feat: opaque session、安装/发帖 SSR 与最小 Admin 后台

浏览器登录改为 DB sessions（可吊销）；敏感词与 OIDC PEM 入 settings；
落地安装向导、注册发帖与 /admin 仪表盘/板块/审核/设置。

Co-authored-by: Cursor <cursoragent@cursor.com>

templates/base/navbar.tmpl

@@ -0,0 +1,27 @@
+{{define "base/navbar"}}
+  <header class="j13-header">
+    <div class="j13-header__inner">
+      <a class="j13-brand" href="/">
+        <span class="j13-brand__mark">{{.LogoMark}}</span>
+        <span class="j13-brand__text">
+          <strong>{{.SiteName}}</strong>
+          {{if .Slogan}}<span class="j13-brand__slogan">{{.Slogan}}</span>{{end}}
+        </span>
+      </a>
+      <nav class="j13-nav">
+        {{if .LoggedIn}}
+          <a href="/compose">发帖</a>
+          <a href="/profile">{{.ViewerName}}</a>
+          {{if .IsAdmin}}<a href="/admin/dashboard">后台</a>{{end}}
+          <form class="j13-inline-form" method="post" action="/logout">
+            <input type="hidden" name="_csrf" value="{{.CSRF}}"/>
+            <button type="submit" class="j13-linkbtn">退出</button>
+          </form>
+        {{else}}
+          <a href="/register">注册</a>
+          <a href="/login">登录</a>
+        {{end}}
+      </nav>
+    </div>
+  </header>
+{{end}}