fix(security): security audit fixes for API vulnerabilities

Security fixes:
- Fix sensitive data exposure: UserResponse no longer contains email/phone
- Add UserSelfResponse for authenticated user's own data
- Protect Gorse endpoints with admin role requirement
- Add rate limiting (10 req/min) to auth endpoints
- Fix CORS configuration to use allowed origins list
- Add pagination parameter validation (max 100 per page)

Changes:
- dto/dto.go: Add UserSelfResponse type
- dto/user_converter.go: Add ConvertUserToSelfResponse
- handler/user_handler.go: Use secure response types
- middleware/cors.go: Implement origin whitelist
- middleware/ratelimit.go: Enhance rate limiter
- router/router.go: Add auth rate limit, protect Gorse
- service/admin_*.go: Use ConvertUserToResponse

internal/service/admin_comment_service.go

@@ -135,18 +135,7 @@ func (s *adminCommentServiceImpl) convertCommentToAdminListResponse(comment *mod
 	// 作者信息
 	var author *dto.UserResponse
 	if comment.User != nil {
-		author = &dto.UserResponse{
-			ID:        comment.User.ID,
-			Username:  comment.User.Username,
-			Nickname:  comment.User.Nickname,
-			Email:     comment.User.Email,
-			Phone:     comment.User.Phone,
-			Avatar:    comment.User.Avatar,
-			Bio:       comment.User.Bio,
-			Website:   comment.User.Website,
-			Location:  comment.User.Location,
-			CreatedAt: comment.User.CreatedAt.Format("2006-01-02T15:04:05Z07:00"),
-		}
+		author = dto.ConvertUserToResponse(comment.User)
 	}
 
 	// 帖子简要信息
@@ -197,18 +186,7 @@ func (s *adminCommentServiceImpl) convertCommentToAdminDetailResponse(comment *m
 	// 作者信息
 	var author *dto.UserResponse
 	if comment.User != nil {
-		author = &dto.UserResponse{
-			ID:        comment.User.ID,
-			Username:  comment.User.Username,
-			Nickname:  comment.User.Nickname,
-			Email:     comment.User.Email,
-			Phone:     comment.User.Phone,
-			Avatar:    comment.User.Avatar,
-			Bio:       comment.User.Bio,
-			Website:   comment.User.Website,
-			Location:  comment.User.Location,
-			CreatedAt: comment.User.CreatedAt.Format("2006-01-02T15:04:05Z07:00"),
-		}
+		author = dto.ConvertUserToResponse(comment.User)
 	}
 
 	// 帖子简要信息