fix: deploy crash + multiple bug fixes + cleanup

- server.js: fix getSiteName() returning string when not installed causing
  'getSiteName(...).then is not a function' crash on homepage (deploy blocker)
- server.js: auto-load business routes after install completes (no restart needed),
  HTML cache keyed by api_key
- install: validate db name/email/password, trigger route loading after complete
- app.js: fix forgot/reset/verify pages rendering HomePage (missing page mapping)
- verify.js: support URL token auto-verification for external registration links
- auth: new email_code template for 6-digit code, reset_password template
  (forgot-password was using verify_email template)
- upload.js: fix MP4 magic-bytes check using undefined buf variable
- tickets.js: status enum validation, anonymous submission rate limit
- security.js: XSS whitelist preserves email template HTML, strips scripts,
  blocks javascript:/data: hrefs; CORS reject returns 403
- bans.js: allow clearing reason/duration, status enum validation
- users.js: fix req.user.role ReferenceError in create user modal
- home.js: tracking results now have detail view button
- .gitignore: ignore data/ (db credentials), logs, session files, temp scripts

backend/routes/auth.js

@@ -24,9 +24,9 @@ router.post('/send-verify-code', async (req, res) => {
     await query("DELETE FROM captchas WHERE created_at < NOW() - INTERVAL 5 MINUTE");
     await query('INSERT INTO captchas(id, question, answer) VALUES (?,?,?)', [codeId, email, code]);
 
-    const sent = await sendEmail(email, 'verify_email', {
+    const sent = await sendEmail(email, 'email_code', {
       username: email.split('@')[0], game_name: '', game_uid: '',
-      verify_link: code,
+      code,
     });
     if (!sent) {
       await query('DELETE FROM captchas WHERE id = ?', [codeId]);
@@ -229,9 +229,9 @@ router.post('/forgot-password', async (req, res) => {
     const resetToken = uuid();
     await query("UPDATE users SET reset_token = ?, reset_expires = DATE_ADD(NOW(), INTERVAL 1 HOUR) WHERE id = ?", [resetToken, user.id]);
     const site = await getRow("SELECT v FROM settings WHERE k='site_url'");
-    await sendEmail(email, 'verify_email', {
+    await sendEmail(email, 'reset_password', {
       username: user.username, game_name: user.game_name, game_uid: user.game_uid,
-      verify_link: `${site?.v||'http://localhost:3100'}#/reset?token=${resetToken}`,
+      reset_link: `${site?.v||'http://localhost:3100'}#/reset?token=${resetToken}`,
     });
     res.json({ message: '如果邮箱已注册，重置链接已发送' });
   } catch (err) {