feat(api): tiered cumulative quota + self-service registration

Anonymous callers get a free cumulative quota (1000 calls per IP); once
exhausted they get 403 quota_exhausted and must register. Public users can
self-register (email+password) to obtain a higher-quota API key, view usage,
and regenerate the key. Quota counters live in Redis; the public API stays
read-only except for the registration writes.

- migration 0011: app_user table + api_key.quota_total + 'registered' tier
- ratelimit: IncrTotal/TotalUsed/CopyTotal lifetime counters
- middleware: enforce cumulative quota + X-Quota-* headers
- store: RegisterUser/Authenticate/RegenerateKey (bcrypt)
- handlers: POST /api/v1/register, /account, /account/regenerate
- admin: quota_total column + registered tier
- public: 'API 密钥' account page + API docs quota section

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

api/internal/config/config.go

@@ -9,19 +9,25 @@ import (
 // Values are read from environment variables with sensible defaults so the
 // server can boot in a local Docker Compose setup without extra configuration.
 type Config struct {
-	Addr                string
-	DatabaseURL         string
-	RedisURL            string
-	AnonRateLimitPerMin int
+	Addr                      string
+	DatabaseURL               string
+	RedisURL                  string
+	AnonRateLimitPerMin       int
+	AnonTotalQuota            int
+	RegisteredRateLimitPerMin int
+	RegisteredQuotaTotal      int
 }
 
 // Load reads configuration from the environment.
 func Load() Config {
 	return Config{
-		Addr:                getenv("OPENGOODS_ADDR", ":8080"),
-		DatabaseURL:         getenv("OPENGOODS_DATABASE_URL", "postgres://opengoods:opengoods@localhost:5432/opengoods?sslmode=disable"),
-		RedisURL:            getenv("OPENGOODS_REDIS_URL", "redis://localhost:6379/0"),
-		AnonRateLimitPerMin: getenvInt("OPENGOODS_ANON_RATE_LIMIT_PER_MIN", 60),
+		Addr:                      getenv("OPENGOODS_ADDR", ":8080"),
+		DatabaseURL:               getenv("OPENGOODS_DATABASE_URL", "postgres://opengoods:opengoods@localhost:5432/opengoods?sslmode=disable"),
+		RedisURL:                  getenv("OPENGOODS_REDIS_URL", "redis://localhost:6379/0"),
+		AnonRateLimitPerMin:       getenvInt("OPENGOODS_ANON_RATE_LIMIT_PER_MIN", 60),
+		AnonTotalQuota:            getenvInt("OPENGOODS_ANON_TOTAL_QUOTA", 1000),
+		RegisteredRateLimitPerMin: getenvInt("OPENGOODS_REGISTERED_RATE_LIMIT_PER_MIN", 300),
+		RegisteredQuotaTotal:      getenvInt("OPENGOODS_REGISTERED_QUOTA_TOTAL", 100000),
 	}
 }