feat: 站点提交改为待审核(pending)，管理员审核通过/拒绝

- submitSite: 新站点 status=PENDING
- AdminController: GET /admin/sites/pending, POST /admin/sites/{id}/approve|reject
- reject 物理删除站点记录

par-api/src/main/java/com/par/api/controller/AdminController.java

@@ -40,6 +40,7 @@ public class AdminController {
     private final AccountService accountService;
     private final PskService pskService;
     private final CachedStorageService storageService;
+    private final com.par.core.service.SiteService siteService;
 
     /**
      * 获取所有用户列表
@@ -255,6 +256,32 @@ public class AdminController {
         return ApiResponse.success();
     }
 
+    // ===================== 站点审核 =====================
+
+    @GetMapping("/sites/pending")
+    public ApiResponse<List<com.par.core.dto.SiteDTO>> listPendingSites(HttpServletRequest request) {
+        checkAdmin(request);
+        return ApiResponse.success(siteService.listPendingSites().stream()
+                .map(siteService::toDTO).toList());
+    }
+
+    @PostMapping("/sites/{id}/approve")
+    public ApiResponse<Void> approveSite(@PathVariable Long id, HttpServletRequest request) {
+        checkAdmin(request);
+        Long reviewerId = (Long) request.getAttribute("accountId");
+        siteService.approveSite(id, reviewerId);
+        log.info("Site approved: id={}, reviewer={}", id, reviewerId);
+        return ApiResponse.success();
+    }
+
+    @PostMapping("/sites/{id}/reject")
+    public ApiResponse<Void> rejectSite(@PathVariable Long id, HttpServletRequest request) {
+        checkAdmin(request);
+        siteService.rejectSite(id);
+        log.info("Site rejected: id={}", id);
+        return ApiResponse.success();
+    }
+
     private void checkAdmin(HttpServletRequest request) {
         TrustLevel level = (TrustLevel) request.getAttribute("trustLevel");
         if (level == null || level != TrustLevel.ADMIN) {