merge: 合入本地 Ops 扩展与 origin/main（ECR-009–016）

保留远程用户侧 ECR-009–016 与本地 Ops 目录/RBAC/CMS/危机等能力；文档标注分叉期间 ECR 编号冲突。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/service/auth/service.go

@@ -42,6 +42,9 @@ type SessionResult struct {
 	IsNew     bool      `json:"is_new"`
 }
 
+// ErrAccountRestricted is returned when UserStatus is not active.
+var ErrAccountRestricted = errors.New("账户已受限")
+
 // Register upgrades or opens an account (same open rules as Login).
 func (s *Service) Register(ctx context.Context, userID uuid.UUID, deviceKey, phone, password, nickname string) (*SessionResult, error) {
 	return s.OpenLogin(ctx, userID, deviceKey, phone, password, nickname)
@@ -74,6 +77,9 @@ func (s *Service) OpenLogin(ctx context.Context, deviceUserID uuid.UUID, deviceK
 
 	acc, err := s.Repo.GetByPhone(ctx, phone)
 	if err == nil {
+		if acc.Status != "active" {
+			return nil, ErrAccountRestricted
+		}
 		_ = s.Repo.TouchPassword(ctx, acc.ID, hashStr)
 		if deviceKey != "" {
 			_ = s.Repo.BindDevice(ctx, deviceKey, acc.ID)
@@ -100,6 +106,9 @@ func (s *Service) OpenLogin(ctx context.Context, deviceUserID uuid.UUID, deviceK
 	cur, curErr := s.Repo.GetAccount(ctx, deviceUserID)
 	uid := deviceUserID
 	if curErr == nil && cur.Phone == "" {
+		if cur.Status != "active" {
+			return nil, ErrAccountRestricted
+		}
 		if err := s.Repo.RegisterOnUser(ctx, deviceUserID, phone, hashStr, nick); err != nil {
 			return nil, errors.New("登录失败，请重试")
 		}