security: fix rate-limit bypass, payment amount check, stats leak, owner-dir collision, video panic guard

- clientIP: stop trusting client-supplied X-Forwarded-For; use gin ClientIP
  with trusted proxies limited to private docker networks
- payment: verify notify money matches order amount; remove hardcoded
  gateway default, fail loudly when api_base is unset
- stats: public endpoint now serves aggregates only; recent files (owner
  names) moved to admin-only /stats/recent
- auth: reject signups whose username/email-local collides with another
  user's media directory namespace
- v1: recover panics in background video jobs, refund + mark failed

backend/internal/repo/user_repo.go

@@ -129,6 +129,18 @@ func (r *UserRepository) ExistsName(ctx context.Context, name, excludeUserID str
 	return count > 0, nil
 }
 
+// ListOwnerCandidates returns every user's name+email. Consumed by the
+// registration-time owner-directory collision check (media paths derive
+// from sanitized names / email local-parts, so those namespaces must stay
+// disjoint across users). Self-hosted user counts keep this scan cheap.
+func (r *UserRepository) ListOwnerCandidates(ctx context.Context) ([]model.User, error) {
+	var users []model.User
+	if err := r.db.WithContext(ctx).Select("name", "email").Find(&users).Error; err != nil {
+		return nil, err
+	}
+	return users, nil
+}
+
 func (r *UserRepository) GetByAPIKeyHash(ctx context.Context, keyHash string) (*model.User, error) {
 	var apiKey model.APIKey
 	if err := r.db.WithContext(ctx).First(&apiKey, "key_hash = ?", keyHash).Error; err != nil {