取消游客模式，强制登录后使用

backend/internal/middleware/auth.go

@@ -19,6 +19,11 @@ type CurrentUser struct {
 	Role     models.RoleName
 }
 
+var publicPaths = map[string]struct{}{
+	"/api/auth/register": {},
+	"/api/auth/login":    {},
+}
+
 func AuthMiddleware(cfg *config.Config, db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		authHeader := c.GetHeader("Authorization")
@@ -41,6 +46,17 @@ func AuthMiddleware(cfg *config.Config, db *gorm.DB) gin.HandlerFunc {
 			}
 		}
 
+		if _, exists := c.Get("currentUser"); !exists {
+			if c.Request.Method == "OPTIONS" {
+				c.Next()
+				return
+			}
+			if _, ok := publicPaths[c.Request.URL.Path]; !ok {
+				c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"success": false, "error": "访问令牌无效或已过期"})
+				return
+			}
+		}
+
 		c.Next()
 	}
 }