feat: 帖子收藏与用户关注

- 新增收藏功能：favorite 服务与 handler、FavoriteButton 组件
- 新增关注功能：follow 服务与 handler、FollowButton 组件
- 用户主页适配关注/粉丝与收藏展示
- flash 消息工具、广告与侧边栏组件微调

backend/handler/user.go

@@ -62,6 +62,7 @@ func (h *Handlers) UserProfile(c *gin.Context) {
 
 	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
 	size, _ := strconv.Atoi(c.DefaultQuery("size", "20"))
+	sort := c.DefaultQuery("sort", "new")
 
 	var viewerID uint
 	var actor *service.Actor
@@ -72,7 +73,7 @@ func (h *Handlers) UserProfile(c *gin.Context) {
 		}
 	}
 
-	posts, postsTotal, err := h.Post.ListByUser(user.ID, viewerID, actor, page, size)
+	posts, postsTotal, err := h.Post.ListByUser(user.ID, viewerID, actor, page, size, sort)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -91,6 +92,9 @@ func (h *Handlers) UserProfile(c *gin.Context) {
 
 	postCount, _ := h.Post.CountByUser(user.ID)
 	commentCount, _ := h.Comment.CountByUser(user.ID)
+	favoriteCount := h.Favorite.CountByUser(user.ID)
+	followingCount := h.Follow.CountFollowing(user.ID)
+	isFollowing := viewerID > 0 && viewerID != user.ID && h.Follow.IsFollowing(viewerID, user.ID)
 
 	// 签到积分概览（失败不阻塞资料返回）
 	pointsTotal, streak := 0, 0
@@ -124,6 +128,12 @@ func (h *Handlers) UserProfile(c *gin.Context) {
 	if actor != nil && actor.HasPerm(service.PermUsers) {
 		userPayload["banned"] = user.Banned
 	}
+	// 访客与该用户的关注关系（关注按钮初始态）
+	userPayload["is_following"] = isFollowing
+	// 邮箱仅本人可见，打码展示（j***@163.com）
+	if viewerID == user.ID && user.Email != "" {
+		userPayload["email"] = maskEmail(user.Email)
+	}
 	// 徽章墙（失败不阻塞资料返回）
 	if h.Badge != nil {
 		if badges, err := h.Badge.ForUser(user.ID); err == nil && badges != nil {
@@ -134,10 +144,12 @@ func (h *Handlers) UserProfile(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{
 		"user": userPayload,
 		"stats": gin.H{
-			"post_count":    postCount,
-			"comment_count": commentCount,
-			"points":        pointsTotal,
-			"streak":        streak,
+			"post_count":     postCount,
+			"comment_count":  commentCount,
+			"points":         pointsTotal,
+			"streak":         streak,
+			"favorite_count": favoriteCount,
+			"following_count": followingCount,
 		},
 		"posts":       nonNilSlice(posts),
 		"posts_total": postsTotal,
@@ -146,6 +158,21 @@ func (h *Handlers) UserProfile(c *gin.Context) {
 	})
 }
 
+// maskEmail 邮箱打码：保留首字符与 @ 后域名（j***@163.com）
+func maskEmail(email string) string {
+	at := -1
+	for i, r := range email {
+		if r == '@' {
+			at = i
+			break
+		}
+	}
+	if at <= 0 {
+		return "***"
+	}
+	return email[:1] + "***" + email[at:]
+}
+
 // UserComments 获取用户发表的评论列表（分页，含帖子标题）
 func (h *Handlers) UserComments(c *gin.Context) {
 	id, err := strconv.ParseUint(c.Param("id"), 10, 64)