feat: 外观支持自定义 CSS/JS，并升级发帖工作台与积分存量看板

后台可注入全站 CSS/JS（SSR 生效，CSS 可热换）；发帖/编辑改为锁一屏工作室；经济看板增加存量健康度；主题令牌与弹层误关一并收紧。

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/service/custom_code_settings_test.go

@@ -0,0 +1,19 @@
+package service
+
+import "testing"
+
+func TestSanitizeCustomSnippet(t *testing.T) {
+	got, err := sanitizeCustomSnippet("  body{color:red}  ", "</style", MaxCustomCSSRunes)
+	if err != nil || got != "body{color:red}" {
+		t.Fatalf("trim got %q err=%v", got, err)
+	}
+	if _, err = sanitizeCustomSnippet("a</style>b", "</style", MaxCustomCSSRunes); err == nil {
+		t.Fatal("css closer should fail")
+	}
+	if _, err = sanitizeCustomSnippet("a</SCRIPT>b", "</script", MaxCustomJSRunes); err == nil {
+		t.Fatal("js closer should fail")
+	}
+	if _, err = sanitizeCustomSnippet("ok", "</script", MaxCustomJSRunes); err != nil {
+		t.Fatalf("valid js: %v", err)
+	}
+}