feat: 添加用户注册登录功能，实现数据和配置的用户隔离

- 新增 users 和 user_settings 表，repositories/analyses/review_notes 添加 user_id 列
- 实现基于邮箱+密码的注册登录，密码使用 bcrypt 哈希
- 使用 gin-contrib/sessions cookie-based session 管理
- 所有仓库、分析记录、review notes 按用户隔离
- 用户设置（LLM 配置、review 参数、缓存配置）独立存储
- 新增登录/注册页面，导航栏显示用户邮箱和退出按钮
- 前端 fetch 请求统一添加 credentials: 'same-origin'
- 支持 SESSION_SECRET 环境变量配置会话密钥

handlers/settings.go

@@ -16,8 +16,14 @@ func NewSettingsHandler(db *sql.DB) *SettingsHandler {
 }
 
 func (h *SettingsHandler) GetSettings(c *gin.Context) {
+	user := GetCurrentUser(c)
+	if user == nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthenticated"})
+		return
+	}
+
 	settings := make(map[string]string)
-	rows, err := h.db.Query(`SELECT key, value FROM settings`)
+	rows, err := h.db.Query(`SELECT key, value FROM user_settings WHERE user_id = ?`, user.ID)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -33,6 +39,12 @@ func (h *SettingsHandler) GetSettings(c *gin.Context) {
 }
 
 func (h *SettingsHandler) UpdateSettings(c *gin.Context) {
+	user := GetCurrentUser(c)
+	if user == nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthenticated"})
+		return
+	}
+
 	var body map[string]string
 	if err := c.ShouldBindJSON(&body); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid request body"})
@@ -44,7 +56,7 @@ func (h *SettingsHandler) UpdateSettings(c *gin.Context) {
 		return
 	}
 	for key, val := range body {
-		_, err := tx.Exec(`INSERT OR REPLACE INTO settings (key, value) VALUES (?, ?)`, key, val)
+		_, err := tx.Exec(`INSERT OR REPLACE INTO user_settings (user_id, key, value) VALUES (?, ?, ?)`, user.ID, key, val)
 		if err != nil {
 			tx.Rollback()
 			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})