feat: opaque session、安装/发帖 SSR 与最小 Admin 后台

浏览器登录改为 DB sessions（可吊销）；敏感词与 OIDC PEM 入 settings；
落地安装向导、注册发帖与 /admin 仪表盘/板块/审核/设置。

Co-authored-by: Cursor <cursoragent@cursor.com>

services/content_gate.go

@@ -0,0 +1,21 @@
+package services
+
+import "git.iioio.com/freefire/jiang13-forum/models"
+
+// ApplyPostContentGates 按观众身份对帖文 HTML 做门控遮盖（消毒 + members/reply/points）
+func ApplyPostContentGates(content string, post *models.Post, viewerID uint, isAdmin bool, hasReplied bool) string {
+	content = SanitizePostHTML(content)
+	if viewerID == 0 {
+		content = RedactMembersOnlyHTML(content)
+		content = RedactReplyOnlyHTML(content)
+	} else if !isAdmin && post.UserID != viewerID && !hasReplied {
+		content = RedactReplyOnlyHTML(content)
+	}
+	if isAdmin || post.UserID == viewerID {
+		content = RevealAllPointsOnly(content)
+	} else {
+		unlocked, _ := ListUnlockedKeys(viewerID, post.ID)
+		content = RedactPointsOnlyHTML(content, unlocked)
+	}
+	return content
+}