security+fix: 评审修复——下线webview-token任意账号接管；progress接口付费字段只读；检测题答案脱敏；读接口不记日志；share-gain每日限3次防刷；页面标题/分享标题搜索优化

server/src/routes/admin.js

@@ -106,7 +106,6 @@ router.get('/dashboard', requirePermission('dashboard:read'), async (req, res) =
       Order.getWeekTrend()
     ])
     
-    await logAction(req, 'read', 'dashboard')
     
     return ApiResponse.success(res, {
       today: {
@@ -201,7 +200,6 @@ router.get('/users', requirePermission('users:read'), async (req, res) => {
       }
     })
     
-    await logAction(req, 'read', 'users', null, { page, limit, search })
     
     return ApiResponse.paginated(res, formattedUsers, {
       page: parseInt(page),
@@ -263,7 +261,6 @@ router.get('/users/:id', requirePermission('users:read'), async (req, res) => {
     
     // 画廊（Gallery）功能已移除，作品数为 0
     
-    await logAction(req, 'read', 'users', req.params.id)
     
     return ApiResponse.success(res, {
       ...user,
@@ -302,7 +299,6 @@ router.get('/knowledge', requirePermission('knowledge:read'), async (req, res) =
       .limit(parseInt(limit))
       .lean()
     
-    await logAction(req, 'read', 'knowledge', null, { page, limit, dim, status })
     
     return ApiResponse.paginated(res, knowledge, {
       page: parseInt(page),
@@ -435,7 +431,6 @@ router.get('/orders', requirePermission('orders:read'), async (req, res) => {
       .limit(parseInt(limit))
       .lean()
     
-    await logAction(req, 'read', 'orders', null, { page, limit, status })
     
     return ApiResponse.paginated(res, orders, {
       page: parseInt(page),
@@ -464,7 +459,6 @@ router.get('/shop', requirePermission('shop:read'), async (req, res) => {
       .limit(parseInt(limit))
       .lean()
     
-    await logAction(req, 'read', 'shop', null, { page, limit, status })
     
     return ApiResponse.paginated(res, items, {
       page: parseInt(page),
@@ -555,7 +549,6 @@ router.get('/admins', requirePermission('*'), async (req, res) => {
       .sort({ createdAt: -1 })
       .lean()
     
-    await logAction(req, 'read', 'admins')
     
     return ApiResponse.success(res, admins)
     
@@ -580,7 +573,6 @@ router.get('/shop-items', requirePermission('shop:read'), async (req, res) => {
       .limit(parseInt(limit))
       .lean()
     
-    await logAction(req, 'read', 'shop', null, { page, limit, status })
     
     return ApiResponse.paginated(res, items, {
       page: parseInt(page),
@@ -890,7 +882,6 @@ router.get('/feedback', requirePermission('feedback:read'), async (req, res) =>
       hasImages: fb.images?.length > 0
     }))
     
-    await logAction(req, 'read', 'feedback', null, { page, limit, status, type })
     
     return ApiResponse.paginated(res, formattedFeedbacks, {
       page: parseInt(page),
@@ -918,7 +909,6 @@ router.get('/feedback/:id', requirePermission('feedback:read'), async (req, res)
       return ApiResponse.notFound(res, '反馈不存在')
     }
     
-    await logAction(req, 'read', 'feedback', req.params.id)
     
     return ApiResponse.success(res, {
       id: feedback._id,
@@ -1114,7 +1104,6 @@ router.get('/login-logs', requirePermission('user:read'), async (req, res) => {
       createdAt: log.createdAt
     }))
     
-    await logAction(req, 'read', 'login-logs', null, { page, limit })
     
     return ApiResponse.paginated(res, formattedLogs, {
       page: parseInt(page),