feat: 新增维护模式 + 修复注册关闭页面标题显示问题

- 修复注册关闭时标题“创建账号”和副标题仍显示的问题，三态互斥（维护中 > 关闭注册 > 正常）
- 新增 maintenance.enabled 站点设置，默认关闭，仅 Owner 可见可调节
- 维护中间件：全局拦截，维护期间仅站长可访问，白名单放行登录相关路径
- 登录服务：维护期间仅 Owner 角色可登录，Register 优先检查维护状态
- Nav 模板新增维护通知条（黄色横幅）
- 管理后台站点设置新增“启用维护模式”开关
- BuildPageData 自动注入 IsMaintenance 到所有页面模板

internal/common/errors.go

@@ -35,6 +35,7 @@ var (
 	ErrNeedsConfirmRestore  = errors.New("需要二次确认恢复账号")
 	ErrOwnerCannotDelete    = errors.New("站长不可自主注销，请先转让站长权限")
 	ErrRegistrationDisabled = errors.New("注册功能已关闭")
+	ErrMaintenanceMode      = errors.New("社区正在维护中，仅站长可登录")
 
 	// 帖子相关
 	ErrPostNotFound             = errors.New("帖子不存在")

internal/common/helper.go

@@ -40,6 +40,10 @@ func BuildPageData(c *gin.Context, extra gin.H) gin.H {
 	if role, exists := c.Get("role"); exists {
 		data["CanAccessAdmin"] = model.HasMinRole(role.(string), model.RoleModerator)
 	}
+	// 注入维护状态
+	if isMaintenance, exists := c.Get("is_maintenance"); exists {
+		data["IsMaintenance"] = isMaintenance
+	}
 	return data
 }
 

internal/config/site_settings.go

@@ -128,3 +128,8 @@ func (s *SiteSettings) SiteInfo() SiteInfoDefaults {
 func (s *SiteSettings) IsRegistrationEnabled() bool {
 	return s.GetBool("registration.enabled", true)
 }
+
+// IsMaintenanceEnabled 是否处于维护模式（维护期间仅站长可登录和访问）
+func (s *SiteSettings) IsMaintenanceEnabled() bool {
+	return s.GetBool("maintenance.enabled", false)
+}

internal/controller/auth_api_login.go

@@ -62,6 +62,8 @@ func (ac *AuthController) Login(c *gin.Context) {
 			common.Error(c, http.StatusForbidden, "账号已被封禁")
 		case common.ErrUserLocked:
 			common.Error(c, http.StatusUnauthorized, "邮箱或密码错误")
+		case common.ErrMaintenanceMode:
+			common.Error(c, http.StatusForbidden, "社区正在维护中，仅站长可登录")
 		case common.ErrNeedsConfirmRestore:
 			// 注销账号登录 → 需要二次确认恢复
 			c.JSON(http.StatusOK, gin.H{

internal/controller/auth_api_register.go

@@ -47,6 +47,8 @@ func (ac *AuthController) Register(c *gin.Context) {
 			recordReg()
 		}
 		switch err {
+		case common.ErrMaintenanceMode:
+			common.Error(c, http.StatusForbidden, "社区正在维护中，暂不支持注册")
 		case common.ErrEmailExists:
 			common.Error(c, http.StatusConflict, "该邮箱已注册")
 		case common.ErrWeakPassword:

internal/middleware/maintenance.go

@@ -0,0 +1,97 @@
+package middleware
+
+import (
+	"net/http"
+	"strings"
+
+	"metazone.cc/metalab/internal/common"
+	"metazone.cc/metalab/internal/config"
+	"metazone.cc/metalab/internal/model"
+
+	"github.com/gin-gonic/gin"
+)
+
+// MaintenanceMiddleware 维护模式中间件：维护期间仅站长（Owner）可访问
+type MaintenanceMiddleware struct {
+	cfg          *config.Config
+	siteSettings *config.SiteSettings
+}
+
+// NewMaintenanceMiddleware 构造函数
+func NewMaintenanceMiddleware(cfg *config.Config, siteSettings *config.SiteSettings) *MaintenanceMiddleware {
+	return &MaintenanceMiddleware{cfg: cfg, siteSettings: siteSettings}
+}
+
+// Handler 返回 Gin 中间件处理函数
+func (mm *MaintenanceMiddleware) Handler() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		// 未启用维护模式 → 放行
+		if !mm.siteSettings.IsMaintenanceEnabled() {
+			c.Next()
+			return
+		}
+
+		path := c.Request.URL.Path
+
+		// 白名单：登录相关页面和 API 始终可访问
+		if isMaintenanceWhitelist(path) {
+			c.Next()
+			return
+		}
+
+		// 尝试读取 token 并解析角色
+		tokenStr, err := c.Cookie(common.CookieName)
+		if err != nil {
+			// 未登录 → 重定向到登录页（API 返回 403）
+			blockAccess(c, path)
+			return
+		}
+
+		claims, err := parseToken(tokenStr, mm.cfg.JWT.Secret)
+		if err != nil {
+			blockAccess(c, path)
+			return
+		}
+
+		role, _ := claims["role"].(string)
+		if !model.HasMinRole(role, model.RoleOwner) {
+			blockAccess(c, path)
+			return
+		}
+
+		// 注入用户信息到 context（后续 auth 中间件可能还需要）
+		injectUserContext(c, claims)
+
+		c.Next()
+	}
+}
+
+// isMaintenanceWhitelist 判断路径是否在维护白名单中
+func isMaintenanceWhitelist(path string) bool {
+	// 登录页面和认证 API
+	if path == "/auth/login" || strings.HasPrefix(path, "/api/auth/") {
+		return true
+	}
+	// 静态资源
+	if strings.HasPrefix(path, "/static/") || strings.HasPrefix(path, "/shared/") {
+		return true
+	}
+	// favicon
+	if path == "/favicon.ico" || path == "/favicon.svg" {
+		return true
+	}
+	return false
+}
+
+// blockAccess 根据请求类型阻止访问（页面重定向，API 返回 403 JSON）
+func blockAccess(c *gin.Context, path string) {
+	if strings.HasPrefix(path, "/api/") || strings.HasPrefix(path, "/admin/api/") {
+		c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
+			"success": false,
+			"message": "社区正在维护中，仅站长可访问",
+		})
+		return
+	}
+	c.Redirect(http.StatusFound, "/auth/login")
+	c.Abort()
+}

internal/middleware/site_info.go

@@ -7,12 +7,13 @@ import (
 )
 
 // InjectSiteInfo 注入站点展示信息到请求上下文（供 BuildPageData 使用）
-// 应用于引擎级全局中间件，确保所有 SSR 页面都能读取 Framework/CopyrightStart
+// 应用于引擎级全局中间件，确保所有 SSR 页面都能读取 Framework/CopyrightStart/IsMaintenance
 func InjectSiteInfo(siteSettings *config.SiteSettings) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		info := siteSettings.SiteInfo()
 		c.Set("site_framework", info.Framework)
 		c.Set("site_copyright_start", info.CopyrightStart)
+		c.Set("is_maintenance", siteSettings.IsMaintenanceEnabled())
 		c.Next()
 	}
 }

internal/router/deps_core.go

@@ -14,6 +14,7 @@ import (
 type dependencies struct {
 	authCtrl        *controller.AuthController
 	authMdw         *middleware.AuthMiddleware
+	maintenanceMdw  *middleware.MaintenanceMiddleware
 	settingsCtrl    *controller.SettingsController
 	messageCtrl     *controller.MessageController
 	postCtrl        *controller.PostController

internal/router/deps_extra.go

@@ -4,6 +4,7 @@ import (
 	"metazone.cc/metalab/internal/config"
 	"metazone.cc/metalab/internal/controller"
 	adminCtrl "metazone.cc/metalab/internal/controller/admin"
+	"metazone.cc/metalab/internal/middleware"
 	"metazone.cc/metalab/internal/repository"
 	"metazone.cc/metalab/internal/service"
 
@@ -41,8 +42,11 @@ func buildDeps(db *gorm.DB, cfg *config.Config, siteSettings *config.SiteSetting
 	spaceService := service.NewSpaceService(userRepo, postRepo)
 	spaceCtrl := controller.NewSpaceController(spaceService)
 
+	maintenanceMdw := middleware.NewMaintenanceMiddleware(cfg, siteSettings)
+
 	return &dependencies{
-		authCtrl: authCtrl, authMdw: authMdw, settingsCtrl: settingsCtrl,
+		authCtrl: authCtrl, authMdw: authMdw, maintenanceMdw: maintenanceMdw,
+		settingsCtrl: settingsCtrl,
 		messageCtrl: messageController, postCtrl: postCtrl, spaceCtrl: spaceCtrl,
 		studioCtrl: studioCtrl,
 		adminPostCtrl: adminPostCtrl,

internal/router/router.go

@@ -15,6 +15,9 @@ func Setup(r *gin.Engine, db *gorm.DB, cfg *config.Config, siteSettings *config.
 
 	deps := buildDeps(db, cfg, siteSettings)
 
+	// 维护模式中间件（全局，在路由匹配之前）
+	r.Use(deps.maintenanceMdw.Handler())
+
 	setupFrontendRoutes(r, cfg, deps)
 	setupAPIRoutes(r, cfg, deps)
 	setupAdminRoutes(r, cfg, deps)

internal/service/auth_service.go

@@ -62,7 +62,11 @@ func (s *AuthService) IsRegistrationEnabled() bool {
 // rememberMe=true: refresh Cookie 持久化（30天）；false: session cookie（关浏览器即清除）
 // regIP: 注册 IP 地址
 func (s *AuthService) Register(req model.RegisterRequest, regIP string) (string, string, *model.User, error) {
-	// 0. 检查注册开关
+	// 0. 维护期间禁止注册
+	if s.siteSettings.IsMaintenanceEnabled() {
+		return "", "", nil, common.ErrMaintenanceMode
+	}
+	// 1. 检查注册开关
 	if !s.siteSettings.IsRegistrationEnabled() {
 		return "", "", nil, common.ErrRegistrationDisabled
 	}
@@ -154,6 +158,11 @@ func (s *AuthService) Login(req model.LoginRequest, loginIP string) (string, str
 		return "", "", nil, common.ErrUserBanned
 	}
 
+	// 维护期间仅站长可登录
+	if s.siteSettings.IsMaintenanceEnabled() && !model.HasMinRole(user.Role, model.RoleOwner) {
+		return "", "", nil, common.ErrMaintenanceMode
+	}
+
 	if !common.CheckPassword(req.Password, user.PasswordHash) {
 		return "", "", nil, common.ErrInvalidCred
 	}

templates/MetaLab-2026/html/auth/register.html

@@ -5,9 +5,15 @@
 
 <main class="auth-page">
     <div class="auth-card">
+        {{if .IsMaintenance}}
+        <h2>系统维护中</h2>
+        <p class="auth-subtitle">社区正在维护升级，期间仅站长可访问</p>
+        <div class="registration-closed">
+            <p class="closed-message">请耐心等待，维护完成后将恢复注册与访问</p>
+        </div>
+        {{else if .RegistrationEnabled}}
         <h2>创建账号</h2>
         <p class="auth-subtitle">加入 MetaLab 开发者社区</p>
-        {{if .RegistrationEnabled}}
         <form id="registerForm" novalidate>
             <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
             <div class="form-group">
@@ -36,9 +42,11 @@
             <button type="submit" class="submit-btn" id="submitBtn">注 册</button>
         </form>
         {{else}}
+        <h2>暂停注册</h2>
+        <p class="auth-subtitle">新用户注册暂时关闭</p>
         <div class="registration-closed">
             <p class="closed-message">当前暂不开放注册，敬请期待</p>
-            <p class="closed-subtitle">社区正在维护中，请稍后再来</p>
+            <p class="closed-subtitle">如需加入社区，请关注后续开放通知</p>
         </div>
         {{end}}
         <div class="auth-footer">

templates/MetaLab-2026/html/layout/nav.html

@@ -23,3 +23,9 @@
         </ul>
     </div>
 </header>
+{{if .IsMaintenance}}
+<div class="maintenance-banner">
+    <span class="maintenance-banner-icon">&#9881;</span>
+    <span>社区正在维护中，仅站长可访问</span>
+</div>
+{{end}}

templates/MetaLab-2026/static/css/common.css

@@ -193,6 +193,22 @@ header {
     cursor: pointer;
 }
 
+/* ---------- Maintenance Banner ---------- */
+.maintenance-banner {
+    text-align: center;
+    padding: .6rem 1rem;
+    background: #fef3cd;
+    border-bottom: 1px solid #f0d48a;
+    color: #856404;
+    font-size: .9rem;
+    font-weight: 500;
+}
+
+.maintenance-banner-icon {
+    font-size: 1rem;
+    margin-right: .4rem;
+}
+
 /* ---------- Contact / Footer ---------- */
 .contact-bar {
     text-align: center;

templates/admin/html/site-settings/index.html

@@ -1,7 +1,7 @@
 {{template "admin/layout/base.html" .}}
         <div class="page-header">
             <h1>站点设置</h1>
-            <p class="page-desc">管理站点基本配置、审核开关与注册策略</p>
+            <p class="page-desc">管理站点基本配置、维护开关、审核开关与注册策略</p>
         </div>
 
         <!-- 基本设置 -->
@@ -31,6 +31,23 @@
             </div>
         </div>
 
+        <!-- 维护设置 -->
+        <div class="settings-section">
+            <div class="section-title">维护设置</div>
+            <div class="section-body">
+                <div class="setting-item">
+                    <div class="setting-info">
+                        <span class="setting-label">启用维护模式</span>
+                        <span class="setting-desc">开启后仅站长可登录和访问，其他用户将看到维护提示</span>
+                    </div>
+                    <label class="toggle-switch">
+                        <input type="checkbox" id="maintenance-enabled" data-key="maintenance.enabled">
+                        <span class="toggle-slider"></span>
+                    </label>
+                </div>
+            </div>
+        </div>
+
         <!-- 注册设置 -->
         <div class="settings-section">
             <div class="section-title">注册设置</div>

templates/admin/static/js/site-settings.js

@@ -7,6 +7,7 @@
     'use strict';
 
     const TOGGLE_KEYS = [
+        { id: 'maintenance-enabled', key: 'maintenance.enabled' },
         { id: 'registration-enabled', key: 'registration.enabled' },
         { id: 'audit-enabled', key: 'audit.enabled' },
         { id: 'audit-username', key: 'audit.username_audit' },
@@ -17,6 +18,7 @@
     // 已有专属 UI 的设置 key，不在"其他设置"中重复显示
     var DEDICATED_KEYS = {
         'site.framework': true, 'site.copyright_start': true,
+        'maintenance.enabled': true,
         'registration.enabled': true,
         'audit.enabled': true, 'audit.username_audit': true, 'audit.avatar_audit': true, 'audit.bio_audit': true
     };
@@ -34,8 +36,8 @@
                 var el = document.getElementById(t.id);
                 if (!el) return;
 
-                if (t.id === 'registration-enabled') {
+                if (t.id === 'maintenance-enabled' || t.id === 'registration-enabled') {
-                    el.checked = allSettings['registration.enabled'] !== 'false';
+                    el.checked = allSettings[t.key] !== 'false';
                 } else {
                     el.checked = audit[t.key.split('.')[1]] === true;
                 }