feat(be+admin): 后台看板扩展 + 社区内容安全审核

看板（Recharts）:
- 概览页加 DAU/WAU/MAU、今日/本月新增 KPI，新增趋势/活跃趋势/月活/留存曲线
- GET /admin/analytics 内存计算，活跃口径=当天有记录/发帖/评论，排除 bot

内容安全（微信官方 UGC）:
- 文本 msg_sec_check 同步判、图片 media_check_async 异步查
- 帖子/评论加 pending/rejected 审核态，feed 只放 published
- 图片结果回调 /api/wx/sec-callback，JSON/XML + 明文模式，签名校验
- 检测不了/未发布时一律转待审核，走后台手动审核
- 后台帖子/评论审核页：修好看不到图（补 attachPostImages）、
  加状态筛选 + 通过/打回；新增评论审核状态接口

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

pets-be/internal/handler/admin.go

@@ -1,6 +1,8 @@
 package handler
 
 import (
+	"strconv"
+
 	"github.com/gin-gonic/gin"
 
 	"github.com/sundynix/pets-be/internal/middleware"
@@ -109,6 +111,17 @@ func (h *Handler) AdminStats(c *gin.Context) {
 	response.OK(c, stats)
 }
 
+// AdminAnalytics GET /api/admin/analytics?days=30 看板的活跃/新增/留存
+func (h *Handler) AdminAnalytics(c *gin.Context) {
+	days, _ := strconv.Atoi(c.Query("days"))
+	data, err := h.svc.AdminAnalytics(days)
+	if err != nil {
+		response.FailErr(c, err)
+		return
+	}
+	response.OK(c, data)
+}
+
 type adminListReq struct {
 	response.PageQuery
 	Keyword string `form:"keyword"`
@@ -196,7 +209,7 @@ func (h *Handler) AdminListComments(c *gin.Context) {
 	var req adminListReq
 	_ = c.ShouldBindQuery(&req)
 	req.Normalize()
-	comments, total, err := h.svc.ListCommentsAdmin(req.Offset(), req.Limit())
+	comments, total, err := h.svc.ListCommentsAdmin(req.Status, req.Offset(), req.Limit())
 	if err != nil {
 		response.FailErr(c, err)
 		return
@@ -204,6 +217,20 @@ func (h *Handler) AdminListComments(c *gin.Context) {
 	response.OK(c, response.NewPage(comments, total, req.PageQuery))
 }
 
+// AdminSetCommentStatus PUT /api/admin/comments/:id/status
+func (h *Handler) AdminSetCommentStatus(c *gin.Context) {
+	var req postStatusReq
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.FailParams(c, err.Error())
+		return
+	}
+	if err := h.svc.SetCommentStatus(idParam(c, "id"), req.Status); err != nil {
+		response.FailErr(c, err)
+		return
+	}
+	response.OK(c, gin.H{"ok": true})
+}
+
 // AdminDeleteComment DELETE /api/admin/comments/:id
 func (h *Handler) AdminDeleteComment(c *gin.Context) {
 	if err := h.svc.DeleteCommentAdmin(idParam(c, "id")); err != nil {