fix(auth): 公开登录门按来源限速并设全站发信上限，冷却表定期清理

panel/src/i18n/resources/en-US/errors.json

@@ -23,6 +23,8 @@
   "otp_resend_cooldown": "Verification code requested too frequently, please try again later.",
   "otp_locked": "Too many incorrect attempts, please request a new verification code.",
   "otp_account_locked": "Too many wrong codes in 24 hours — email codes for this account are paused. Try again later or use a passkey.",
+  "rate_limited": "Too many sign-in attempts from your network — wait a minute and try again.",
+  "mail_rate_limited": "This server is sending too much mail right now, so codes are paused. Try again shortly or use a passkey.",
   "passkey_challenge_invalid": "Passkey challenge is invalid or expired, please try again.",
   "invalid_attestation": "Could not verify this Passkey, please try again.",
   "passkey_already_bound": "This Passkey is already bound to another account.",

panel/src/i18n/resources/zh-CN/errors.json

@@ -23,6 +23,8 @@
   "otp_resend_cooldown": "验证码发送频繁，请稍后再试。",
   "otp_locked": "验证码错误次数过多，请重新获取验证码。",
   "otp_account_locked": "24 小时内验证码错误次数已达上限，此账号的邮箱验证码暂时停用，请稍后再试或改用 Passkey。",
+  "rate_limited": "登录请求过于频繁，请稍等一分钟再试。",
+  "mail_rate_limited": "服务器当前发信过多，验证码暂时发不出去，请稍后再试或改用 Passkey。",
   "passkey_challenge_invalid": "验证挑战无效或已过期，请重试。",
   "invalid_attestation": "无法验证此 Passkey，请重试。",
   "passkey_already_bound": "此 Passkey 已被其他账户绑定。",

panel/src/lib/api.ts

@@ -679,6 +679,12 @@ export function humanizeError(e: unknown): string {
       return t("otp_locked");
     case "otp_account_locked":
       return t("otp_account_locked");
+    // Volumetric limits on the sign-in doors (internal/api/ratelimit.go): one
+    // network calling too fast, or the install-wide mail budget spent.
+    case "rate_limited":
+      return t("rate_limited");
+    case "mail_rate_limited":
+      return t("mail_rate_limited");
     case "passkey_challenge_invalid":
       return t("passkey_challenge_invalid");
     case "invalid_attestation":