feat(admin+api+player): 站内信手动发送、媒体库选择与发送记录详情

新增管理员手动发送站内信（三语富文本），支持发送记录查看与删除；修复全站「从媒体库选择」因分类过滤导致列表为空的问题；玩家端支持渲染管理员自定义消息；并优化后台列表页双层卡片布局。

apps/api/src/applications/admin/admin.controller.ts

@@ -64,6 +64,7 @@ import {
   IsIn,
   Min,
   Max,
+  MaxLength,
   Equals,
   ValidateIf,
 } from 'class-validator';
@@ -1111,6 +1112,33 @@ class InboxNotifySettingsDto {
   deposit?: boolean;
 }
 
+class BroadcastTranslationDto {
+  @IsString()
+  locale!: string;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(256)
+  title?: string;
+
+  @IsOptional()
+  @IsString()
+  body?: string;
+}
+
+class CreatePlayerMessageBroadcastDto {
+  @IsArray()
+  translations!: BroadcastTranslationDto[];
+
+  @IsIn(['ALL', 'USER'])
+  targetType!: 'ALL' | 'USER';
+
+  @ValidateIf((dto: CreatePlayerMessageBroadcastDto) => dto.targetType === 'USER')
+  @IsString()
+  @MinLength(1)
+  targetUsername?: string;
+}
+
 class UpdateDepositCleanupConfigDto {
   @IsOptional()
   @IsBoolean()
@@ -3102,8 +3130,24 @@ export class AdminController {
     @Query('category') category?: string,
     @Query('page') page?: string,
     @Query('pageSize') pageSize?: string,
+    @Query('imagesOnly') imagesOnly?: string,
   ) {
-    const where = category && UPLOAD_CATEGORIES.includes(category as any) ? { category } : {};
+    const where: {
+      category?: string | { in: string[] };
+      mimeType?: { startsWith: string };
+    } = {};
+
+    if (category && UPLOAD_CATEGORIES.includes(category as UploadCategory)) {
+      where.category = category;
+    } else if (imagesOnly === '1' || imagesOnly === 'true') {
+      // 媒体库选择器：默认可选 banners/teams/contents/payments，不含 deposits
+      where.category = { in: ['banners', 'teams', 'contents', 'payments'] };
+    }
+
+    if (imagesOnly === '1' || imagesOnly === 'true') {
+      where.mimeType = { startsWith: 'image/' };
+    }
+
     const take = Math.min(parseInt(pageSize ?? '50', 10) || 50, 200);
     const skip = (Math.max(parseInt(page ?? '1', 10) || 1, 1) - 1) * take;
 
@@ -3310,6 +3354,68 @@ export class AdminController {
     return jsonResponse(settings);
   }
 
+  @Get('player-message-broadcasts')
+  @RequirePermissions(P.content, P.reports)
+  async listPlayerMessageBroadcasts(
+    @Query('page') page?: string,
+    @Query('pageSize') pageSize?: string,
+  ) {
+    const p = Math.max(1, page ? parseInt(page, 10) || 1 : 1);
+    const size = Math.min(Math.max(1, pageSize ? parseInt(pageSize, 10) : 20), 50);
+    const result = await this.playerMessages.listBroadcasts(p, size);
+    return jsonResponse(result);
+  }
+
+  @Post('player-message-broadcasts')
+  @RequirePermissions(P.content)
+  async createPlayerMessageBroadcast(
+    @CurrentUser('id') operatorId: bigint,
+    @Body() dto: CreatePlayerMessageBroadcastDto,
+  ) {
+    const operator = await this.prisma.user.findUnique({
+      where: { id: operatorId },
+      select: { username: true },
+    });
+    const item = await this.playerMessages.createCustomBroadcast({
+      translations: dto.translations,
+      targetType: dto.targetType,
+      targetUsername: dto.targetUsername,
+      createdById: operatorId,
+      createdByUsername: operator?.username ?? null,
+    });
+    await this.audit.log({
+      operatorId,
+      operatorType: 'ADMIN',
+      action: 'SEND_PLAYER_MESSAGE_BROADCAST',
+      module: 'CONTENT',
+      afterData: JSON.stringify({
+        id: item.id,
+        title: item.title,
+        targetType: item.targetType,
+        recipientCount: item.recipientCount,
+      }),
+    });
+    return jsonResponse(item);
+  }
+
+  @Delete('player-message-broadcasts/:id')
+  @RequirePermissions(P.content)
+  async deletePlayerMessageBroadcast(
+    @CurrentUser('id') operatorId: bigint,
+    @Param('id') id: string,
+  ) {
+    const result = await this.playerMessages.deleteBroadcast(BigInt(id));
+    await this.audit.log({
+      operatorId,
+      operatorType: 'ADMIN',
+      action: 'DELETE_PLAYER_MESSAGE_BROADCAST',
+      module: 'CONTENT',
+      targetId: id,
+      afterData: JSON.stringify(result),
+    });
+    return jsonResponse(result);
+  }
+
   @Get('contents')
   @RequirePermissions(P.content, P.reports)
   async listContents(