docs: 全部 Go 代码注释汉化

- 48 个 Go 文件所有注释（行注释/块注释/行尾注释，含 _test.go）翻译为中文
- 保留技术标识符：SECURITY_TODO(n)、unsafe-inline、sqlite/mysql、路由参数等
- 代码、字符串字面量、日志消息保持英文原文，零逻辑改动
- go build/vet 通过，go test -count=1 ./... 全绿

middleware/security_headers_test.go

@@ -20,7 +20,7 @@ func newHeadersTestRouter() *gin.Engine {
 func TestSecurityHeadersPresent(t *testing.T) {
 	r := newHeadersTestRouter()
 
-	// Plain HTTP request: hardening headers present, no HSTS.
+	// 明文 HTTP 请求：加固头存在，无 HSTS。
 	req := httptest.NewRequest(http.MethodGet, "/", nil)
 	w := httptest.NewRecorder()
 	r.ServeHTTP(w, req)
@@ -53,7 +53,7 @@ func TestSecurityHeadersPresent(t *testing.T) {
 func TestSecurityHeadersHSTSOverHTTPS(t *testing.T) {
 	r := newHeadersTestRouter()
 
-	// TLS request: HSTS present.
+	// TLS 请求：HSTS 存在。
 	req := httptest.NewRequest(http.MethodGet, "/", nil)
 	req.TLS = &tls.ConnectionState{}
 	w := httptest.NewRecorder()
@@ -62,7 +62,7 @@ func TestSecurityHeadersHSTSOverHTTPS(t *testing.T) {
 		t.Errorf("HSTS over TLS = %q, want max-age=31536000", v)
 	}
 
-	// Behind a trusted proxy (X-Forwarded-Proto: https): HSTS present.
+	// 位于可信代理之后（X-Forwarded-Proto: https）：HSTS 存在。
 	req = httptest.NewRequest(http.MethodGet, "/", nil)
 	req.Header.Set("X-Forwarded-Proto", "https")
 	w = httptest.NewRecorder()
@@ -73,22 +73,22 @@ func TestSecurityHeadersHSTSOverHTTPS(t *testing.T) {
 }
 
 func TestIsHTTPSRequest(t *testing.T) {
-	// TLS request.
+	// TLS 请求。
 	if !IsHTTPSRequest(&gin.Context{Request: mustTLSRequest()}) {
 		t.Error("TLS request must be HTTPS")
 	}
-	// Plain request.
+	// 明文请求。
 	c := &gin.Context{}
 	c.Request = httptest.NewRequest(http.MethodGet, "/", nil)
 	if IsHTTPSRequest(c) {
 		t.Error("plain request must not be HTTPS")
 	}
-	// X-Forwarded-Proto: https.
+	// X-Forwarded-Proto: https。
 	c.Request.Header.Set("X-Forwarded-Proto", "https")
 	if !IsHTTPSRequest(c) {
 		t.Error("X-Forwarded-Proto https must be treated as HTTPS")
 	}
-	// X-Forwarded-Proto: http must not trigger HTTPS behavior.
+	// X-Forwarded-Proto: http 不得触发 HTTPS 行为。
 	c.Request.Header.Set("X-Forwarded-Proto", "http")
 	if IsHTTPSRequest(c) {
 		t.Error("X-Forwarded-Proto http must not be treated as HTTPS")