feat: PSK 版本化管理 + DB 表 + 管理后台增删启禁

- V4 迁移: psks 表 (version, secret, description, is_active)
- PskService: 启动导入 PAR_MEDIABOT_PSK → v1, verify 遍历所有活跃 PSK
- HmacAuthInterceptor: PSK 签名优先验签，精简为 Bearer/PSK 双路径
- AdminController: GET/POST /psks + toggle 启禁
- AuthController: register/recover 改用 PskService 验证
- docker-compose.yml 新增 PAR_MEDIABOT_PSK 环境变量

mediabot 端只需: X-Signature = HMAC(PSK, 'email:ts')

docker-compose.yml

@@ -20,6 +20,7 @@ services:
       MYSQL_USER: "${MYSQL_USER:-root}"
       MYSQL_PASSWORD: "${MYSQL_PASSWORD:-root}"
       HMAC_SECRET: "${HMAC_SECRET:-}"
+      PAR_MEDIABOT_PSK: "${PAR_MEDIABOT_PSK:-}"
       PAR_STATIC_PATH: "/app/static"
       PAR_ADMIN_PATH: "/app/static/admin"
     extra_hosts: