refactor: 拆分超标控制器文件至行数≤120行

- auth_controller.go(238→54): 拆出auth_api_login.go(107)+auth_api_register.go(96)
- settings_controller.go(289→101): 拆出settings_api_profile(116)+account(59)+error_handlers(41)
- message_controller.go(129→85): 拆出message_page_controller.go(55)
- 所有拆分后文件均≤120行，符合code-style.md瘦控制器规范

internal/controller/auth_api_register.go

@@ -0,0 +1,96 @@
+package controller
+
+import (
+	"net/http"
+
+	"metazone.cc/metalab/internal/common"
+	"metazone.cc/metalab/internal/model"
+
+	"github.com/gin-gonic/gin"
+)
+
+// CheckEmail 检查邮箱是否已注册
+func (ac *AuthController) CheckEmail(c *gin.Context) {
+	var req model.CheckEmailRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		common.Error(c, http.StatusBadRequest, "请提供有效的邮箱地址")
+		return
+	}
+
+	exists, err := ac.authService.CheckEmail(req.Email)
+	if err != nil {
+		common.Error(c, http.StatusInternalServerError, "检查失败")
+		return
+	}
+
+	common.Ok(c, gin.H{"exists": exists})
+}
+
+// Register 注册 API
+func (ac *AuthController) Register(c *gin.Context) {
+	var req model.RegisterRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		common.Error(c, http.StatusBadRequest, "请检查输入："+err.Error())
+		return
+	}
+
+	// 注册 IP 限流：1 分钟 5 次
+	regResult, recordReg := ac.rateLimiter.AllowIP(clientIP(c) + ":register")
+	if regResult.Blocked {
+		common.Error(c, http.StatusTooManyRequests, "注册请求过于频繁，请稍后重试")
+		return
+	}
+
+	accessToken, refreshToken, user, err := ac.authService.Register(req, clientIP(c))
+	if err != nil {
+		if recordReg != nil {
+			recordReg()
+		}
+		switch err {
+		case common.ErrEmailExists:
+			common.Error(c, http.StatusConflict, "该邮箱已注册")
+		case common.ErrWeakPassword:
+			common.Error(c, http.StatusBadRequest, err.Error())
+		default:
+			common.Error(c, http.StatusInternalServerError, "注册失败，请稍后重试")
+		}
+		return
+	}
+
+	common.SetAuthCookies(c, accessToken, refreshToken, req.RememberMe, ac.cfg)
+
+	common.OkWithMessage(c, user, "注册成功！欢迎加入 MetaLab")
+}
+
+// Logout 退出登录：清除所有认证 Cookie
+func (ac *AuthController) Logout(c *gin.Context) {
+	common.ClearAuthCookies(c, ac.cfg)
+	common.OkMessage(c, "已退出登录")
+}
+
+// RefreshToken 用 refresh token 换取新的 access token
+func (ac *AuthController) RefreshToken(c *gin.Context) {
+	refreshToken, err := c.Cookie(common.RefreshCookieName)
+	if err != nil {
+		common.Error(c, http.StatusUnauthorized, "请重新登录")
+		return
+	}
+
+	accessToken, _, err := ac.tokenService.RefreshAccessToken(refreshToken)
+	if err != nil {
+		common.ClearAuthCookies(c, ac.cfg)
+		switch err {
+		case common.ErrTokenExpired, common.ErrTokenRevoked:
+			common.Error(c, http.StatusUnauthorized, "登录凭证已失效，请重新登录")
+		case common.ErrUserBanned:
+			common.Error(c, http.StatusForbidden, "账号已被封禁")
+		default:
+			common.Error(c, http.StatusUnauthorized, "请重新登录")
+		}
+		return
+	}
+
+	common.SetAccessCookie(c, accessToken, ac.cfg)
+
+	common.Ok(c, nil)
+}