refactor(auth): move authentication params to headers and simplify validation

- Move token and timestamp validation to HTTP headers
- Simplify ValidateTimeStamp to return boolean
- Update AddUser to use default "visitor" type
- Remove redundant timestamp and token fields from request structs
- Update API documentation to reflect header-based authentication

auth.go

@@ -6,6 +6,8 @@ import (
 	"encoding/base64"
 	"encoding/hex"
 	"fmt"
+	"net/http"
+	"strconv"
 	"strings"
 	"super-frpc/postLog"
 	"sync"
@@ -175,13 +177,24 @@ func isValidPassword(password string) bool { // Validate password complexity and
 	return hasUpper && hasLower && hasDigit && hasSpecial
 }
 
-func ValidateTimeStamp(timeStamp int64) error {
-	if globalConfig.Debug {
-		return nil
+func ValidateTimeStamp(header http.Header) bool {
+	timeStampStr := header.Get("X-Timestamp")
+	if timeStampStr == "" {
+		return false
 	}
+
+	timeStamp, err := strconv.ParseInt(timeStampStr, 10, 64)
+	if err != nil {
+		return false
+	}
+
+	if globalConfig.Debug {
+		return true
+	}
+
 	currentTime := time.Now().UnixMilli()
 	if currentTime-timeStamp > 3000 || timeStamp-currentTime > 3000 {
-		return fmt.Errorf("Timestamp out of valid range: %d", timeStamp)
+		return false
 	}
-	return nil
+	return true
 }