feat: 新增管理员用户管理功能与账号封禁体系

此提交完成了全站管理员后台核心功能开发：
1.  新增AdminUserService与管理接口，支持用户列表查询、角色变更与封禁解封
2.  重构认证链路，统一账号封禁错误码与处理逻辑
3.  新增全局强制下线机制，账号被封禁时自动弹出告知弹窗并清理登录态
4.  重构管理员后台路由与布局，统一权限校验逻辑
5.  优化通知轮询逻辑，页面切回前台时立即刷新未读计数
6.  合并原公告、外观管理页到统一后台面板

backend/handler/admin_user.go

@@ -0,0 +1,111 @@
+package handler
+
+import (
+	"errors"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/freefire/jiang13-bbs/middleware"
+	"github.com/freefire/jiang13-bbs/service"
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+)
+
+// ===== 用户管理（RequireAdmin 兜底，前端不做权限判定） =====
+
+// AdminListUsers 用户分页列表（搜索/角色/状态筛选 + 全站汇总）
+func (h *Handlers) AdminListUsers(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	size, _ := strconv.Atoi(c.DefaultQuery("size", "20"))
+
+	res, err := h.AdminUser.List(service.AdminUserListQuery{
+		Page:    page,
+		Size:    size,
+		Keyword: strings.TrimSpace(c.Query("q")),
+		Role:    c.Query("role"),
+		Status:  c.Query("status"),
+	})
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "获取用户列表失败"})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"users":   res.Users,
+		"total":   res.Total,
+		"page":    res.Page,
+		"size":    res.Size,
+		"summary": res.Summary,
+	})
+}
+
+// adminUserActionBody 角色/封禁变更的通用请求体
+type adminUserRoleBody struct {
+	Role string `json:"role"`
+}
+
+type adminUserBanBody struct {
+	Banned bool `json:"banned"`
+}
+
+// AdminUpdateUserRole 设置用户角色（user / admin）
+func (h *Handlers) AdminUpdateUserRole(c *gin.Context) {
+	id, ok := parseAdminUserID(c)
+	if !ok {
+		return
+	}
+	var body adminUserRoleBody
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "请求参数无效"})
+		return
+	}
+	user, err := h.AdminUser.SetRole(middleware.CurrentUser(c).ID, id, body.Role)
+	if err != nil {
+		respondAdminUserError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"user": user})
+}
+
+// AdminSetUserBan 封禁 / 解封用户
+func (h *Handlers) AdminSetUserBan(c *gin.Context) {
+	id, ok := parseAdminUserID(c)
+	if !ok {
+		return
+	}
+	var body adminUserBanBody
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "请求参数无效"})
+		return
+	}
+	user, err := h.AdminUser.SetBanned(middleware.CurrentUser(c).ID, id, body.Banned)
+	if err != nil {
+		respondAdminUserError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"user": user})
+}
+
+// parseAdminUserID 解析路径中的用户 ID，失败时直接写出 400
+func parseAdminUserID(c *gin.Context) (uint, bool) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil || id == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "无效的用户 ID"})
+		return 0, false
+	}
+	return uint(id), true
+}
+
+// respondAdminUserError 统一映射用户管理业务错误到 HTTP 状态码
+func respondAdminUserError(c *gin.Context, err error) {
+	switch {
+	case errors.Is(err, gorm.ErrRecordNotFound):
+		c.JSON(http.StatusNotFound, gin.H{"error": "用户不存在"})
+	case errors.Is(err, service.ErrAdminSelfAction),
+		errors.Is(err, service.ErrLastAdmin),
+		errors.Is(err, service.ErrInvalidUserRole):
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+	default:
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "操作失败"})
+	}
+}

backend/handler/auth.go

@@ -1,6 +1,7 @@
 package handler
 
 import (
+	"errors"
 	"net/http"
 	"time"
 
@@ -146,6 +147,11 @@ func (h *Handlers) Login(c *gin.Context) {
 	}
 	accessToken, refreshToken, user, err := h.Auth.Login(req.Username, req.Password)
 	if err != nil {
+		// 封禁与凭据错误区分：前端可据此展示针对性提示
+		if errors.Is(err, service.ErrAccountBanned) {
+			c.JSON(http.StatusForbidden, gin.H{"error": err.Error(), "code": "account_banned"})
+			return
+		}
 		c.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
 		return
 	}
@@ -172,6 +178,11 @@ func (h *Handlers) Refresh(c *gin.Context) {
 	accessToken, newRefresh, user, err := h.Auth.RotateRefreshToken(refreshToken)
 	if err != nil {
 		clearAuthCookies(c, !h.Cfg.DevMode)
+		if errors.Is(err, service.ErrAccountBanned) {
+			// 账号已封禁：清 cookie 的同时给出可识别 code，前端弹封禁告知并强制下线
+			c.JSON(http.StatusForbidden, gin.H{"error": "账号已被封禁", "code": "account_banned"})
+			return
+		}
 		c.JSON(http.StatusUnauthorized, gin.H{"error": "登录已过期，请重新登录"})
 		return
 	}
@@ -238,7 +249,14 @@ func meUserBody(user *model.User) gin.H {
 func (h *Handlers) Me(c *gin.Context) {
 	claims := middleware.CurrentUser(c)
 	if claims == nil {
-		c.JSON(http.StatusOK, gin.H{"user": nil, "unread_count": 0})
+		resp := gin.H{"user": nil, "unread_count": 0}
+		// OptionalAuth 识别到封禁：HTTP 仍为 200（/me 不阻断页面），
+		// 但带 banned/code，客户端静默校正时据此强制下线并弹告知
+		if c.GetBool(middleware.AccountBannedKey) {
+			resp["banned"] = true
+			resp["code"] = "account_banned"
+		}
+		c.JSON(http.StatusOK, resp)
 		return
 	}
 	user, err := h.Auth.GetUserByID(claims.ID)

backend/handler/handlers.go

@@ -19,4 +19,5 @@ type Handlers struct {
 	Announcement *service.AnnouncementService
 	Upload       *service.UploadService
 	Setting      *service.SettingService
+	AdminUser    *service.AdminUserService
 }