feat(config): implement dynamic security blocklist and home marketing popup with admin controls

server/src/core/security/content-security.service.ts

@@ -30,6 +30,25 @@ export class ContentSecurityService {
     ]
   };
 
+  // 动态自定义敏感词列表（支持管理后台增删改并实时热生效）
+  private customKeywords: string[] = [];
+
+  /**
+   * 载入或更新动态敏感词黑名单
+   */
+  public setCustomKeywords(keywords: string[]): void {
+    if (Array.isArray(keywords)) {
+      this.customKeywords = keywords.map(k => k.trim()).filter(Boolean);
+    }
+  }
+
+  /**
+   * 获取当前生效的所有自定义敏感词
+   */
+  public getCustomKeywords(): string[] {
+    return [...this.customKeywords];
+  }
+
   /**
    * 检查文本内容安全 (security.msgSecCheck)
    * @param text 待检测文本（支持动态、评论、活动标题、个人简介等）
@@ -47,6 +66,21 @@ export class ContentSecurityService {
 
     const cleanText = text.replace(/[\s\r\n\t\-_,.，。！？]/g, '').toLowerCase();
 
+    // 1. 优先检测管理后台运营配置的自定义违规词库
+    for (const kw of this.customKeywords) {
+      const cleanKw = kw.replace(/[\s\r\n\t\-_,.，。！？]/g, '').toLowerCase();
+      if (cleanText.includes(cleanKw)) {
+        return {
+          pass: false,
+          code: 87014,
+          label: 'CUSTOM_BLOCKLIST',
+          suggest: 'block',
+          message: `内容含有涉嫌违规或敏感词汇[${kw}]，已被系统拦截，请文明发言`
+        };
+      }
+    }
+
+    // 2. 检测系统内置的核心安全敏感词库
     for (const [category, keywords] of Object.entries(ContentSecurityService.SENSITIVE_KEYWORDS)) {
       for (const kw of keywords) {
         const cleanKw = kw.replace(/[\s\r\n\t\-_,.，。！？]/g, '').toLowerCase();