fix(security): security audit fixes for API vulnerabilities

Security fixes:
- Fix sensitive data exposure: UserResponse no longer contains email/phone
- Add UserSelfResponse for authenticated user's own data
- Protect Gorse endpoints with admin role requirement
- Add rate limiting (10 req/min) to auth endpoints
- Fix CORS configuration to use allowed origins list
- Add pagination parameter validation (max 100 per page)

Changes:
- dto/dto.go: Add UserSelfResponse type
- dto/user_converter.go: Add ConvertUserToSelfResponse
- handler/user_handler.go: Use secure response types
- middleware/cors.go: Implement origin whitelist
- middleware/ratelimit.go: Enhance rate limiter
- router/router.go: Add auth rate limit, protect Gorse
- service/admin_*.go: Use ConvertUserToResponse

internal/handler/gorse_handler.go

@@ -77,13 +77,10 @@ func (h *GorseHandler) ImportData(c *gin.Context) {
 // GetStatus 获取Gorse状态
 // GET /api/v1/gorse/status
 func (h *GorseHandler) GetStatus(c *gin.Context) {
-	// 返回Gorse连接状态和配置信息
 	hasPassword := h.importPassword != ""
 	response.Success(c, gin.H{
 		"enabled":      h.gorseConfig.Enabled,
 		"has_password": hasPassword,
-		"address":      h.gorseConfig.Address,
-		"api_key":      strings.Repeat("*", 8), // 不返回实际APIKey
 	})
 }