feat(framework): 回灌 OpenFlare 分层、安全与运行时改进

将平台域持久化收敛为 repository 唯一入口，model 去掉 IO。
邮件头写入前清除 CR/LF，防止 header 注入。
httppool 支持可配置 Transport；batchwriter 增加 MinBatchSize/Stats，flush 失败交回批次；任务 PermanentError 作为 SkipRetry 终态。
设置与推送页的确认改为 AlertDialog；axios 去尾斜杠并按 Gin 数组序列化查询参数。
升级共享 Go 依赖（Gin、Asynq、OTel、GORM、Redis 等）。

internal/repository/errs.go

@@ -0,0 +1,25 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package repository
+
+// Persistence and repository-layer parameter messages live here (unexported).
+// Domain field validation used by model.Validate stays in internal/model/errs.go;
+// repository may call model.Validate and return those errors as-is.
+// Keep wording aligned with model where the same user-facing phrase applies,
+// but do not import or re-export model unexported consts (would require exporting).
+const (
+	errDatabaseNotInitialized               = "database not initialized"
+	errConfigIntParseFailed                 = "配置 %s 的值 '%s' 无法转换为整数: %w"
+	errConfigDecimalParseFailed             = "配置 %s 的值 '%s' 无法转换为decimal: %w"
+	errConfigBoolParseFailed                = "配置 %s 的值 '%s' 无法转换为布尔值: %w"
+	errParseMenuDisplayConfigFailed         = "解析目录显示配置失败: %w"
+	errAuthSourceNameRequired               = "认证源名称不能为空"
+	errAuthSourceIDRequired                 = "认证源 ID 不能为空"
+	errExternalAccountBindingIncomplete     = "外部账号绑定信息不完整"
+	errExternalAccountAlreadyBoundToAnother = "该外部账号已绑定到其他用户"
+	errUserIDRequired                       = "用户 ID 不能为空"
+	errExternalAccountBindingIDRequired     = "绑定记录 ID 不能为空"
+)
+
+const colName = "name"