security: backend validation for all inputs

- router.param('id'): all :id path params must be positive ints
  (tickets/features/polls/auth/users; external/bans/notifications already
  had parseInt - now consistent)
- notifications: type enum + webhook URL format + SSRF (isPrivateUrl
  exported) + events whitelist + active boolean check on PUT
- bans: type enum + player_name length
- external: all-tickets type/status enums, bans status/type enums,
  page/limit floor protection, ticket field length caps, clients active
  boolean + id validation
- verified: 28 checks (syntax + validation coverage)

backend/routes/tickets.js

@@ -28,6 +28,12 @@ const { validateLengths, ticketAnonLimiter } = require('../middleware/security')
 
 const router = express.Router();
 
+// 统一校验 :id 路径参数(必须是正整数)
+router.param('id', (req, res, next, id) => {
+  if (!/^\d+$/.test(id)) return res.status(400).json({ error: '无效的ID' });
+  next();
+});
+
 const SL = { pending:'待处理', processing:'处理中', awaiting_info:'待补充', appealing:'申诉中', resolved:'已解决', rejected:'已驳回', closed:'已关闭' };
 const TL = { report:'举报', suggestion:'建议', appeal:'申诉', result_appeal:'结果申诉' };
 const SC = { pending:'#f59e0b', processing:'#7c3aed', awaiting_info:'#d97706', appealing:'#f97316', resolved:'#059669', rejected:'#dc2626', closed:'#6b7280' };