refactor: 拆分超标控制器文件至行数≤120行

- auth_controller.go(238→54): 拆出auth_api_login.go(107)+auth_api_register.go(96)
- settings_controller.go(289→101): 拆出settings_api_profile(116)+account(59)+error_handlers(41)
- message_controller.go(129→85): 拆出message_page_controller.go(55)
- 所有拆分后文件均≤120行，符合code-style.md瘦控制器规范

internal/controller/auth_api_login.go

@@ -0,0 +1,107 @@
+package controller
+
+import (
+	"net/http"
+
+	"metazone.cc/metalab/internal/common"
+	"metazone.cc/metalab/internal/model"
+
+	"github.com/gin-gonic/gin"
+)
+
+// clientIP 获取客户端真实 IP（考虑反向代理）
+func clientIP(c *gin.Context) string {
+	if fwd := c.GetHeader("X-Forwarded-For"); fwd != "" {
+		return fwd
+	}
+	if real := c.GetHeader("X-Real-IP"); real != "" {
+		return real
+	}
+	return c.ClientIP()
+}
+
+// Login 登录 API（含双维度限流）
+func (ac *AuthController) Login(c *gin.Context) {
+	var req model.LoginRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		common.Error(c, http.StatusBadRequest, "请检查输入")
+		return
+	}
+
+	email := req.Email
+	ip := clientIP(c)
+
+	// --- 限流：账户维度 ---
+	acctResult, recordAccount := ac.rateLimiter.AllowAccount(email)
+	if acctResult.Blocked {
+		common.Error(c, http.StatusTooManyRequests, acctResult.Message)
+		return
+	}
+
+	// --- 限流：IP 维度 ---
+	ipResult, recordIP := ac.rateLimiter.AllowIP(ip)
+	if ipResult.Blocked {
+		common.Error(c, http.StatusTooManyRequests, ipResult.Message)
+		return
+	}
+
+	accessToken, refreshToken, user, err := ac.authService.Login(req, ip)
+	if err != nil {
+		// 记录失败 → 两个维度各 +1
+		if recordAccount != nil {
+			recordAccount()
+		}
+		if recordIP != nil {
+			recordIP()
+		}
+
+		switch err {
+		case common.ErrInvalidCred:
+			common.Error(c, http.StatusUnauthorized, "邮箱或密码错误")
+		case common.ErrUserBanned:
+			common.Error(c, http.StatusForbidden, "账号已被封禁")
+		case common.ErrUserLocked:
+			common.Error(c, http.StatusUnauthorized, "邮箱或密码错误")
+		case common.ErrNeedsConfirmRestore:
+			// 注销账号登录 → 需要二次确认恢复
+			c.JSON(http.StatusOK, gin.H{
+				"success": true,
+				"action":  "confirm_restore",
+				"message": "你的账号正在注销中，登录将中止注销流程",
+			})
+		default:
+			common.Error(c, http.StatusInternalServerError, "登录失败，请稍后重试")
+		}
+		return
+	}
+
+	// 登录成功 → 清除失败计数
+	ac.rateLimiter.Clear(email, ip)
+
+	common.SetAuthCookies(c, accessToken, refreshToken, req.RememberMe, ac.cfg)
+
+	common.OkWithMessage(c, user, "登录成功")
+}
+
+// ConfirmRestore 二次确认恢复已注销账号
+func (ac *AuthController) ConfirmRestore(c *gin.Context) {
+	var req model.LoginRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		common.Error(c, http.StatusBadRequest, "请检查输入")
+		return
+	}
+
+	accessToken, refreshToken, user, err := ac.authService.ConfirmRestore(req, clientIP(c))
+	if err != nil {
+		switch err {
+		case common.ErrInvalidCred:
+			common.Error(c, http.StatusUnauthorized, "邮箱或密码错误")
+		default:
+			common.Error(c, http.StatusInternalServerError, "操作失败，请稍后重试")
+		}
+		return
+	}
+
+	common.SetAuthCookies(c, accessToken, refreshToken, req.RememberMe, ac.cfg)
+	common.OkWithMessage(c, user, "账号已恢复，欢迎回来")
+}