fix(security): security audit fixes for API vulnerabilities

Security fixes:
- Fix sensitive data exposure: UserResponse no longer contains email/phone
- Add UserSelfResponse for authenticated user's own data
- Protect Gorse endpoints with admin role requirement
- Add rate limiting (10 req/min) to auth endpoints
- Fix CORS configuration to use allowed origins list
- Add pagination parameter validation (max 100 per page)

Changes:
- dto/dto.go: Add UserSelfResponse type
- dto/user_converter.go: Add ConvertUserToSelfResponse
- handler/user_handler.go: Use secure response types
- middleware/cors.go: Implement origin whitelist
- middleware/ratelimit.go: Enhance rate limiter
- router/router.go: Add auth rate limit, protect Gorse
- service/admin_*.go: Use ConvertUserToResponse

internal/dto/dto.go

@@ -7,8 +7,27 @@ import (
 
 // ==================== User DTOs ====================
 
-// UserResponse 用户信息响应
+// UserResponse 用户公开信息响应（不包含敏感信息）
 type UserResponse struct {
+	ID             string `json:"id"`
+	Username       string `json:"username"`
+	Nickname       string `json:"nickname"`
+	EmailVerified  bool   `json:"email_verified"`
+	Avatar         string `json:"avatar"`
+	CoverURL       string `json:"cover_url"`
+	Bio            string `json:"bio"`
+	Website        string `json:"website"`
+	Location       string `json:"location"`
+	PostsCount     int    `json:"posts_count"`
+	FollowersCount int    `json:"followers_count"`
+	FollowingCount int    `json:"following_count"`
+	IsFollowing    bool   `json:"is_following"`
+	IsFollowingMe  bool   `json:"is_following_me"`
+	CreatedAt      string `json:"created_at"`
+}
+
+// UserSelfResponse 用户自身信息响应（包含敏感信息，仅本人可见）
+type UserSelfResponse struct {
 	ID             string  `json:"id"`
 	Username       string  `json:"username"`
 	Nickname       string  `json:"nickname"`
@@ -16,28 +35,7 @@ type UserResponse struct {
 	Phone          *string `json:"phone,omitempty"`
 	EmailVerified  bool    `json:"email_verified"`
 	Avatar         string  `json:"avatar"`
-	CoverURL       string  `json:"cover_url"` // 头图URL
-	Bio            string  `json:"bio"`
-	Website        string  `json:"website"`
-	Location       string  `json:"location"`
-	PostsCount     int     `json:"posts_count"`
-	FollowersCount int     `json:"followers_count"`
-	FollowingCount int     `json:"following_count"`
-	IsFollowing    bool    `json:"is_following"`    // 当前用户是否关注了该用户
-	IsFollowingMe  bool    `json:"is_following_me"` // 该用户是否关注了当前用户
-	CreatedAt      string  `json:"created_at"`
-}
-
-// UserDetailResponse 用户详情响应
-type UserDetailResponse struct {
-	ID             string  `json:"id"`
-	Username       string  `json:"username"`
-	Nickname       string  `json:"nickname"`
-	Email          *string `json:"email"`
-	EmailVerified  bool    `json:"email_verified"`
-	Phone          *string `json:"phone,omitempty"` // 仅当前用户自己可见
-	Avatar         string  `json:"avatar"`
-	CoverURL       string  `json:"cover_url"` // 头图URL
+	CoverURL       string  `json:"cover_url"`
 	Bio            string  `json:"bio"`
 	Website        string  `json:"website"`
 	Location       string  `json:"location"`
@@ -45,8 +43,28 @@ type UserDetailResponse struct {
 	FollowersCount int     `json:"followers_count"`
 	FollowingCount int     `json:"following_count"`
 	IsVerified     bool    `json:"is_verified"`
-	IsFollowing    bool    `json:"is_following"`    // 当前用户是否关注了该用户
-	IsFollowingMe  bool    `json:"is_following_me"` // 该用户是否关注了当前用户
+	CreatedAt      string  `json:"created_at"`
+}
+
+// UserDetailResponse 用户详情响应（仅本人可见，包含敏感信息）
+type UserDetailResponse struct {
+	ID             string  `json:"id"`
+	Username       string  `json:"username"`
+	Nickname       string  `json:"nickname"`
+	Email          *string `json:"email,omitempty"`
+	EmailVerified  bool    `json:"email_verified"`
+	Phone          *string `json:"phone,omitempty"`
+	Avatar         string  `json:"avatar"`
+	CoverURL       string  `json:"cover_url"`
+	Bio            string  `json:"bio"`
+	Website        string  `json:"website"`
+	Location       string  `json:"location"`
+	PostsCount     int     `json:"posts_count"`
+	FollowersCount int     `json:"followers_count"`
+	FollowingCount int     `json:"following_count"`
+	IsVerified     bool    `json:"is_verified"`
+	IsFollowing    bool    `json:"is_following"`
+	IsFollowingMe  bool    `json:"is_following_me"`
 	CreatedAt      string  `json:"created_at"`
 }