feat: add article comment system with moderation

- Comment model with nested replies (ParentID), dual authorship
  (logged-in UserID / anonymous GuestToken cookie), email hash for
  Gravatar, private flag, and moderation status
- CommentConfig singleton (enabled / allow guest / guest-require-approval
  / use Gravatar) cached like the other platform config
- Markdown comments with built-in emoji picker, preview, and markdown
  help; rendered client-side via marked + DOMPurify, with server-side
  HTML/dangerous-scheme stripping as a first XSS defense
- Private comments visible only to admin and the author; pending
  comments visible only to admin and the author
- Admin moderation list (pending/approved/rejected/all tabs) with
  approve/reject/delete and a pending-count badge
- Comment settings page with the four toggles
- One-time session flash notice (auto-dismissed after 4s) so the
  "comment posted" banner no longer persists across refreshes

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

handlers/home.go

@@ -4,6 +4,7 @@ import (
 	"net/http"
 	"time"
 
+	"github.com/gin-contrib/sessions"
 	"github.com/gin-gonic/gin"
 	"go_blog/models"
 
@@ -53,20 +54,46 @@ func ArticleDetail(db *gorm.DB) gin.HandlerFunc {
 		db.Model(&models.Article{}).Where("id = ?", article.ID).
 			UpdateColumn("view_count", gorm.Expr("view_count + 1"))
 
-		authorName := article.Author.Username
-		if article.Author.DisplayName != "" {
-			authorName = article.Author.DisplayName
-		}
-
-		data := DefaultData(c)
-		data["Title"] = article.Title
-		data["Article"] = article
-		data["AuthorName"] = authorName
-		data["PublishedAt"] = formatPublishTime(article.PublishedAt)
-		c.HTML(http.StatusOK, "article", data)
+		// One-time flash notice (set by PostComment on success/pending). Reading
+		// consumes the flash, so refreshing the page no longer re-shows it.
+		notice := readCommentFlash(c)
+		renderArticleDetail(c, db, &article, commentForm{}, "", notice)
 	}
 }
 
+// renderArticleDetail renders the article page, including the comment section.
+// formErr refills the form with an error banner; notice is a one-time
+// success/pending banner (already consumed from the session by the caller).
+func renderArticleDetail(c *gin.Context, db *gorm.DB, article *models.Article, form commentForm, formErr, notice string) {
+	tr := getTr(c)
+
+	authorName := article.Author.Username
+	if article.Author.DisplayName != "" {
+		authorName = article.Author.DisplayName
+	}
+
+	viewer := viewerFromContext(c)
+
+	var comments []models.Comment
+	db.Where("article_id = ?", article.ID).Order("created_at ASC").Find(&comments)
+	cfg := models.GetCommentConfig()
+	useGravatar := cfg != nil && cfg.UseGravatar
+	tree := buildCommentTree(comments, viewer, tr, useGravatar)
+
+	data := DefaultData(c)
+	data["Title"] = article.Title
+	data["Article"] = article
+	data["AuthorName"] = authorName
+	data["PublishedAt"] = formatPublishTime(article.PublishedAt)
+	data["Comments"] = tree
+	data["CommentConfig"] = models.GetCommentConfig()
+	data["CommentForm"] = form
+	data["CommentError"] = formErr
+	data["CommentNotice"] = notice
+	data["MaxCommentLength"] = MaxCommentLength
+	c.HTML(http.StatusOK, "article", data)
+}
+
 // formatPublishTime returns the publication time as a readable string, falling
 // back to the creation time when the publish timestamp is unset.
 func formatPublishTime(publishedAt *time.Time) string {
@@ -75,3 +102,27 @@ func formatPublishTime(publishedAt *time.Time) string {
 	}
 	return ""
 }
+
+// commentFlashKey is the session key for the one-time comment notice.
+const commentFlashKey = "comment_flash"
+
+// setCommentFlash stores a one-time comment notice in the session so the
+// following GET /article/:slug (after the POST/redirect) can show it once and
+// never again on refresh.
+func setCommentFlash(c *gin.Context, value string) {
+	session := sessions.Default(c)
+	session.Set(commentFlashKey, value)
+	session.Save()
+}
+
+// readCommentFlash returns and clears the one-time comment notice, if any.
+func readCommentFlash(c *gin.Context) string {
+	session := sessions.Default(c)
+	v, ok := session.Get(commentFlashKey).(string)
+	if ok && v != "" {
+		session.Delete(commentFlashKey)
+		session.Save()
+		return v
+	}
+	return ""
+}