test: add comprehensive test coverage and improve code quality

- Add new test files for auth, service, and handler modules
- Improve test organization and coverage
- Refactor code for better maintainability
- Add captcha, settings, stats, and theme handler tests
- Add auth module tests (CAS, OAuth, password, SSO, state)
- Add service layer tests for auth, export, permissions, roles
- All Go tests pass (exit code 0)
- All frontend tests pass (325 tests in 59 files)

internal/auth/state.go

@@ -12,13 +12,11 @@ type StateManager struct {
 	ttl    time.Duration
 }
 
-var (
-	// 全局状态管理器
-	stateManager = &StateManager{
-		states: make(map[string]time.Time),
-		ttl:    10 * time.Minute, // 10分钟过期
-	}
-)
+// 全局状态管理器
+var stateManager = &StateManager{
+	states: make(map[string]time.Time),
+	ttl:    10 * time.Minute, // 10分钟过期
+}
 
 // Note: GenerateState and ValidateState are defined in oauth_utils.go
 // to avoid duplication, please use those implementations
@@ -34,12 +32,12 @@ func (sm *StateManager) Store(state string) {
 func (sm *StateManager) Validate(state string) bool {
 	sm.mu.RLock()
 	defer sm.mu.RUnlock()
-	
+
 	expiredAt, exists := sm.states[state]
 	if !exists {
 		return false
 	}
-	
+
 	// 检查是否过期
 	return time.Now().Before(expiredAt.Add(sm.ttl))
 }
@@ -55,7 +53,7 @@ func (sm *StateManager) Delete(state string) {
 func (sm *StateManager) Cleanup() {
 	sm.mu.Lock()
 	defer sm.mu.Unlock()
-	
+
 	now := time.Now()
 	for state, expiredAt := range sm.states {
 		if now.After(expiredAt.Add(sm.ttl)) {