feat: 交付官方 Docker 运行时，外观改背景图并下线自定义 CSS/JS

站点/后台分轨背景与用户列表排序一并落地；生产 CORS 改走 SITE_URL，健康检查带版本号。

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/service/setting.go

@@ -49,10 +49,6 @@ const (
 	SettingKeyAttachmentMaxCount = "attachment_max_count"
 	// SettingKeyImageMaxMB 正文插图上限（MB）；缺行=5
 	SettingKeyImageMaxMB = "image_max_mb"
-	// SettingKeyCustomCSS 全站自定义 CSS（外观页注入，空=无）
-	SettingKeyCustomCSS = "custom_css"
-	// SettingKeyCustomJS 全站自定义 JS（外观页注入，空=无）
-	SettingKeyCustomJS = "custom_js"
 )
 
 const (
@@ -74,9 +70,6 @@ const (
 	MinAttachmentMaxCount     = 1
 	MaxAttachmentMaxCount     = 20
 	MaxAttachmentExtCount     = 80
-
-	MaxCustomCSSRunes = 48000
-	MaxCustomJSRunes  = 48000
 )
 
 // DefaultAttachmentExts 论坛向默认允许扩展名（含安装包/脚本/网页）
@@ -122,8 +115,10 @@ type PublicSiteSettings struct {
 	AttachmentMaxMB      int      `json:"attachment_max_mb"`
 	AttachmentMaxCount   int      `json:"attachment_max_count"`
 	ImageMaxMB           int      `json:"image_max_mb"`
-	CustomCSS            string   `json:"custom_css"`
-	CustomJS             string   `json:"custom_js"`
+	BgSiteURL            string   `json:"bg_site_url"`
+	BgSiteMode           string   `json:"bg_site_mode"`
+	BgAdminURL           string   `json:"bg_admin_url"`
+	BgAdminMode          string   `json:"bg_admin_mode"`
 }
 
 // SettingService 站点级键值设置
@@ -198,6 +193,8 @@ func (s *SettingService) Public() (PublicSiteSettings, error) {
 		AttachmentMaxMB:      DefaultAttachmentMaxMB,
 		AttachmentMaxCount:   DefaultAttachmentMaxCount,
 		ImageMaxMB:           DefaultImageMaxMB,
+		BgSiteMode:           DefaultBgMode,
+		BgAdminMode:          DefaultBgMode,
 	}
 	accent, err := s.AccentColor()
 	if err != nil {
@@ -326,17 +323,26 @@ func (s *SettingService) Public() (PublicSiteSettings, error) {
 	}
 	out.ImageMaxMB = imgMB
 
-	css, err := s.CustomCSS()
+	siteURL, err := s.BgSiteURL()
 	if err != nil {
 		return out, err
 	}
-	out.CustomCSS = css
-
-	js, err := s.CustomJS()
+	out.BgSiteURL = siteURL
+	siteMode, err := s.BgSiteMode()
 	if err != nil {
 		return out, err
 	}
-	out.CustomJS = js
+	out.BgSiteMode = siteMode
+	adminURL, err := s.BgAdminURL()
+	if err != nil {
+		return out, err
+	}
+	out.BgAdminURL = adminURL
+	adminMode, err := s.BgAdminMode()
+	if err != nil {
+		return out, err
+	}
+	out.BgAdminMode = adminMode
 	return out, nil
 }
 
@@ -788,65 +794,3 @@ func (s *SettingService) ImageMaxBytes() (int64, error) {
 	}
 	return int64(mb) << 20, nil
 }
-
-func sanitizeCustomSnippet(s, closer string, maxRunes int) (string, error) {
-	s = strings.TrimSpace(s)
-	if strings.ContainsRune(s, 0) {
-		return "", ErrInvalidSiteSetting
-	}
-	if utf8.RuneCountInString(s) > maxRunes {
-		return "", ErrInvalidSiteSetting
-	}
-	if closer != "" && strings.Contains(strings.ToLower(s), closer) {
-		return "", ErrInvalidSiteSetting
-	}
-	return s, nil
-}
-
-// CustomCSS 全站自定义 CSS。缺行/空=无。
-func (s *SettingService) CustomCSS() (string, error) {
-	v, found, err := s.getValue(SettingKeyCustomCSS)
-	if err != nil || !found {
-		return "", err
-	}
-	out, nerr := sanitizeCustomSnippet(v, "</style", MaxCustomCSSRunes)
-	if nerr != nil {
-		return "", nil
-	}
-	return out, nil
-}
-
-func (s *SettingService) SetCustomCSS(css string) error {
-	normalized, err := sanitizeCustomSnippet(css, "</style", MaxCustomCSSRunes)
-	if err != nil {
-		return err
-	}
-	if normalized == "" {
-		return s.deleteKey(SettingKeyCustomCSS)
-	}
-	return s.putValue(SettingKeyCustomCSS, normalized)
-}
-
-// CustomJS 全站自定义 JS。缺行/空=无。
-func (s *SettingService) CustomJS() (string, error) {
-	v, found, err := s.getValue(SettingKeyCustomJS)
-	if err != nil || !found {
-		return "", err
-	}
-	out, nerr := sanitizeCustomSnippet(v, "</script", MaxCustomJSRunes)
-	if nerr != nil {
-		return "", nil
-	}
-	return out, nil
-}
-
-func (s *SettingService) SetCustomJS(js string) error {
-	normalized, err := sanitizeCustomSnippet(js, "</script", MaxCustomJSRunes)
-	if err != nil {
-		return err
-	}
-	if normalized == "" {
-		return s.deleteKey(SettingKeyCustomJS)
-	}
-	return s.putValue(SettingKeyCustomJS, normalized)
-}