fix: Auth redirects and navigation for landing page routing

- login.html: Post-login redirect / -> /index.html; already-logged-in redirect / -> /index.html
- articles.html, topics.html: Auth failure redirect -> /login.html
- uni-nav.js: Dashboard link / -> /index.html; navigate function fix for prefix handling
- sw.js: Remove / pre-cache; HTML documents use Network First strategy for fresh content

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

platform/frontend/topics.html

@@ -445,7 +445,7 @@ const TopicsApp = {
         getToken() { return localStorage.getItem('authToken'); },
         async api(url, opts = {}) {
             const token = this.getToken();
-            if (!token) { this.$message.error('请先登录'); setTimeout(() => window.location.href = '/', 1500); return null; }
+            if (!token) { this.$message.error('请先登录'); setTimeout(() => window.location.href = '/login.html', 1500); return null; }
             const res = await fetch(url, { headers: { 'Authorization': 'Bearer ' + token, 'Content-Type': 'application/json', ...opts.headers }, ...opts });
             if (!res.ok) { const data = await res.json().catch(() => ({})); throw new Error(data.detail || `请求失败: ${res.status}`); }
             return res.json();
@@ -722,8 +722,22 @@ const TopicsApp = {
             this.editing = false;
             this.editContent = '';
         },
+        sanitizeHtml(html) {
+            const div = document.createElement('div');
+            div.innerHTML = html;
+            div.querySelectorAll('script, iframe, object, embed').forEach(el => el.remove());
+            div.querySelectorAll('*').forEach(el => {
+                for (const attr of el.attributes) {
+                    if (attr.name.startsWith('on') || attr.value.toLowerCase().startsWith('javascript:')) {
+                        el.removeAttribute(attr.name);
+                    }
+                }
+            });
+            return div.innerHTML;
+        },
         async saveContent() {
             if (!this.previewTopic || !this.editContent) { this.$message.warning('没有内容可保存'); return; }
+            this.editContent = this.sanitizeHtml(this.editContent);
             this.savingContent = true;
             try {
                 const original = this.platformContents[this.previewPlatform] || '';