Fix: V02-unsafe-get-mutations-verify

[Morgen-Kornblume]

V02 修复说明

已修复 GET/HEAD 触发身份切换、活动签到和通知批量变更的问题：

• 身份切换仅接受受 CSRF 保护的 POST，使用组织主键，并在切换前重新校验有效个人账号、管理员职位、组织状态及组织账号状态；失败不会改变当前 Session。
• 活动签到的 GET/HEAD 仅展示确认页，实际签到必须通过 CSRF POST；事务内锁定并复核活动、个人和报名记录，重复签到保持幂等。
• 通知 readall/deleteall 已改为 CSRF POST，更新范围严格限定为当前接收者及合法源状态；单条通知 AJAX 操作也已补充 CSRF。
• 身份切换辅助函数已禁止 GET/HEAD 改变 Session，覆盖其他间接调用路径。
• 已更新相关模板并新增安全回归测试。

验证结果：

• 定向安全测试：30 项通过
• 完整 Django 测试：458 项通过
• manage.py check、迁移检查、Python 编译检查及 git diff --check 均通过
• 修复后 review 未发现未解决的阻断性或高风险问题

兼容性说明：旧版签到二维码仍可导航至带校验值的确认页面，但 GET/HEAD 已无业务副作用，页面设置了 no-store 和 no-referrer，真正签到只会在用户确认后的 CSRF POST 中发生。

[Morgen-Kornblume]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c350e6d65b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Preserve switches for existing account sessions

For sessions created before this deployment, update_related_account_in_session() stored only Incharge and NP, so InchargeAccounts is absent. This loop therefore renders no organization forms—despite the surrounding menu still being enabled by Incharge—and logged-in personal users lose account switching until they sign out and back in. Populate the new session field lazily or retain a compatible fallback for existing sessions.

AGENTS.md reference: AGENTS.md:L343-L345

Useful? React with 👍 / 👎.