fix(security): security audit fixes for API vulnerabilities

Security fixes:
- Fix sensitive data exposure: UserResponse no longer contains email/phone
- Add UserSelfResponse for authenticated user's own data
- Protect Gorse endpoints with admin role requirement
- Add rate limiting (10 req/min) to auth endpoints
- Fix CORS configuration to use allowed origins list
- Add pagination parameter validation (max 100 per page)

Changes:
- dto/dto.go: Add UserSelfResponse type
- dto/user_converter.go: Add ConvertUserToSelfResponse
- handler/user_handler.go: Use secure response types
- middleware/cors.go: Implement origin whitelist
- middleware/ratelimit.go: Enhance rate limiter
- router/router.go: Add auth rate limit, protect Gorse
- service/admin_*.go: Use ConvertUserToResponse

internal/service/admin_post_service.go

@@ -274,18 +274,7 @@ func convertPostToAdminListResponse(post *model.Post) dto.AdminPostListResponse
 
 	var author *dto.UserResponse
 	if post.User != nil {
-		author = &dto.UserResponse{
-			ID:        post.User.ID,
-			Username:  post.User.Username,
-			Nickname:  post.User.Nickname,
-			Email:     post.User.Email,
-			Phone:     post.User.Phone,
-			Avatar:    post.User.Avatar,
-			Bio:       post.User.Bio,
-			Website:   post.User.Website,
-			Location:  post.User.Location,
-			CreatedAt: post.User.CreatedAt.Format("2006-01-02T15:04:05Z07:00"),
-		}
+		author = dto.ConvertUserToResponse(post.User)
 	}
 
 	return dto.AdminPostListResponse{
@@ -326,18 +315,7 @@ func convertPostToAdminDetailResponse(post *model.Post) *dto.AdminPostDetailResp
 
 	var author *dto.UserResponse
 	if post.User != nil {
-		author = &dto.UserResponse{
-			ID:        post.User.ID,
-			Username:  post.User.Username,
-			Nickname:  post.User.Nickname,
-			Email:     post.User.Email,
-			Phone:     post.User.Phone,
-			Avatar:    post.User.Avatar,
-			Bio:       post.User.Bio,
-			Website:   post.User.Website,
-			Location:  post.User.Location,
-			CreatedAt: post.User.CreatedAt.Format("2006-01-02T15:04:05Z07:00"),
-		}
+		author = dto.ConvertUserToResponse(post.User)
 	}
 
 	return &dto.AdminPostDetailResponse{