feat(backend): unified response helpers, refresh token, security hardening

- new resp package (OK/Page/Fail/BadRequest/.../InternalErr): unified error
  envelope {detail, code?}, sanitized 500s (full error logged server-side,
  generic message to client - stops DB error leakage), pagination envelope
  {items,total,page,page_size}; migrate 200+ inline c.JSON error sites
- refresh token: 7d rotation tokens (SHA-256 hashed at rest), public
  POST /auth/refresh with single-use rotation, POST /auth/logout revokes
  all user refresh tokens (endpoint previously missing - frontend 404)
- security: gh-ost command line password masked in task status payload;
  Instance.MarshalJSON guarantees encrypted passwords never leave the API
  (removes reliance on per-handler manual masking); production (DEBUG=false)
  with default JWT secret now auto-generates and persists a random secret
- safe.Go recover wrapper for background goroutines (instance probe,
  gh-ost async)
- delete dead service layer (zero callers)
- fix pre-existing go vet unkeyed bson.E literals

backend/internal/handler/dashboard.go

@@ -32,19 +32,19 @@ func DashboardStats(c *gin.Context) {
 	model.DB.Model(&model.Ticket{}).Select("db_type as db_type, count(*) as count").Group("db_type").Scan(&typeDist)
 
 	c.JSON(http.StatusOK, gin.H{
-		"ticket_total":     ticketTotal,
-		"ticket_pending":   ticketPending,
-		"ticket_month":     ticketTotal, // 简化
-		"ticket_executing": ticketExecuting,
-		"instance_total":   instanceTotal,
-		"instance_online":  instanceOnline,
-		"user_total":       userTotal,
-		"queries_today":    queriesToday,
+		"ticket_total":      ticketTotal,
+		"ticket_pending":    ticketPending,
+		"ticket_month":      ticketTotal, // 简化
+		"ticket_executing":  ticketExecuting,
+		"instance_total":    instanceTotal,
+		"instance_online":   instanceOnline,
+		"user_total":        userTotal,
+		"queries_today":     queriesToday,
 		"type_distribution": typeDist,
 		"query_stats": gin.H{
-			"total":            queriesToday,
-			"avg_time_ms":      0,
-			"slow_count":       0,
+			"total":             queriesToday,
+			"avg_time_ms":       0,
+			"slow_count":        0,
 			"type_distribution": typeDist,
 		},
 	})