fix: restore security hardening compatibility and validation

Restore authorized rule reveal, explicit full HTTP capture and retention, video task business fields, and valid payment URLs. Add opt-in credential preservation for trusted recovery, fix frontend type contracts and async races, and eliminate PostgreSQL test fixture resource leaks. Document audit coverage and successful fmt and CI-scoped Clippy checks.

frontend/src/features/users/components/UserBatchQuotaPanel.vue

@@ -24,7 +24,7 @@
         </div>
         <Select
           :model-value="modelValue"
-          @update:model-value="$emit('update:modelValue', $event)"
+          @update:model-value="($event === 'skip' || $event === 'wallet' || $event === 'unlimited') && $emit('update:modelValue', $event)"
         >
           <SelectTrigger class="h-9 w-full">
             <SelectValue />

frontend/src/features/users/components/UserBatchRolePanel.vue

@@ -23,7 +23,7 @@
       </div>
       <Select
         :model-value="modelValue"
-        @update:model-value="$emit('update:modelValue', $event)"
+        @update:model-value="($event === 'user' || $event === 'admin' || $event === 'audit_admin') && $emit('update:modelValue', $event)"
       >
         <SelectTrigger class="h-10 w-full">
           <SelectValue />

frontend/src/features/users/components/UserFilterControls.vue

@@ -17,7 +17,7 @@
     <div class="xl:hidden">
       <Select
         :model-value="filterRole"
-        @update:model-value="$emit('update:filterRole', $event)"
+        @update:model-value="updateRole"
       >
         <SelectTrigger :class="mobile ? 'w-24 h-8 text-xs border-border/60' : 'w-32 h-8 text-xs border-border/60'">
           <SelectValue :placeholder="legacyT(mobile ? '角色' : '全部角色')" />
@@ -37,7 +37,7 @@
     <div class="xl:hidden">
       <Select
         :model-value="filterStatus"
-        @update:model-value="$emit('update:filterStatus', $event)"
+        @update:model-value="updateStatus"
       >
         <SelectTrigger :class="mobile ? 'w-20 h-8 text-xs border-border/60' : 'w-28 h-8 text-xs border-border/60'">
           <SelectValue :placeholder="legacyT(mobile ? '状态' : '全部状态')" />
@@ -78,7 +78,7 @@
     <div class="xl:hidden">
       <Select
         :model-value="sortOption"
-        @update:model-value="$emit('update:sortOption', $event)"
+        @update:model-value="updateSort"
       >
         <SelectTrigger :class="mobile ? 'w-32 h-8 text-xs border-border/60' : 'w-40 h-8 text-xs border-border/60'">
           <SelectValue :placeholder="legacyT('排序')" />
@@ -133,7 +133,7 @@ const props = withDefaults(defineProps<{
   mobile: false,
 })
 
-defineEmits<{
+const emit = defineEmits<{
   'update:searchQuery': [value: string]
   'update:filterRole': [value: FilterRole]
   'update:filterGroup': [value: string]
@@ -141,6 +141,21 @@ defineEmits<{
   'update:sortOption': [value: SortOption]
 }>()
 
+function updateRole(value: string) {
+  const option = props.roleOptions.find((option) => option.value === value)
+  if (option) emit('update:filterRole', option.value)
+}
+
+function updateStatus(value: string) {
+  const option = props.statusOptions.find((option) => option.value === value)
+  if (option) emit('update:filterStatus', option.value)
+}
+
+function updateSort(value: string) {
+  const option = props.sortOptions.find((option) => option.value === value)
+  if (option) emit('update:sortOption', option.value)
+}
+
 const { legacyT } = useI18n()
 const searchPlaceholder = computed(() => props.mobile ? legacyT('搜索...') : legacyT('搜索用户名或邮箱...'))
 </script>

frontend/src/features/users/components/UserFormDialog.vue

@@ -295,7 +295,7 @@ import {
   validatePasswordByPolicy,
   type PasswordPolicyLevel,
 } from '@/utils/passwordPolicy'
-import type { UserGroup } from '@/api/users'
+import type { UserGroup, UserRole } from '@/api/users'
 
 export interface UserFormData {
   id?: string
@@ -303,7 +303,7 @@ export interface UserFormData {
   email: string
   initial_gift_usd?: number | null
   unlimited?: boolean
-  role: 'admin' | 'user'
+  role: UserRole
   is_active?: boolean
   group_ids?: string[]
   feature_settings?: Record<string, unknown> | null
@@ -332,7 +332,7 @@ const form = ref({
   confirmPassword: '',
   email: '',
   initial_gift_usd: 10 as number | undefined,
-  role: 'user' as 'admin' | 'user',
+  role: 'user' as UserRole,
   unlimited: false,
   is_active: true,
   group_ids: [] as string[],