feat: enhance security with IP banning, ownership checks, and SSRF protection

Add comprehensive security improvements across the application:

- **IP-based login protection**: Implement IP ban system tracking login failures, auto-banning after threshold exceeded
- **Ownership verification**: Add userID parameter to Delete/Update operations for posts and comments to prevent unauthorized modifications
- **SSRF protection**: Add URL and resolved host validation for image URLs in chat and OpenAI client
- **SQL injection prevention**: Add EscapeLikeWildcard utility to escape special characters in LIKE queries
- **HTTP security**: Configure server timeouts and add security headers middleware
- **Rate limiting**: Refactor to support configurable duration and per-endpoint rate limits for auth routes
- **Error handling**: Standardize error responses using HandleError and proper error types

internal/router/router.go

@@ -140,6 +140,7 @@ func New(
 // setupRoutes 设置路由
 func (r *Router) setupRoutes() {
 	// 中间件
+	r.engine.Use(middleware.SecurityHeaders())
 	r.engine.Use(middleware.CORS())
 
 	// 健康检查
@@ -150,15 +151,16 @@ func (r *Router) setupRoutes() {
 	// API v1
 	v1 := r.engine.Group("/api/v1")
 	{
-		// 认证路由（公开，需要速率限制）
+		// 认证路由（公开，按接口类型设置不同速率限制）
 		auth := v1.Group("/auth")
-		auth.Use(middleware.RateLimit(10)) // 每分钟最多10次请求
+		auth.Use(middleware.GlobalAuthRateLimit())
+		auth.Use(middleware.IPBanMiddleware())
 		{
-			auth.POST("/register", r.userHandler.Register)
-			auth.POST("/register/send-code", r.userHandler.SendRegisterCode)
-			auth.POST("/login", r.userHandler.Login)
-			auth.POST("/password/send-code", r.userHandler.SendPasswordResetCode)
-			auth.POST("/password/reset", r.userHandler.ResetPassword)
+			auth.POST("/register", middleware.RegisterRateLimit(), r.userHandler.Register)
+			auth.POST("/register/send-code", middleware.SendCodeRateLimit(), r.userHandler.SendRegisterCode)
+			auth.POST("/login", middleware.LoginRateLimit(), r.userHandler.Login)
+			auth.POST("/password/send-code", middleware.PasswordResetRateLimit(), r.userHandler.SendPasswordResetCode)
+			auth.POST("/password/reset", middleware.PasswordResetRateLimit(), r.userHandler.ResetPassword)
 			auth.POST("/logout", r.userHandler.Logout)
 			auth.POST("/refresh", r.userHandler.RefreshToken)
 		}