fix: 补全管理后台缺失的 API 端点 + 修复 @RequestParam 参数名

- AdminController: 新增 GET /admin/accounts 用户列表
- ConfigController: 新增 GET /configs/pending 待审核列表
- AdminController: 修复 @RequestParam 缺少参数名导致参数绑定失败
- SiteConfigMapper/ConfigService: 新增 selectPending/listPendingConfigs

par-api/src/main/java/com/par/api/controller/AdminController.java

@@ -1,6 +1,8 @@
 package com.par.api.controller;
 
+import com.par.core.dto.AccountDTO;
 import com.par.core.dto.ApiResponse;
+import com.par.core.entity.Account;
 import com.par.core.entity.SiteConfig;
 import com.par.core.enums.ConfigStatus;
 import com.par.core.enums.TrustLevel;
@@ -8,16 +10,18 @@ import com.par.core.mapper.AccountMapper;
 import com.par.core.mapper.ConfigReviewMapper;
 import com.par.core.mapper.SiteConfigMapper;
 import com.par.core.mapper.SiteMapper;
+import com.par.core.service.AccountService;
 import jakarta.servlet.http.HttpServletRequest;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.web.bind.annotation.*;
 
 import java.time.LocalDateTime;
+import java.util.List;
 
 /**
  * 管理员控制器
- * 所有接口需 HMAC 鉴权 + 管理员权限
+ * 所有接口需鉴权 + 管理员权限
  */
 @Slf4j
 @RestController
@@ -29,6 +33,20 @@ public class AdminController {
     private final ConfigReviewMapper configReviewMapper;
     private final AccountMapper accountMapper;
     private final SiteMapper siteMapper;
+    private final AccountService accountService;
+
+    /**
+     * 获取所有用户列表
+     */
+    @GetMapping("/accounts")
+    public ApiResponse<List<AccountDTO>> listAccounts(HttpServletRequest request) {
+        checkAdmin(request);
+        List<Account> accounts = accountMapper.selectList(null);
+        List<AccountDTO> dtos = accounts.stream()
+                .map(accountService::toDTO)
+                .toList();
+        return ApiResponse.success(dtos);
+    }
 
     /**
      * 审核配置
@@ -36,7 +54,7 @@ public class AdminController {
     @PostMapping("/reviews/{reviewId}/approve")
     public ApiResponse<Void> approveConfig(
             @PathVariable Long reviewId,
-            @RequestParam(required = false) String comment,
+            @RequestParam(value = "comment", required = false) String comment,
             HttpServletRequest request) {
 
         checkAdmin(request);
@@ -78,7 +96,7 @@ public class AdminController {
     @PostMapping("/reviews/{reviewId}/reject")
     public ApiResponse<Void> rejectConfig(
             @PathVariable Long reviewId,
-            @RequestParam String comment,
+            @RequestParam("comment") String comment,
             HttpServletRequest request) {
 
         checkAdmin(request);
@@ -107,7 +125,7 @@ public class AdminController {
     @PostMapping("/accounts/{accountId}/trust-level")
     public ApiResponse<Void> setTrustLevel(
             @PathVariable Long accountId,
-            @RequestParam String level,
+            @RequestParam("level") String level,
             HttpServletRequest request) {
 
         checkAdmin(request);

par-api/src/main/java/com/par/api/controller/ConfigController.java

@@ -35,6 +35,18 @@ public class ConfigController {
     @Value("${par.static.path:./static}")
     private String staticPath;
 
+    /**
+     * 列出所有待审核配置
+     */
+    @GetMapping("/pending")
+    public ApiResponse<List<SiteConfigDTO>> listPendingConfigs() {
+        List<SiteConfig> configs = configService.listPendingConfigs();
+        List<SiteConfigDTO> dtos = configs.stream()
+                .map(configService::toDTO)
+                .toList();
+        return ApiResponse.success(dtos);
+    }
+
     /**
      * 获取站点最新配置版本列表
      */