feat(config): implement dynamic security blocklist and home marketing popup with admin controls

server/src/index.ts

@@ -1078,11 +1078,13 @@ app.put('/api/admin/system/configs/:key', async (req: Request, res: Response) =>
     const configKey = String(req.params.key);
     const { name, valueJson, description, status } = req.body;
 
-    // 微信内容安全审查（检查文本内容或字符串化后的配置）
-    const textToCheck = `${name || ''} ${description || ''} ${JSON.stringify(valueJson || '')}`;
-    const sec = contentSecurityService.checkText(textToCheck);
-    if (!sec.pass) {
-      return res.status(400).json({ code: sec.code, message: sec.message });
+    // 微信内容安全审查（检查文本内容或字符串化后的配置，security_words 黑名单库配置项除外）
+    if (configKey !== 'security_words') {
+      const textToCheck = `${name || ''} ${description || ''} ${JSON.stringify(valueJson || '')}`;
+      const sec = contentSecurityService.checkText(textToCheck);
+      if (!sec.pass) {
+        return res.status(400).json({ code: sec.code, message: sec.message });
+      }
     }
 
     const updated = await repo.updatePlatformConfig(configKey, {
@@ -1096,6 +1098,11 @@ app.put('/api/admin/system/configs/:key', async (req: Request, res: Response) =>
       return res.status(404).json({ code: 40400, message: '配置项不存在' });
     }
 
+    // 若更新的是自定义敏感词库，实时热更新内存过滤引擎
+    if (configKey === 'security_words' && Array.isArray(valueJson)) {
+      contentSecurityService.setCustomKeywords(valueJson);
+    }
+
     res.json({ code: 20000, data: updated, message: '系统配置更新成功' });
   } catch (err: any) {
     res.status(400).json({ code: 40000, message: err.message });
@@ -1616,6 +1623,13 @@ async function bootstrap() {
   try {
     await initDatabase();
     console.log('[Peiwan Server] MySQL 数据库核心表及种子数据已校验就绪');
+
+    // 载入自定义敏感词过滤库
+    const secWordsConfig = await repo.getPlatformConfigByKey('security_words');
+    if (secWordsConfig && Array.isArray(secWordsConfig.valueJson)) {
+      contentSecurityService.setCustomKeywords(secWordsConfig.valueJson);
+      console.log(`[Peiwan Server] 已成功装载 ${secWordsConfig.valueJson.length} 条自定义安全拦截词`);
+    }
   } catch (err) {
     console.error('[Peiwan Server] MySQL 初始化连接发生警告:', err);
   }