fix: 接通服务器V2排序链路

- 将排序参数从V2 Handler传递至Service与Repository

- 增加仓储分页排序与参数白名单测试

backend/repository/repo.go

@@ -23,7 +23,7 @@ func (r *ServerRepository) DB() *gorm.DB {
 }
 
 // List 分页查询服务器列表
-func (r *ServerRepository) List(keyword, status, regionID string, page, pageSize int) ([]model.Server, int64, error) {
+func (r *ServerRepository) List(keyword, status, regionID, sortField, sortOrder string, page, pageSize int) ([]model.Server, int64, error) {
 	q := r.db.Model(&model.Server{})
 	if keyword != "" {
 		q = q.Where("hostname LIKE ? OR ip LIKE ? OR public_ip LIKE ?",
@@ -42,11 +42,22 @@ func (r *ServerRepository) List(keyword, status, regionID string, page, pageSize
 	var list []model.Server
 	err := q.Preload("Region").Preload("Cloud").
 		Offset((page - 1) * pageSize).Limit(pageSize).
-		Order("created_at DESC").Find(&list).Error
+		Order(serverOrderClause(sortField, sortOrder)).Find(&list).Error
 
 	return list, total, err
 }
 
+// serverOrderClause 返回服务器列表允许使用的排序表达式，避免直接拼接请求参数。 // Logan.Li
+func serverOrderClause(sortField, sortOrder string) string {
+	if sortField != "hostname" {
+		return "created_at DESC"
+	}
+	if sortOrder == "desc" {
+		return "LOWER(hostname) DESC, id DESC"
+	}
+	return "LOWER(hostname) ASC, id ASC"
+}
+
 // GetByID 根据 ID 获取服务器
 func (r *ServerRepository) GetByID(id uint) (*model.Server, error) {
 	var s model.Server