feat: skin site UUID lookup - auto-fetch UUID from player name

- GET /settings/uuid-lookup?site=&name= : proxy Yggdrasil API
  (POST {site}/api/yggdrasil/api/profiles/minecraft), SSRF guard,
  10s timeout, name regex, UUID formatting (with dashes)
- GET /settings/skin-site : public read of configured skin site
- settings page: 皮肤站地址 config
- bind identity modals (player dashboard + admin users): 获取UUID button,
  auto-fill site from settings, auto-fill UID from lookup
- verified live against littleskin.cn (Steve -> df273bda...)
- API docs updated

docs/API.md

@@ -85,6 +85,8 @@ Base URL: `http://<host>:3100/api`
 | 同来源重复 | 拒绝(先删除再重新绑定) |
 | 至少保留一个 | 解绑时若只剩一个身份则拒绝 |
 
+**皮肤站 UUID 自动查询**:皮肤站来源时,可通过 `GET /settings/uuid-lookup?site=<皮肤站地址>&name=<用户名>` 自动获取 UUID(调 Yggdrasil API `POST {site}/api/yggdrasil/api/profiles/minecraft`,带 SSRF 防护与 10s 超时)。站点皮肤站地址可在系统设置配置,前端绑定弹窗自动带出。
+
 ### DELETE /auth/identities/:id *(认证)*
 解绑身份。响应: `{ "message": "已解绑" }`
 
@@ -225,7 +227,7 @@ Base URL: `http://<host>:3100/api`
 ```json
 { "source": "skin", "game_name": "Alex", "game_uid": "SKIN_UUID" }
 ```
-规则同 `POST /auth/identities`(同来源唯一、游戏名全局唯一、网易端必填 UID)。
+规则同 `POST /auth/identities`(同来源唯一、游戏名全局唯一、网易端必填 UID)。皮肤站来源同样支持「获取 UUID」辅助查询。
 
 ### DELETE /users/:id/identities/:identityId *(admin/owner)*
 管理员解绑用户身份(至少保留一个)。