完善站点运营设置：分路由管理、登录可见评论、邮件模板内联与关闭注册 SSR。

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/handler/post.go

@@ -1,11 +1,14 @@
 package handler
 
 import (
+	"context"
 	"errors"
+	"io"
 	"net/http"
 	"net/url"
 	"path/filepath"
 	"strconv"
+	"time"
 
 	"github.com/freefire/jiang13-bbs/middleware"
 	"github.com/freefire/jiang13-bbs/model"
@@ -446,6 +449,20 @@ func (h *Handlers) DownloadPostAttachment(c *gin.Context) {
 		ct = "application/octet-stream"
 	}
 	c.Header("Content-Type", ct)
+	if att.ObjectID != "" {
+		ctx, cancel := context.WithTimeout(c.Request.Context(), 60*time.Second)
+		defer cancel()
+		r, _, err := h.Ops.OpenObject(ctx, att.ObjectID, false)
+		if err != nil {
+			c.JSON(503, gin.H{"error": "文件暂不可用"})
+			return
+		}
+		defer r.Close()
+		c.Header("Cache-Control", "private, no-store")
+		c.Status(200)
+		_, _ = io.Copy(c.Writer, r)
+		return
+	}
 	c.File(path)
 	_ = filepath.Base(path)
 }