fix: deploy crash + multiple bug fixes + cleanup

- server.js: fix getSiteName() returning string when not installed causing
  'getSiteName(...).then is not a function' crash on homepage (deploy blocker)
- server.js: auto-load business routes after install completes (no restart needed),
  HTML cache keyed by api_key
- install: validate db name/email/password, trigger route loading after complete
- app.js: fix forgot/reset/verify pages rendering HomePage (missing page mapping)
- verify.js: support URL token auto-verification for external registration links
- auth: new email_code template for 6-digit code, reset_password template
  (forgot-password was using verify_email template)
- upload.js: fix MP4 magic-bytes check using undefined buf variable
- tickets.js: status enum validation, anonymous submission rate limit
- security.js: XSS whitelist preserves email template HTML, strips scripts,
  blocks javascript:/data: hrefs; CORS reject returns 403
- bans.js: allow clearing reason/duration, status enum validation
- users.js: fix req.user.role ReferenceError in create user modal
- home.js: tracking results now have detail view button
- .gitignore: ignore data/ (db credentials), logs, session files, temp scripts

public/js/pages/verify.js

@@ -1,5 +1,13 @@
 const VerifyPage = {
   async render() {
+    const params = new URLSearchParams((location.hash.split('?')[1] || ''));
+    const token = params.get('token');
+    if (token) {
+      return `<div class="pub-card"><div class="logo"><i class="fas fa-envelope"></i><h2>邮箱验证</h2><p>正在验证您的邮箱...</p></div>
+      <div id="vf-msg" class="alert alert-i">验证中，请稍候...</div>
+      <div style="margin-top:14px;text-align:center;font-size:13px"><a href="#/login" style="color:var(--p);text-decoration:none">返回登录</a></div>
+    </div>`;
+    }
     return `<div class="pub-card"><div class="logo"><i class="fas fa-envelope"></i><h2>邮箱验证</h2><p>请输入邮件中的6位验证码</p></div>
       <form id="verify-form"><div class="form-group"><input id="vf-code" placeholder="6位验证码" required maxlength="6" minlength="6" pattern="[0-9]{6}" autofocus></div>
       <div id="vf-msg" class="hidden"></div>
@@ -8,6 +16,12 @@ const VerifyPage = {
     </div>`;
   },
   mount() {
+    const params = new URLSearchParams((location.hash.split('?')[1] || ''));
+    const token = params.get('token');
+    if (token) {
+      this.verifyToken(token);
+      return;
+    }
     document.getElementById('verify-form').addEventListener('submit', async e => {
       e.preventDefault();
       const code = document.getElementById('vf-code').value.trim();
@@ -22,5 +36,15 @@ const VerifyPage = {
         msg.classList.remove('hidden');
       }
     });
+  },
+  async verifyToken(token) {
+    const msg = document.getElementById('vf-msg');
+    try {
+      const r = await API.post('/auth/verify-email', { code: token });
+      msg.className = 'alert alert-s'; msg.textContent = r.message || '验证成功';
+      setTimeout(() => location.hash = '#/login', 2000);
+    } catch (ex) {
+      msg.className = 'alert alert-e'; msg.textContent = ex.message;
+    }
   }
 };