feat(framework): 回灌 OpenFlare 分层、安全与运行时改进

将平台域持久化收敛为 repository 唯一入口，model 去掉 IO。
邮件头写入前清除 CR/LF，防止 header 注入。
httppool 支持可配置 Transport；batchwriter 增加 MinBatchSize/Stats，flush 失败交回批次；任务 PermanentError 作为 SkipRetry 终态。
设置与推送页的确认改为 AlertDialog；axios 去尾斜杠并按 Gin 数组序列化查询参数。
升级共享 Go 依赖（Gin、Asynq、OTel、GORM、Redis 等）。

pkg/mail/mail.go

@@ -12,6 +12,7 @@ import (
 	"net"
 	"net/smtp"
 	"strconv"
+	"strings"
 	"time"
 )
 
@@ -29,6 +30,14 @@ type Config struct {
 	Password string
 }
 
+// sanitizeHeaderValue removes CR/LF bytes so untrusted values cannot inject
+// additional email headers (email header injection).
+func sanitizeHeaderValue(v string) string {
+	v = strings.ReplaceAll(v, "\r", "")
+	v = strings.ReplaceAll(v, "\n", "")
+	return v
+}
+
 // SendMail sends an HTML email using the provided config and message details
 func SendMail(ctx context.Context, cfg Config, to string, subject, body string) error {
 	return SendMailHTML(ctx, cfg, to, subject, body)
@@ -40,9 +49,9 @@ func SendMailHTML(ctx context.Context, cfg Config, to string, subject, body stri
 
 	// Header & MIME settings for HTML email
 	header := make(map[string]string)
-	header["From"] = cfg.Username
-	header["To"] = to
-	header["Subject"] = subject
+	header["From"] = sanitizeHeaderValue(cfg.Username)
+	header["To"] = sanitizeHeaderValue(to)
+	header["Subject"] = sanitizeHeaderValue(subject)
 	header["MIME-Version"] = "1.0"
 	header["Content-Type"] = "text/html; charset=UTF-8"
 
@@ -212,9 +221,9 @@ func SendMailWithLog(ctx context.Context, cfg Config, to string, subject, body s
 
 	// Header & MIME settings for HTML email
 	header := make(map[string]string)
-	header["From"] = cfg.Username
-	header["To"] = to
-	header["Subject"] = subject
+	header["From"] = sanitizeHeaderValue(cfg.Username)
+	header["To"] = sanitizeHeaderValue(to)
+	header["Subject"] = sanitizeHeaderValue(subject)
 	header["MIME-Version"] = "1.0"
 	header["Content-Type"] = "text/html; charset=UTF-8"