feat: 搬移附件/头像端点模板 JS 至 /api 路径

- article_create.html：附件上传/删除/列表 fetch 改 /api/admin/articles/attachments
  （删除改用 DELETE 方法），与新路由匹配
- profile.html：头像上传 fetch 改 /api/profile/avatar
- 验证：grep 确认模板/static 无残留旧 URL，go build/vet/test 全绿

templates/admin/article_create.html

@@ -206,8 +206,8 @@ var easyMDE = new EasyMDE({
         delBtn.className = 'text-red-600 hover:text-red-800 font-medium cursor-pointer bg-transparent border-none';
         delBtn.onclick = function () {
             if (!confirm("{{index .Tr "article_att_delete_confirm"}}")) return;
-            fetch('/admin/articles/attachments/' + att.id + '/delete', {
-                method: 'POST',
+            fetch('/api/admin/articles/attachments/' + att.id, {
+                method: 'DELETE',
                 headers: { 'X-CSRF-Token': csrfToken }
             })
                 .then(function (r) { return r.json(); })
@@ -232,7 +232,7 @@ var easyMDE = new EasyMDE({
         if (articleID) { fd.append('article_id', articleID); }
         else { fd.append('session_token', sessionToken); }
         msgEl.textContent = "{{index .Tr "article_att_uploading"}}";
-        fetch('/admin/articles/attachments', {
+        fetch('/api/admin/articles/attachments', {
             method: 'POST',
             headers: { 'X-CSRF-Token': csrfToken },
             body: fd
@@ -249,7 +249,7 @@ var easyMDE = new EasyMDE({
 
     // Edit page: load existing attachments.
     if (articleID) {
-        fetch('/admin/articles/' + articleID + '/attachments')
+        fetch('/api/admin/articles/' + articleID + '/attachments')
             .then(function (r) { return r.json(); })
             .then(function (r) {
                 (r.attachments || []).forEach(addRow);

templates/pages/profile.html

@@ -195,7 +195,7 @@
             var formData = new FormData();
             formData.append('avatar', blob, 'avatar.jpg');
 
-            fetch('/profile/avatar', {
+            fetch('/api/profile/avatar', {
                 method: 'POST',
                 headers: { 'X-CSRF-Token': csrfToken },
                 body: formData,