feat: 类型帖互动、积分经济与发帖体验

补齐问答采纳/重开、投票匿名与有票禁编、悬赏过期退回、抽奖回帖开奖，并接入积分账本与发帖附件可见性。

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/service/upload.go

@@ -5,6 +5,9 @@ import (
 	"crypto/rand"
 	"encoding/hex"
 	"errors"
+	"image"
+	_ "image/jpeg"
+	_ "image/png"
 	"log"
 	"os"
 	"path/filepath"
@@ -20,6 +23,10 @@ const (
 	AvatarMaxBytes = 2 << 20 // 2 MiB
 	AvatarMinDim   = 64
 	AvatarMaxDim   = 512
+
+	// 帖子插图：允许 JPEG/PNG/WebP，不强制转码
+	ImageMaxBytes = 5 << 20 // 5 MiB
+	ImageMaxDim   = 4096
 )
 
 // UploadService 附件上传：落盘到 data/uploads，元信息入库 attachments
@@ -34,7 +41,10 @@ func NewUploadService(db *gorm.DB, uploadDir string) *UploadService {
 
 // EnsureDir 启动时确保上传目录存在
 func (s *UploadService) EnsureDir() error {
-	return os.MkdirAll(filepath.Join(s.dir, "avatars"), 0o755)
+	if err := os.MkdirAll(filepath.Join(s.dir, "avatars"), 0o755); err != nil {
+		return err
+	}
+	return os.MkdirAll(filepath.Join(s.dir, "images"), 0o755)
 }
 
 // SaveAvatar 保存裁剪后的 WebP 头像：校验魔数/大小/尺寸 → 落盘 → 写附件记录 → 更新用户头像
@@ -96,6 +106,89 @@ func (s *UploadService) SaveAvatar(userID uint, data []byte) (*model.Attachment,
 	return att, nil
 }
 
+// imageFormat 由魔数识别的插图格式
+type imageFormat struct {
+	ext  string
+	mime string
+}
+
+func detectImageFormat(data []byte) (imageFormat, error) {
+	if len(data) >= 3 && data[0] == 0xff && data[1] == 0xd8 && data[2] == 0xff {
+		return imageFormat{ext: ".jpg", mime: "image/jpeg"}, nil
+	}
+	if len(data) >= 8 && string(data[0:8]) == "\x89PNG\r\n\x1a\n" {
+		return imageFormat{ext: ".png", mime: "image/png"}, nil
+	}
+	if len(data) >= 12 && string(data[0:4]) == "RIFF" && string(data[8:12]) == "WEBP" {
+		return imageFormat{ext: ".webp", mime: "image/webp"}, nil
+	}
+	return imageFormat{}, errors.New("仅支持 JPEG / PNG / WebP")
+}
+
+func decodeImageSize(data []byte, mime string) (w, h int, err error) {
+	r := bytes.NewReader(data)
+	var cfg image.Config
+	switch mime {
+	case "image/webp":
+		cfg, err = webp.DecodeConfig(r)
+	default:
+		cfg, _, err = image.DecodeConfig(r)
+	}
+	if err != nil {
+		return 0, 0, errors.New("无法解析图片")
+	}
+	return cfg.Width, cfg.Height, nil
+}
+
+// SaveImage 保存帖子插图：校验格式/大小/尺寸 → 落盘 → 写 attachments（kind=image）
+func (s *UploadService) SaveImage(userID uint, data []byte) (*model.Attachment, error) {
+	if len(data) == 0 {
+		return nil, errors.New("文件为空")
+	}
+	if len(data) > ImageMaxBytes {
+		return nil, errors.New("图片不能超过 5MB")
+	}
+	format, err := detectImageFormat(data)
+	if err != nil {
+		return nil, err
+	}
+	w, h, err := decodeImageSize(data, format.mime)
+	if err != nil {
+		return nil, err
+	}
+	if w < 1 || h < 1 {
+		return nil, errors.New("无效的图片尺寸")
+	}
+	if w > ImageMaxDim || h > ImageMaxDim {
+		return nil, errors.New("图片边长不能超过 4096px")
+	}
+
+	nameBytes := make([]byte, 16)
+	if _, err := rand.Read(nameBytes); err != nil {
+		return nil, err
+	}
+	filename := hex.EncodeToString(nameBytes) + format.ext
+	fullPath := filepath.Join(s.dir, "images", filename)
+	if err := os.WriteFile(fullPath, data, 0o644); err != nil {
+		return nil, err
+	}
+
+	att := &model.Attachment{
+		UserID: userID,
+		Kind:   model.AttachmentKindImage,
+		URL:    "/uploads/images/" + filename,
+		MIME:   format.mime,
+		Size:   len(data),
+		Width:  w,
+		Height: h,
+	}
+	if err := s.db.Create(att).Error; err != nil {
+		_ = os.Remove(fullPath)
+		return nil, err
+	}
+	return att, nil
+}
+
 // UseAvatar 选用一张【本人历史上传】的头像
 func (s *UploadService) UseAvatar(userID uint, url string) error {
 	url = strings.TrimSpace(url)