security: fix rate-limit bypass, payment amount check, stats leak, owner-dir collision, video panic guard

- clientIP: stop trusting client-supplied X-Forwarded-For; use gin ClientIP
  with trusted proxies limited to private docker networks
- payment: verify notify money matches order amount; remove hardcoded
  gateway default, fail loudly when api_base is unset
- stats: public endpoint now serves aggregates only; recent files (owner
  names) moved to admin-only /stats/recent
- auth: reject signups whose username/email-local collides with another
  user's media directory namespace
- v1: recover panics in background video jobs, refund + mark failed

backend/internal/http/handler/admin_read.go

@@ -187,6 +187,17 @@ func (h *AdminReadHandler) Stats(c *gin.Context) {
 	c.JSON(http.StatusOK, stats)
 }
 
+// StatsRecent serves the recent-files list (owner names included) — only
+// mounted on the admin-session route group.
+func (h *AdminReadHandler) StatsRecent(c *gin.Context) {
+	data, err := h.admin.StatsRecent(c.Request.Context())
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "failed to load recent files"})
+		return
+	}
+	c.JSON(http.StatusOK, data)
+}
+
 func (h *AdminReadHandler) Dashboard(c *gin.Context) {
 	data, err := h.admin.Dashboard(c.Request.Context())
 	if err != nil {