feat(hide): 密码可见隐藏块，发帖双栏预览与门禁体验修复

增加密码解锁与游客签名 cookie；发帖页对齐 1440 并默认双栏预览；修复 locked 解析、按钮对比度与回复聚焦。

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/markdown/hide_test.go

@@ -111,6 +111,56 @@ func TestCodeInsideHide(t *testing.T) {
 	}
 }
 
+func TestParsePasswordAndSanitize(t *testing.T) {
+	src := "公开\n\n:::hide password secret1\n密码内容\n:::\n"
+	blocks, err := ParseHideBlocks(src)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(blocks) != 1 || blocks[0].Kind != HideKindPassword || blocks[0].Password != "secret1" {
+		t.Fatalf("%+v", blocks)
+	}
+	d := DeriveAccess(blocks)
+	if d.Access != "password" {
+		t.Fatalf("access=%s", d.Access)
+	}
+	out, fully := SanitizeForViewer(src, ViewerCaps{})
+	if fully {
+		t.Fatal("public visible")
+	}
+	if strings.Contains(out, "secret1") || strings.Contains(out, "密码内容") {
+		t.Fatalf("leaked: %q", out)
+	}
+	if !strings.Contains(out, ":::hide password locked") {
+		t.Fatalf("%q", out)
+	}
+	out2, _ := SanitizeForViewer(src, ViewerCaps{PasswordUnlocked: map[int]bool{0: true}})
+	if !strings.Contains(out2, "密码内容") {
+		t.Fatalf("unlock failed: %q", out2)
+	}
+	if strings.Contains(out2, "secret1") {
+		t.Fatalf("password leaked after unlock: %q", out2)
+	}
+}
+
+func TestMatchPasswordBlocks(t *testing.T) {
+	src := ":::hide password aaa\nA\n:::\n\n:::hide password bbb\nB\n:::\n"
+	hit, err := MatchPasswordBlocks(src, "bbb")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(hit) != 1 || hit[0] != 1 {
+		t.Fatalf("%v", hit)
+	}
+}
+
+func TestPasswordNeed(t *testing.T) {
+	_, err := ParseHideBlocks(":::hide password\n无密码\n:::\n")
+	if err != ErrHidePasswordNeed {
+		t.Fatalf("got %v", err)
+	}
+}
+
 func TestWrapContentAsHide(t *testing.T) {
 	got := WrapContentAsHide("points", 20, "旧正文")
 	if !strings.HasPrefix(got, ":::hide points 20\n") {