docs: 全部 Go 代码注释汉化

- 48 个 Go 文件所有注释（行注释/块注释/行尾注释，含 _test.go）翻译为中文
- 保留技术标识符：SECURITY_TODO(n)、unsafe-inline、sqlite/mysql、路由参数等
- 代码、字符串字面量、日志消息保持英文原文，零逻辑改动
- go build/vet 通过，go test -count=1 ./... 全绿

middleware/https.go

@@ -6,12 +6,11 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
-// IsHTTPSRequest reports whether the client reached us over TLS. Behind a
-// reverse proxy (Caddy/nginx) the app itself usually terminates plain
-// connections, so X-Forwarded-Proto is consulted as well. The header is only
-// honored when a trusted proxy forwarded the request - untrusted clients
-// spoofing it can at worst break their own session (the cookie turns Secure
-// and is refused over plain HTTP).
+// IsHTTPSRequest 报告客户端是否通过 TLS 访问到我们。当应用部署在反向代理
+// （Caddy/nginx）之后，应用本身通常使用明文连接，因此还需参考
+// X-Forwarded-Proto 请求头。仅当请求由可信代理转发时才采信该头部——
+// 不受信任的客户端伪造它，最坏情况下只会破坏自己的会话（Cookie 变为
+// Secure，在明文 HTTP 下会被拒收）。
 func IsHTTPSRequest(c *gin.Context) bool {
 	if c.Request.TLS != nil {
 		return true