fix: 调整路由顺序，修复静态文件被JWT拦截的问题

- 将 /static/{tail:.*} 路由移到受保护 scope 之前
- 确保静态文件无需认证即可访问

src/handlers/user.rs

@@ -0,0 +1,77 @@
+use actix_web::{web, get, put, HttpResponse, Responder};
+use sqlx::postgres::PgPool;
+use tracing::error;
+use serde::Deserialize;
+
+use crate::db;
+use crate::models::{Claims, ErrorResponse};
+
+#[get("/api/user/profile")]
+pub async fn get_current_user_profile(
+    pool: web::Data<PgPool>,
+    claims: web::ReqData<Claims>,
+) -> impl Responder {
+    let user_id = claims.user_id;
+    tracing::info!("获取当前用户信息, 用户ID: {}", user_id);
+
+    match db::get_user_by_id(pool.get_ref(), user_id).await {
+        Ok(user) => {
+            let is_paid_active = user.is_paid && 
+                (user.paid_expires_at.is_none() || user.paid_expires_at.unwrap() > chrono::Utc::now());
+            
+            HttpResponse::Ok().json(serde_json::json!({
+                "success": true,
+                "data": {
+                    "id": user.id,
+                    "name": user.name,
+                    "nickname": user.nickname,
+                    "avatarUrl": user.avatar_url,
+                    "is_paid": user.is_paid,
+                    "is_paid_active": is_paid_active,
+                    "is_admin": user.is_admin,
+                    "paid_expires_at": user.paid_expires_at
+                }
+            }))
+        }
+        Err(e) => {
+            error!("获取用户信息失败: {}", e);
+            HttpResponse::Ok().json(serde_json::json!({
+                "success": false,
+                "errcode": 500,
+                "errmsg": e
+            }))
+        }
+    }
+}
+
+#[derive(Debug, Deserialize)]
+pub struct SaveUserProfileRequest {
+    pub nickname: Option<String>,
+    pub avatar_url: Option<String>,
+}
+
+#[put("/api/user/profile")]
+pub async fn save_user_profile(
+    pool: web::Data<PgPool>,
+    claims: web::ReqData<Claims>,
+    body: web::Json<SaveUserProfileRequest>,
+) -> impl Responder {
+    let user_id = claims.user_id;
+    tracing::info!("保存用户信息, 用户ID: {}", user_id);
+
+    match db::update_user_profile(pool.get_ref(), user_id, &body.nickname, &body.avatar_url).await {
+        Ok(_) => {
+            HttpResponse::Ok().json(serde_json::json!({
+                "success": true
+            }))
+        }
+        Err(e) => {
+            error!("保存用户信息失败: {}", e);
+            HttpResponse::Ok().json(serde_json::json!({
+                "success": false,
+                "errcode": 500,
+                "errmsg": e
+            }))
+        }
+    }
+}