feat(api): tiered cumulative quota + self-service registration

Anonymous callers get a free cumulative quota (1000 calls per IP); once
exhausted they get 403 quota_exhausted and must register. Public users can
self-register (email+password) to obtain a higher-quota API key, view usage,
and regenerate the key. Quota counters live in Redis; the public API stays
read-only except for the registration writes.

- migration 0011: app_user table + api_key.quota_total + 'registered' tier
- ratelimit: IncrTotal/TotalUsed/CopyTotal lifetime counters
- middleware: enforce cumulative quota + X-Quota-* headers
- store: RegisterUser/Authenticate/RegenerateKey (bcrypt)
- handlers: POST /api/v1/register, /account, /account/regenerate
- admin: quota_total column + registered tier
- public: 'API 密钥' account page + API docs quota section

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

public-frontend/src/api.ts

@@ -36,6 +36,23 @@ export interface Stats {
   min_score: number;
 }
 
+export interface KeyResponse {
+  email: string;
+  api_key: string;
+  key_prefix: string;
+  rate_limit_per_min: number;
+  quota_total: number;
+}
+
+export interface AccountInfo {
+  email: string;
+  key_prefix: string;
+  rate_limit_per_min: number;
+  quota_total: number;
+  quota_used: number;
+  quota_remaining: number;
+}
+
 export const api = {
   stats: () => req<Stats>(`/api/v1/stats`),
   search: (q: string, page = 1, size = 20, filters: SearchFilters = {}) => {
@@ -55,4 +72,19 @@ export const api = {
       method: "POST",
       body: JSON.stringify(input),
     }),
+  register: (email: string, password: string) =>
+    req<KeyResponse>(`/api/v1/register`, {
+      method: "POST",
+      body: JSON.stringify({ email, password }),
+    }),
+  account: (email: string, password: string) =>
+    req<AccountInfo>(`/api/v1/account`, {
+      method: "POST",
+      body: JSON.stringify({ email, password }),
+    }),
+  regenerate: (email: string, password: string) =>
+    req<KeyResponse>(`/api/v1/account/regenerate`, {
+      method: "POST",
+      body: JSON.stringify({ email, password }),
+    }),
 };