feat: enhance security with IP banning, ownership checks, and SSRF protection

Add comprehensive security improvements across the application:

- **IP-based login protection**: Implement IP ban system tracking login failures, auto-banning after threshold exceeded
- **Ownership verification**: Add userID parameter to Delete/Update operations for posts and comments to prevent unauthorized modifications
- **SSRF protection**: Add URL and resolved host validation for image URLs in chat and OpenAI client
- **SQL injection prevention**: Add EscapeLikeWildcard utility to escape special characters in LIKE queries
- **HTTP security**: Configure server timeouts and add security headers middleware
- **Rate limiting**: Refactor to support configurable duration and per-endpoint rate limits for auth routes
- **Error handling**: Standardize error responses using HandleError and proper error types

internal/service/notification_service.go

@@ -58,27 +58,21 @@ func (s *NotificationService) GetByUserID(ctx context.Context, userID string, pa
 	return s.notificationRepo.GetByUserID(userID, page, pageSize, unreadOnly)
 }
 
-// MarkAsRead 标记为已读
-func (s *NotificationService) MarkAsRead(ctx context.Context, id string) error {
-	err := s.notificationRepo.MarkAsRead(id)
-	if err != nil {
-		return err
-	}
-
-	// 注意：这里无法获取userID，所以不在缓存中失效
-	// 调用方应该使用MarkAsReadWithUserID方法
-
-	return nil
-}
-
-// MarkAsReadWithUserID 标记为已读（带用户ID，用于缓存失效）
+// MarkAsReadWithUserID 标记为已读（带用户ID，验证所有权）
 func (s *NotificationService) MarkAsReadWithUserID(ctx context.Context, id, userID string) error {
-	err := s.notificationRepo.MarkAsRead(id)
+	notification, err := s.notificationRepo.GetByID(id)
+	if err != nil {
+		return err
+	}
+	if notification.UserID != userID {
+		return apperrors.ErrForbidden
+	}
+
+	err = s.notificationRepo.MarkAsRead(id)
 	if err != nil {
 		return err
 	}
 
-	// 失效未读数缓存
 	cache.InvalidateUnreadSystem(s.cache, userID)
 
 	return nil
@@ -97,11 +91,6 @@ func (s *NotificationService) MarkAllAsRead(ctx context.Context, userID string)
 	return nil
 }
 
-// Delete 删除通知
-func (s *NotificationService) Delete(ctx context.Context, id string) error {
-	return s.notificationRepo.Delete(id)
-}
-
 // GetUnreadCount 获取未读数量（带缓存）
 func (s *NotificationService) GetUnreadCount(ctx context.Context, userID string) (int64, error) {
 	cacheSettings := cache.GetSettings()