fix: v6 code review P0 auth/IDOR fixes + frontend regression patches

Backend fixes:
- auth_handler: P0 认证逻辑修复
- ratelimit: 限速中间件增强 + 新增单元测试
- auth_service: 认证服务逻辑完善 + 新增测试
- server: server 配置增强 + 新增测试
- handler_test: 新增 handler 层集成测试
- auth_bootstrap_test: bootstrap 路径测试

Frontend patches:
- LoginPage/RegisterPage: CSRF + 表单交互修复
- BootstrapAdminPage: 引导流程修复
- DevicesPage: 设备管理页修复
- auth/social-accounts/users/webhooks services: 类型修正
- csrf.ts: CSRF token 处理修正
- E2E 脚本: CDP smoke + auth e2e 增强

Docs:
- FULL_CODE_REVIEW_REPORT_2026-04-20
- report-v6 执行计划
- REAL_PROJECT_STATUS 更新
- .gitignore: 新增 .gocache-*/config.yaml 排除

验证: go build/vet 0错误, go test 42/42 PASS, 0 FAIL

internal/service/auth_email.go

@@ -69,13 +69,17 @@ func (s *AuthService) RegisterWithActivation(ctx context.Context, req *RegisterR
 	if s.emailActivationSvc != nil && req.Email != "" {
 		initialStatus = domain.UserStatusInactive
 	}
+	nickname := req.Nickname
+	if nickname == "" {
+		nickname = req.Username
+	}
 
 	user := &domain.User{
 		Username: req.Username,
 		Email:    domain.StrPtr(req.Email),
 		Phone:    domain.StrPtr(req.Phone),
 		Password: hashedPassword,
-		Nickname: req.Nickname,
+		Nickname: nickname,
 		Status:   initialStatus,
 	}
 	if err := s.userRepo.Create(ctx, user); err != nil {
@@ -85,10 +89,6 @@ func (s *AuthService) RegisterWithActivation(ctx context.Context, req *RegisterR
 	s.bestEffortAssignDefaultRoles(ctx, user.ID, "register_with_activation")
 
 	if s.emailActivationSvc != nil && req.Email != "" {
-		nickname := req.Nickname
-		if nickname == "" {
-			nickname = req.Username
-		}
 		// #nosec G118 - 使用独立上下文避免请求结束后被取消
 		go func() { // #nosec G118
 			bgCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)