fix(security): security audit fixes for API vulnerabilities

Security fixes:
- Fix sensitive data exposure: UserResponse no longer contains email/phone
- Add UserSelfResponse for authenticated user's own data
- Protect Gorse endpoints with admin role requirement
- Add rate limiting (10 req/min) to auth endpoints
- Fix CORS configuration to use allowed origins list
- Add pagination parameter validation (max 100 per page)

Changes:
- dto/dto.go: Add UserSelfResponse type
- dto/user_converter.go: Add ConvertUserToSelfResponse
- handler/user_handler.go: Use secure response types
- middleware/cors.go: Implement origin whitelist
- middleware/ratelimit.go: Enhance rate limiter
- router/router.go: Add auth rate limit, protect Gorse
- service/admin_*.go: Use ConvertUserToResponse

internal/service/admin_group_service.go

@@ -119,18 +119,7 @@ func (s *adminGroupServiceImpl) GetGroupDetail(ctx context.Context, groupID stri
 	if group.OwnerID != "" {
 		owner, err := s.userRepo.GetByID(group.OwnerID)
 		if err == nil && owner != nil {
-			response.Owner = &dto.UserResponse{
-				ID:        owner.ID,
-				Username:  owner.Username,
-				Nickname:  owner.Nickname,
-				Email:     owner.Email,
-				Phone:     owner.Phone,
-				Avatar:    owner.Avatar,
-				Bio:       owner.Bio,
-				Website:   owner.Website,
-				Location:  owner.Location,
-				CreatedAt: dto.FormatTime(owner.CreatedAt),
-			}
+			response.Owner = dto.ConvertUserToResponse(owner)
 		}
 	}