feat: 交付官方 Docker 运行时，外观改背景图并下线自定义 CSS/JS

站点/后台分轨背景与用户列表排序一并落地；生产 CORS 改走 SITE_URL，健康检查带版本号。

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/service/admin_user_sort_test.go

@@ -0,0 +1,46 @@
+package service
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/freefire/jiang13-bbs/model"
+)
+
+func TestAdminUserOrderSQLDefault(t *testing.T) {
+	got := adminUserOrderSQL("", "")
+	if got != "users.id DESC" {
+		t.Fatalf("默认排序应为 id DESC，得到 %q", got)
+	}
+	if adminUserOrderSQL("unknown", "drop table") != "users.id DESC" {
+		t.Fatalf("非法 sort/dir 必须回落到 id DESC")
+	}
+}
+
+func TestAdminUserOrderSQLWhitelist(t *testing.T) {
+	cases := []struct {
+		sort, dir, wantSub string
+		asc                bool
+	}{
+		{"id", "asc", "users.id ASC", true},
+		{"points", "desc", "users.points DESC, users.id DESC", false},
+		{"status", "ASC", "users.banned ASC, users.id DESC", true},
+		{"created_at", "", "users.created_at DESC, users.id DESC", false},
+		{"online", "asc", "users.last_seen_at ASC NULLS LAST", true},
+		{"last_login", "desc", "FROM login_logs", false},
+		{"role", "asc", "WHEN 'owner' THEN 100", true},
+		{"counts", "desc", "posts.status = '" + model.ContentStatusPublished + "'", false},
+	}
+	for _, tc := range cases {
+		got := adminUserOrderSQL(tc.sort, tc.dir)
+		if !strings.Contains(got, tc.wantSub) {
+			t.Fatalf("sort=%s dir=%s 应包含 %q，得到 %q", tc.sort, tc.dir, tc.wantSub, got)
+		}
+		if strings.ContainsAny(tc.sort+tc.dir, ";") {
+			t.Fatalf("用例本身不应含注入字符")
+		}
+		if tc.asc && !strings.Contains(got, "ASC") {
+			t.Fatalf("sort=%s 应为 ASC：%q", tc.sort, got)
+		}
+	}
+}