fix(honeypot): 蜜罐封禁与 enable_auto_ban 解耦 + 泄露扫描后缀匹配

- autoban: 新增 RecordHoneypot 独立通道（不受 enabled 约束）+ 独立阈值/时长；
  IsBanned 不再因 enable_auto_ban=false 而忽略已有封禁
- honeypot: 新增 honeypotSuffixes 后缀匹配，覆盖 /backup.zip、/db.sql、/id_rsa.pem
- 新增配置 honeypot_threshold / honeypot_ban_minutes
- 补测试：autoban/honeypot_test.go、route 侧禁用自动封禁仍封禁

internal/security/honeypot/honeypot_test.go

@@ -16,6 +16,10 @@ func TestMatch(t *testing.T) {
 		"/administrator", "/phpmyadmin", "/actuator/env", "/swagger-ui.html",
 		"/xmlrpc.php", "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php",
 		"/wp-admin/../wp-content/x.php",
+		// 后缀匹配：备份/配置/密钥泄露扫描
+		"/backup.zip", "/www.zip", "/site.tar.gz", "/db.sql", "/dump.sql",
+		"/x.bak", "/config.php.bak", "/.env.bak", "/id_rsa.pem", "/private.key",
+		"/server.jks", "/data.ovpn",
 	}
 	for _, p := range hit {
 		if !h.Match(p) {
@@ -29,6 +33,8 @@ func TestMatch(t *testing.T) {
 		"/api/v1/questions", "/static/css/base.css", "/favicon.ico", "/robots.txt",
 		"/about", "/rules", "/sponsor", "/change-logs.html", "/vote/abc",
 		"/explore", "/i18n/en",
+		// 业务 URL 空间里不存在这些后缀
+		"/_/admin.ini", "/api/v1/questions.json", "/user/settings.yaml",
 	}
 	for _, p := range miss {
 		if h.Match(p) {