security: fix rate-limit bypass, payment amount check, stats leak, owner-dir collision, video panic guard

- clientIP: stop trusting client-supplied X-Forwarded-For; use gin ClientIP
  with trusted proxies limited to private docker networks
- payment: verify notify money matches order amount; remove hardcoded
  gateway default, fail loudly when api_base is unset
- stats: public endpoint now serves aggregates only; recent files (owner
  names) moved to admin-only /stats/recent
- auth: reject signups whose username/email-local collides with another
  user's media directory namespace
- v1: recover panics in background video jobs, refund + mark failed

backend/internal/service/admin_read.go

@@ -221,7 +221,6 @@ func (s *AdminReadService) Stats(ctx context.Context) (map[string]any, error) {
 	if err != nil {
 		return nil, err
 	}
-	recentFiles, _ := s.RecentImages(ctx, 24)
 	files, _, _ := s.scanGeneratedFiles(ctx)
 	// Exclude homepage showcase media so 已生成作品 matches the 作品管理 total.
 	pinned := map[string]struct{}{}
@@ -239,15 +238,26 @@ func (s *AdminReadService) Stats(ctx context.Context) (map[string]any, error) {
 		count++
 		size += f.Size
 	}
+	// Aggregate-only: `recent` (owner dirs + filenames) is served via
+	// StatsRecent behind an admin session — it must not leak publicly.
 	return map[string]any{
 		"generated_count":      count,
 		"generated_size_bytes": size,
-		"recent":               recentFiles,
 		"avg_elapsed_ms":       stats.AvgElapsedMS,
 		"avg_elapsed_ms_24h":   stats.AvgElapsedMS24,
 	}, nil
 }
 
+// StatsRecent backs the admin image picker; the route lives in the
+// RequireAdminSession group because entries carry per-user owner names.
+func (s *AdminReadService) StatsRecent(ctx context.Context) (map[string]any, error) {
+	recentFiles, err := s.RecentImages(ctx, 24)
+	if err != nil {
+		return nil, err
+	}
+	return map[string]any{"recent": recentFiles}, nil
+}
+
 // Dashboard assembles the admin overview's analytics entirely server-side
 // (event windows, hourly trend, top models/failures/spenders) plus CDK / invite
 // / checkin summaries. This replaces the old client-side math over the last 200