安全加固 + 结构清理：修注入/串写/竞态，DOMPurify 上线，后端补事务与 handler 测试

后端：
- ORDER BY 白名单（sanitizeOrder）堵住 ?order= SQL 注入，补回归测试
- 登录限速（每 IP 10 次失败/10 分钟 429）、TLS/反代下 Secure cookie、NewAPI 构造器
- Delete/setTags/MergeTags/DeleteTag 包事务；Archive 去 500 篇上限
- 列表接口裁剪：不传 content_md，长文 content_html 截 600，新增 content_len；health 探 DB

前端：
- EditorView 路由复用串写修复（RouterView :key + sync watch 回写原文章）
- v-html 出口统一过 DOMPurify（sanitizeHtml），stripTags 改 DOMParser
- 列表竞态防护（Home/Tag/Posts 请求序号）、TagView 分页修复
- 侧栏接口 30s 缓存去重；one:unauthorized 监听器泄漏修复
- 删 styles.css 498 行重复块；移除 tailwind/marked/vue-tsc 死依赖；CommandPalette a11y 语义

frontend/package.json

@@ -7,15 +7,11 @@
   "scripts": {
     "dev": "vite",
     "build": "vite build",
-    "preview": "vite preview",
-    "typecheck": "vue-tsc --noEmit"
+    "preview": "vite preview"
   },
   "dependencies": {
-    "@egoist/tailwindcss-icons": "^1.8.0",
-    "@iconify-json/mingcute": "^1.1.17",
     "@milkdown/crepe": "^7.22.1",
     "dompurify": "^3.1.6",
-    "marked": "^12.0.2",
     "vue": "^3.4.0",
     "vue-router": "^4.4.0"
   },
@@ -23,10 +19,8 @@
     "@vitejs/plugin-vue": "^5.1.0",
     "autoprefixer": "^10.4.20",
     "postcss": "^8.4.40",
-    "tailwindcss": "^3.4.3",
     "typescript": "^5.5.0",
-    "vite": "^5.4.0",
-    "vue-tsc": "^2.1.0"
+    "vite": "^5.4.0"
   },
   "pnpm": {
     "onlyBuiltDependencies": [