fix: public footer reads DB settings for all visitors

- settings.js: new public GET /settings/public returns only
  copyright + icp (no auth, no sensitive settings leaked)
- app.js loadFooter(): dropped Auth.isAdmin() gate, uses public
  endpoint; showPublic() (home/root) now loads footer too
- security.js: apiKeyGuard whitelist /api/settings/public and
  /api/settings/skin-site

public/js/app.js

@@ -71,14 +71,15 @@ const App = {
   },
 
   async loadFooter() {
-    if (!Auth.isAdmin() || this._footerLoaded) return;
+    if (this._footerLoaded) return;
     this._footerLoaded = true;
     try {
-      const s = await API.get('/settings/settings');
+      // 公开接口: 访客与登录用户都能读到页尾(版权/ICP), 不暴露敏感设置
+      const s = await API.get('/settings/public');
       const cr = document.getElementById('footer-copyright');
       const icp = document.getElementById('footer-icp');
-      if (cr && s.copyright) cr.innerHTML = s.copyright.value;
-      if (icp && s.icp && s.icp.value) icp.innerHTML = `<a href="https://beian.miit.gov.cn" target="_blank">${s.icp.value}</a>`;
+      if (cr && s.copyright) cr.innerHTML = s.copyright;
+      if (icp && s.icp) icp.innerHTML = `<a href="https://beian.miit.gov.cn" target="_blank">${s.icp}</a>`;
     } catch {}
   },
 
@@ -160,6 +161,7 @@ const App = {
     pub.classList.remove('hidden');
     document.getElementById('top-bar').classList.remove('hidden');
     this.updateTopAuth();
+    this.loadFooter();
     const comp = page === 'login' ? LoginPage : page === 'register' ? RegisterPage : page === 'install' ? InstallPage : page === 'forgot' ? ForgotPage : page === 'reset' ? ResetPage : page === 'verify' ? VerifyPage : HomePage;
     comp.render(param).then(html => { pub.innerHTML = html; if (comp.mount) comp.mount(param); }).catch(() => {
       pub.innerHTML = '<div class="pub-card"><div class="logo"><i class="fas fa-exclamation-triangle" style="color:var(--d)"></i><h2>加载失败</h2><p>请刷新页面重试</p></div></div>';