refactor: 拆分超标控制器文件至行数≤120行

- auth_controller.go(238→54): 拆出auth_api_login.go(107)+auth_api_register.go(96)
- settings_controller.go(289→101): 拆出settings_api_profile(116)+account(59)+error_handlers(41)
- message_controller.go(129→85): 拆出message_page_controller.go(55)
- 所有拆分后文件均≤120行，符合code-style.md瘦控制器规范

internal/controller/auth_controller.go

@@ -5,7 +5,6 @@ import (
 
 	"metazone.cc/metalab/internal/common"
 	"metazone.cc/metalab/internal/config"
-	"metazone.cc/metalab/internal/model"
 	"metazone.cc/metalab/internal/theme"
 
 	"github.com/gin-gonic/gin"
@@ -53,186 +52,3 @@ func (ac *AuthController) LoginPage(c *gin.Context) {
 		"ExtraCSS": "/static/css/auth.css",
 	}))
 }
-
-// clientIP 获取客户端真实 IP（考虑反向代理）
-func clientIP(c *gin.Context) string {
-	if fwd := c.GetHeader("X-Forwarded-For"); fwd != "" {
-		return fwd
-	}
-	if real := c.GetHeader("X-Real-IP"); real != "" {
-		return real
-	}
-	return c.ClientIP()
-}
-
-// Login 登录 API（含双维度限流）
-func (ac *AuthController) Login(c *gin.Context) {
-	var req model.LoginRequest
-	if err := c.ShouldBindJSON(&req); err != nil {
-		common.Error(c, http.StatusBadRequest, "请检查输入")
-		return
-	}
-
-	email := req.Email
-	ip := clientIP(c)
-
-	// --- 限流：账户维度 ---
-	acctResult, recordAccount := ac.rateLimiter.AllowAccount(email)
-	if acctResult.Blocked {
-		common.Error(c, http.StatusTooManyRequests, acctResult.Message)
-		return
-	}
-
-	// --- 限流：IP 维度 ---
-	ipResult, recordIP := ac.rateLimiter.AllowIP(ip)
-	if ipResult.Blocked {
-		common.Error(c, http.StatusTooManyRequests, ipResult.Message)
-		return
-	}
-
-	accessToken, refreshToken, user, err := ac.authService.Login(req, ip)
-	if err != nil {
-		// 记录失败 → 两个维度各 +1
-		if recordAccount != nil {
-			recordAccount()
-		}
-		if recordIP != nil {
-			recordIP()
-		}
-
-		switch err {
-		case common.ErrInvalidCred:
-			common.Error(c, http.StatusUnauthorized, "邮箱或密码错误")
-		case common.ErrUserBanned:
-			common.Error(c, http.StatusForbidden, "账号已被封禁")
-		case common.ErrUserLocked:
-			common.Error(c, http.StatusUnauthorized, "邮箱或密码错误")
-		case common.ErrNeedsConfirmRestore:
-			// 注销账号登录 → 需要二次确认恢复
-			c.JSON(http.StatusOK, gin.H{
-				"success": true,
-				"action":  "confirm_restore",
-				"message": "你的账号正在注销中，登录将中止注销流程",
-			})
-		default:
-			common.Error(c, http.StatusInternalServerError, "登录失败，请稍后重试")
-		}
-		return
-	}
-
-	// 登录成功 → 清除失败计数
-	ac.rateLimiter.Clear(email, ip)
-
-	common.SetAuthCookies(c, accessToken, refreshToken, req.RememberMe, ac.cfg)
-
-	common.OkWithMessage(c, user, "登录成功")
-}
-
-// ConfirmRestore 二次确认恢复已注销账号
-func (ac *AuthController) ConfirmRestore(c *gin.Context) {
-	var req model.LoginRequest
-	if err := c.ShouldBindJSON(&req); err != nil {
-		common.Error(c, http.StatusBadRequest, "请检查输入")
-		return
-	}
-
-	accessToken, refreshToken, user, err := ac.authService.ConfirmRestore(req, clientIP(c))
-	if err != nil {
-		switch err {
-		case common.ErrInvalidCred:
-			common.Error(c, http.StatusUnauthorized, "邮箱或密码错误")
-		default:
-			common.Error(c, http.StatusInternalServerError, "操作失败，请稍后重试")
-		}
-		return
-	}
-
-	common.SetAuthCookies(c, accessToken, refreshToken, req.RememberMe, ac.cfg)
-	common.OkWithMessage(c, user, "账号已恢复，欢迎回来")
-}
-
-// CheckEmail 检查邮箱是否已注册
-func (ac *AuthController) CheckEmail(c *gin.Context) {
-	var req model.CheckEmailRequest
-	if err := c.ShouldBindJSON(&req); err != nil {
-		common.Error(c, http.StatusBadRequest, "请提供有效的邮箱地址")
-		return
-	}
-
-	exists, err := ac.authService.CheckEmail(req.Email)
-	if err != nil {
-		common.Error(c, http.StatusInternalServerError, "检查失败")
-		return
-	}
-
-	common.Ok(c, gin.H{"exists": exists})
-}
-
-// Register 注册 API
-func (ac *AuthController) Register(c *gin.Context) {
-	var req model.RegisterRequest
-	if err := c.ShouldBindJSON(&req); err != nil {
-		common.Error(c, http.StatusBadRequest, "请检查输入："+err.Error())
-		return
-	}
-
-	// 注册 IP 限流：1 分钟 5 次
-	regResult, recordReg := ac.rateLimiter.AllowIP(clientIP(c) + ":register")
-	if regResult.Blocked {
-		common.Error(c, http.StatusTooManyRequests, "注册请求过于频繁，请稍后重试")
-		return
-	}
-
-	accessToken, refreshToken, user, err := ac.authService.Register(req, clientIP(c))
-	if err != nil {
-		if recordReg != nil {
-			recordReg()
-		}
-		switch err {
-		case common.ErrEmailExists:
-			common.Error(c, http.StatusConflict, "该邮箱已注册")
-		case common.ErrWeakPassword:
-			common.Error(c, http.StatusBadRequest, err.Error())
-		default:
-			common.Error(c, http.StatusInternalServerError, "注册失败，请稍后重试")
-		}
-		return
-	}
-
-	common.SetAuthCookies(c, accessToken, refreshToken, req.RememberMe, ac.cfg)
-
-	common.OkWithMessage(c, user, "注册成功！欢迎加入 MetaLab")
-}
-
-// Logout 退出登录：清除所有认证 Cookie
-func (ac *AuthController) Logout(c *gin.Context) {
-	common.ClearAuthCookies(c, ac.cfg)
-	common.OkMessage(c, "已退出登录")
-}
-
-// RefreshToken 用 refresh token 换取新的 access token
-func (ac *AuthController) RefreshToken(c *gin.Context) {
-	refreshToken, err := c.Cookie(common.RefreshCookieName)
-	if err != nil {
-		common.Error(c, http.StatusUnauthorized, "请重新登录")
-		return
-	}
-
-	accessToken, _, err := ac.tokenService.RefreshAccessToken(refreshToken)
-	if err != nil {
-		common.ClearAuthCookies(c, ac.cfg)
-		switch err {
-		case common.ErrTokenExpired, common.ErrTokenRevoked:
-			common.Error(c, http.StatusUnauthorized, "登录凭证已失效，请重新登录")
-		case common.ErrUserBanned:
-			common.Error(c, http.StatusForbidden, "账号已被封禁")
-		default:
-			common.Error(c, http.StatusUnauthorized, "请重新登录")
-		}
-		return
-	}
-
-	common.SetAccessCookie(c, accessToken, ac.cfg)
-
-	common.Ok(c, nil)
-}