开源前加固认证与部署契约：加密随机 JWT、改密事务吊销、登录 CSRF，并禁止生产回落 localhost。

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/handler/post.go

@@ -538,10 +538,11 @@ func (h *Handlers) ToggleRecommend(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{"recommended": rec})
 }
 
-// requireAdminOrAbove 置顶/加精仅管理员及以上可用；校验失败已写响应，返回 false
+// requireAdminOrAbove 置顶/加精仅管理员及以上可用；以 DB Actor 为准
 func (h *Handlers) requireAdminOrAbove(c *gin.Context) bool {
 	claims := middleware.CurrentUser(c)
-	if model.RoleLevel(model.Role(claims.Role)) < model.RoleLevel(model.RoleAdmin) {
+	actor, err := h.Auth.LoadActor(claims.ID)
+	if err != nil || model.RoleLevel(actor.Role) < model.RoleLevel(model.RoleAdmin) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "仅管理员可操作"})
 		return false
 	}