fix: resolve 10 code review issues

High priority:
- Fix concurrent race condition for view_count/like_count (atomic update)
- Add route request ID tracking to prevent race conditions
- Filter get_joke by status=approved (no pending content leak)
- Add error feedback for like button

Performance:
- Optimize random joke query (avoid full table sort)
- Limit page_size max to 100 (DoS prevention)

Medium:
- Add localStorage quota error handling
- Handle empty AI response gracefully
- Fix generate content title extraction

Low:
- Add rejected_jokes to stats API
- Update dashboard to show rejected count

api/app/routers/settings.py

@@ -0,0 +1,96 @@
+from fastapi import APIRouter, Depends, HTTPException
+from sqlalchemy.orm import Session
+
+from app.database import get_db
+from app.models.setting import AiSetting
+from app.schemas.setting import AiSettingCreate
+from app.routers.admin import get_current_admin_user
+from app.models.user import AdminUser
+
+router = APIRouter(prefix="/admin/settings", tags=["AI设置"])
+
+
+@router.get("", response_model=list)
+def list_settings(
+    db: Session = Depends(get_db),
+    current_user: AdminUser = Depends(get_current_admin_user),
+):
+    """列出所有 AI 配置"""
+    return db.query(AiSetting).order_by(AiSetting.created_at.desc()).all()
+
+
+@router.get("/active")
+def get_active_setting(
+    db: Session = Depends(get_db),
+    current_user: AdminUser = Depends(get_current_admin_user),
+):
+    """获取当前激活的 AI 配置（爬虫调用，无需用户认证，token 校验仍保留）"""
+    setting = db.query(AiSetting).filter(AiSetting.is_active == True).first()
+    if not setting:
+        raise HTTPException(status_code=404, detail="未找到激活的 AI 配置")
+    return setting
+
+
+@router.post("")
+def create_setting(
+    setting: AiSettingCreate,
+    db: Session = Depends(get_db),
+    current_user: AdminUser = Depends(get_current_admin_user),
+):
+    """新建 AI 配置"""
+    db_setting = AiSetting(**setting.model_dump())
+    db.add(db_setting)
+    db.commit()
+    db.refresh(db_setting)
+    return db_setting
+
+
+@router.put("/{setting_id}")
+def update_setting(
+    setting_id: int,
+    setting: AiSettingCreate,
+    db: Session = Depends(get_db),
+    current_user: AdminUser = Depends(get_current_admin_user),
+):
+    """更新 AI 配置"""
+    db_setting = db.query(AiSetting).filter(AiSetting.id == setting_id).first()
+    if not db_setting:
+        raise HTTPException(status_code=404, detail="配置不存在")
+    for key, value in setting.model_dump().items():
+        setattr(db_setting, key, value)
+    db.commit()
+    db.refresh(db_setting)
+    return db_setting
+
+
+@router.put("/{setting_id}/toggle")
+def toggle_setting(
+    setting_id: int,
+    db: Session = Depends(get_db),
+    current_user: AdminUser = Depends(get_current_admin_user),
+):
+    """切换激活状态（只能有一个活跃）"""
+    db_setting = db.query(AiSetting).filter(AiSetting.id == setting_id).first()
+    if not db_setting:
+        raise HTTPException(status_code=404, detail="配置不存在")
+
+    # 先全部设为非活跃
+    db.query(AiSetting).update({AiSetting.is_active: False})
+    db_setting.is_active = True
+    db.commit()
+    return {"message": "已激活", "id": setting_id}
+
+
+@router.delete("/{setting_id}")
+def delete_setting(
+    setting_id: int,
+    db: Session = Depends(get_db),
+    current_user: AdminUser = Depends(get_current_admin_user),
+):
+    """删除 AI 配置"""
+    db_setting = db.query(AiSetting).filter(AiSetting.id == setting_id).first()
+    if not db_setting:
+        raise HTTPException(status_code=404, detail="配置不存在")
+    db.delete(db_setting)
+    db.commit()
+    return {"message": "删除成功"}