评论阶段二：GitHub OAuth 登录 + 评论表/用户表 + 先审后显开关 + 禁言 + 后台评论管理页

- auth 包：读者会话（one_reader，与后台令牌互斥）+ GitHub OAuth 客户端；Verify 校验 HMAC 与 reader: 前缀
- 公开 API：auth 五端点、评论列表（顶层可见+自己待审、回复内嵌）、发表（登录/禁言/开关/500 字校验）、10 分钟编辑窗、软删墓碑
- 管理端：评论列表（待审/已通过/全部）、通过、软删、读者列表、禁言切换
- 前台：登录卡/禁言卡；后台：评论管理页 + 设置页审核开关

frontend/src/api.js

@@ -83,6 +83,14 @@ export const adminApi = {
   deleteProject: (id) => request('/api/admin/projects/' + id, { method: 'DELETE' }),
   settings: () => request('/api/admin/settings'),
   saveSettings: (body) => request('/api/admin/settings', { method: 'PUT', body }),
+  // ---------- 评论管理 ----------
+  comments: (params = {}) => request('/api/admin/comments?' + new URLSearchParams(params)),
+  approveComment: (id) =>
+    request('/api/admin/comments/' + id, { method: 'PUT', body: { status: 'visible' } }),
+  deleteComment: (id) => request('/api/admin/comments/' + id, { method: 'DELETE' }),
+  readers: (params = {}) => request('/api/admin/readers?' + new URLSearchParams(params)),
+  setReaderBanned: (id, banned) =>
+    request('/api/admin/readers/' + id + '/ban', { method: 'POST', body: { banned } }),
   // ---------- 文件上传 ----------
   files: (params = {}) => request('/api/admin/files?' + new URLSearchParams(params)),
   deleteFile: (id) => request('/api/admin/files/' + id, { method: 'DELETE' }),