merge: 合入本地 Ops 扩展与 origin/main（ECR-009–016）

保留远程用户侧 ECR-009–016 与本地 Ops 目录/RBAC/CMS/危机等能力；文档标注分叉期间 ECR 编号冲突。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/handler/auth.go

@@ -1,6 +1,7 @@
 package handler
 
 import (
+	"errors"
 	"net/http"
 	"strings"
 
@@ -51,6 +52,10 @@ func (h *AuthHandler) RegisterAccount(c *gin.Context) {
 		if failTextCompliance(c, err) {
 			return
 		}
+		if errors.Is(err, auth.ErrAccountRestricted) {
+			response.Fail(c, http.StatusUnauthorized, 40113, err.Error())
+			return
+		}
 		response.Fail(c, http.StatusBadRequest, 40110, err.Error())
 		return
 	}
@@ -72,6 +77,10 @@ func (h *AuthHandler) Login(c *gin.Context) {
 	deviceKey := c.GetHeader(middleware.DeviceKeyHeader)
 	res, err := h.Svc.Login(c.Request.Context(), userID, deviceKey, body.Phone, body.Password)
 	if err != nil {
+		if errors.Is(err, auth.ErrAccountRestricted) {
+			response.Fail(c, http.StatusUnauthorized, 40113, err.Error())
+			return
+		}
 		response.Fail(c, http.StatusBadRequest, 40111, err.Error())
 		return
 	}