feat: 敏感操作增加IP维度限流

- RateLimiter 新增 AllowSensitive 方法（1分钟5次，超限封禁5分钟）
- 新增 SensitiveRateLimit Gin 中间件
- 改密（PUT /api/settings/password）增加限流保护
- 注销（POST /api/settings/delete-account）增加限流保护
- 签到（POST /api/level/checkin）增加限流保护

internal/middleware/rate.go

@@ -0,0 +1,24 @@
+package middleware
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
+// SensitiveRateLimit 敏感操作（改密/注销/签到）IP 维度限流中间件。
+// 1 分钟最多 5 次请求，超限后封禁 5 分钟。
+func SensitiveRateLimit(rl *RateLimiter) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		result := rl.AllowSensitive(c.ClientIP())
+		if result.Blocked {
+			c.JSON(http.StatusTooManyRequests, gin.H{
+				"success": false,
+				"error":   result.Message,
+			})
+			c.Abort()
+			return
+		}
+		c.Next()
+	}
+}

internal/middleware/ratelimit.go

@@ -32,3 +32,8 @@ func (rl *RateLimiter) AllowAccount(email string) RateLimitResult {
 func (rl *RateLimiter) AllowIP(ip string) RateLimitResult {
 	return rl.try(rl.ipFailures, ip, ipWindow, ipBlockDur, ipMaxFails, false)
 }
+
+// AllowSensitive 敏感操作限流（改密/注销/签到），基于 IP，1 分钟最多 5 次，超限封禁 5 分钟。
+func (rl *RateLimiter) AllowSensitive(ip string) RateLimitResult {
+	return rl.try(rl.ipFailures, "sensitive:"+ip, sensitiveWindow, sensitiveBlockDur, sensitiveMaxRequests, false)
+}

internal/middleware/ratelimit_core.go

@@ -21,6 +21,11 @@ const (
 	ipBlockDur      = 1 * time.Minute
 	cleanupInterval = 2 * time.Minute
 	maxEntries      = 10000
+
+	// 敏感操作限流：改密/注销/签到
+	sensitiveWindow      = 1 * time.Minute
+	sensitiveMaxRequests = 5
+	sensitiveBlockDur    = 5 * time.Minute
 )
 
 // windowState 单个维度的限流状态