feat: 同步 huangguo2-server 的 11 个非基线提交

按意图重做在 huakui 代码底：
- 删除数据埋点逻辑：移除 pub/dataReport、reportser、srv_report、
  eventmod、上报定时任务及注册/登录/点赞/收藏/评论/解锁/订单处的
  上报调用和 reportSdkConfig 配置下发
- app 认证改为按设备ID识别用户：去掉 token 校验、Register/Login/
  ResetPassword/GuestLogin 接口，新增 ResolveDeviceUser 和设备缓存
- 广告改为按 AppId 从媒资中心拉取：pub/storage 新增 QueryAdvitise，
  UpdateAdvitiseData 替代 UpdateAdvitiseDataFromJt
- 后台登录取消谷歌二次验证，密码正确即登录
- 短剧/专题 slug 改为 10 位大小写字母+数字混合
- 本地 app.yaml/web.yaml 保留 HKDJNET_* 模板（不提交生产凭据）

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

app/router/gin.go

@@ -70,7 +70,7 @@ func registeMiddleware(engine *gin.Engine) {
 			Methods: []string{http.MethodGet, http.MethodPost, http.MethodPut, http.MethodHead, http.MethodDelete},
 			AllowedHeaders: []string{
 				"Content-Length", "Content-Type", "Authorization", "X-User-Agent",
-				"device", "api_version", "x-api-key",
+				"device", "api_version", "x-api-key", "channel",
 				"sid",
 				"device_brand", "device-brand",
 				"device_model", "device-model",
@@ -78,7 +78,7 @@ func registeMiddleware(engine *gin.Engine) {
 				"system_version", "system-version",
 				useragent.SDKCommonHeader,
 			},
-			ExposedHeaders:       []string{"Content-Disposition", "Refresh-Authorization"},
+			ExposedHeaders:       []string{"Content-Disposition"},
 			OptionsSuccessStatus: http.StatusOK,
 		}),
 		// 必须是此顺序, happens before原则