feat: add article comment system with moderation

- Comment model with nested replies (ParentID), dual authorship
  (logged-in UserID / anonymous GuestToken cookie), email hash for
  Gravatar, private flag, and moderation status
- CommentConfig singleton (enabled / allow guest / guest-require-approval
  / use Gravatar) cached like the other platform config
- Markdown comments with built-in emoji picker, preview, and markdown
  help; rendered client-side via marked + DOMPurify, with server-side
  HTML/dangerous-scheme stripping as a first XSS defense
- Private comments visible only to admin and the author; pending
  comments visible only to admin and the author
- Admin moderation list (pending/approved/rejected/all tabs) with
  approve/reject/delete and a pending-count badge
- Comment settings page with the four toggles
- One-time session flash notice (auto-dismissed after 4s) so the
  "comment posted" banner no longer persists across refreshes

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

handlers/settings.go

@@ -334,3 +334,43 @@ func deleteDownloadBaseURL(db *gorm.DB, c *gin.Context) {
 	id, _ := strconv.Atoi(c.PostForm("id"))
 	db.Delete(&models.DownloadBaseURL{}, id)
 }
+
+// ---------------- Comment settings ----------------
+
+// CommentSettingsPage renders the comment policy form.
+func CommentSettingsPage(db *gorm.DB) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		tr := getTr(c)
+		var cc models.CommentConfig
+		if err := db.First(&cc, 1).Error; err != nil {
+			cc = *models.GetCommentConfig()
+		}
+
+		data := DefaultData(c)
+		data["Title"] = tr["comment_settings_title"]
+		data["CommentConfig"] = cc
+		if msg := c.Query("saved"); msg == "1" {
+			data["Success"] = tr["settings_saved"]
+		}
+		c.HTML(http.StatusOK, "settings_comment", data)
+	}
+}
+
+// CommentSettingsSave persists the comment policy toggles and refreshes the
+// in-memory cache so subsequent requests see the change.
+func CommentSettingsSave(db *gorm.DB) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var cc models.CommentConfig
+		if err := db.First(&cc, 1).Error; err != nil {
+			cc = models.CommentConfig{ID: 1}
+		}
+		cc.Enabled = c.PostForm("enabled") == "1"
+		cc.AllowGuest = c.PostForm("allow_guest") == "1"
+		cc.GuestRequireApproval = c.PostForm("guest_require_approval") == "1"
+		cc.UseGravatar = c.PostForm("use_gravatar") == "1"
+		cc.UpdatedBy = userIDFromSession(c)
+		db.Save(&cc)
+		models.RefreshConfigCache(db)
+		c.Redirect(http.StatusFound, "/admin/settings/comments?saved=1")
+	}
+}