refactor(db): 删除旧分区展示块与兼容字段

- v23 迁移删除 section_block 表，以及 node 的 view_mode / empty_text / show_in_sidebar / allow_groups
- 重建 node 表并保留 44 条内容、15 个分组、5 张卡片，外键检查通过
- 种子库直接生成 card / card_group，不再依赖 section_block
- 删除旧 /api/catalog、/api/categories、/api/groups/{id} 与 categories 模块
- 分组接口不再接收/返回 format，前端 GroupNode 同步移除
- README/HANDOFF 更新到 v23；管理页提示改为『格式由每条内容决定』

src/server.rs

@@ -206,31 +206,6 @@ async fn list_projects_api(State(state): State<AppState>) -> impl IntoResponse {
     }))
 }
 
-/// API: 完整内容目录（分区 / 分组 / 条目 + 首页展示块）
-///
-/// 数据量很小（几十 KB），一次全量下发，前端搜索仍然在客户端做。
-/// 侧栏由这份数据派生，不再单独下发导航。
-async fn catalog_api(State(state): State<AppState>) -> Response {
-    let db = state.db.clone();
-
-    // rusqlite 是同步的，查询扔进阻塞线程池，别占住 async 执行器
-    match tokio::task::spawn_blocking(move || db.load_catalog()).await {
-        Ok(Ok(catalog)) => Json(serde_json::json!({
-            "categories": catalog.categories,
-        }))
-        .into_response(),
-        Ok(Err(error)) => {
-            // 典型原因是用户手改坏了 JSON，错误信息里已带条目 id
-            warn!("读取内容库失败: {error}");
-            error.into_response()
-        }
-        Err(error) => {
-            warn!("内容库查询任务崩溃: {error}");
-            StashError::Database(format!("内容库查询任务崩溃: {error}")).into_response()
-        }
-    }
-}
-
 /// SSE：内容库被外部修改时通知前端重新拉取。
 ///
 /// 这里轮询 `PRAGMA data_version` 而不是监听数据库文件：
@@ -964,172 +939,6 @@ async fn set_card_groups(
     }
 }
 
-/// POST /api/categories —— 新建分区（需要登录）
-async fn create_category(
-    State(state): State<AppState>,
-    headers: HeaderMap,
-    Json(body): Json<crate::db::categories::NewCategory>,
-) -> Response {
-    if !same_origin(&headers) {
-        return api_error(StatusCode::FORBIDDEN, "跨站请求被拒绝");
-    }
-    match read_session(&state, &headers).await {
-        Ok(session) if session.authenticated => {}
-        Ok(_) => return api_error(StatusCode::UNAUTHORIZED, "请先登录"),
-        Err(response) => return response,
-    }
-
-    let db = Arc::clone(&state.db);
-    match tokio::task::spawn_blocking(move || db.create_category(body)).await {
-        Ok(Ok(())) => Json(serde_json::json!({ "ok": true })).into_response(),
-        Ok(Err(StashError::Conflict(message))) => api_error(StatusCode::CONFLICT, &message),
-        Ok(Err(StashError::InvalidDirectory(message))) => {
-            api_error(StatusCode::BAD_REQUEST, &message)
-        }
-        Ok(Err(error)) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
-        Err(error) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
-    }
-}
-
-/// PATCH /api/categories/{id} —— 修改分区（需要登录）
-async fn update_category(
-    State(state): State<AppState>,
-    Path(id): Path<String>,
-    headers: HeaderMap,
-    Json(body): Json<crate::db::categories::UpdateCategory>,
-) -> Response {
-    if !same_origin(&headers) {
-        return api_error(StatusCode::FORBIDDEN, "跨站请求被拒绝");
-    }
-    match read_session(&state, &headers).await {
-        Ok(session) if session.authenticated => {}
-        Ok(_) => return api_error(StatusCode::UNAUTHORIZED, "请先登录"),
-        Err(response) => return response,
-    }
-
-    let db = Arc::clone(&state.db);
-    match tokio::task::spawn_blocking(move || db.update_category(&id, body)).await {
-        Ok(Ok(())) => Json(serde_json::json!({ "ok": true })).into_response(),
-        Ok(Err(StashError::NotFound(message))) => api_error(StatusCode::NOT_FOUND, &message),
-        Ok(Err(StashError::InvalidDirectory(message))) => {
-            api_error(StatusCode::BAD_REQUEST, &message)
-        }
-        Ok(Err(error)) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
-        Err(error) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
-    }
-}
-
-/// POST /api/categories/{id}/groups —— 新建分组（需要登录）
-async fn create_group(
-    State(state): State<AppState>,
-    Path(section_id): Path<String>,
-    headers: HeaderMap,
-    Json(body): Json<crate::db::categories::NewGroup>,
-) -> Response {
-    if !same_origin(&headers) {
-        return api_error(StatusCode::FORBIDDEN, "跨站请求被拒绝");
-    }
-    match read_session(&state, &headers).await {
-        Ok(session) if session.authenticated => {}
-        Ok(_) => return api_error(StatusCode::UNAUTHORIZED, "请先登录"),
-        Err(response) => return response,
-    }
-
-    let db = Arc::clone(&state.db);
-    match tokio::task::spawn_blocking(move || db.create_group(&section_id, body)).await {
-        Ok(Ok(())) => Json(serde_json::json!({ "ok": true })).into_response(),
-        Ok(Err(StashError::Conflict(message))) => api_error(StatusCode::CONFLICT, &message),
-        Ok(Err(StashError::NotFound(message))) => api_error(StatusCode::NOT_FOUND, &message),
-        Ok(Err(StashError::InvalidDirectory(message))) => {
-            api_error(StatusCode::BAD_REQUEST, &message)
-        }
-        Ok(Err(error)) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
-        Err(error) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
-    }
-}
-
-/// PATCH /api/groups/{id} —— 分组改名 / 显隐（需要登录）
-async fn update_group(
-    State(state): State<AppState>,
-    Path(id): Path<String>,
-    headers: HeaderMap,
-    Json(body): Json<crate::db::categories::UpdateGroup>,
-) -> Response {
-    if !same_origin(&headers) {
-        return api_error(StatusCode::FORBIDDEN, "跨站请求被拒绝");
-    }
-    match read_session(&state, &headers).await {
-        Ok(session) if session.authenticated => {}
-        Ok(_) => return api_error(StatusCode::UNAUTHORIZED, "请先登录"),
-        Err(response) => return response,
-    }
-
-    let db = Arc::clone(&state.db);
-    match tokio::task::spawn_blocking(move || db.update_group(&id, body)).await {
-        Ok(Ok(())) => Json(serde_json::json!({ "ok": true })).into_response(),
-        Ok(Err(StashError::NotFound(message))) => api_error(StatusCode::NOT_FOUND, &message),
-        Ok(Err(StashError::InvalidDirectory(message))) => {
-            api_error(StatusCode::BAD_REQUEST, &message)
-        }
-        Ok(Err(error)) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
-        Err(error) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
-    }
-}
-
-/// DELETE /api/groups/{id} —— 删除分组（需要登录，组内条目级联删除）
-async fn delete_group(
-    State(state): State<AppState>,
-    Path(id): Path<String>,
-    headers: HeaderMap,
-) -> Response {
-    if !same_origin(&headers) {
-        return api_error(StatusCode::FORBIDDEN, "跨站请求被拒绝");
-    }
-    match read_session(&state, &headers).await {
-        Ok(session) if session.authenticated => {}
-        Ok(_) => return api_error(StatusCode::UNAUTHORIZED, "请先登录"),
-        Err(response) => return response,
-    }
-
-    let db = Arc::clone(&state.db);
-    match tokio::task::spawn_blocking(move || db.remove_group(&id)).await {
-        Ok(Ok(())) => Json(serde_json::json!({ "ok": true })).into_response(),
-        Ok(Err(StashError::NotFound(message))) => api_error(StatusCode::NOT_FOUND, &message),
-        Ok(Err(StashError::InvalidDirectory(message))) => {
-            api_error(StatusCode::BAD_REQUEST, &message)
-        }
-        Ok(Err(error)) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
-        Err(error) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
-    }
-}
-
-/// DELETE /api/categories/{id} —— 删除分区（需要登录，级联内容）
-async fn delete_category(
-    State(state): State<AppState>,
-    Path(id): Path<String>,
-    headers: HeaderMap,
-) -> Response {
-    if !same_origin(&headers) {
-        return api_error(StatusCode::FORBIDDEN, "跨站请求被拒绝");
-    }
-    match read_session(&state, &headers).await {
-        Ok(session) if session.authenticated => {}
-        Ok(_) => return api_error(StatusCode::UNAUTHORIZED, "请先登录"),
-        Err(response) => return response,
-    }
-
-    let db = Arc::clone(&state.db);
-    match tokio::task::spawn_blocking(move || db.remove_category(&id)).await {
-        Ok(Ok(())) => Json(serde_json::json!({ "ok": true })).into_response(),
-        Ok(Err(StashError::NotFound(message))) => api_error(StatusCode::NOT_FOUND, &message),
-        Ok(Err(StashError::InvalidDirectory(message))) => {
-            api_error(StatusCode::BAD_REQUEST, &message)
-        }
-        Ok(Err(error)) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
-        Err(error) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
-    }
-}
-
 /// 组装路由：API + 内嵌前端 + 托管目录。
 /// 单独抽出来是为了测试能直接对 `Router` 发请求：`start` 要绑定端口、
 /// 起监听任务，没法在单元测试里用。
@@ -1148,7 +957,6 @@ fn build_router(state: AppState) -> Router {
         .route("/api/health", get(health_check))
         .route("/api/projects", get(list_projects_api))
         .route("/api/projects/events", get(project_events))
-        .route("/api/catalog", get(catalog_api))
         .route("/api/catalog2", get(catalog2_api))
         .route("/api/nodes", post(create_node))
         .route("/api/nodes/{key}", patch(update_node).delete(delete_node))
@@ -1166,13 +974,6 @@ fn build_router(state: AppState) -> Router {
         .route("/api/items", post(create_item))
         .route("/api/items/{key}/view", post(post_view))
         .route("/api/items/{key}/like", post(post_like))
-        .route("/api/categories", post(create_category))
-        .route(
-            "/api/categories/{id}",
-            patch(update_category).delete(delete_category),
-        )
-        .route("/api/categories/{id}/groups", post(create_group))
-        .route("/api/groups/{id}", patch(update_group).delete(delete_group))
         .route("/api/backup", get(backup_db))
         .route("/", get(web_index))
         .route("/index.html", get(web_index))