26.9（安全审计修复版）

Go 1.27.1 (Gin+GORM) + Vue 3 文件快传服务：

- 安全审计全部修复（docs/security-audit-2026-09-05.md）：
  bcrypt 密码哈希与自动升级、presign 直传服务端大小/内容校验、
  全局请求体上限、依赖升级（govulncheck 0 命中）、janitor 后台清理、
  管理端审计动作落库、/admin CORS 收紧、通知内容白名单净化、
  会话默认 7 天、限流缓存故障降级、robots.txt 端点等
- 前端：取件链接复制修复（不再重复拼接提取码）、markdown 净化器加固
- Redis 支持库号（FCB_REDIS_DB / redis://…/db URL）
- 文档：docs/api/* 与 openapi.yaml 同步最新行为（robots.txt、
  提码 5 位起、chunk 32MiB 上限、admin 审计动作等）

验证：gofmt/go vet/go test 全绿；二进制端到端冒烟通过

server/internal/audit/ua_test.go

@@ -0,0 +1,45 @@
+package audit
+
+import "testing"
+
+func TestParseUserAgent(t *testing.T) {
+	cases := []struct {
+		ua      string
+		os      string
+		browser string
+		typ     string
+	}{
+		{
+			ua: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
+			os: "Windows", browser: "Chrome", typ: "desktop",
+		},
+		{
+			ua: "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1",
+			os: "iOS", browser: "Safari", typ: "mobile",
+		},
+		{
+			ua: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0",
+			os: "macOS", browser: "Edge", typ: "desktop",
+		},
+		{
+			ua: "Mozilla/5.0 (Linux; Android 13; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Mobile Safari/537.36",
+			os: "Android", browser: "Chrome", typ: "mobile",
+		},
+		{
+			ua: "curl/8.4.0",
+			os: "Unknown", browser: "Other", typ: "bot",
+		},
+		{
+			ua: "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0",
+			os: "Linux", browser: "Firefox", typ: "desktop",
+		},
+		{ua: "", os: "Unknown", browser: "Other", typ: "other"},
+	}
+	for i, tc := range cases {
+		got := ParseUserAgent(tc.ua)
+		if got.OS != tc.os || got.Browser != tc.browser || got.Type != tc.typ {
+			t.Errorf("case %d: ParseUserAgent(%q) = %+v, want os=%s browser=%s type=%s",
+				i, tc.ua, got, tc.os, tc.browser, tc.typ)
+		}
+	}
+}