backend: add bookmark CRUD with public list endpoint

New bookmarks feature: domain model, repository, service and handler
supporting list/create/update/delete. Public endpoint exposes the
admin user's bookmarks for the homepage navigation grid; authenticated
endpoints scope by user. Dev Dockerfile drops air for plain `go run`
and uses goproxy.cn to avoid build failures on the deploy host.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/internal/router/router.go

@@ -20,8 +20,12 @@ func Setup(cfg *config.Config) *gin.Engine {
 	userRepo := repository.NewUserRepository(db.DB)
 	userService := service.NewUserService(userRepo)
 
+	bookmarkRepo := repository.NewBookmarkRepository(db.DB)
+	bookmarkService := service.NewBookmarkService(bookmarkRepo)
+
 	authHandler := handler.NewAuthHandler(userService)
 	healthHandler := handler.NewHealthHandler(db.DB)
+	bookmarkHandler := handler.NewBookmarkHandler(bookmarkService, userService)
 
 	// Public routes
 	r.POST("/api/auth/local-login", authHandler.LocalLogin)
@@ -29,6 +33,17 @@ func Setup(cfg *config.Config) *gin.Engine {
 	r.POST("/api/auth/bind-keycloak", authHandler.BindKeycloak)
 	r.POST("/api/auth/init", authHandler.InitAdmin)
 	r.GET("/api/health", healthHandler.Check)
+	r.GET("/api/bookmarks/public", bookmarkHandler.PublicList)
+
+	// Authenticated routes
+	auth := r.Group("/api")
+	auth.Use(middleware.AuthProxy())
+	{
+		auth.GET("/bookmarks", bookmarkHandler.List)
+		auth.POST("/bookmarks", bookmarkHandler.Create)
+		auth.PUT("/bookmarks/:id", bookmarkHandler.Update)
+		auth.DELETE("/bookmarks/:id", bookmarkHandler.Delete)
+	}
 
 	return r
 }