feat(frontend): replicate reference header user box 1:1

顶导航点击小人弹出的用户信息浮层，从 AKSRT 定制结构改为与参考主题 zib_header_user_box() 逐行同构：头像链接包裹、钱包双瓷砖、会员条、签到、消息图标、统计徽章行全部改用参考主题遗留类，渲染交回 main.css（.sub-user-box 242px、.avatar-img 38px、.msg-news-icon、badge.top、.payvip-icon 深色渐变加 gem 水印、.vip-expdate-tag、.muted-box）。

头像改走 aksrt_get_avatar_box(用户ID, avatar-img, true, false)，得到参考的 a 链接包裹 avatar-img 结构。消息图标改参考标记 msg-news-icon abs-right 加 toggle-radius msg-icon，未读徽章用 badge.top，avatar_dropdown 位置门控契约保留。管理端行在「后台管理」前插入「支付中心」，跳 admin.php?page=aksrt_pay，即参考主题「商城中心」槽位，图标 fa-credit-card。

钱包重写为参考双瓷砖：余额在前（c-blue-2 加 fa-money-bill-wave）、积分在后（c-yellow 加 fa-coins），分别按充值开关与积分总开关门控，两块皆关则不渲染，并保留 data-aksrt-wallet-value 与 data-aksrt-points-value 两个 JS 刷新钩子。会员条去掉 AKSRT 自创的 vipbg-v2 level-N 金色背景，改参考的 payvip-icon 加 badg jb-yellow vip-expdate-tag，到期文案按参考语义分为已过期、永久会员、裸日期三种。签到入口由 button 改为 a.but block c-yellow，并去掉随之失效的 compact 形参，data-signin 挂载与 wp_footer 验证码不变。统计行删掉文章徽章（本站不做帖子），图标由 SVG sprite 换 FA5+ 的 fa-comment-dots、fa-thumbs-up、fa-fire。

会员等级图标契约不动：aksrt_get_vip_icon 与 User\Level::get_badge_html 的调用与参数保持原样。

顺带清死代码：aksrt_header_user_badges_row 原本取到函数后直接返回空串，现在真正输出统计行；删掉 header-userbox.css 里整套 bespoke 规则与 vip-modal.css 的 vipbg-v2 死规则。

显式偏差：统计行链接保持扁平用户主页 URL（AKSRT 用户主页是干净 URL 加 JS tab，没有 query tab 路由）；签到入口沿用积分签到总开关门控，不新增管理端可配置项。

public.css 与 public.min.css 用 tools/build-public-assets.mjs 重建：该 bundle 打包了 header-userbox.css 且作为依赖先于单模块入队，旧的 width 260px 会压过新源码、把卡片钉在 260px 而不是参考的 242px。

验证：node --test tests/**/*.test.cjs 573 项全通过；六个改动 PHP 文件 php -l 无语法错误；卡片用到的 FA5 token 逐个核对 5.15.4 全部命中。未做真实视觉效果验收。

tests/widget-system/notification-preferences-contract.test.cjs

@@ -27,6 +27,7 @@ test('notification icon positions map to their four render locations', () => {
   const integration = read('src/Settings/Integration.php');
   const header = read('inc/helpers/header/aksrt-header-navbar.php');
   const headerStyles = read('assets/css/frontend/header-userbox.css');
+  const legacyMainCss = read('assets/css/main.css');
   const userCenter = read('inc/helpers/aksrt-user-center.php');
   const userHome = read('templates/parts/user/author-hero.php');
 
@@ -40,7 +41,13 @@ test('notification icon positions map to their four render locations', () => {
   assert.match(integration, /\['nav_menu', 'avatar_dropdown', 'user_center_header', 'user_home_header'\]/);
   assert.match(header, /in_array\('nav_menu', \$positions, true\)/);
   assert.match(header, /in_array\('avatar_dropdown', \$positions, true\)/);
-  assert.match(headerStyles, /\.aksrt-header-userbox \.user-info > \.abs-right \{[\s\S]*?top: 50%;[\s\S]*?transform: translateY\(-50%\);/);
+  // The card message icon uses the reference msg-news-icon markup, positioned by
+  // the shared legacy stylesheet instead of a bespoke popover rule.
+  assert.match(header, /msg-news-icon abs-right/);
+  assert.match(header, /toggle-radius msg-icon/);
+  assert.match(header, /<badge class="top">/);
+  assert.match(legacyMainCss, /\.sub-user-box \.msg-news-icon \{[\s\S]*?top: 0\.4em;[\s\S]*?right: 0;/);
+  assert.doesNotMatch(headerStyles, /\.aksrt-header-userbox \.user-info > \.abs-right/);
   assert.match(header, /aksrt-nav-icon aksrt-nav-notification/);
   assert.match(header, /\$notification_but \. \$sign_but \. \$search_but/);
   assert.match(userCenter, /in_array\('user_center_header'/);

tests/widget-system/page-display-contract.test.cjs

@@ -290,7 +290,7 @@ test('user profile and author widgets render the reference user-card contract',
   // 用户个人信息小工具不显示文章模块，显示签到徽章。
   assert.match(userRenderer, /'show_posts'   => false,/)
   assert.match(userRenderer, /'show_checkin' => true,/)
-  assert.match(userRenderer, /aksrt_header_user_checkin_btn\(\$user_id, true, 'img-badge jb-yellow'\)/)
+  assert.match(userRenderer, /aksrt_header_user_checkin_btn\(\$user_id, 'img-badge jb-yellow'\)/)
   // 文章作者信息小工具显示文章模块，并走同一 widget 变体。
   assert.match(userRenderer, /'show_posts'   => !isset\(\$i\['show_posts'\]\) \|\| !empty\(\$i\['show_posts'\]\),/)
   assert.match(userRenderer, /'post_type'    => 'post',/)
@@ -372,8 +372,16 @@ test('header user-card publish controls are removed from configuration and runti
 test('header user-card membership stays on one row with a date-only expiry', () => {
   assert.match(headerUserbox, /wp_date\('Y年m月d日', \$expires\)/)
   assert.doesNotMatch(headerUserbox, /wp_date\('Y-m-d H:i', \$expires\)/)
-  assert.match(headerCss, /\.aksrt-header-payvip__active\s*\{[^}]*flex-direction:\s*row;[^}]*gap:\s*8px !important;[^}]*white-space:\s*nowrap;/s)
-  assert.match(headerCss, /\.aksrt-header-payvip__exp\s*\{[^}]*display:\s*inline;[^}]*white-space:\s*nowrap;/s)
+  // Reference VIP bar: legacy payvip-icon geometry, the untouched level-icon
+  // contract, and the yellow expiry pill.
+  assert.match(headerUserbox, /radius4 payvip-icon btn-block text-center/)
+  assert.match(headerUserbox, /aksrt_get_vip_icon\(\$user_id, 'em12 mr6', false\)/)
+  assert.match(headerUserbox, /class="ml10 badg jb-yellow vip-expdate-tag"/)
+  assert.match(legacyMainCss, /\.sub-user-box \.payvip-icon\s*\{[^}]*padding:\s*8px;/s)
+  assert.doesNotMatch(headerCss, /aksrt-header-payvip/)
+  // The CTA wrapper is the reference padding wrapper, not a bespoke hook.
+  assert.match(headerUserbox, /'<div class="mt10 em09" style="padding:2px;">'/)
+  assert.doesNotMatch(headerUserbox, /aksrt-header-payvip/)
 })
 
 test('save contract rejects invalid input and round-trips canonical nested values', () => {

tests/widget-system/post-visual-contract.test.cjs

@@ -307,7 +307,8 @@ test('after-box author card mirrors legacy user-card structure', () => {
   assert.match(render, /<div class="user-desc mt10 muted-2-color em09">/);
   assert.doesNotMatch(render, /user-btns/);
   assert.doesNotMatch(render, /发布文章.*用户中心/s);
-  assert.match(identity, /tag-posts/);
+  // The project ships no posts, so the stats row carries no posts chip.
+  assert.doesNotMatch(identity, /tag-posts/);
   assert.match(identity, /tag-comment/);
   assert.match(identity, /tag-follow/);
   assert.match(identity, /tag-like/);

tests/widget-system/user-card-runtime-harness.php

@@ -110,9 +110,9 @@ namespace {
 	}
 	function aksrt_get_user_badges(int $user_id): string { return '<span class="badg">' . $user_id . '</span>'; }
 	function aksrt_get_user_description(int $user_id): string { return 'Description ' . $user_id; }
-	function aksrt_header_user_checkin_btn(int $user_id, bool $large, string $class): string {
-		unset($user_id, $large);
-		return '<button class="' . esc_attr($class) . '">签到</button>';
+	function aksrt_header_user_checkin_btn(int $user_id, string $class): string {
+		unset($user_id);
+		return '<a class="' . esc_attr($class) . '" href="javascript:;">签到</a>';
 	}
 	function aksrt_render_user_card_posts(array $args): string {
 		return '<div data-post-type="' . esc_attr((string) ($args['post_type'] ?? '')) . '" data-post-style="' . esc_attr((string) ($args['post_style'] ?? '')) . '"></div>';