feat: enhance security with IP banning, ownership checks, and SSRF protection

Add comprehensive security improvements across the application:

- **IP-based login protection**: Implement IP ban system tracking login failures, auto-banning after threshold exceeded
- **Ownership verification**: Add userID parameter to Delete/Update operations for posts and comments to prevent unauthorized modifications
- **SSRF protection**: Add URL and resolved host validation for image URLs in chat and OpenAI client
- **SQL injection prevention**: Add EscapeLikeWildcard utility to escape special characters in LIKE queries
- **HTTP security**: Configure server timeouts and add security headers middleware
- **Rate limiting**: Refactor to support configurable duration and per-endpoint rate limits for auth routes
- **Error handling**: Standardize error responses using HandleError and proper error types

internal/service/post_service.go

@@ -8,6 +8,7 @@ import (
 	"strings"
 	"time"
 
+	apperrors "with_you/internal/errors"
 	"with_you/internal/cache"
 	"with_you/internal/dto"
 	"with_you/internal/model"
@@ -30,7 +31,7 @@ type PostService interface {
 	GetByID(ctx context.Context, id string) (*model.Post, error)
 	Update(ctx context.Context, post *model.Post) error
 	UpdateWithImages(ctx context.Context, post *model.Post, images *[]string) error
-	Delete(ctx context.Context, id string) error
+	Delete(ctx context.Context, userID string, id string) error
 
 	// 帖子列表
 	List(ctx context.Context, page, pageSize int, userID string, includePending bool, channelID *string) ([]*model.Post, int64, error)
@@ -313,13 +314,20 @@ func (s *postServiceImpl) UpdateWithImages(ctx context.Context, post *model.Post
 }
 
 // Delete 删除帖子
-func (s *postServiceImpl) Delete(ctx context.Context, id string) error {
-	err := s.postRepo.Delete(id)
+func (s *postServiceImpl) Delete(ctx context.Context, userID string, id string) error {
+	post, err := s.postRepo.GetByID(id)
+	if err != nil {
+		return err
+	}
+	if post.UserID != userID {
+		return apperrors.ErrForbidden
+	}
+
+	err = s.postRepo.Delete(id)
 	if err != nil {
 		return err
 	}
 
-	// 失效帖子详情缓存和列表缓存
 	cache.InvalidatePostDetail(s.cache, id)
 	cache.InvalidatePostList(s.cache)