feat: add article comment system with moderation

- Comment model with nested replies (ParentID), dual authorship
  (logged-in UserID / anonymous GuestToken cookie), email hash for
  Gravatar, private flag, and moderation status
- CommentConfig singleton (enabled / allow guest / guest-require-approval
  / use Gravatar) cached like the other platform config
- Markdown comments with built-in emoji picker, preview, and markdown
  help; rendered client-side via marked + DOMPurify, with server-side
  HTML/dangerous-scheme stripping as a first XSS defense
- Private comments visible only to admin and the author; pending
  comments visible only to admin and the author
- Admin moderation list (pending/approved/rejected/all tabs) with
  approve/reject/delete and a pending-count badge
- Comment settings page with the four toggles
- One-time session flash notice (auto-dismissed after 4s) so the
  "comment posted" banner no longer persists across refreshes

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

models/seed.go

@@ -39,6 +39,25 @@ func seedUploadConfig(db *gorm.DB) {
 	}
 }
 
+// seedCommentConfig inserts the singleton comment_configs row (id=1) if absent.
+func seedCommentConfig(db *gorm.DB) {
+	var count int64
+	db.Model(&CommentConfig{}).Count(&count)
+	if count > 0 {
+		return
+	}
+	c := &CommentConfig{
+		ID:                   1,
+		Enabled:              true,
+		AllowGuest:           true,
+		GuestRequireApproval: false,
+		UseGravatar:          true,
+	}
+	if err := db.Create(c).Error; err != nil {
+		log.Printf("Warning: failed to seed comment_configs: %v", err)
+	}
+}
+
 // defaultUploadFileTypes is the set of commonly permitted attachment types
 // seeded on first run.
 var defaultUploadFileTypes = []UploadFileType{