feat: add hook system, QR code login, and layered cache

- Implement extensible hook system for content moderation with
  builtin and AI-powered moderation hooks
- Add QR code login feature with SSE for real-time status updates
  and scan/confirm/cancel workflow
- Introduce layered cache with local LRU + Redis backend for
  improved read performance
- Refactor post and comment services to use hook-based moderation
  instead of direct AI service calls
- Add local cache configuration options (size, buckets, ttl)

internal/wire/infrastructure.go

@@ -9,11 +9,13 @@ import (
 	"carrot_bbs/internal/pkg/crypto"
 	"carrot_bbs/internal/pkg/email"
 	"carrot_bbs/internal/pkg/gorse"
+	"carrot_bbs/internal/pkg/hook"
 	"carrot_bbs/internal/pkg/openai"
 	"carrot_bbs/internal/pkg/redis"
 	"carrot_bbs/internal/pkg/s3"
 	"carrot_bbs/internal/pkg/sse"
 	"carrot_bbs/internal/repository"
+	"carrot_bbs/internal/service"
 
 	"github.com/google/wire"
 	"go.uber.org/zap"
@@ -38,6 +40,11 @@ var InfrastructureSet = wire.NewSet(
 	ProvideRedisClient,
 	ProvideCache,
 
+	// 钩子系统
+	ProvideHookManager,
+	ProvideBuiltinHooks,
+	ProvideModerationHooks,
+
 	// SSE Hub
 	ProvideSSEHub,
 
@@ -88,7 +95,18 @@ func ProvideCache(cfg *config.Config, redisClient *redis.Client) cache.Cache {
 		DisableFlushDB:  cfg.Cache.DisableFlushDB,
 	})
 
-	// 直接创建 RedisCache 实例，不依赖全局变量
+	if cfg.Cache.Local.Enabled {
+		layeredCache := cache.NewLayeredCache(redisClient, &cache.LayeredCacheOptions{
+			LocalSize:       cfg.Cache.Local.Size,
+			LocalBuckets:    cfg.Cache.Local.Buckets,
+			LocalDefaultTTL: time.Duration(cfg.Cache.Local.DefaultTTL) * time.Second,
+			KeyPrefix:       cfg.Cache.KeyPrefix,
+			Enabled:         cfg.Cache.Enabled,
+		})
+		zap.L().Info("Initialized layered cache (local LRU + Redis)")
+		return layeredCache
+	}
+
 	if redisClient == nil {
 		zap.L().Warn("Redis client is nil, cache will not be available")
 		return nil
@@ -99,6 +117,47 @@ func ProvideCache(cfg *config.Config, redisClient *redis.Client) cache.Cache {
 	return cacheInstance
 }
 
+// ProvideHookManager 提供钩子管理器
+func ProvideHookManager() *hook.Manager {
+	return hook.NewManager(&hook.ManagerOptions{
+		MaxConcurrentAsync: 100,
+		Enabled:            true,
+	})
+}
+
+// ProvideBuiltinHooks 注册内置钩子
+func ProvideBuiltinHooks(manager *hook.Manager) *hook.BuiltinHooks {
+	builtin := hook.NewBuiltinHooks(manager)
+	builtin.RegisterAll()
+	zap.L().Info("Registered builtin hooks")
+	return builtin
+}
+
+// ProvideModerationHooks 注册审核钩子
+func ProvideModerationHooks(
+	manager *hook.Manager,
+	postAIService *service.PostAIService,
+	postRepo *repository.PostRepository,
+	commentRepo *repository.CommentRepository,
+	cfg *config.Config,
+) *hook.ModerationHooks {
+	strictMode := cfg.OpenAI.StrictModeration
+
+	moderationHooks := hook.NewModerationHooks(
+		postAIService,
+		nil,
+		postRepo,
+		commentRepo,
+		strictMode,
+		"***",
+	)
+	moderationHooks.RegisterAll(manager)
+	zap.L().Info("Registered moderation hooks",
+		zap.Bool("strict_mode", strictMode),
+	)
+	return moderationHooks
+}
+
 // ProvideSSEHub 提供 SSE Hub
 func ProvideSSEHub() *sse.Hub {
 	return sse.NewHub()