security: backend validation for all inputs

- router.param('id'): all :id path params must be positive ints
  (tickets/features/polls/auth/users; external/bans/notifications already
  had parseInt - now consistent)
- notifications: type enum + webhook URL format + SSRF (isPrivateUrl
  exported) + events whitelist + active boolean check on PUT
- bans: type enum + player_name length
- external: all-tickets type/status enums, bans status/type enums,
  page/limit floor protection, ticket field length caps, clients active
  boolean + id validation
- verified: 28 checks (syntax + validation coverage)

backend/routes/features.js

@@ -23,6 +23,12 @@ const { authenticate, requireRole } = require('../middleware/auth');
 
 const router = express.Router();
 
+// 统一校验 :id 路径参数(必须是正整数)
+router.param('id', (req, res, next, id) => {
+  if (!/^\d+$/.test(id)) return res.status(400).json({ error: '无效的ID' });
+  next();
+});
+
 router.get('/', authenticate, async (req, res) => {
   const { group_name, server_name, sort, status } = req.query;
   let orderClause = 'ORDER BY fi.created_at DESC';