical" href="` + html.EscapeString(meta.Canonical) + `"/>`)
+	}
+	writeEscapedMeta(&b, "property", "og:type", ogType)
+	writeEscapedMeta(&b, "property", "og:site_name", meta.SiteName)
+	writeEscapedMeta(&b, "property", "og:locale", locale)
+	writeEscapedMeta(&b, "property", "og:title", meta.Title)
+	writeEscapedMeta(&b, "property", "og:description", meta.Description)
+	writeEscapedMeta(&b, "property", "og:url", meta.Canonical)
+	writeEscapedMeta(&b, "property", "og:image", meta.OGImage)
+	card := "summary"
+	if strings.TrimSpace(meta.OGImage) != "" {
+		card = "summary_large_image"
+	}
+	writeEscapedMeta(&b, "name", "twitter:card", card)
+	writeEscapedMeta(&b, "name", "twitter:title", meta.Title)
+	writeEscapedMeta(&b, "name", "twitter:description", meta.Description)
+	writeEscapedMeta(&b, "name", "twitter:image", meta.OGImage)
+	if meta.JSONLD != "" {
+		b.WriteString(`<script type="application/ld+json">`)
+		b.WriteString(meta.JSONLD)
+		b.WriteString(`</script>`)
+	}
+	b.WriteString(`<style>
+body{font-family:system-ui,sans-serif;line-height:1.6;max-width:800px;margin:24px auto;padding:0 16px;color:#222}
+a{color:#2d6a4f}img{max-width:100%;height:auto}
+.meta{color:#666;font-size:14px;margin:8px 0 20px}
+.nav{margin:32px 0;font-size:14px}
+</style>`)
+	b.WriteString("</head><body>")
+	b.WriteString(bodyInner)
+	b.WriteString(`<p class="nav"><a href="/">← 返回首页</a></p>`)
+	b.WriteString("</body></html>")
+	return b.String()
+}
+
+func writeEscapedTag(b *strings.Builder, tag, text string) {
+	text = strings.TrimSpace(text)
+	if text == "" {
+		return
+	}
+	b.WriteString("<" + tag + ">" + html.EscapeString(text) + "</" + tag + ">")
+}
+
+func writeEscapedMeta(b *strings.Builder, attr, key, content string) {
+	content = strings.TrimSpace(content)
+	if content == "" {
+		return
+	}
+	b.WriteString("<meta " + attr + "=\"" + html.EscapeString(key) + "\" content=\"" + html.EscapeString(content) + "\"/>")
+}
+
+func (h *Handlers) botHomeHTML(meta *embed_static.SPAPageMeta, brand service.SiteBranding) string {
+	name := strings.TrimSpace(brand.Name)
+	if name == "" {
+		name = "姜十三论坛"
+	}
+	intro := brand.MetaDescription()
+	if intro == "" {
+		intro = brand.Slogan
+	}
+	var body strings.Builder
+	body.WriteString("<h1>" + html.EscapeString(name) + "</h1>")
+	if intro != "" {
+		body.WriteString("<p>" + html.EscapeString(intro) + "</p>")
+	}
+	body.WriteString(`<p><a href="/projects">浏览项目</a></p>`)
+	return renderBotHTML(meta, body.String())
+}
+
+func (h *Handlers) botPostHTML(base, siteName, defaultImage, keywords string, post *model.Post) string {
+	meta := attachSiteSEO(h.postPageMeta(base, siteName, defaultImage, post), siteName, keywords)
+	content := service.RedactMembersOnlyHTML(post.Content)
+	author := service.DisplayName(&post.User)
+	var body strings.Builder
+	body.WriteString("<article>")
+	body.WriteString("<h1>" + html.EscapeString(post.Title) + "</h1>")
+	body.WriteString(`<p class="meta">`)
+	body.WriteString(html.EscapeString(author))
+	body.WriteString(" · ")
+	body.WriteString(html.EscapeString(post.CreatedAt.Local().Format("2006-01-02 15:04")))
+	if post.Board.Name != "" {
+		body.WriteString(" · ")
+		body.WriteString(html.EscapeString(post.Board.Name))
+	}
+	body.WriteString("</p>")
+	body.WriteString(content)
+	body.WriteString("</article>")
+	return renderBotHTML(meta, body.String())
+}
+
+func (h *Handlers) botUserHTML(base, siteName, defaultImage, keywords string, user *model.User) string {
+	meta := attachSiteSEO(h.userPageMeta(base, siteName, defaultImage, user), siteName, keywords)
+	name := service.DisplayName(user)
+	sig := strings.TrimSpace(user.Signature)
+	var body strings.Builder
+	body.WriteString("<h1>" + html.EscapeString(name) + " 的主页</h1>")
+	if sig != "" {
+		body.WriteString("<p>" + html.EscapeString(sig) + "</p>")
+	}
+	body.WriteString(fmt.Sprintf(`<p class="meta">加入于 %s</p>`, html.EscapeString(user.CreatedAt.Local().Format(time.DateOnly))))
+	return renderBotHTML(meta, body.String())
+}
+
+func botNotFoundHTML(base, siteName, keywords, path string) string {
+	meta := notFoundPageMeta(base, siteName, keywords, path)
+	body := `<h1>页面不存在</h1><p>您访问的页面不存在或已删除。</p>`
+	return renderBotHTML(meta, body)
+}

handler/thumb.go

@@ -11,7 +11,7 @@ import (
 )
 
 // ServeImageThumb 帖子图片缩略图（按需生成并缓存）
-// GET /media/thumb/posts/xxx.jpg → 最长边 1280 的 JPEG 预览
+// GET /media/thumb/posts/xxx.webp → 最长边 1280 的 WebP 预览
 func (h *Handlers) ServeImageThumb(c *gin.Context) {
 	rel := strings.TrimPrefix(c.Param("filepath"), "/")
 	uploadsRoot := filepath.Join(h.Cfg.DataDir, "uploads")