fix: public footer reads DB settings for all visitors

- settings.js: new public GET /settings/public returns only
  copyright + icp (no auth, no sensitive settings leaked)
- app.js loadFooter(): dropped Auth.isAdmin() gate, uses public
  endpoint; showPublic() (home/root) now loads footer too
- security.js: apiKeyGuard whitelist /api/settings/public and
  /api/settings/skin-site

backend/routes/settings.js

@@ -70,6 +70,16 @@ function formatUuid(id) {
   return `${s.slice(0,8)}-${s.slice(8,12)}-${s.slice(12,16)}-${s.slice(16,20)}-${s.slice(20)}`;
 }
 
+// 公开: 页尾信息(版权/ICP, 访客可见, 不暴露其他设置)
+router.get('/public', async (req, res) => {
+  try {
+    const rows = await query("SELECT k, v FROM settings WHERE k IN ('copyright','icp')");
+    const map = {};
+    for (const r of rows) map[r.k] = r.v;
+    res.json({ copyright: map.copyright || '', icp: map.icp || '' });
+  } catch { res.json({ copyright: '', icp: '' }); }
+});
+
 // 公开: 读取站点配置的皮肤站地址(玩家绑定身份时自动带出)
 router.get('/skin-site', async (req, res) => {
   try {