docs: 全部 Go 代码注释汉化

- 48 个 Go 文件所有注释（行注释/块注释/行尾注释，含 _test.go）翻译为中文
- 保留技术标识符：SECURITY_TODO(n)、unsafe-inline、sqlite/mysql、路由参数等
- 代码、字符串字面量、日志消息保持英文原文，零逻辑改动
- go build/vet 通过，go test -count=1 ./... 全绿

middleware/security_headers.go

@@ -2,12 +2,11 @@ package middleware
 
 import "github.com/gin-gonic/gin"
 
-// csp is the Content-Security-Policy for HTML responses.
+// csp 是 HTML 响应的 Content-Security-Policy 策略。
 //
-// 'unsafe-inline' is required because templates embed inline <script> and
-// <style> blocks (Go html/template is the XSS defense for those). All
-// third-party assets are vendored locally (SECURITY_TODO #9), so the policy
-// allows no other origins for scripts or styles.
+// 需要 'unsafe-inline' 是因为模板内嵌了 <script> 与 <style> 块
+// （这些块的 XSS 防御由 Go html/template 提供）。所有第三方资源均已
+// 本地化托管（SECURITY_TODO #9），因此策略不允许其他来源的脚本或样式。
 const csp = "default-src 'self'; " +
 	"script-src 'self' 'unsafe-inline'; " +
 	"style-src 'self' 'unsafe-inline'; " +
@@ -18,11 +17,11 @@ const csp = "default-src 'self'; " +
 	"base-uri 'self'; " +
 	"form-action 'self'"
 
-// SecurityHeaders sets hardening response headers on every response:
-// CSP, nosniff, clickjacking (X-Frame-Options + frame-ancestors),
-// referrer policy, and HSTS when the request arrived over HTTPS.
-// Register it before all other middleware so the headers are present even
-// on rejected (403/redirect) responses.
+// SecurityHeaders 为每个响应设置安全加固头：
+// CSP、nosniff、点击劫持防护（X-Frame-Options + frame-ancestors）、
+// Referrer-Policy，以及当请求通过 HTTPS 到达时的 HSTS。
+// 必须在其他中间件之前注册，以确保即使在被拒绝（403/重定向）的响应上
+// 也包含这些头。
 func SecurityHeaders() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		c.Header("Content-Security-Policy", csp)
@@ -31,8 +30,8 @@ func SecurityHeaders() gin.HandlerFunc {
 		c.Header("Referrer-Policy", "strict-origin-when-cross-origin")
 		c.Header("Permissions-Policy", "camera=(), microphone=(), geolocation=()")
 		if IsHTTPSRequest(c) {
-			// includeSubDomains is deliberately omitted: some subdomains of
-			// the site may still be served over plain HTTP.
+			// 故意省略 includeSubDomains：站点的某些子域
+			// 可能仍通过明文 HTTP 提供访问。
 			c.Header("Strict-Transport-Security", "max-age=31536000")
 		}
 		c.Next()