feat(api): tiered cumulative quota + self-service registration

Anonymous callers get a free cumulative quota (1000 calls per IP); once
exhausted they get 403 quota_exhausted and must register. Public users can
self-register (email+password) to obtain a higher-quota API key, view usage,
and regenerate the key. Quota counters live in Redis; the public API stays
read-only except for the registration writes.

- migration 0011: app_user table + api_key.quota_total + 'registered' tier
- ratelimit: IncrTotal/TotalUsed/CopyTotal lifetime counters
- middleware: enforce cumulative quota + X-Quota-* headers
- store: RegisterUser/Authenticate/RegenerateKey (bcrypt)
- handlers: POST /api/v1/register, /account, /account/regenerate
- admin: quota_total column + registered tier
- public: 'API 密钥' account page + API docs quota section

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

public-frontend/src/components/ApiDocs.tsx

@@ -102,7 +102,7 @@ function Endpoint({
   );
 }
 
-export default function ApiDocs() {
+export default function ApiDocs({ onRegister }: { onRegister?: () => void }) {
   return (
     <div className="space-y-5">
       <div className="bg-white border rounded-lg p-5">
@@ -117,7 +117,11 @@ export default function ApiDocs() {
             基础地址：<code className="font-mono bg-gray-100 rounded px-1.5 py-0.5">{BASE}</code>
           </div>
           <ul className="mt-2 list-disc pl-5 text-gray-600 space-y-1">
-            <li>无需 API Key / Token 即可直接 GET；带 Key 可获得更高频率上限（见下文「鉴权与限流」）。</li>
+            <li>
+              无需 API Key / Token 即可直接 GET；匿名调用按来源 IP 累计共 <strong>1000</strong> 次，
+              用满后需<button onClick={onRegister} className="text-emerald-600 hover:underline">注册账号</button>
+              领取更高配额密钥（见下文「鉴权与配额」）。
+            </li>
             <li>
               分页参数 <code className="font-mono">page</code>（默认 1）、
               <code className="font-mono">size</code>（默认 20，最大 100）。
@@ -132,10 +136,13 @@ export default function ApiDocs() {
       </div>
 
       <div className="bg-white border rounded-lg p-5">
-        <h2 className="text-lg font-semibold text-gray-800">鉴权与限流</h2>
+        <h2 className="text-lg font-semibold text-gray-800">鉴权与配额</h2>
         <p className="mt-2 text-gray-600 text-sm leading-relaxed">
-          API 默认<strong>匿名可用</strong>：无需任何凭证即可调用，按来源 IP 计入一个较低的默认频率额度。
-          如需更高额度并让用量归属到你，可在运营方申请一枚 API Key，请求时通过请求头携带：
+          API 默认<strong>匿名可用</strong>：无需任何凭证即可调用，但按来源 IP 计一个
+          <strong>累计总配额（共 1000 次）</strong>，用满后返回
+          <code className="font-mono">403</code>（错误码 <code className="font-mono">quota_exhausted</code>），
+          需<button onClick={onRegister} className="text-emerald-600 hover:underline">注册账号</button>
+          自助领取更高配额的 API Key。注册得到的密钥拥有更高的每分钟频率与累计调用配额，请求时通过请求头携带：
         </p>
         <div className="mt-3">
           <Code>{`# 二选一
@@ -143,7 +150,7 @@ curl -H "X-API-Key: og_live_xxxxxxxx" ${BASE}/products/search?q=牛奶
 curl -H "Authorization: Bearer og_live_xxxxxxxx" ${BASE}/products/search?q=牛奶`}</Code>
         </div>
         <p className="mt-3 text-gray-600 text-sm leading-relaxed">
-          采用<strong>固定窗口</strong>限流（每分钟）。每个响应都会回写以下响应头，便于客户端自适应：
+          同时采用<strong>每分钟固定窗口</strong>频率限制与<strong>累计总配额</strong>两层控制。每个响应都会回写以下响应头，便于客户端自适应：
         </p>
         <table className="mt-3 w-full text-sm">
           <thead className="text-gray-400 text-left">
@@ -169,12 +176,26 @@ curl -H "Authorization: Bearer og_live_xxxxxxxx" ${BASE}/products/search?q=牛
               <td className="pr-4 py-0.5 font-mono text-gray-700">Retry-After</td>
               <td className="py-0.5 text-gray-600">超额时返回，建议等待的秒数</td>
             </tr>
+            <tr>
+              <td className="pr-4 py-0.5 font-mono text-gray-700">X-Quota-Limit</td>
+              <td className="py-0.5 text-gray-600">累计总配额上限</td>
+            </tr>
+            <tr>
+              <td className="pr-4 py-0.5 font-mono text-gray-700">X-Quota-Used</td>
+              <td className="py-0.5 text-gray-600">已累计使用的调用次数</td>
+            </tr>
+            <tr>
+              <td className="pr-4 py-0.5 font-mono text-gray-700">X-Quota-Remaining</td>
+              <td className="py-0.5 text-gray-600">累计配额剩余可用次数</td>
+            </tr>
           </tbody>
         </table>
         <p className="mt-3 text-gray-600 text-sm leading-relaxed">
-          超过额度返回 <code className="font-mono">429 Too Many Requests</code>，错误码
-          <code className="font-mono">rate_limited</code>；无效或已吊销的 Key 返回
-          <code className="font-mono">401</code>，错误码 <code className="font-mono">invalid_api_key</code>。
+          每分钟超额返回 <code className="font-mono">429 Too Many Requests</code>（错误码
+          <code className="font-mono">rate_limited</code>）；累计配额用尽返回
+          <code className="font-mono">403</code>（错误码 <code className="font-mono">quota_exhausted</code>）；
+          无效或已吊销的 Key 返回 <code className="font-mono">401</code>（错误码
+          <code className="font-mono">invalid_api_key</code>）。
         </p>
       </div>
 
@@ -322,6 +343,70 @@ curl -H "Authorization: Bearer og_live_xxxxxxxx" ${BASE}/products/search?q=牛
 }`}
       />
 
+      <Endpoint
+        method="POST"
+        path="/api/v1/register"
+        title="注册账号并领取 API 密钥"
+        desc="用邮箱 + 密码（至少 8 位）注册，自助领取一枚更高配额的 API 密钥。明文密钥只在本次响应返回一次，请妥善保存。"
+        params={[
+          { name: "email", required: true, desc: "邮箱（唯一）" },
+          { name: "password", required: true, desc: "密码，至少 8 位" },
+        ]}
+        example={`curl -X POST ${BASE}/register \\
+  -H "Content-Type: application/json" \\
+  -d '{"email":"you@example.com","password":"your-password"}'`}
+        response={`{
+  "email": "you@example.com",
+  "api_key": "og_live_xxxxxxxxxxxx",
+  "key_prefix": "og_live_xxxx",
+  "rate_limit_per_min": 300,
+  "quota_total": 100000
+}`}
+      />
+
+      <Endpoint
+        method="POST"
+        path="/api/v1/account"
+        title="查看账号与配额用量"
+        desc="用邮箱 + 密码查询当前密钥前缀、频率/累计配额上限及已用量（不返回明文密钥）。"
+        params={[
+          { name: "email", required: true, desc: "注册邮箱" },
+          { name: "password", required: true, desc: "账号密码" },
+        ]}
+        example={`curl -X POST ${BASE}/account \\
+  -H "Content-Type: application/json" \\
+  -d '{"email":"you@example.com","password":"your-password"}'`}
+        response={`{
+  "email": "you@example.com",
+  "key_prefix": "og_live_xxxx",
+  "rate_limit_per_min": 300,
+  "quota_total": 100000,
+  "quota_used": 1234,
+  "quota_remaining": 98766
+}`}
+      />
+
+      <Endpoint
+        method="POST"
+        path="/api/v1/account/regenerate"
+        title="重置 API 密钥"
+        desc="吊销当前密钥并生成新密钥（累计用量会延续，不会因重置而清零）。明文新密钥只返回一次。"
+        params={[
+          { name: "email", required: true, desc: "注册邮箱" },
+          { name: "password", required: true, desc: "账号密码" },
+        ]}
+        example={`curl -X POST ${BASE}/account/regenerate \\
+  -H "Content-Type: application/json" \\
+  -d '{"email":"you@example.com","password":"your-password"}'`}
+        response={`{
+  "email": "you@example.com",
+  "api_key": "og_live_yyyyyyyyyyyy",
+  "key_prefix": "og_live_yyyy",
+  "rate_limit_per_min": 300,
+  "quota_total": 100000
+}`}
+      />
+
       <div className="text-xs text-gray-400 leading-relaxed">
         数据可能存在误差或滞后，按「现状」提供，不构成医疗/购买建议。商品资料版权归各原始来源所有，
         请遵循其许可（如 OpenFoodFacts 的 ODbL）。