feat: 管理员跨租户管理 + 注册开关

- 管理员可管理任意用户笔记(读取/修改/删除/回收站/标签/图谱/FTS 全平台)
- 普通用户仍数据隔离, 越权返回404
- 新增注册开关: 管理员后台⚙设置可开/关, 支持REGISTRATION_ENABLED环境变量
- 注册关闭时前台/登录页隐藏注册入口, 注册接口返回400
- 冒烟测试扩展到91用例全过

handler/auth_handler.go

@@ -82,7 +82,9 @@ func (h *AuthHandler) Logout(c *gin.Context) {
 func (h *AuthHandler) Me(c *gin.Context) {
 	uid := middleware.GetUserID(c)
 	if uid == 0 {
-		success(c, nil)
+		success(c, gin.H{
+			"registration_enabled": h.userSvc.RegistrationEnabled(),
+		})
 		return
 	}
 	u, err := h.userSvc.GetByID(uid)
@@ -91,9 +93,39 @@ func (h *AuthHandler) Me(c *gin.Context) {
 		return
 	}
 	success(c, gin.H{
-		"id":           u.ID,
-		"username":     u.Username,
-		"display_name": u.DisplayName,
-		"role":         u.Role,
+		"id":                  u.ID,
+		"username":            u.Username,
+		"display_name":        u.DisplayName,
+		"role":                u.Role,
+		"registration_enabled": h.userSvc.RegistrationEnabled(),
 	})
 }
+
+// GetRegistrationStatus 获取注册开关状态（管理员）
+func (h *AuthHandler) GetRegistrationStatus(c *gin.Context) {
+	if !h.userSvc.IsAdmin(middleware.GetUserID(c)) {
+		fail(c, http.StatusForbidden, "仅管理员可操作")
+		return
+	}
+	success(c, gin.H{"registration_enabled": h.userSvc.RegistrationEnabled()})
+}
+
+// SetRegistration 切换注册开关（管理员）
+func (h *AuthHandler) SetRegistration(c *gin.Context) {
+	if !h.userSvc.IsAdmin(middleware.GetUserID(c)) {
+		fail(c, http.StatusForbidden, "仅管理员可操作")
+		return
+	}
+	var req struct {
+		Enabled bool `json:"enabled"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		fail(c, http.StatusBadRequest, "请求参数错误")
+		return
+	}
+	if err := h.userSvc.SetRegistrationEnabled(req.Enabled); err != nil {
+		fail(c, http.StatusInternalServerError, err.Error())
+		return
+	}
+	success(c, gin.H{"registration_enabled": req.Enabled})
+}