test: add comprehensive test coverage and improve code quality

- Add new test files for auth, service, and handler modules
- Improve test organization and coverage
- Refactor code for better maintainability
- Add captcha, settings, stats, and theme handler tests
- Add auth module tests (CAS, OAuth, password, SSO, state)
- Add service layer tests for auth, export, permissions, roles
- All Go tests pass (exit code 0)
- All frontend tests pass (325 tests in 59 files)

internal/api/router/router.go

@@ -4,7 +4,7 @@ import (
 	"github.com/gin-gonic/gin"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 	swaggerFiles "github.com/swaggo/files"
-	"github.com/swaggo/gin-swagger"
+	ginSwagger "github.com/swaggo/gin-swagger"
 
 	"github.com/user-management-system/internal/api/handler"
 	"github.com/user-management-system/internal/api/middleware"
@@ -33,9 +33,9 @@ type Router struct {
 	rateLimitMiddleware  *middleware.RateLimitMiddleware
 	opLogMiddleware      *middleware.OperationLogMiddleware
 	ipFilterMiddleware   *middleware.IPFilterMiddleware
-	ssoHandler          *handler.SSOHandler
-	settingsHandler     *handler.SettingsHandler
-	metrics             *monitoring.Metrics // CRIT-01/02: Prometheus 指标
+	ssoHandler           *handler.SSOHandler
+	settingsHandler      *handler.SettingsHandler
+	metrics              *monitoring.Metrics // CRIT-01/02: Prometheus 指标
 }
 
 func NewRouter(
@@ -86,20 +86,20 @@ func NewRouter(
 		smsHandler:           smsHandler,
 		customFieldHandler:   customFieldHandler,
 		themeHandler:         themeHandler,
-		ssoHandler:          ssoHandler,
-		settingsHandler:     settingsHandler,
+		ssoHandler:           ssoHandler,
+		settingsHandler:      settingsHandler,
 		avatarHandler:        avatar,
 		authMiddleware:       authMiddleware,
 		rateLimitMiddleware:  rateLimitMiddleware,
 		opLogMiddleware:      opLogMiddleware,
 		ipFilterMiddleware:   ipFilterMiddleware,
-		metrics:             metrics,
+		metrics:              metrics,
 	}
 }
 
 func (r *Router) Setup() *gin.Engine {
 	r.engine.Use(middleware.Recover())
-	r.engine.Use(middleware.TraceID())       // 可观察性补强：每个请求生成唯一 trace_id
+	r.engine.Use(middleware.TraceID()) // 可观察性补强：每个请求生成唯一 trace_id
 	r.engine.Use(middleware.ErrorHandler())
 	r.engine.Use(middleware.Logger())
 	r.engine.Use(middleware.SecurityHeaders())