feat(songs): 歌曲管理支持批量驳回、投稿留言自动审查与排期范围可见性过滤

- 新增 /api/admin/songs/batch-reject.post 批量驳回接口（事务清排期/投票/扣接纳数/黑名单去重/异步通知）
- requireSongAdmin 三角色校验 + createApiError 统一错误包装
- scheduleDaysBefore/After 四字段排期可见范围限制（开放 API 与公开排期接口三处缓存路径 + DB 条件过滤）
- submissionNoteAutoModeration 基于黑名单 KEYWORD/LANGUAGE/GENRE 自动判定留言 publicStatus，命中自动关闭 submissionNotePublic
- 更新 songs/request.post 与 songs/[id]/update.put 接入自动审查逻辑

server/utils/user-avatar.ts

@@ -0,0 +1,45 @@
+interface AvatarUserState {
+  avatarProvider?: string | null
+  avatarProviderUserId?: string | null
+}
+
+interface IdentityRow {
+  provider: string
+  providerUserId: string
+  avatar?: string | null
+  createdAt: Date | string
+}
+
+export interface AvatarSource {
+  provider: string | null
+  providerUserId: string | null
+}
+
+export function resolveAvatarSource(
+  user: AvatarUserState,
+  identities: IdentityRow[]
+): AvatarSource | null {
+  if (user.avatarProvider) {
+    return {
+      provider: user.avatarProvider,
+      providerUserId: user.avatarProviderUserId ?? null
+    }
+  }
+
+  const sorted = [...identities].sort((a, b) => {
+    const at = new Date(a.createdAt).getTime()
+    const bt = new Date(b.createdAt).getTime()
+    return at - bt
+  })
+
+  for (const identity of sorted) {
+    if (identity.avatar) {
+      return {
+        provider: identity.provider,
+        providerUserId: identity.providerUserId
+      }
+    }
+  }
+
+  return null
+}