feat(backend): user + library admin API, atomic sanitized upload

backend/internal/api/router.go

@@ -21,7 +21,16 @@ func NewRouter(cfg *config.Config, st *store.Store, rdb *redispkg.R) *gin.Engine
 
 	p := g.Group("", a.authMw())
 	p.GET("/auth/me", a.me)
-	// ponytail: 501 垫片，Task 5 换成 a.createUser；无此路由则 member 403 测不到
-	p.POST("/users", a.adminOnly(), func(c *gin.Context) { c.Status(http.StatusNotImplemented) })
+
+	users := p.Group("/users", a.adminOnly())
+	users.GET("", a.listUsers)
+	users.POST("", a.createUser)
+	users.DELETE("/:id", a.deleteUser)
+
+	libs := p.Group("/libraries")
+	libs.GET("", a.listLibraries)
+	libs.POST("", a.adminOnly(), a.createLibrary)
+	libs.POST("/:id/scan", a.adminOnly(), a.scanLibrary)
+	libs.POST("/:id/upload", a.adminOnly(), a.upload)
 	return r
 }