fix(security): P1/P2 审计修复 + JWT HttpOnly Cookie 双模认证 + 限流

- P0/P1 审计修复: 滑块验证码不再下发 x_position/成败即销毁 key、
  user-login 补失败计数+滑块门控、限流标识改 X-Real-IP、
  百度翻译 appkey 环境化、ChangeEmail/ChangePhone 补调 avalidate、
  logs/tasks.py Count(filter=Q) 修复、chat 收藏 SSRF 内网黑名单
- P1 #6/7: token_blacklist + ROTATE_REFRESH_TOKENS 开启,
  /user/token/refresh/ 挂载
- #2 JWT HttpOnly Cookie 双模认证: user/cookie_auth.py 种/清 Cookie,
  user/authentication.py CookieOrHeaderJWTAuthentication(Bearer 优先/_COOKIE 兜底),
  user/views/token.py CookieTokenRefreshView + UserLogoutAPIView(/user/logout/),
  create_standardized_response 自动对含 token 的响应种 Cookie,
  异步视图内 RefreshToken.for_user 全部 sync_to_async 包裹(修 SynchronousOnlyOperation 500),
  WS ChatConsumer 优先读 Cookie token
- P2 #11 限流: utils/rate_limit.py 固定窗口频控,
  shorturl 生成 匿名10次/分+登录60次/分, 邮箱验证码 同邮箱60s1次+同IP10次/10min,
  登录/注册验证码 错5次作废+成功即销毁防重放, 换绑邮箱/手机 同步落地,
  urls.py 补挂 shorturl 路由(此前 404)

user/views/email.py

@@ -44,6 +44,15 @@ class SendChangeEmailCodeAPIView(APIView):
 
         identifier = str(request.user.id)
         operation = 'change_email'
+
+        from utils.rate_limit import check_rate_limit
+        if not await sync_to_async(check_rate_limit)('change_email_send', identifier, limit=1, window_seconds=60):
+            return create_standardized_error_response(
+                code=ResponseCode.PARAMETER_ERROR,
+                message="验证码发送过于频繁，请60秒后再试",
+                status_code=status.HTTP_429_TOO_MANY_REQUESTS
+            )
+
         captcha_required = await sync_to_async(check_captcha_required)(operation, identifier)
 
         if captcha_required:
@@ -156,6 +165,17 @@ class ChangeEmailAPIView(APIView):
                 status_code=status.HTTP_400_BAD_REQUEST
             )
 
+        # 安全修复：此前从未调用 avalidate，邮箱验证码形同虚设（任何已登录用户可无码改绑邮箱）
+        try:
+            await serializer.avalidate(serializer.validated_data)
+        except Exception as e:
+            return create_standardized_error_response(
+                data=getattr(e, 'detail', None) or {'code': [str(e)]},
+                code=ResponseCode.PARAMETER_ERROR,
+                message='验证码校验失败',
+                status_code=status.HTTP_400_BAD_REQUEST
+            )
+
         try:
             updated_user = await serializer.asave()
             user_serializer = UserSerializer(updated_user)