feat: 完成头像上传、站点主题配置与UI优化

- 新增附件模型与上传服务，拆分头像上传/管理逻辑
- 重构用户资料接口，移除直接修改头像字段，改用专用上传接口
- 添加站点公开设置API与管理员外观配置页
- 全局替换hover背景为accent-soft，优化交互一致性
- 完善头像组件，支持图片加载失败回退与src更新重置
- 新增用户状态事件总线，解决同页头像更新不及时问题
- 调整依赖包顺序与CI依赖版本
- 重构板块列表接口，新增帖子计数
- 迁移账号设置到用户主页tab，合并重复代码

backend/router/router.go

@@ -1,6 +1,7 @@
 package router
 
 import (
+	"path/filepath"
 	"time"
 
 	"github.com/freefire/jiang13-bbs/config"
@@ -46,6 +47,11 @@ func Setup(cfg *config.Config) (*gin.Engine, error) {
 	overviewSvc := service.NewOverviewService(model.DB)
 	checkinSvc := service.NewCheckinService(model.DB)
 	announcementSvc := service.NewAnnouncementService(model.DB)
+	uploadSvc := service.NewUploadService(model.DB, filepath.Join(cfg.DataDir, "uploads"))
+	settingSvc := service.NewSettingService(model.DB)
+	if err := uploadSvc.EnsureDir(); err != nil {
+		return nil, err
+	}
 	limiter := service.DefaultRateLimiter()
 
 	h := &handler.Handlers{
@@ -59,10 +65,15 @@ func Setup(cfg *config.Config) (*gin.Engine, error) {
 		OverviewSvc:  overviewSvc,
 		Checkin:      checkinSvc,
 		Announcement: announcementSvc,
+		Upload:       uploadSvc,
+		Setting:      settingSvc,
 	}
 
 	authMW := middleware.NewAuthMiddleware(authSvc)
 
+	// 上传文件静态服务（data/uploads → /uploads）
+	r.Static("/uploads", filepath.Join(cfg.DataDir, "uploads"))
+
 	// 健康检查 & SEO
 	r.GET("/health", h.Health)
 	r.GET("/robots.txt", h.RobotsTxt)
@@ -81,6 +92,7 @@ func Setup(cfg *config.Config) (*gin.Engine, error) {
 		pubAPI.GET("/users/:id/comments", h.UserComments)
 		pubAPI.GET("/announcements", h.AnnouncementsList)
 		pubAPI.GET("/announcements/:id", h.AnnouncementDetail)
+		pubAPI.GET("/settings", h.PublicSettings)
 		pubAPI.POST("/register", middleware.RateLimitMiddleware(limiter, service.RateRegister), h.Register)
 		pubAPI.POST("/login", middleware.RateLimitMiddleware(limiter, service.RateLogin), h.Login)
 		// refresh token 端点：access 过期后用 refresh 换新 token（需 CSRF 防护）
@@ -109,6 +121,11 @@ func Setup(cfg *config.Config) (*gin.Engine, error) {
 		// 每日签到
 		api.GET("/checkin", h.GetCheckin)
 		api.POST("/checkin", middleware.RateLimitMiddleware(limiter, service.RateComment), h.DoCheckin)
+		// 头像上传（裁剪后的 WebP）/ 媒体库 / 附件删除
+		api.POST("/upload/avatar", h.UploadAvatar)
+		api.PUT("/avatar/use", h.UseAvatar)
+		api.GET("/my/media", h.MyMedia)
+		api.DELETE("/my/attachments/:id", h.DeleteAttachment)
 	}
 
 	// 管理员 API（同样需要 CSRF 防护）
@@ -122,6 +139,8 @@ func Setup(cfg *config.Config) (*gin.Engine, error) {
 		adminAPI.POST("/announcements", h.AdminCreateAnnouncement)
 		adminAPI.PUT("/announcements/:id", h.AdminUpdateAnnouncement)
 		adminAPI.DELETE("/announcements/:id", h.AdminDeleteAnnouncement)
+		// 站点外观设置（主题色）
+		adminAPI.PUT("/settings", h.UpdateSettings)
 	}
 
 	r.NoRoute(func(c *gin.Context) {