fix(security): security audit fixes for API vulnerabilities

Security fixes:
- Fix sensitive data exposure: UserResponse no longer contains email/phone
- Add UserSelfResponse for authenticated user's own data
- Protect Gorse endpoints with admin role requirement
- Add rate limiting (10 req/min) to auth endpoints
- Fix CORS configuration to use allowed origins list
- Add pagination parameter validation (max 100 per page)

Changes:
- dto/dto.go: Add UserSelfResponse type
- dto/user_converter.go: Add ConvertUserToSelfResponse
- handler/user_handler.go: Use secure response types
- middleware/cors.go: Implement origin whitelist
- middleware/ratelimit.go: Enhance rate limiter
- router/router.go: Add auth rate limit, protect Gorse
- service/admin_*.go: Use ConvertUserToResponse

internal/handler/post_handler.go

@@ -147,8 +147,9 @@ func (h *PostHandler) RecordView(c *gin.Context) {
 func (h *PostHandler) List(c *gin.Context) {
 	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
 	pageSize, _ := strconv.Atoi(c.DefaultQuery("page_size", "20"))
+	page, pageSize = normalizePagination(page, pageSize)
 	userID := c.Query("user_id")
-	tab := c.Query("tab") // recommend, follow, hot, latest
+	tab := c.Query("tab")
 
 	// 获取当前用户ID
 	currentUserID := c.GetString("user_id")
@@ -416,6 +417,7 @@ func (h *PostHandler) GetUserPosts(c *gin.Context) {
 	userID := c.Param("id")
 	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
 	pageSize, _ := strconv.Atoi(c.DefaultQuery("page_size", "20"))
+	page, pageSize = normalizePagination(page, pageSize)
 
 	currentUserID := c.GetString("user_id")
 	includePending := currentUserID != "" && currentUserID == userID
@@ -443,6 +445,7 @@ func (h *PostHandler) GetFavorites(c *gin.Context) {
 	userID := c.Param("id")
 	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
 	pageSize, _ := strconv.Atoi(c.DefaultQuery("page_size", "20"))
+	page, pageSize = normalizePagination(page, pageSize)
 
 	posts, total, err := h.postService.GetFavorites(c.Request.Context(), userID, page, pageSize)
 	if err != nil {
@@ -469,6 +472,7 @@ func (h *PostHandler) Search(c *gin.Context) {
 	keyword := c.Query("keyword")
 	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
 	pageSize, _ := strconv.Atoi(c.DefaultQuery("page_size", "20"))
+	page, pageSize = normalizePagination(page, pageSize)
 
 	posts, total, err := h.postService.Search(c.Request.Context(), keyword, page, pageSize)
 	if err != nil {