fix: deploy crash + multiple bug fixes + cleanup

- server.js: fix getSiteName() returning string when not installed causing
  'getSiteName(...).then is not a function' crash on homepage (deploy blocker)
- server.js: auto-load business routes after install completes (no restart needed),
  HTML cache keyed by api_key
- install: validate db name/email/password, trigger route loading after complete
- app.js: fix forgot/reset/verify pages rendering HomePage (missing page mapping)
- verify.js: support URL token auto-verification for external registration links
- auth: new email_code template for 6-digit code, reset_password template
  (forgot-password was using verify_email template)
- upload.js: fix MP4 magic-bytes check using undefined buf variable
- tickets.js: status enum validation, anonymous submission rate limit
- security.js: XSS whitelist preserves email template HTML, strips scripts,
  blocks javascript:/data: hrefs; CORS reject returns 403
- bans.js: allow clearing reason/duration, status enum validation
- users.js: fix req.user.role ReferenceError in create user modal
- home.js: tracking results now have detail view button
- .gitignore: ignore data/ (db credentials), logs, session files, temp scripts

backend/routes/bans.js

@@ -53,9 +53,12 @@ router.post('/', authenticate, requireRole('owner'), async (req, res) => {
 
 router.put('/:id', authenticate, requireRole('owner'), async (req, res) => {
   const fields = {};
-  if (req.body.status) fields.status = req.body.status;
-  if (req.body.reason) fields.reason = req.body.reason;
-  if (req.body.duration) fields.duration = req.body.duration;
+  if (req.body.status) {
+    if (!['active','expired','appealed','lifted'].includes(req.body.status)) return res.status(400).json({ error: '无效的状态值' });
+    fields.status = req.body.status;
+  }
+  if (req.body.reason !== undefined) fields.reason = req.body.reason;
+  if (req.body.duration !== undefined) fields.duration = req.body.duration;
   if (!Object.keys(fields).length) return res.status(400).json({ error: '无更新内容' });
   const sets = Object.keys(fields).map(k => `${k} = ?`).join(', ');
   await query(`UPDATE bans SET ${sets} WHERE id = ?`, [...Object.values(fields), req.params.id]);