fix: deploy crash + multiple bug fixes + cleanup

- server.js: fix getSiteName() returning string when not installed causing
  'getSiteName(...).then is not a function' crash on homepage (deploy blocker)
- server.js: auto-load business routes after install completes (no restart needed),
  HTML cache keyed by api_key
- install: validate db name/email/password, trigger route loading after complete
- app.js: fix forgot/reset/verify pages rendering HomePage (missing page mapping)
- verify.js: support URL token auto-verification for external registration links
- auth: new email_code template for 6-digit code, reset_password template
  (forgot-password was using verify_email template)
- upload.js: fix MP4 magic-bytes check using undefined buf variable
- tickets.js: status enum validation, anonymous submission rate limit
- security.js: XSS whitelist preserves email template HTML, strips scripts,
  blocks javascript:/data: hrefs; CORS reject returns 403
- bans.js: allow clearing reason/duration, status enum validation
- users.js: fix req.user.role ReferenceError in create user modal
- home.js: tracking results now have detail view button
- .gitignore: ignore data/ (db credentials), logs, session files, temp scripts

backend/db.js

@@ -307,6 +307,9 @@ async function seedTemplates(db) {
     ['verify_email', '邮箱验证', '【{{site_name}}】请验证您的邮箱',
      '<p>您好 <strong>{{username}}</strong>（游戏名: {{game_name}}，UID: {{game_uid}}），</p><p>感谢注册！请点击以下链接验证邮箱：</p><p><a href="{{verify_link}}">{{verify_link}}</a></p><p>链接有效期24小时。</p><p>— {{site_name}}</p>',
      '变量: {{site_name}}, {{username}}, {{game_name}}, {{game_uid}}, {{verify_link}}'],
+    ['email_code', '邮箱验证码', '【{{site_name}}】您的邮箱验证码',
+     '<p>您好，</p><p>您的邮箱验证码为：</p><p style="font-size:24px;font-weight:bold;letter-spacing:4px">{{code}}</p><p>验证码10分钟内有效。如非本人操作，请忽略此邮件。</p><p>— {{site_name}}</p>',
+     '变量: {{site_name}}, {{code}}'],
     ['ticket_created', '工单创建通知', '【{{site_name}}】{{ticket_type}}已提交 #{{ticket_id}}',
      '<p><strong>{{reporter_game_name}}</strong>（UID: {{reporter_game_uid}}），您的{{ticket_type}}已提交。</p><p>工单编号: <strong>#{{ticket_id}}</strong></p><p>标题: {{ticket_title}}</p><p><a href="{{tracking_link}}">查看工单</a></p><p>— {{site_name}}</p>',
      '变量: {{site_name}}, {{reporter_game_name}}, {{ticket_type}}, {{ticket_id}}, {{ticket_title}}, {{tracking_link}}'],
@@ -319,6 +322,9 @@ async function seedTemplates(db) {
     ['ticket_transferred', '工单已转交', '【{{site_name}}】工单 #{{ticket_id}} 已转交',
      '<p>工单 <strong>#{{ticket_id}}</strong>（{{ticket_title}}）已由 {{from_user}} 转交给 {{to_user}}。</p><p>— {{site_name}}</p>',
      '变量: {{site_name}}, {{ticket_id}}, {{ticket_title}}, {{from_user}}, {{to_user}}'],
+    ['reset_password', '密码重置', '【{{site_name}}】密码重置请求',
+     '<p>您好 <strong>{{username}}</strong>，</p><p>我们收到了您的密码重置请求。请点击以下链接设置新密码：</p><p><a href="{{reset_link}}">{{reset_link}}</a></p><p>链接1小时内有效。如非本人操作，请忽略此邮件。</p><p>— {{site_name}}</p>',
+     '变量: {{site_name}}, {{username}}, {{reset_link}}'],
   ];
 
   for (const t of temps) {