feat(admin): 用户主页增加封禁与改角色快捷菜单

超管/站长可在他人主页就地管理账号；待审评论支持拒绝；角色弹窗前后台共用。

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/handler/user.go

@@ -108,17 +108,23 @@ func (h *Handlers) UserProfile(c *gin.Context) {
 		boardIDs = []uint{}
 	}
 
+	userPayload := gin.H{
+		"id":         user.ID,
+		"username":   user.Username,
+		"nickname":   user.Nickname,
+		"avatar":     user.Avatar,
+		"signature":  user.Signature,
+		"role":       user.Role,
+		"board_ids":  boardIDs,
+		"created_at": user.CreatedAt,
+	}
+	// 仅对具备用户管理权限的访客下发封禁态（避免信息公开）
+	if actor != nil && actor.HasPerm(service.PermUsers) {
+		userPayload["banned"] = user.Banned
+	}
+
 	c.JSON(http.StatusOK, gin.H{
-		"user": gin.H{
-			"id":         user.ID,
-			"username":   user.Username,
-			"nickname":   user.Nickname,
-			"avatar":     user.Avatar,
-			"signature":  user.Signature,
-			"role":       user.Role,
-			"board_ids":  boardIDs,
-			"created_at": user.CreatedAt,
-		},
+		"user": userPayload,
 		"stats": gin.H{
 			"post_count":    postCount,
 			"comment_count": commentCount,