fix: deploy crash + multiple bug fixes + cleanup

- server.js: fix getSiteName() returning string when not installed causing
  'getSiteName(...).then is not a function' crash on homepage (deploy blocker)
- server.js: auto-load business routes after install completes (no restart needed),
  HTML cache keyed by api_key
- install: validate db name/email/password, trigger route loading after complete
- app.js: fix forgot/reset/verify pages rendering HomePage (missing page mapping)
- verify.js: support URL token auto-verification for external registration links
- auth: new email_code template for 6-digit code, reset_password template
  (forgot-password was using verify_email template)
- upload.js: fix MP4 magic-bytes check using undefined buf variable
- tickets.js: status enum validation, anonymous submission rate limit
- security.js: XSS whitelist preserves email template HTML, strips scripts,
  blocks javascript:/data: hrefs; CORS reject returns 403
- bans.js: allow clearing reason/duration, status enum validation
- users.js: fix req.user.role ReferenceError in create user modal
- home.js: tracking results now have detail view button
- .gitignore: ignore data/ (db credentials), logs, session files, temp scripts

backend/routes/auth.js

@@ -24,9 +24,9 @@ router.post('/send-verify-code', async (req, res) => {
     await query("DELETE FROM captchas WHERE created_at < NOW() - INTERVAL 5 MINUTE");
     await query('INSERT INTO captchas(id, question, answer) VALUES (?,?,?)', [codeId, email, code]);
 
-    const sent = await sendEmail(email, 'verify_email', {
+    const sent = await sendEmail(email, 'email_code', {
       username: email.split('@')[0], game_name: '', game_uid: '',
-      verify_link: code,
+      code,
     });
     if (!sent) {
       await query('DELETE FROM captchas WHERE id = ?', [codeId]);
@@ -229,9 +229,9 @@ router.post('/forgot-password', async (req, res) => {
     const resetToken = uuid();
     await query("UPDATE users SET reset_token = ?, reset_expires = DATE_ADD(NOW(), INTERVAL 1 HOUR) WHERE id = ?", [resetToken, user.id]);
     const site = await getRow("SELECT v FROM settings WHERE k='site_url'");
-    await sendEmail(email, 'verify_email', {
+    await sendEmail(email, 'reset_password', {
       username: user.username, game_name: user.game_name, game_uid: user.game_uid,
-      verify_link: `${site?.v||'http://localhost:3100'}#/reset?token=${resetToken}`,
+      reset_link: `${site?.v||'http://localhost:3100'}#/reset?token=${resetToken}`,
     });
     res.json({ message: '如果邮箱已注册，重置链接已发送' });
   } catch (err) {

backend/routes/bans.js

@@ -53,9 +53,12 @@ router.post('/', authenticate, requireRole('owner'), async (req, res) => {
 
 router.put('/:id', authenticate, requireRole('owner'), async (req, res) => {
   const fields = {};
-  if (req.body.status) fields.status = req.body.status;
-  if (req.body.reason) fields.reason = req.body.reason;
-  if (req.body.duration) fields.duration = req.body.duration;
+  if (req.body.status) {
+    if (!['active','expired','appealed','lifted'].includes(req.body.status)) return res.status(400).json({ error: '无效的状态值' });
+    fields.status = req.body.status;
+  }
+  if (req.body.reason !== undefined) fields.reason = req.body.reason;
+  if (req.body.duration !== undefined) fields.duration = req.body.duration;
   if (!Object.keys(fields).length) return res.status(400).json({ error: '无更新内容' });
   const sets = Object.keys(fields).map(k => `${k} = ?`).join(', ');
   await query(`UPDATE bans SET ${sets} WHERE id = ?`, [...Object.values(fields), req.params.id]);

backend/routes/install.js

@@ -12,6 +12,7 @@ router.get('/status', (req, res) => {
 
 router.post('/check-db', async (req, res) => {
   const { host, port, user, password, database } = req.body;
+  if (!/^[A-Za-z0-9_]+$/.test(database || '')) return res.status(400).json({ error: '数据库名仅允许字母、数字、下划线' });
   try {
     const conn = await mysql.createConnection({
       host: host || 'localhost',
@@ -42,6 +43,9 @@ router.post('/complete', async (req, res) => {
   if (!db_host || !db_user || !db_name || !admin_username || !admin_password || !admin_email) {
     return res.status(400).json({ error: '必填字段不完整' });
   }
+  if (!/^[A-Za-z0-9_]+$/.test(db_name || '')) return res.status(400).json({ error: '数据库名仅允许字母、数字、下划线' });
+  if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(admin_email)) return res.status(400).json({ error: '邮箱格式不正确' });
+  if (admin_password.length < 6) return res.status(400).json({ error: '密码至少6位' });
 
   try {
     const conn = await mysql.createConnection({
@@ -90,7 +94,9 @@ router.post('/complete', async (req, res) => {
       external_api_key: externalKey,
     });
 
-    res.json({ ok: true, message: '安装完成，请重新启动服务器' });
+    try { if (typeof global.__loadBusinessRoutes === 'function') global.__loadBusinessRoutes(); } catch {}
+
+    res.json({ ok: true, message: '安装完成，无需重启，系统已就绪' });
   } catch (e) {
     res.status(500).json({ error: '安装失败: ' + e.message });
   }

backend/routes/tickets.js

@@ -5,7 +5,7 @@ const { authenticate, requireRole, optionalAuth } = require('../middleware/auth'
 const { upload, finalizeUpload } = require('../middleware/upload');
 const { sendEmail } = require('../mailer');
 const { sendWebhook } = require('../webhook');
-const { validateLengths } = require('../middleware/security');
+const { validateLengths, ticketAnonLimiter } = require('../middleware/security');
 
 const router = express.Router();
 
@@ -101,7 +101,7 @@ router.get('/:id', authenticate, async (req, res) => {
   res.json(t);
 });
 
-router.post('/', optionalAuth, upload.array('files', 5), finalizeUpload, validateLengths({
+router.post('/', ticketAnonLimiter, optionalAuth, upload.array('files', 5), finalizeUpload, validateLengths({
   title:100, reporter_game_name:50, reporter_game_uid:50, target_game_name:50, target_game_uid:50, reason:300, description:5000,
 }), async (req, res) => {
   const { type, title, reporter_game_name, reporter_game_uid, target_game_name, target_game_uid, reason, description, is_admin_complaint, parent_ticket_id } = req.body;
@@ -185,7 +185,10 @@ router.put('/:id', authenticate, requireRole('owner','admin'), async (req, res)
   if (req.user.role === 'admin' && t.assigned_to && t.assigned_to !== req.user.id) return res.status(403).json({ error: '只能修改自己负责的工单' });
   if (t.status === 'closed' && req.user.role !== 'owner') return res.status(400).json({ error: '已关闭的工单仅服主可操作' });
   const fields = {};
-  if (req.body.status) fields.status = req.body.status;
+  if (req.body.status) {
+    if (!['pending','processing','awaiting_info','appealing','resolved','rejected','closed'].includes(req.body.status)) return res.status(400).json({ error: '无效的状态值' });
+    fields.status = req.body.status;
+  }
   if (req.body.priority) fields.priority = req.body.priority;
   if (req.body.priority && !['low','medium','high','urgent'].includes(req.body.priority)) return res.status(400).json({ error: '无效的优先级' });
   if (req.body.claim_note !== undefined) fields.claim_note = req.body.claim_note;