security: backend validation for all inputs

- router.param('id'): all :id path params must be positive ints
  (tickets/features/polls/auth/users; external/bans/notifications already
  had parseInt - now consistent)
- notifications: type enum + webhook URL format + SSRF (isPrivateUrl
  exported) + events whitelist + active boolean check on PUT
- bans: type enum + player_name length
- external: all-tickets type/status enums, bans status/type enums,
  page/limit floor protection, ticket field length caps, clients active
  boolean + id validation
- verified: 28 checks (syntax + validation coverage)

backend/routes/bans.js

@@ -49,6 +49,8 @@ router.post('/', authenticate, requireRole('owner'), async (req, res) => {
   try {
     const { player_name, player_uid, reason, type, duration, ticket_id, expires_at, source } = req.body;
     if (!player_name) return res.status(400).json({ error: '玩家名为必填' });
+    if (player_name.length > 50) return res.status(400).json({ error: '玩家名过长' });
+    if (type && !['ban','mute','warn','other'].includes(type)) return res.status(400).json({ error: '无效的处罚类型' });
 
     const durDays = parseDuration(duration);
     const prev = await getRow('SELECT * FROM bans WHERE (player_name = ? OR player_uid = ?) AND type = ? AND status = ? ORDER BY created_at DESC LIMIT 1',
@@ -85,7 +87,9 @@ router.put('/:id', authenticate, requireRole('owner'), async (req, res) => {
 });
 
 router.delete('/:id', authenticate, requireRole('owner'), async (req, res) => {
-  await query('DELETE FROM bans WHERE id = ?', [req.params.id]);
+  const id = parseInt(req.params.id);
+  if (!id) return res.status(400).json({ error: '无效的ID' });
+  await query('DELETE FROM bans WHERE id = ?', [id]);
   res.json({ message: '已删除' });
 });