commit e3e59e7c69cf7e8b35371a36bcfd7a0a965fc90a
Author: tamakyi <gekkatamakyi@gmail>
Date:   Thu Sep 10 10:56:27 2026 +0800

    chore: baseline snapshot before moderation-strictness feature
    
    Repo .git was damaged (refs/ missing, index truncated, object store near-empty).
    Repaired via git init (rebuilt refs), stale index preserved as .git/index.corrupt-20260910.bak,
    then full worktree committed as a rollback baseline.

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..4617537
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,31 @@
+# ---> Go
+# If you prefer the allow list template instead of the deny list, see community template:
+# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
+#
+# Binaries for programs and plugins
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+
+# Test binary, built with `go test -c`
+*.test
+
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
+
+# Dependency directories (remove the comment below to include it)
+# vendor/
+
+# Go workspace file
+go.work
+go.work.sum
+
+# env file
+.env
+
+# otherfile
+./workbuddy
+./scripts
+./outputs
\ No newline at end of file
diff --git a/.workbuddy/backup/autoban-track-notfound-20260905/app.sample.ini b/.workbuddy/backup/autoban-track-notfound-20260905/app.sample.ini
new file mode 100644
index 0000000..10c1d99
--- /dev/null
+++ b/.workbuddy/backup/autoban-track-notfound-20260905/app.sample.ini
@@ -0,0 +1,154 @@
+[app]
+production = true
+title = "NekoBox"
+icp = ""
+default_lang = ""                        ; 站点默认语言：zh-CN / zh-TW / en / ja，留空默认简体中文（访客未设置语言时的兜底）
+uptrace_dsn = ""
+qiniu_access_key = ""
+qiniu_access_secret = ""
+aliyun_access_key = ""
+aliyun_access_key_secret = ""
+share_background = "https://your-default-background.jpg"  ; 默认分享图背景图链接（1280x720）
+font_path = "static/fonts/NotoSansSC-Regular.otf"         ; 中文字体文件路径（相对项目根目录）
+
+[security]
+enable_text_censor = true
+ip_blacklist =                     ; 逗号分隔的IP黑名单，支持精确IP(如1.2.3.4)和CIDR(如1.2.3.0/24)，留空不启用
+ip_blacklist_redirect_url =        ; 黑名单IP访问时强制跳转到该URL
+trust_proxy = false                ; 是否信任反向代理设置的 CF-Connecting-IP / X-Real-IP / X-Forwarded-For 头。
+                                   ; 仅当站点部署在可信反向代理（如 nginx/Cloudflare）之后且代理已覆盖这些头时设为 true；
+                                   ; 否则保持 false，防止客户端伪造 header 绕过速率限制与 IP 黑名单。
+                                   ; ⚠️ 若站点在 Cloudflare 后且需使用下面的自动封禁，必须设为 true，
+                                   ; 否则解析到的将是 Cloudflare 边缘 IP，自动封禁会误伤所有访客。
+                                   ; ⚠️ 开启 trust_proxy 时，必须配合「Cloudflare Tunnel / Authenticated Origin Pull /
+                                   ; 防火墙仅放行 Cloudflare / EdgeOne 回源网段」锁定源站，否则攻击者可直连源站并伪造
+                                   ; CF-Connecting-IP / EO-Client-IP 头。无需维护 CDN 庞大 CIDR 清单。
+                                   ;
+                                   ; —— 双 CDN（境内腾讯 EdgeOne + 境外 Cloudflare）场景 ——
+                                   ; EdgeOne 回源会用 EO-Client-IP 携带客户端真实 IP（等效 CF-Connecting-IP），
+                                   ; 本程序在 trust_proxy=true 时已同时信任这两个权威头。
+                                   ; 两家 CDN 并存时必须：① 防火墙仅放行两家回源网段；② 在各家 CDN 的规则引擎中
+                                   ; 删除回源请求里「对方 CDN」的权威头（经 EdgeOne 回源删 CF-Connecting-IP、
+                                   ; 经 Cloudflare 回源删 EO-Client-IP），否则攻击者可借道另一家伪造客户端身份，
+                                   ; 绕过限流 / 自动封禁 / 单 IP 投票限制。详细步骤见 outputs/edgeone-cloudflare-dual-cdn-guide.md。
+
+trusted_proxies =
+                                   ; 逗号分隔的「你自己的」反向代理/负载均衡 IP 或 CIDR（如 127.0.0.1、
+                                   ; 10.0.0.0/8）。仅当 TCP 对端落在该清单内时才解析 X-Forwarded-For / X-Real-IP。
+                                   ; 留空（默认）则这两个头永不被信任，仅采用 CDN 权威头 CF-Connecting-IP /
+                                   ; EO-Client-IP（需源站已锁定）。
+                                   ; 注意：此清单用于你自己的基础设施，不是 CDN 的全量 CIDR 清单。
+enable_auto_ban = true             ; 自动封禁（fail2ban 风格）：检测到批量扫描/探测后临时封禁来源 IP
+ban_track_notfound = false         ; 是否把「未注册路径的 404」计入封禁统计（默认 false）。正常业务
+                                   ; （域名/题目不存在等均走 302 业务跳转，不产生 404 计数）一律放行，
+                                   ; 仅命中后台扫描特征路径（/admin、/.env 等）才参与统计封禁，避免
+                                   ; 共享出口（CDN 边缘 / CGNAT）下正常用户被 404 探测连坐误伤。
+                                   ; 如需恢复对纯 404 字典扫描的封禁再置 true。
+ban_threshold_sensitive = 10       ; 统计窗口内命中敏感路径（/admin、/.env、/wp-admin 等）的次数阈值
+ban_threshold_404 = 20             ; 统计窗口内返回 404 的次数阈值（仅 ban_track_notfound = true 时生效）
+ban_window_seconds = 60            ; 统计窗口时长（秒）
+ban_duration_minutes = 15          ; 临时封禁时长（分钟），到期自动解除，重启即清零
+security_alert_email =             ; 触发封禁时发送告警邮件的收件人（复用下方 SMTP 发信配置），留空不发送
+
+[server]
+port = 80
+; 绑定监听地址（含端口）。Cloudflare Tunnel 部署时强烈建议设为 127.0.0.1:<port>，
+; 使源站端口仅对本地 cloudflared 可见，即使防火墙误配也无法被外部直连伪造 CF-Connecting-IP。
+; 留空（默认）则监听所有网卡 ":port"。
+listen =
+salt = ""
+# ⚠️ 必填：密码哈希盐，留空会导致启动失败（已在 conf.Init 强制校验）
+xsrf_key = ""
+# ⚠️ 必填：CSRF token 密钥，留空会导致启动失败（已强制校验）
+xsrf_expire = 3600
+
+[database]
+type = "postgres"
+user = "nekobox"
+password = ""
+host = "127.0.0.1"
+port = 5432
+name = "nekobox"
+schema = "public"
+# 仅在已确认需要自动清理重复 email/domain 时开启；默认关闭，避免启动时改写账号数据。
+dedupe_unique_fields = false
+
+[redis]
+addr = "127.0.0.1:6379"
+password = ""
+
+[recaptcha]
+captcha_type = recaptcha  ; recaptcha（默认）, turnstile, math（本地算数验证码，国内访问友好）
+domain = "https://www.recaptcha.net"
+site_key = ""
+server_key = ""
+turnstile_style = false
+
+[upload]
+default_avatar = ""
+default_background = ""
+
+# User avatar and background.
+aliyun_endpoint = ""
+aliyun_access_id = ""
+aliyun_access_secret = ""
+aliyun_bucket = ""
+aliyun_bucket_cdn_host = ""
+image_endpoint = ""
+image_access_id = ""
+image_access_secret =""
+image_bucket = ""
+image_bucket_cdn_host = ""
+
+# User uploaded images.
+image_endpoint = ""
+image_access_id = ""
+image_access_secret = ""
+image_bucket = ""
+image_bucket_cdn_host = ""
+
+[mail]
+account = ""
+password = ""
+port = 465
+smtp = ""
+
+[limits]
+; ── 全站内容 / 数量上限（运行时配置，修改后重启生效）──────────────────────
+; 缺失本段或个别键时按内置默认值运行。长度统一按字符（rune）计数。
+; 键留空或填 0/负数时自动回退内置默认值，不会导致启动失败，但也不会按你的意图生效，
+; 请按需填写正整数。本文件启用 IgnoreInlineComment，行内分号注释会被并入配置值，
+; 因此下面注释一律独占整行、勿写行内注释。
+
+; ── 标签与屏蔽词（账号设置页）──────────────────────────────────────────────
+; 最多标签个数
+max_tags = 5
+; 单个标签最大字符数
+max_tag_len = 5
+; 最多屏蔽词个数
+max_block_words = 10
+; 单个屏蔽词最大字符数
+max_block_word_len = 10
+
+; ── 投票 ────────────────────────────────────────────────────────────────────
+; 参与者填写的「自定义补充选项」（其他/自定义）最大字符数
+custom_answer_len = 200
+; 站长创建投票时单个「选项」文本最大字符数（预设选项）
+vote_option_len = 300
+
+; ── 提问 / 回答 / 追问 ─────────────────────────────────────────────────────
+; 提问正文最大字符数（访客提交的问题内容）
+question_content_len = 1000
+; 回答正文最大字符数（箱主对提问的回答，及对追问的回复，共用）
+answer_content_len = 2000
+; 追问正文最大字符数（提问者被回答后继续追问的内容）
+followup_content_len = 2000
+
+; ── 私聊 ────────────────────────────────────────────────────────────────────
+; 单条消息（发送/回复）最大字符数
+chat_message_len = 2000
+; 每个私聊会话的消息条数上限（系统硬顶）。用户只能在 1..该值 之间设置自己的
+; 会话条数上限；新注册用户的默认值即该硬顶。
+chat_max_messages = 200
+; 单用户每日私信条数上限（用户可设范围 0..该值；0 表示不限制每日条数）
+daily_message_limit_max = 999
diff --git a/.workbuddy/backup/autoban-track-notfound-20260905/autoban.go b/.workbuddy/backup/autoban-track-notfound-20260905/autoban.go
new file mode 100644
index 0000000..9f2004b
--- /dev/null
+++ b/.workbuddy/backup/autoban-track-notfound-20260905/autoban.go
@@ -0,0 +1,266 @@
+// Package autoban 提供 fail2ban 风格的自动临时封禁：检测批量扫描/探测特征后
+// 临时封禁来源 IP，并可回调发送告警。纯标准库实现，便于独立测试与复用。
+package autoban
+
+import (
+	"strings"
+	"sync"
+	"time"
+)
+
+// 探测事件类型
+const (
+	KindNone      = 0 // 无探测特征
+	KindSensitive = 1 // 命中敏感路径
+	KindNotFound  = 2 // 404 响应（未命中敏感路径）
+)
+
+// 默认阈值/窗口（Options 未配置或为 0 时兜底）。
+const (
+	DefaultWindowSeconds      = 60
+	DefaultDurationMinutes    = 15
+	DefaultThresholdSensitive = 10
+	DefaultThreshold404       = 20
+	pathSampleMax             = 6
+)
+
+// Options 自动封禁配置。
+type Options struct {
+	Enabled            bool
+	ThresholdSensitive int                                                        // 窗口内敏感路径命中次数
+	Threshold404       int                                                        // 窗口内 404 次数
+	Window             time.Duration                                              // 统计窗口
+	Duration           time.Duration                                              // 封禁时长
+	AlertEmail         string                                                     // 告警收件人（留空不发送）
+	SendAlert          func(ip string, paths []string, durationMinutes int) error // 告警发送函数（nil 则不发送）
+}
+
+// sensitivePaths 常见后台/配置/漏洞探测路径特征（忽略大小写，前缀匹配）。
+var sensitivePaths = []string{
+	"/admin", "/wp-admin", "/wp-login.php", "/wp-content", "/wordpress",
+	"/administrator", "/manager", "/cpanel", "/plesk",
+	"/.env", "/.git", "/.aws", "/.ssh", "/.svn", "/.hg", "/.htaccess",
+	"/config", "/configuration", "/backup", "/database", "/db",
+	"/actuator", "/swagger", "/api-docs", "/openapi", "/v2/api-docs",
+	"/phpmyadmin", "/pma", "/mysql", "/server-status", "/server-info",
+	"/shell", "/webshell", "/cmd", "/eval", "/hack", "/shell.php",
+	"/login.php", "/admin.php", "/index.php", "/console", "/vendor",
+}
+
+type probeEvent struct {
+	at   time.Time
+	kind int
+}
+
+type probeStat struct {
+	events    []probeEvent
+	sensitive int
+	notFound  int
+	paths     []string // 命中路径样本（告警用）
+}
+
+// Banner 自动封禁器。方法并发安全。
+type Banner struct {
+	mu sync.Mutex
+
+	probes  map[string]*probeStat
+	banned  map[string]time.Time
+	alerted map[string]bool
+
+	thresholdSensitive int
+	threshold404       int
+	window             time.Duration
+	duration           time.Duration
+	alertEmail         string
+	sendAlert          func(ip string, paths []string, durationMinutes int) error
+	enabled            bool
+}
+
+// New 按配置创建封禁器并注册全局清理。
+func New(opts Options) *Banner {
+	window := opts.Window
+	if window <= 0 {
+		window = DefaultWindowSeconds * time.Second
+	}
+	duration := opts.Duration
+	if duration <= 0 {
+		duration = DefaultDurationMinutes * time.Minute
+	}
+	sensitive := opts.ThresholdSensitive
+	if sensitive <= 0 {
+		sensitive = DefaultThresholdSensitive
+	}
+	notFound := opts.Threshold404
+	if notFound <= 0 {
+		notFound = DefaultThreshold404
+	}
+	b := &Banner{
+		probes:             make(map[string]*probeStat),
+		banned:             make(map[string]time.Time),
+		alerted:            make(map[string]bool),
+		thresholdSensitive: sensitive,
+		threshold404:       notFound,
+		window:             window,
+		duration:           duration,
+		alertEmail:         strings.TrimSpace(opts.AlertEmail),
+		sendAlert:          opts.SendAlert,
+		enabled:            opts.Enabled,
+	}
+	register(b)
+	return b
+}
+
+// Record 记录一次探测事件，达到阈值时封禁 IP 并触发一次告警。
+func (b *Banner) Record(ip, path string, kind int) {
+	if !b.enabled || ip == "" || kind == KindNone {
+		return
+	}
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	now := time.Now()
+	cutoff := now.Add(-b.window)
+
+	st := b.probes[ip]
+	if st == nil {
+		st = &probeStat{}
+		b.probes[ip] = st
+	}
+
+	// 滚动清理过期事件并重算计数
+	valid := st.events[:0]
+	sensitive, notFound := 0, 0
+	for _, e := range st.events {
+		if e.at.After(cutoff) {
+			valid = append(valid, e)
+			if e.kind == KindSensitive {
+				sensitive++
+			} else if e.kind == KindNotFound {
+				notFound++
+			}
+		}
+	}
+	valid = append(valid, probeEvent{at: now, kind: kind})
+	if kind == KindSensitive {
+		sensitive++
+	} else {
+		notFound++
+	}
+	st.events = valid
+	st.sensitive = sensitive
+	st.notFound = notFound
+	if len(st.paths) < pathSampleMax && path != "" {
+		st.paths = append(st.paths, path)
+	}
+
+	if sensitive < b.thresholdSensitive && notFound < b.threshold404 {
+		return
+	}
+
+	// 已达阈值：封禁（已在封禁中则跳过）
+	if until, ok := b.banned[ip]; ok && until.After(now) {
+		return
+	}
+	until := now.Add(b.duration)
+	b.banned[ip] = until
+
+	// 告警（每 IP 仅一次）
+	if b.alertEmail != "" && b.sendAlert != nil && !b.alerted[ip] {
+		b.alerted[ip] = true
+		sample := append([]string{}, st.paths...)
+		dur := int(b.duration.Minutes())
+		go func() {
+			_ = b.sendAlert(ip, sample, dur)
+		}()
+	}
+}
+
+// IsBanned 判断 IP 是否处于封禁期；到期自动解除。
+func (b *Banner) IsBanned(ip string) bool {
+	if !b.enabled || ip == "" {
+		return false
+	}
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if until, ok := b.banned[ip]; ok {
+		if until.After(time.Now()) {
+			return true
+		}
+		delete(b.banned, ip)
+	}
+	return false
+}
+
+// IsSensitivePath 判断路径是否命中敏感探测特征（忽略大小写，完整段前缀匹配）。
+func IsSensitivePath(p string) bool {
+	lower := strings.ToLower(p)
+	for _, s := range sensitivePaths {
+		if lower == s || strings.HasPrefix(lower, s+"/") {
+			return true
+		}
+	}
+	return false
+}
+
+// ---------- 全局注册与清理 ----------
+
+var (
+	bannersMu   sync.Mutex
+	banners     = make(map[*Banner]struct{})
+	bannersOnce sync.Once
+)
+
+func register(b *Banner) {
+	bannersMu.Lock()
+	banners[b] = struct{}{}
+	bannersMu.Unlock()
+
+	bannersOnce.Do(func() {
+		go func() {
+			for {
+				time.Sleep(2 * time.Minute)
+				bannersMu.Lock()
+				for b := range banners {
+					b.cleanup()
+				}
+				bannersMu.Unlock()
+			}
+		}()
+	})
+}
+
+// cleanup 定期清理过期探测记录与已到期封禁（防止内存膨胀）。
+func (b *Banner) cleanup() {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	now := time.Now()
+	cutoff := now.Add(-b.window)
+
+	for ip, st := range b.probes {
+		if len(st.events) == 0 || st.events[len(st.events)-1].at.Before(cutoff) {
+			delete(b.probes, ip)
+			continue
+		}
+		valid := st.events[:0]
+		sensitive, notFound := 0, 0
+		for _, e := range st.events {
+			if e.at.After(cutoff) {
+				valid = append(valid, e)
+				if e.kind == KindSensitive {
+					sensitive++
+				} else if e.kind == KindNotFound {
+					notFound++
+				}
+			}
+		}
+		st.events = valid
+		st.sensitive = sensitive
+		st.notFound = notFound
+	}
+	for ip, until := range b.banned {
+		if !until.After(now) {
+			delete(b.banned, ip)
+		}
+	}
+}
diff --git a/.workbuddy/backup/autoban-track-notfound-20260905/autoban_test.go b/.workbuddy/backup/autoban-track-notfound-20260905/autoban_test.go
new file mode 100644
index 0000000..bd2fd2e
--- /dev/null
+++ b/.workbuddy/backup/autoban-track-notfound-20260905/autoban_test.go
@@ -0,0 +1,123 @@
+package autoban
+
+import (
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func newTestBanner(thresholdSensitive, threshold404 int, window, duration time.Duration, alertEmail string, alertCalls *int64) *Banner {
+	return New(Options{
+		Enabled:            true,
+		ThresholdSensitive: thresholdSensitive,
+		Threshold404:       threshold404,
+		Window:             window,
+		Duration:           duration,
+		AlertEmail:         alertEmail,
+		SendAlert: func(ip string, paths []string, dur int) error {
+			if alertCalls != nil {
+				atomic.AddInt64(alertCalls, 1)
+			}
+			return nil
+		},
+	})
+}
+
+func TestSensitiveThreshold(t *testing.T) {
+	b := newTestBanner(2, 5, time.Minute, time.Minute, "", nil)
+	b.Record("1.2.3.4", "/admin", KindSensitive)
+	if b.IsBanned("1.2.3.4") {
+		t.Fatal("should not be banned before reaching threshold")
+	}
+	b.Record("1.2.3.4", "/.env", KindSensitive)
+	if !b.IsBanned("1.2.3.4") {
+		t.Fatal("expected ban after reaching sensitive threshold")
+	}
+}
+
+func TestNotFoundThreshold(t *testing.T) {
+	b := newTestBanner(10, 3, time.Minute, time.Minute, "", nil)
+	for i := 0; i < 3; i++ {
+		b.Record("5.6.7.8", "/random-"+string(rune('a'+i)), KindNotFound)
+	}
+	if !b.IsBanned("5.6.7.8") {
+		t.Fatal("expected ban after reaching 404 threshold")
+	}
+}
+
+func TestWindowExpiry(t *testing.T) {
+	b := newTestBanner(2, 5, 50*time.Millisecond, time.Minute, "", nil)
+	b.Record("1.1.1.1", "/admin", KindSensitive)
+	time.Sleep(80 * time.Millisecond) // 事件滑出窗口
+	b.Record("1.1.1.1", "/.env", KindSensitive)
+	if b.IsBanned("1.1.1.1") {
+		t.Fatal("events outside the window must not accumulate")
+	}
+}
+
+func TestDurationExpiry(t *testing.T) {
+	b := newTestBanner(1, 5, time.Minute, 60*time.Millisecond, "", nil)
+	b.Record("2.2.2.2", "/admin", KindSensitive)
+	if !b.IsBanned("2.2.2.2") {
+		t.Fatal("expected ban")
+	}
+	time.Sleep(100 * time.Millisecond) // 封禁到期
+	if b.IsBanned("2.2.2.2") {
+		t.Fatal("ban should expire after duration")
+	}
+}
+
+func TestAlertOncePerIP(t *testing.T) {
+	var calls int64
+	b := newTestBanner(1, 5, time.Minute, time.Minute, "admin@example.com", &calls)
+	b.Record("9.9.9.9", "/wp-admin", KindSensitive)
+	b.Record("9.9.9.9", "/.git", KindSensitive) // 已在封禁中，不应重复告警
+	b.Record("9.9.9.9", "/config", KindSensitive)
+
+	// sendAlert 异步调用，轮询等待最多 500ms
+	deadline := time.Now().Add(500 * time.Millisecond)
+	for atomic.LoadInt64(&calls) == 0 && time.Now().Before(deadline) {
+		time.Sleep(10 * time.Millisecond)
+	}
+	if got := atomic.LoadInt64(&calls); got != 1 {
+		t.Fatalf("expected exactly 1 alert, got %d", got)
+	}
+}
+
+func TestDisabled(t *testing.T) {
+	b := New(Options{Enabled: false})
+	b.Record("3.3.3.3", "/admin", KindSensitive)
+	if b.IsBanned("3.3.3.3") {
+		t.Fatal("disabled auto-ban must not ban")
+	}
+}
+
+func TestDefaults(t *testing.T) {
+	b := New(Options{Enabled: true}) // 全部走默认值
+	if b.thresholdSensitive != DefaultThresholdSensitive || b.threshold404 != DefaultThreshold404 {
+		t.Fatalf("default thresholds wrong: %d/%d", b.thresholdSensitive, b.threshold404)
+	}
+	if b.window != DefaultWindowSeconds*time.Second || b.duration != DefaultDurationMinutes*time.Minute {
+		t.Fatalf("default window/duration wrong: %v/%v", b.window, b.duration)
+	}
+}
+
+func TestIsSensitivePath(t *testing.T) {
+	cases := []struct {
+		path string
+		want bool
+	}{
+		{"/admin", true},
+		{"/admin/panel", true},
+		{"/WP-ADMIN", true},
+		{"/.env", true},
+		{"/user/questions", false},
+		{"/vote/abc123", false},
+		{"/administratorx", false}, // 前缀必须完整段匹配，避免误伤
+	}
+	for _, c := range cases {
+		if got := IsSensitivePath(c.path); got != c.want {
+			t.Errorf("IsSensitivePath(%q) = %v, want %v", c.path, got, c.want)
+		}
+	}
+}
diff --git a/.workbuddy/backup/autoban-track-notfound-20260905/route.go b/.workbuddy/backup/autoban-track-notfound-20260905/route.go
new file mode 100644
index 0000000..dc32c09
--- /dev/null
+++ b/.workbuddy/backup/autoban-track-notfound-20260905/route.go
@@ -0,0 +1,409 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package route
+
+import (
+	"encoding/gob"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/flamego/cache"
+	cacheRedis "github.com/flamego/cache/redis"
+	"github.com/flamego/csrf"
+	"github.com/flamego/flamego"
+	"github.com/flamego/recaptcha"
+	"github.com/flamego/session"
+	"github.com/flamego/session/mysql"
+	sessionRedis "github.com/flamego/session/redis"
+	"github.com/flamego/template"
+	"github.com/sirupsen/logrus"
+
+	"github.com/tamakyi/TamaBox/internal/captcha"
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/context"
+	"github.com/tamakyi/TamaBox/internal/form"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+	"github.com/tamakyi/TamaBox/internal/mail"
+	"github.com/tamakyi/TamaBox/internal/route/chat" // 私聊路由
+	"github.com/tamakyi/TamaBox/internal/security/autoban"
+	"github.com/tamakyi/TamaBox/internal/shared"
+	templatepkg "github.com/tamakyi/TamaBox/internal/template"
+	"github.com/tamakyi/TamaBox/route"
+	"github.com/tamakyi/TamaBox/route/auth"
+	"github.com/tamakyi/TamaBox/route/pixel"
+	"github.com/tamakyi/TamaBox/route/question"
+	"github.com/tamakyi/TamaBox/route/service"
+	"github.com/tamakyi/TamaBox/route/user"
+	"github.com/tamakyi/TamaBox/route/vote"
+	"github.com/tamakyi/TamaBox/static"
+	"github.com/tamakyi/TamaBox/templates"
+)
+
+// CSRFUserSessionKey 是 CSRF token 绑定的会话键，必须与登录时写入的会话键一致
+// （见 route/auth/login.go 中 ctx.Session.Set("uid", ...)）。flamego/csrf 默认使用
+// "userID"，若不与之对齐，token 的 id 恒为 "0"，任意匿名访客从公开页面取到的 token
+// 对全部已登录用户均有效，CSRF 退化为全站公开常量。
+//
+// 本常量同时被 csrf_binding_test.go 引用，作为单一事实来源：一旦被误改，回归测试会在
+// CI 失败，避免修复悄悄倒退。
+const CSRFUserSessionKey = "uid"
+
+// securityHeaders adds security-related HTTP headers to every response.
+func securityHeaders() flamego.Handler {
+	return func(ctx flamego.Context) {
+		w := ctx.ResponseWriter()
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+		w.Header().Set("X-Frame-Options", "DENY")
+		w.Header().Set("X-XSS-Protection", "1; mode=block")
+		w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
+		// HSTS：仅当站点以 https 对外提供服务时下发，避免 http 部署下把用户锁死在 https。
+		if strings.HasPrefix(conf.App.ExternalURL, "https") {
+			w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
+		}
+	}
+}
+
+func New() *flamego.Flame {
+	f := flamego.Classic()
+	if conf.App.Production {
+		flamego.SetEnv(flamego.EnvTypeProd)
+	}
+
+	// 自动封禁实例：整个请求链路共享同一个，供中间件与 f.NotFound 复用，
+	// 避免对业务性 302→/（语言切换、登出、投票不存在等）误判为路径扫描。
+	ab := autoban.New(autoban.Options{
+		Enabled:            conf.Security.EnableAutoBan,
+		ThresholdSensitive: conf.Security.BanThresholdSensitive,
+		Threshold404:       conf.Security.BanThreshold404,
+		Window:             time.Duration(conf.Security.BanWindowSeconds) * time.Second,
+		Duration:           time.Duration(conf.Security.BanDurationMinutes) * time.Minute,
+		AlertEmail:         conf.Security.SecurityAlertEmail,
+		SendAlert:          mail.SendSecurityAlertMail,
+	})
+	// 需要输出详细日志时配置如下
+	// if conf.App.Production {
+	//   	flamego.SetEnv(flamego.EnvTypeProd)
+	// }
+
+	templateFS, err := template.EmbedFS(templates.FS, ".", []string{".html"})
+	if err != nil {
+		logrus.WithError(err).Fatal("Failed to embed templates file system")
+	}
+
+	gob.Register(time.Time{})
+	gob.Register(context.Flash{})
+	gob.Register(captcha.StoredAnswer{})
+	var sessionStorage interface{}
+	initer := session.MemoryIniter()
+	if conf.Database.DSN != "" {
+		initer = mysql.Initer()
+		sessionStorage = mysql.Config{
+			DSN:      conf.Database.DSN,
+			Lifetime: 7 * 24 * time.Hour,
+		}
+	}
+	if conf.Redis.Addr != "" {
+		initer = sessionRedis.Initer()
+		sessionStorage = sessionRedis.Config{
+			Options: &sessionRedis.Options{
+				Addr:     conf.Redis.Addr,
+				Password: conf.Redis.Password,
+				DB:       1,
+			},
+			Lifetime: 7 * 24 * time.Hour,
+		}
+	}
+	sessioner := session.Sessioner(session.Options{
+		Initer: initer,
+		Config: sessionStorage,
+		// 显式声明 cookie 安全属性，不依赖库默认值：
+		//   - HTTPOnly：禁止 JS 读取，降低 XSS 窃取会话的风险
+		//   - SameSite=Lax：阻断经典跨站表单 POST（CSRF 的主要防线之一）
+		//   - Secure：仅在站点以 https 对外服务时下发，避免 http 本地开发下 cookie 不生效。
+		//     缺失 Secure 时，HSTS 尚未落地的首次访问可被主动 MITM 诱导明文请求窃取会话。
+		Cookie: session.CookieOptions{
+			HTTPOnly: true,
+			SameSite: http.SameSiteLaxMode,
+			Secure:   strings.HasPrefix(conf.App.ExternalURL, "https"),
+		},
+	})
+
+	f.Use(flamego.Static(flamego.StaticOptions{
+		FileSystem: http.FS(static.FS),
+		Prefix:     "/static",
+		// 静态资源随二进制发布，内容变更需重新部署；1 天缓存是安全折中
+		CacheControl: func() string {
+			return "public, max-age=86400"
+		},
+	}))
+
+	f.Use(securityHeaders())
+	f.Use(ipBlacklistMiddleware())
+	f.Use(autobanMiddleware(ab))
+	// 全局请求体上限：必须在任何会读取 body 的中间件（尤其 Contexter 内的 CSRF 校验）
+	// 之前执行，否则超大 multipart 会在 Bind 的路由级限制生效前落盘临时文件耗尽磁盘。
+	f.Use(requestBodyLimitMiddleware())
+
+	reqUserSignOut := context.Toggle(&context.ToggleOptions{UserSignOutRequired: true})
+	reqUserSignIn := context.Toggle(&context.ToggleOptions{UserSignInRequired: true})
+
+	f.Group("", func() {
+		f.Get("/", route.Home)
+		f.Get("/pixel", reqUserSignIn, pixel.Index)
+		f.Get("/sponsor", route.Sponsor)
+		f.Get("/change-logs", route.ChangeLogs)
+		f.Get("/about-me", route.AboutMe)
+		f.Get("/robots.txt", func(c context.Context) {
+			fs, err := static.FS.Open("robots.txt")
+			if err != nil {
+				c.ResponseWriter().WriteHeader(404)
+				return
+			}
+			defer func() { _ = fs.Close() }()
+			c.ResponseWriter().Header().Set("Content-Type", "text/plain; charset=utf-8")
+			c.ResponseWriter().Header().Set("Cache-Control", "public, max-age=86400")
+			_, _ = io.Copy(c.ResponseWriter(), fs)
+		})
+		f.Get("/favicon.ico", func(c context.Context) {
+			fs, _ := static.FS.Open("favicon.ico")
+			defer func() { _ = fs.Close() }()
+			c.ResponseWriter().Header().Set("Content-Type", "image/x-icon")
+			c.ResponseWriter().Header().Set("Cache-Control", "public, max-age=86400")
+			_, _ = io.Copy(c.ResponseWriter(), fs)
+		})
+
+		f.Get("/sitemap.xml", func(c context.Context) {
+			fs, err := static.FS.Open("sitemap.xml")
+			if err != nil {
+				c.ResponseWriter().WriteHeader(404)
+				return
+			}
+			defer func() { _ = fs.Close() }()
+			c.ResponseWriter().Header().Set("Content-Type", "application/xml")
+			c.ResponseWriter().Header().Set("Content-Type", "text/xml; charset=utf-8")
+			c.ResponseWriter().Header().Set("Cache-Control", "public, max-age=86400")
+			_, _ = io.Copy(c.ResponseWriter(), fs)
+		})
+
+		f.Get("/llms.txt", func(c context.Context) {
+			fs, err := static.FS.Open("llms.txt")
+			if err != nil {
+				c.ResponseWriter().WriteHeader(404)
+				return
+			}
+			defer func() { _ = fs.Close() }()
+			c.ResponseWriter().Header().Set("Content-Type", "text/plain; charset=utf-8")
+			c.ResponseWriter().Header().Set("Cache-Control", "public, max-age=86400")
+			_, _ = io.Copy(c.ResponseWriter(), fs)
+		})
+
+		f.Get("/llms-full.txt", func(c context.Context) {
+			fs, err := static.FS.Open("llms-full.txt")
+			if err != nil {
+				c.ResponseWriter().WriteHeader(404)
+				return
+			}
+			defer func() { _ = fs.Close() }()
+			c.ResponseWriter().Header().Set("Content-Type", "text/plain; charset=utf-8")
+			c.ResponseWriter().Header().Set("Cache-Control", "public, max-age=86400")
+			_, _ = io.Copy(c.ResponseWriter(), fs)
+		})
+
+		f.Group("", func() {
+			f.Combo("/register").Get(auth.Register).Post(form.Bind(form.Register{}), rateLimitMiddleware(10, 1*time.Minute), auth.RegisterAction)
+			f.Combo("/login").Get(auth.Login).Post(form.Bind(form.Login{}), rateLimitMiddleware(20, 1*time.Minute), auth.LoginAction)
+			f.Combo("/forgot-password").Get(auth.ForgotPassword).Post(form.Bind(form.ForgotPassword{}), rateLimitMiddleware(5, 5*time.Minute), auth.ForgotPasswordAction)
+			f.Combo("/recover-password").Get(auth.RecoverPassword).Post(form.Bind(form.RecoverPassword{}), auth.RecoverPasswordAction)
+		}, reqUserSignOut)
+
+		// 页面密码验证路由（独立于密码保护中间件）；限流防爆破
+		f.Combo("/_/{domain}/password").Get(question.PasswordPage).Post(rateLimitMiddleware(10, 1*time.Minute), question.VerifyPagePassword)
+
+		// 独立的分享图路由（不经过 Pager 中间件，直接返回图片）
+		// 注意：仍挂载 question.Pager，页面设置了密码时必须先通过密码验证，
+		// 否则分享图会绕过页面密码保护（与单题分享图行为一致）。
+		f.Group("/_/{domain}", func() {
+			f.Get("/share-card", question.ShareCard)
+		}, question.Pager)
+
+		f.Group("/_/{domain}", func() {
+			f.Combo("").Get(question.List).Post(form.Bind(form.NewQuestion{}), rateLimitMiddleware(30, 1*time.Minute), question.New)
+			f.Group("/{questionID}", func() {
+				f.Get("", question.Item)
+				f.Get("/share-card", question.QuestionShareCard)
+				f.Post("/delete", question.Delete)
+				f.Post("/set-private", question.SetPrivate)
+				f.Post("/set-public", question.SetPublic)
+				f.Post("/pin", question.TogglePin)
+				f.Post("/read", question.SetRead)
+				f.Post("/unread", question.SetUnread)
+				f.Post("/answer", reqUserSignIn, form.Bind(form.PublishAnswerQuestion{}), question.PublishAnswer)
+				f.Post("/follow-up", form.Bind(form.PublishFollowUpQuestion{}), question.PublishFollowUp)
+				f.Post("/follow-up/{followUpID}/answer", reqUserSignIn, form.Bind(form.AnswerFollowUpQuestion{}), question.AnswerFollowUp)
+			}, question.Questioner)
+
+			// 新增：私聊路由（需要登录，使用 Token 标识对话）
+			f.Group("/chat/{token}", func() {
+				f.Get("", chat.ConversationPage)
+				f.Post("/send", rateLimitMiddleware(20, 1*time.Minute), chat.SendMessage)
+				f.Post("/delete", chat.DeleteConversation)
+				f.Post("/block", chat.ToggleBlockUser)
+			}, reqUserSignIn)
+		}, question.Pager) // Pager 中间件已内置页面密码检查
+
+		f.Get("/explore", user.Explore)
+
+		// 匿名投票参与端（公开）：token 链接入口
+		f.Group("/vote/{token}", func() {
+			f.Get("", vote.Page)
+			// 提交限流优先按登录用户/签名 vote_fp 计数，IP 仅作高阈值兜底，避免共享出口误伤。
+			f.Post("/submit", voteSubmitRateLimitMiddleware(20, 1*time.Minute), vote.Submit)
+		})
+
+		// 公开页语言切换：把语言偏好写入 session（由 session 中间件随其 cookie 一并持久化）
+		// 后跳回原页面。此前写独立 lang cookie 会被 session 中间件的 Set-Cookie 整体覆盖而失效，
+		// 故改为托管在 session 中。仅允许站内相对路径，防开放重定向。
+		f.Get("/i18n/{lang}", func(c context.Context) {
+			lang := i18n.Resolve(c.Param("lang"))
+			// 写入 session，避免被 session 中间件的 Set-Cookie 覆盖（匿名用户也走 session 中间件）。
+			c.Session.Set("lang", lang)
+			to := c.Query("to")
+			// 仅允许站内相对路径，防开放重定向：
+			// 拒绝空、非 "/" 开头、以 "//" 开头的协议相对路径，以及含反斜杠/控制字符的变体。
+			if to == "" || !strings.HasPrefix(to, "/") ||
+				strings.HasPrefix(to, "//") || strings.ContainsAny(to, "\\\x00\r\n\t") {
+				to = "/"
+			}
+			c.Redirect(to)
+		})
+
+		// 算数验证码 API（仅在 captcha_type = "math" 时生效，但路由本身不依赖中间件）
+		// 加限流：防止匿名脚本无限生成/轮询爆破（答案本身对客户端可见，限流是主要节流手段）。
+		f.Get("/api/captcha/generate", rateLimitMiddleware(20, 1*time.Minute), captcha.GenerateHandler)
+		f.Post("/api/captcha/verify", rateLimitMiddleware(20, 1*time.Minute), captcha.VerifyHandler)
+
+		f.Group("/user", func() {
+			f.Get("/questions", user.QuestionList)
+
+			// 匿名投票管理（箱主侧）
+			f.Group("/votes", func() {
+				f.Get("", user.VoteList)
+				f.Get("/new", user.VoteNew)
+				f.Post("", rateLimitMiddleware(10, 1*time.Minute), user.VoteCreate)
+				f.Get("/{voteID}/edit", user.VoteEdit)
+				f.Post("/{voteID}", rateLimitMiddleware(10, 1*time.Minute), user.VoteUpdate)
+				f.Post("/{voteID}/publish", user.VotePublish)
+				f.Post("/{voteID}/close", user.VoteClose)
+				f.Post("/{voteID}/delete", user.VoteDelete)
+				f.Get("/{voteID}/results", user.VoteResults)
+				f.Get("/{voteID}/preview", user.VotePreview)
+				// 导出为只读操作（幂等、无副作用），用 GET 链接下载，避免表单提交
+				f.Get("/{voteID}/export", user.VoteExportCSV)
+			})
+
+			f.Group("/profile", func() {
+				f.Get("", user.Profile)
+				f.Post("/update", form.Bind(form.UpdateProfile{}), rateLimitMiddleware(10, 1*time.Minute), user.UpdateProfile)
+				f.Post("/export", user.ExportProfile)
+				f.Post("/export-json", user.ExportProfileJSON)
+				f.Combo("/deactivate").Get(user.DeactivateProfile).Post(user.DeactivateProfileAction)
+
+				f.Post("/update-page-password", form.Bind(form.UpdatePagePassword{}), rateLimitMiddleware(10, 1*time.Minute), user.UpdatePagePassword)
+				f.Post("/update-ask-password", form.Bind(form.UpdateAskPassword{}), rateLimitMiddleware(10, 1*time.Minute), user.UpdateAskPassword)
+
+				f.Post("/update-chat-settings", user.UpdateChatSettings)
+
+				// 功能管理（提问 / 私聊 / 投票 的开关、定时开关与定量收集）：
+				// 不单独开页面，作为账号设置页的三个面板，保存后回跳到对应面板。
+				f.Group("/features", func() {
+					f.Post("/update", rateLimitMiddleware(20, 1*time.Minute), user.FeaturesUpdate)
+					f.Post("/reset-quota", rateLimitMiddleware(20, 1*time.Minute), user.FeatureResetQuota)
+				})
+			})
+			// 防骚扰设置：注册限制（harassment/update）与全局屏蔽词（blockwords/update）
+			// 拆为两个独立入口。屏蔽词在提问/私聊/投票三个设置面板共用一份，保存后经
+			// ?tab= 参数回跳到来源面板。
+			f.Post("/harassment/update", form.Bind(form.UpdateHarassment{}), user.UpdateHarassment)
+			f.Post("/blockwords/update", form.Bind(form.UpdateBlockWords{}), user.UpdateBlockWords)
+			f.Post("/tags/update", form.Bind(form.UpdateTags{}), user.UpdateTags)
+			// Logout 必须用 POST：GET 会留下 CSRF 风险（第三方图片/链接可触发退出登录）
+			f.Post("/logout", auth.Logout)
+		}, reqUserSignIn)
+
+		f.Group("/api/v1", func() {
+			f.Group("/user", func() {
+				f.Get("", reqUserSignIn, user.ProfileAPI)
+				f.Group("/{domain}", func() {
+					f.Group("/questions", func() {
+						f.Get("", rateLimitMiddleware(60, 1*time.Minute), question.ListAPI)
+					})
+				})
+			})
+			// 像素追踪代理：仅暴露只读 GET（f.Any 会放行写方法，曾有 CSRF 豁免 + 写方法放行的风险），
+			// 并加限流防止被用作高频打点通道。
+			f.Get("/pixel/{**}", reqUserSignIn, rateLimitMiddleware(30, 1*time.Minute), pixel.Proxy)
+			// 服务反代仅暴露只读 GET：本网关是把已登录用户的请求转发到配置好的内部服务，
+			// 不应允许任意写方法，避免被用作对内网后端的越权操作入口。
+			f.Get("/service/{**}", reqUserSignIn, service.Proxy)
+			f.Get("/explore/random", rateLimitMiddleware(60, 1*time.Minute), user.RandomRecommend)
+			// 首页"提问箱信息统计"公开接口（服务端 30 分钟缓存），供前端定时刷新
+			f.Get("/site-stats", rateLimitMiddleware(60, 1*time.Minute), route.SiteStatsAPI)
+		}, context.APIEndpoint)
+	},
+		cache.Cacher(cache.Options{
+			Initer: cacheRedis.Initer(),
+			Config: cacheRedis.Config{
+				Options: &cacheRedis.Options{
+					Addr:     conf.Redis.Addr,
+					Password: conf.Redis.Password,
+					DB:       0,
+				},
+			},
+		}),
+		recaptcha.V3(
+			recaptcha.Options{
+				Secret: conf.Recaptcha.ServerKey,
+				VerifyURL: func() recaptcha.VerifyURL {
+					if conf.Recaptcha.TurnstileStyle {
+						return "https://challenges.cloudflare.com/turnstile/v0/siteverify"
+					}
+					return recaptcha.VerifyURLGlobal
+				}(),
+			},
+		),
+		sessioner,
+		csrf.Csrfer(csrf.Options{
+			Secret: conf.Server.XSRFKey,
+			Header: "X-CSRF-Token",
+			// ⚠️ 必须与 route/auth/login.go 中 ctx.Session.Set("uid", ...) 的 key 一致。
+			// flamego/csrf 默认 SessionKey 为 "userID"，若不显式指定，s.Get("userID")
+			// 恒为 nil，token 内绑定的 id 恒为 "0" —— 由于校验是无状态 HMAC 重算
+			// （不与 session 中存储的 token 比对），这会导致任意匿名访客从公开的
+			// /login 页面取到的 token 对所有已登录用户均有效，CSRF 退化为全站公开常量。
+			// 回归测试见 route/csrf_binding_test.go（引用 CSRFUserSessionKey）。
+			SessionKey: CSRFUserSessionKey,
+		}),
+		template.Templater(template.Options{
+			FileSystem: templateFS,
+			FuncMaps:   templatepkg.FuncMap(),
+		}),
+		context.Contexter(),
+	)
+	f.NotFound(func(ctx flamego.Context) {
+		// 真正的 404 探测在此计数（仅此处，不把业务 302→/ 误判为扫描）。
+		// 注意：flamego 的 NotFound 会先写入 404 状态再 Redirect 到 "/"，
+		// 因此这里在 Redirect 之前记录，确保状态为 404。
+		// 键必须与 autobanMiddleware 中的 IsBanned/Record 保持一致（同样经 LimitKey 聚合），
+		// 否则 404 计数会记在另一个键上，导致封禁永不生效。
+		if ip := shared.LimitKey(shared.ResolveClientIP(ctx.Request().Request)); ip != "" {
+			ab.Record(ip, ctx.Request().URL.Path, autoban.KindNotFound)
+		}
+		ctx.Redirect("/")
+	})
+
+	return f
+}
diff --git a/.workbuddy/backup/autoban-track-notfound-20260905/static.go b/.workbuddy/backup/autoban-track-notfound-20260905/static.go
new file mode 100644
index 0000000..e32d120
--- /dev/null
+++ b/.workbuddy/backup/autoban-track-notfound-20260905/static.go
@@ -0,0 +1,128 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package conf
+
+// Build time and commit information.
+//
+// ⚠️ WARNING: should only be set by "-ldflags".
+var (
+	BuildTime   string
+	BuildCommit = "dev"
+)
+
+var (
+	App struct {
+		Production            bool   `ini:"production"`
+		ExternalURL           string `ini:"external_url"`
+		ICP                   string `ini:"icp"`
+		DefaultLang           string `ini:"default_lang"` // 站点默认语言（zh-CN/zh-TW/en/ja），留空回退简体中文
+		UptraceDSN            string `ini:"uptrace_dsn"`
+		QiniuAccessKey        string `ini:"qiniu_access_key"`
+		QiniuAccessSecret     string `ini:"qiniu_access_secret"`
+		AliyunAccessKey       string `ini:"aliyun_access_key"`
+		AliyunAccessKeySecret string `ini:"aliyun_access_key_secret"`
+		SentryDSN             string `ini:"sentry_dsn"`
+		MaintenanceMode       bool   `ini:"maintenance_mode"`
+		ShareBackground       string `ini:"share_background"`
+		FontPath              string `ini:"font_path"`
+	}
+
+	Security struct {
+		EnableTextCensor       bool   `ini:"enable_text_censor"`
+		IPBlacklist            string `ini:"ip_blacklist"`
+		IPBlacklistRedirectURL string `ini:"ip_blacklist_redirect_url"`
+		// TrustProxy 为 true 时信任 CDN 权威客户端头 CF-Connecting-IP / EO-Client-IP
+		// （以及受信代理设置的 X-Real-IP / X-Forwarded-For）；否则一律使用 RemoteAddr，
+		// 防止客户端伪造 header 绕过速率限制与 IP 黑名单。
+		TrustProxy bool `ini:"trust_proxy"`
+		// TrustedProxies 逗号分隔的 IP / CIDR 列表，仅限“你自己的”反向代理/负载均衡基础设施
+		// （例如本机 nginx 的 127.0.0.1、私有网络 LB）。仅当 TCP 对端落在该清单内时才会解析
+		// X-Forwarded-For / X-Real-IP。留空则这两个头永不被信任（CDN 权威头 CF-Connecting-IP /
+		// EO-Client-IP 仍会被采用，前提是源站已被对应 CDN 锁定）。
+		// 目的：避免维护 Cloudflare / EdgeOne 等上游 CDN 的庞大 CIDR 清单——源站应配合
+		// Cloudflare Tunnel / Authenticated Origin Pull / 防火墙仅放行 CDN 回源网段锁定，
+		// 使 CF-Connecting-IP / EO-Client-IP 成为权威客户端 IP。
+		TrustedProxies string `ini:"trusted_proxies"`
+		// 自动封禁（fail2ban 风格）：检测批量扫描/探测特征后临时封禁来源 IP。
+		EnableAutoBan         bool   `ini:"enable_auto_ban"`
+		BanThresholdSensitive int    `ini:"ban_threshold_sensitive"` // 窗口内敏感路径命中次数
+		BanThreshold404       int    `ini:"ban_threshold_404"`       // 窗口内 404 次数
+		BanWindowSeconds      int    `ini:"ban_window_seconds"`      // 统计窗口（秒）
+		BanDurationMinutes    int    `ini:"ban_duration_minutes"`    // 封禁时长（分钟）
+		SecurityAlertEmail    string `ini:"security_alert_email"`    // 触发封禁时告警收件人（留空不发送）
+	}
+
+	Server struct {
+		Port    int    `ini:"port"`
+		Listen  string `ini:"listen"` // 绑定监听地址（含端口）。留空则默认 ":port"（监听所有网卡）。
+		Salt    string `ini:"salt"`
+		XSRFKey string `ini:"xsrf_key"`
+	}
+
+	Database struct {
+		DSN string
+
+		Type               string `ini:"type"`
+		User               string `ini:"user"`
+		Password           string `ini:"password"`
+		Host               string `ini:"host"`
+		Port               uint   `ini:"port"`
+		Name               string `ini:"name"`
+		Schema             string `ini:"schema"`
+		DedupeUniqueFields bool   `ini:"dedupe_unique_fields"`
+	}
+
+	Redis struct {
+		Addr     string `ini:"addr"`
+		Password string `ini:"password"`
+	}
+
+	Recaptcha struct {
+		CaptchaType    string `ini:"captcha_type"`
+		Domain         string `ini:"domain"`
+		SiteKey        string `ini:"site_key"`
+		ServerKey      string `ini:"server_key"`
+		TurnstileStyle bool   `ini:"turnstile_style"`
+	}
+
+	Pixel struct {
+		Host string `ini:"host"`
+	}
+
+	Upload struct {
+		DefaultAvatarURL          string `ini:"default_avatar"`
+		DefaultBackground         string `ini:"default_background"`
+		DefaultBackgroundImageURL string `ini:"default_qrbackgroundimage"`
+		AliyunEndpoint            string `ini:"aliyun_endpoint"`
+		AliyunAccessID            string `ini:"aliyun_access_id"`
+		AliyunAccessSecret        string `ini:"aliyun_access_secret"`
+		AliyunBucket              string `ini:"aliyun_bucket"`
+		AliyunBucketCDNHost       string `ini:"aliyun_bucket_cdn_host"`
+		ImageEndpoint             string `ini:"image_endpoint"`
+		ImageAccessID             string `ini:"image_access_id"`
+		ImageAccessSecret         string `ini:"image_access_secret"`
+		ImageBucket               string `ini:"image_bucket"`
+		ImageBucketCDNHost        string `ini:"image_bucket_cdn_host"`
+	}
+
+	Mail struct {
+		Account  string `ini:"account"`
+		Password string `ini:"password"`
+		Port     int    `ini:"port"`
+		SMTP     string `ini:"smtp"`
+		// SkipTLSVerify 跳过 SMTP TLS 证书校验（仅自签名/内网 SMTP 需要，默认 false 校验证书）
+		SkipTLSVerify bool `ini:"skip_tls_verify"`
+	}
+
+	Service struct {
+		Backends []struct {
+			Prefix     string `ini:"prefix"`
+			ForwardURL string `ini:"forward_url"`
+		}
+		// TLSInsecureSkipVerify 跳过反向代理到后端服务的 TLS 证书校验
+		// （仅内网后端使用自签名证书时需要，默认 false 校验证书）
+		TLSInsecureSkipVerify bool `ini:"tls_insecure_skip_verify"`
+	}
+)
diff --git a/.workbuddy/backup/cdn-migration-20260905/header.html b/.workbuddy/backup/cdn-migration-20260905/header.html
new file mode 100644
index 0000000..8a6eb93
--- /dev/null
+++ b/.workbuddy/backup/cdn-migration-20260905/header.html
@@ -0,0 +1,977 @@
+<!DOCTYPE html>
+<html lang="{{.LangCode}}">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width">
+  <title>{{ .Title }}</title>
+  <meta name="description" content="{{ if .MetaDescription }}{{ .MetaDescription }}{{ else }}{{ t .LangCode "site.description" }}{{ end }}">
+  <meta name="keywords" content="{{ t .LangCode "site.keywords" }}">
+  <!-- 预连接：UIkit 走公共 CDN（cdnjs.snrat.com），其余自托管库仍在本站 R2，均需预连接 -->
+  <link rel="preconnect" href="https://r2.337845818.best" crossorigin>
+  <link rel="preconnect" href="https://cdnjs.snrat.com" crossorigin>
+  <link rel="dns-prefetch" href="https://cn.vercount.one">
+  <!-- UIkit 3.3.3 切到公共 CDN（cdnjs.snrat.com，国内实测全量下载 ~0.25s，原 R2 自建 ~1.4-2.0s） -->
+  <link rel="stylesheet" href="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/css/uikit.min.css"/>
+  <!-- Waline 评论区样式：非阻塞加载，不阻塞首屏渲染 -->
+  <link rel="stylesheet" href="https://r2.337845818.best/tamabox/cdn/waline/client/v2/waline-no-commits.css" media="print" onload="this.media='all'"/>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/js/uikit.min.js"></script>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/js/uikit-icons.min.js"></script>
+  <!-- UIkit 补丁：复刻原自建版 "modify-black-font"（官方版与自建版仅 3 处颜色差异——把有色容器内默认白字/白标题改为黑字）。
+       模板当前只用到 .uk-light 容器（用户背景封面，question/list.html、question-not-found.html；
+       其中 h3/p 已由 #usernamecolor/#introcolor 内联 style 覆盖），故只需补该容器的 3 处投影即可保持渲染一致。
+       若日后新增 .uk-card-primary/.uk-card-secondary/.uk-section-primary/.uk-tile-*/.uk-overlay-primary 等容器且需黑字，须同步扩展。 -->
+  <style>
+      .uk-light { color: rgba(0,0,0,.7); }
+      .uk-light .uk-h1, .uk-light .uk-h2, .uk-light .uk-h3, .uk-light .uk-h4, .uk-light .uk-h5, .uk-light .uk-h6,
+      .uk-light .uk-heading-2xlarge, .uk-light .uk-heading-large, .uk-light .uk-heading-medium, .uk-light .uk-heading-small, .uk-light .uk-heading-xlarge,
+      .uk-light h1, .uk-light h2, .uk-light h3, .uk-light h4, .uk-light h5, .uk-light h6 { color: #000; }
+      .uk-light .uk-table th { color: rgba(0,0,0,.7); }
+  </style>
+  <script defer src="https://r2.337845818.best/tamabox/cdn/lib/dayjs/1.10.8/dayjs.min.js"></script>
+  <script defer src="https://r2.337845818.best/tamabox/cdn/lib/alpinejs/3.9.0/cdn.min.js"></script>
+  {{ if .VConsole }}
+  <script src="https://r2.337845818.best/tamabox/cdn/lib/vconsole/3.12.1/vconsole.min.js" type="application/javascript"></script>
+  <script>new window.VConsole()</script>
+  {{ end }}
+  <!-- jQuery 已改为按需加载：仅 easy.qrcode 二维码页（list/question-not-found/profile）自行引入 -->
+  <script defer src="https://r2.337845818.best/tamabox/cdn/time.box.js"></script>
+  <!--<script src="https://r2.337845818.best/tamabox/cdn/busuanzi.pure.mini.js"/></script>-->
+  <script defer src="https://cn.vercount.one/js"></script>
+  <script defer src="https://r2.337845818.best/tamabox/cdn/lib/waline/2.15.8/waline.js"></script>
+  {{ if eq .CaptchaType "math" }}
+  <!-- 算数验证码：弹窗模式，不影响原布局 -->
+  <style>
+      .captcha-equation-box {
+          display: inline-flex;
+          align-items: center;
+          background: #f0f2f5;
+          border: 1px solid #dcdcdc;
+          border-radius: 8px;
+          padding: 8px 8px 8px 16px;
+          gap: 6px;
+          transition: border-color 0.2s;
+      }
+      .captcha-equation-box:focus-within {
+          border-color: #1e87f0;
+          box-shadow: 0 0 0 3px rgba(30,135,240,0.12);
+      }
+      .math-captcha-modal-question {
+          font-size: 1.4rem;
+          font-family: "Courier New", monospace;
+          font-weight: 700;
+          color: #333;
+          letter-spacing: 1px;
+          white-space: nowrap;
+      }
+      #captcha-modal-answer {
+          width: 80px;
+          padding: 6px 10px;
+          text-align: center;
+          font-size: 1.2rem;
+          font-family: "Courier New", monospace;
+          font-weight: 600;
+          border: 1px solid #ccc;
+          border-radius: 5px;
+          outline: none;
+          transition: border-color 0.15s, box-shadow 0.15s;
+          background: #fff;
+      }
+      #captcha-modal-answer:focus {
+          border-color: #1e87f0;
+          box-shadow: 0 0 0 2px rgba(30,135,240,0.2);
+      }
+      /* 隐藏数字输入框的上下箭头 */
+      #captcha-modal-answer::-webkit-inner-spin-button,
+      #captcha-modal-answer::-webkit-outer-spin-button {
+          -webkit-appearance: none;
+          margin: 0;
+      }
+      #captcha-modal-answer {
+          -moz-appearance: textfield;
+      }
+  </style>
+  {{ else if .RecaptchaTurnstileStyle }}
+  <script src="https://challenges.cloudflare.com/turnstile/v0/api.js?compat=recaptcha" async defer></script>
+  <script>
+      document.addEventListener('DOMContentLoaded', function () {
+          document.querySelectorAll('.g-recaptcha').forEach(item => {
+              item.disabled = true;
+          });
+      });
+
+      function onSubmit() {
+          document.querySelectorAll('.g-recaptcha').forEach(item => {
+              item.disabled = false;
+          })
+      }</script>
+  {{ else }}
+  <script src="{{.RecaptchaDomain}}/recaptcha/api.js" async defer></script>
+  <script>function onSubmit() {document.getElementById('form').submit();}</script>
+  {{ end }}
+  {{ if ne SentryDSN "" }}
+  <script
+          src="https://browser.sentry-cdn.com/7.37.2/bundle.tracing.replay.min.js"
+          integrity="sha384-o0mU2P+zsvXua0Y6f/J55PKWZt3sZCv3qDqJe6J5lZklyIQkpgjBVqNnPWYWqGhf"
+          crossorigin="anonymous"
+  ></script>
+  <script>
+      Sentry.init({
+          dsn: "{{ SentryDSN }}",
+          integrations: [new Sentry.BrowserTracing(), new Sentry.Replay()],
+          tracesSampleRate: 1.0,
+          replaysSessionSampleRate: 0.1,
+          replaysOnErrorSampleRate: 1.0,
+      });
+  </script>
+  {{ end }}
+  <style>
+      .grecaptcha-badge {visibility: hidden;}
+      .icon-container {
+         display: flex;
+         justify-content: center;
+         width: 100%;
+  }
+      .icon {
+         margin-left: 10px;
+         width: 20px; /* 设置图标的宽度 */
+         height: auto; /* 保持图标的高度自动调整 */
+      }
+      .emoji-placeholder {
+         display: inline-block;
+         animation: jump 0.5s ease-in-out;
+      }
+
+      @keyframes jump {
+         0%, 100% { transform: translateY(0); }
+         50% { transform: translateY(-5px); }
+      }
+     /* 防止 UIkit Dropbar 初始闪烁 */
+     .uk-dropbar {
+       opacity: 0;
+       visibility: hidden;
+       transition: opacity 0.2s ease, visibility 0.2s ease;
+     }
+     
+     .uk-dropbar.uk-open {
+       opacity: 1;
+       visibility: visible;
+     }
+     
+     a.uk-button.uk-button-link {
+       text-transform: none;
+     }
+
+     /* 移动端优化：缩小字体和间距，避免右侧空白 */
+     @media (max-width: 640px) {
+         .uk-logo {
+             font-size: 1rem;
+         }
+         .uk-navbar-nav a {
+             font-size: 0.78rem;
+             padding: 0 4px;
+         }
+         .emoji-placeholder {
+             font-size: 1rem;
+         }
+         /* 移动端用户名限宽省略，避免长英文用户名撑爆顶栏 */
+         .tb-nav-username {
+             max-width: 64px;
+             overflow: hidden;
+             text-overflow: ellipsis;
+             white-space: nowrap;
+             display: inline-block;
+             vertical-align: middle;
+         }
+     }
+  </style>
+
+  <!-- 深色模式：html[data-theme="dark"] 时覆盖 UIkit 3.3.3 编译主题的关键颜色 -->
+  <style>
+      html[data-theme="dark"] {
+          --tb-bg: #1a1d23;
+          --tb-surface: #242830;
+          --tb-surface-2: #2d323c;
+          --tb-border: #3a404c;
+          --tb-text: #d8dce4;
+          --tb-text-muted: #8b93a1;
+          --tb-primary: #5c8dff;
+      }
+      /* 根元素与 body 一起覆盖，确保整个视口（含内容不足一屏时的空白区）都是深色背景 */
+      html[data-theme="dark"],
+      html[data-theme="dark"] body {
+          background-color: var(--tb-bg) !important;
+          color: var(--tb-text) !important;
+      }
+      /* 通用表面容器 */
+      html[data-theme="dark"] .uk-card,
+      html[data-theme="dark"] .uk-card-default,
+      html[data-theme="dark"] .uk-card-secondary,
+      html[data-theme="dark"] .uk-dropbar,
+      html[data-theme="dark"] .uk-navbar-dropdown,
+      html[data-theme="dark"] .uk-modal-dialog,
+      html[data-theme="dark"] .uk-dropdown,
+      html[data-theme="dark"] .uk-offcanvas-bar,
+      html[data-theme="dark"] .uk-section,
+      html[data-theme="dark"] .uk-tile,
+      html[data-theme="dark"] .uk-panel,
+      html[data-theme="dark"] .uk-background-default,
+      html[data-theme="dark"] .uk-search-default .uk-search-input {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-navbar-container {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-navbar-nav > li > a,
+      html[data-theme="dark"] .uk-card a,
+      html[data-theme="dark"] .uk-link,
+      html[data-theme="dark"] a.uk-button-link,
+      html[data-theme="dark"] .uk-navbar-dropdown-nav > li > a,
+      html[data-theme="dark"] .uk-dropdown-nav > li > a,
+      html[data-theme="dark"] .uk-list a {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-navbar-nav > li > a:hover,
+      html[data-theme="dark"] .uk-card a:hover,
+      html[data-theme="dark"] .uk-navbar-dropdown-nav > li > a:hover,
+      html[data-theme="dark"] .uk-dropdown-nav > li > a:hover {
+          color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .uk-input,
+      html[data-theme="dark"] .uk-textarea,
+      html[data-theme="dark"] .uk-select {
+          background-color: var(--tb-surface-2) !important;
+          color: var(--tb-text) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] .uk-input:focus,
+      html[data-theme="dark"] .uk-textarea:focus,
+      html[data-theme="dark"] .uk-select:focus {
+          border-color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .uk-text-muted,
+      html[data-theme="dark"] .uk-text-meta,
+      html[data-theme="dark"] .uk-text-secondary,
+      html[data-theme="dark"] .uk-text-muted a,
+      html[data-theme="dark"] .uk-text-small.uk-text-muted {
+          color: var(--tb-text-muted) !important;
+      }
+      html[data-theme="dark"] .uk-divider-icon::after,
+      html[data-theme="dark"] hr,
+      html[data-theme="dark"] .uk-table th,
+      html[data-theme="dark"] .uk-table td,
+      html[data-theme="dark"] .uk-list-divider > li:nth-child(n+2) {
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] .uk-button-default {
+          background-color: var(--tb-surface-2) !important;
+          color: var(--tb-text) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] .uk-modal-title,
+      html[data-theme="dark"] h1, html[data-theme="dark"] h2, html[data-theme="dark"] h3,
+      html[data-theme="dark"] h4, html[data-theme="dark"] h5, html[data-theme="dark"] h6,
+      html[data-theme="dark"] .uk-card-title {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-alert-warning,
+      html[data-theme="dark"] .uk-alert-danger,
+      html[data-theme="dark"] .uk-alert-success,
+      html[data-theme="dark"] .uk-alert-primary {
+          background-color: var(--tb-surface-2) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .uk-modal-dialog {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .captcha-equation-box {
+          background-color: var(--tb-surface-2) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .math-captcha-modal-question {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-answer {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-answer::placeholder {
+          color: var(--tb-text-muted) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .uk-text-meta,
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-refresh {
+          color: var(--tb-text-muted) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-refresh:hover {
+          color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .uk-label {
+          color: #fff !important;
+      }
+      /* 自定义组件（探索页推荐卡片等）深色覆盖 */
+      html[data-theme="dark"] .recommend-card,
+      html[data-theme="dark"] .recommend-card:hover {
+          background-color: var(--tb-surface-2) !important;
+      }
+      html[data-theme="dark"] .explore-name a {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .explore-name a:hover {
+          color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .explore-intro {
+          color: var(--tb-text-muted) !important;
+      }
+      /* 切换按钮图标切换 */
+      #theme-toggle .tb-icon-dark, #theme-toggle-mobile .tb-icon-dark { display: none; }
+      html[data-theme="dark"] #theme-toggle .tb-icon-light,
+      html[data-theme="dark"] #theme-toggle-mobile .tb-icon-light { display: none; }
+      html[data-theme="dark"] #theme-toggle .tb-icon-dark,
+      html[data-theme="dark"] #theme-toggle-mobile .tb-icon-dark { display: inline; }
+  </style>
+
+  <!-- 顶栏自适应：导航全部直接显示，窄屏时分级缩小字号/间距，保证英文/日文等长文字不溢出 -->
+  <style>
+      .uk-navbar-nav a {
+          font-size: 0.95rem;
+          padding: 0 10px;
+      }
+      /* 未登录移动端占位：桌面端隐藏，仅 ≤640px 显示（见下方 media 查询）。
+         桌面端布局与改动前完全一致，不受影响。 */
+      .tb-mobile-balancer { display: none; }
+      /* 桌面端保持 UIkit 原生居中三列布局（无需额外 CSS） */
+      .tb-navbar .uk-logo {
+          white-space: nowrap;
+      }
+      @media (max-width: 1200px) {
+          .uk-navbar-nav a {
+              font-size: 0.88rem;
+              padding: 0 8px;
+          }
+      }
+      @media (max-width: 1000px) {
+          .uk-navbar-nav a {
+              font-size: 0.82rem;
+              padding: 0 6px;
+          }
+          .uk-logo {
+              font-size: 1.1rem;
+          }
+          /* 登录用户名限宽，过长省略号截断 */
+          .tb-nav-username {
+              max-width: 110px;
+              overflow: hidden;
+              text-overflow: ellipsis;
+              white-space: nowrap;
+              display: inline-block;
+              vertical-align: middle;
+          }
+      }
+      @media (max-width: 800px) {
+          .uk-navbar-nav a {
+              font-size: 0.78rem;
+              padding: 0 4px;
+          }
+          .uk-logo {
+              font-size: 1rem;
+          }
+          .tb-nav-username {
+              max-width: 80px;
+          }
+      }
+      /* 手机端（≤640px）：沿用 UIkit 桌面端 navbar 的原生三列定位。
+         不再重写 .uk-navbar-center / center-left / center-right 的定位，
+         避免 logo 被挤到下一行；底部语言与深色模式按钮仍由下方独立栏承载。 */
+      @media (max-width: 640px) {
+          .tb-navbar {
+              position: relative;
+              min-height: 56px;
+              overflow: visible;
+          }
+          .tb-navbar > .uk-navbar-center {
+              position: relative !important;
+              top: auto !important;
+              left: auto !important;
+              right: auto !important;
+              bottom: auto !important;
+              transform: none !important;
+              display: flex !important;
+              align-items: center;
+              justify-content: center;
+              width: 100%;
+              min-height: 56px;
+              white-space: nowrap;
+              flex-wrap: nowrap;
+          }
+          .tb-navbar .uk-navbar-center-left,
+          .tb-navbar .uk-navbar-center-right {
+              position: static !important;
+              top: auto !important;
+              left: auto !important;
+              right: auto !important;
+              bottom: auto !important;
+              transform: none !important;
+              display: flex !important;
+              align-items: center;
+              flex: 0 0 auto;
+              white-space: nowrap;
+          }
+          .tb-navbar .uk-navbar-center-left > div,
+          .tb-navbar .uk-navbar-center-right > div {
+              display: flex;
+              align-items: center;
+              white-space: nowrap;
+          }
+          .tb-navbar .uk-navbar-nav {
+              display: flex;
+              flex-wrap: nowrap;
+              flex: 0 0 auto;
+          }
+          .tb-navbar .uk-navbar-nav > li > a,
+          .tb-navbar .uk-logo {
+              white-space: nowrap;
+          }
+          /* 未登录：移动端显示与「我的」等宽的隐藏占位，使左栏「探索+占位」与
+             右栏「注册/登录」两项等宽，logo 真正居中，左右视觉平衡 */
+          .tb-mobile-balancer { display: block; }
+      }
+  </style>
+
+  <!-- 标签样式的按钮（管理页置顶等）：
+       尺寸完全继承 .uk-label（font-size/padding/line-height/text-transform 等），
+       仅覆盖 button 元素特有的默认样式（边框/字体族/光标等），保证与相邻 span 标签完全一致。 -->
+  <style>
+      .tb-label-btn {
+          border: none !important;
+          cursor: pointer;
+          font-family: inherit;
+          margin: 0;
+          vertical-align: middle;
+          outline: none;
+          background-image: none;
+          box-sizing: border-box;
+          -webkit-appearance: none;
+          appearance: none;
+      }
+      .tb-label-btn:hover {
+          opacity: 0.85;
+      }
+      /* 公开页置顶小图标：仅一个图钉，不占行高、不影响原布局 */
+      .tb-pin-flag {
+          font-size: 0.9em;
+          margin-right: 4px;
+          vertical-align: -1px;
+          cursor: default;
+      }
+  </style>
+
+  <!-- 页脚统计加载动画：替代 fontawesome 的 fa-spinner（纯 CSS，不引字体库） -->
+  <style>
+      .tb-spinner {
+          display: inline-block;
+          width: 0.9em;
+          height: 0.9em;
+          border: 2px solid rgba(128, 128, 128, 0.25);
+          border-top-color: #666;
+          border-radius: 50%;
+          vertical-align: -2px;
+          animation: tb-spin 0.8s linear infinite;
+      }
+      html[data-theme="dark"] .tb-spinner {
+          border-color: rgba(255, 255, 255, 0.2);
+          border-top-color: #bbb;
+      }
+      @keyframes tb-spin {
+          to { transform: rotate(360deg); }
+      }
+  </style>
+
+  <!-- Markdown 渲染排版（问题/回答/追问正文，左对齐以保留排版格式） -->
+  <style>
+      /* 纯文本列表：保留换行与连续空格（pre-wrap），不渲染 Markdown 大字号/彩色 */
+      .tb-preline {
+          white-space: pre-wrap;
+      }
+      /* 纯文本列表：超过 5 行截断并显示省略号（不足 5 行则完整显示） */
+      .tb-clamp-5 {
+          display: -webkit-box;
+          -webkit-box-orient: vertical;
+          -webkit-line-clamp: 5;
+          overflow: hidden;
+      }
+      .md-body {
+          line-height: 1.7;
+          text-align: left;
+          word-break: break-word;
+      }
+      .md-body p { margin: 0.5em 0; }
+      .md-body h1, .md-body h2, .md-body h3,
+      .md-body h4, .md-body h5, .md-body h6 {
+          margin: 0.8em 0 0.4em;
+          font-weight: 600;
+          line-height: 1.4;
+      }
+      .md-body ul, .md-body ol { padding-left: 1.6em; margin: 0.5em 0; }
+      .md-body li { margin: 0.2em 0; }
+      .md-body blockquote {
+          border-left: 3px solid #d3d1c7;
+          margin: 0.6em 0;
+          padding: 0.2em 1em;
+          color: #5f5e5a;
+      }
+      .md-body pre {
+          background: #f5f5f5;
+          padding: 0.8em 1em;
+          border-radius: 6px;
+          overflow-x: auto;
+          margin: 0.6em 0;
+      }
+      .md-body code {
+          background: #f0f0f0;
+          padding: 0.1em 0.35em;
+          border-radius: 4px;
+          font-size: 0.9em;
+      }
+      .md-body pre code { background: none; padding: 0; }
+      .md-body img { max-width: 100%; height: auto; }
+      .md-body table { border-collapse: collapse; margin: 0.6em 0; }
+      .md-body th, .md-body td {
+          border: 1px solid #ddd;
+          padding: 0.4em 0.8em;
+      }
+      .md-body hr { margin: 1em 0; }
+      html[data-theme="dark"] .md-body blockquote {
+          border-color: #3a404c;
+          color: #8b93a1;
+      }
+      html[data-theme="dark"] .md-body pre,
+      html[data-theme="dark"] .md-body code { background: #2d323c; }
+      html[data-theme="dark"] .md-body th,
+      html[data-theme="dark"] .md-body td { border-color: #3a404c; }
+  </style>
+
+  <!-- 投票结果占比条：UIkit 3 已无 .uk-progressbar 类（那是 UIkit 2 的），
+       模板用 <div class="uk-progress"><div class="uk-progressbar"> 结构，需补一套填充样式，
+       否则内层填充无高度/背景，所有占比条都只剩外层灰色轨道，看起来一模一样。 -->
+  <style>
+      .uk-progress {
+          -webkit-appearance: none;
+          -moz-appearance: none;
+          appearance: none;
+          height: 10px;
+          margin: 0;
+          border: none;
+          border-radius: 6px;
+          background-color: #e5e5e5;
+          overflow: hidden;
+          box-shadow: none;
+      }
+      .uk-progressbar {
+          display: block;
+          height: 100%;
+          background-color: #1e87f0;
+          border-radius: 6px 0 0 6px;
+          transition: width 0.3s ease;
+      }
+      html[data-theme="dark"] .uk-progress {
+          background-color: var(--tb-border);
+      }
+      html[data-theme="dark"] .uk-progressbar {
+          background-color: var(--tb-primary);
+      }
+  </style>
+
+  <!-- 移动端底部操作栏：固定底栏承载语言切换与深色模式，桌面端隐藏 -->
+  <style>
+      #tb-mobile-utils {
+          display: none;
+      }
+      @media (max-width: 640px) {
+          /* 顶栏不再容纳语言/深色按钮，恢复原有导航空间 */
+          .tb-nav-utils {
+              display: none !important;
+          }
+          /* 手机端隐藏登录用户名（左边仅保留"探索"），保证 logo 居中、
+             两侧各不超过 2 个短按钮，避免用户名宽度挤压布局 */
+          .tb-nav-username {
+              display: none !important;
+          }
+          /* 固定底部操作栏 */
+          #tb-mobile-utils {
+              display: flex;
+              position: fixed;
+              left: 0;
+              right: 0;
+              bottom: 0;
+              z-index: 1000;
+              justify-content: center;
+              align-items: center;
+              gap: 10px;
+              padding: 8px 12px calc(8px + env(safe-area-inset-bottom));
+              background: rgba(255, 255, 255, 0.92);
+              -webkit-backdrop-filter: blur(8px);
+              backdrop-filter: blur(8px);
+              box-shadow: 0 -2px 12px rgba(0, 0, 0, 0.08);
+          }
+          #tb-mobile-utils .uk-select {
+              width: 110px;
+          }
+          html[data-theme="dark"] #tb-mobile-utils {
+              background: rgba(36, 40, 48, 0.92);
+              box-shadow: 0 -2px 12px rgba(0, 0, 0, 0.4);
+          }
+          /* 给页面底部预留空间，避免页脚内容被固定底栏遮挡 */
+          body {
+              padding-bottom: 56px;
+          }
+      }
+  </style>
+
+<!-- Commit 6d0a3ad -->
+  <meta property="og:site_name" content="{{ t .LangCode "site.title" }}" />
+  <meta property="og:type" content="website" />
+  <meta property="og:title" content="{{ if .IsUserPage }}{{ .PageUser.Name }} - {{ t .LangCode "site.title" }}{{ else }}{{ t .LangCode "site.title" }}{{ end }}" />
+  <meta property="og:url" content="{{ .ExternalURL }}{{ .CurrentURI }}" />
+  <meta property="og:description" content="{{ if .IsUserPage }}{{ .PageUser.Name }} - {{ t .LangCode "site.description" }}{{ else }}{{ t .LangCode "site.description" }}{{ end }}" />
+  {{ if .NoIndex }}<meta name="robots" content="noindex">{{ end }}
+  {{ if .IsUserPage }}
+   <meta property="og:image" content="{{ .PageUser.Avatar }}?og-image=1" />
+   <meta property="og:image:alt" content="{{ .PageUser.Name }}" />
+   <meta itemprop="image" content="{{ .PageUser.Avatar }}?og-image=1"/>
+   <meta name="msapplication-TileImage" content="{{ .PageUser.Avatar }}"/>
+   <link rel="shortcut icon" href="{{ .PageUser.Avatar }}?og-image=1"/>
+   <link rel="apple-touch-icon" href="{{ .PageUser.Avatar }}?og-image=1"/>
+   <link rel="icon" sizes="192x192" href="{{ .PageUser.Avatar }}?og-image=1">
+   <meta name="twitter:image:src" content="{{ .PageUser.Avatar }}?og-image=1" />
+   {{ else }}
+  <meta itemprop="image" content="https://r2.337845818.best/tamabox/tamabox_low.png"/>
+  <meta name="msapplication-TileImage" content="https://r2.337845818.best/tamabox/tamabox_low.png"/>
+  <link rel="shortcut icon" href="https://r2.337845818.best/tamabox/tamabox_low.png" />
+  <link rel="apple-touch-icon" href="https://r2.337845818.best/tamabox/tamabox_low.png"/>
+  <link rel="icon" sizes="192x192" href="https://r2.337845818.best/tamabox/tamabox_low.png">
+  <meta name="twitter:image:src" content="https://r2.337845818.best/tamabox/tamabox_low.png" />
+   {{ end }}
+
+<!-- Google and Bing -->
+  <meta name="google-site-verification" content="fEPwRRJfiGsgwc5SINBQwZhPK8F0cwRaOvRx0YRurI4" />
+  <meta name="msvalidate.01" content="2F185E8E63C93635F50B3574F3B31E42" />
+  <script defer src="https://mami.tama.guru/tamami.js" data-website-id="c42ebe8b-9281-4da0-83a4-8f18b3e710fe"></script>
+</head>
+<body>
+<nav class="uk-navbar-container uk-margin tb-navbar" uk-navbar>
+  <div class="uk-navbar-center">
+    <div class="uk-navbar-center-left">
+      <div>
+        <ul class="uk-navbar-nav">
+          <!-- 探索链接，始终显示 -->
+          <li><a href="/explore">{{t .LangCode "nav.explore"}}</a></li>
+          {{ if .IsLogged }}
+          <!-- 我的：进入自己的提问箱主页（与右侧「提问/设置」形成左右均衡） -->
+          <li><a href="/_/{{ .LoggedUser.Domain }}">{{t .LangCode "nav.mine"}}</a></li>
+          {{ else }}
+          <!-- 移动端占位：未登录时左栏仅「探索」一项，与右栏「注册/登录」两项不等宽，
+               导致 logo 整体被拉向左（偏左）。移动端(≤640px)显示一个与「我的」等宽的隐藏占位，
+               使左右视觉平衡；桌面端由 .tb-mobile-balancer 隐藏，保持原布局完全不变。 -->
+          <li class="tb-mobile-balancer" aria-hidden="true"><a tabindex="-1" style="visibility:hidden">{{t .LangCode "nav.mine"}}</a></li>
+          {{ end }}
+        </ul>
+      </div>
+    </div>
+
+    <a class="uk-navbar-item uk-logo" href="/"><span class="emoji-placeholder" aria-label="random animal">🐺</span>{{t .LangCode "site.logoSuffix"}}</a>
+
+    <div class="uk-navbar-center-right">
+      <div>
+        {{ if .IsLogged }}
+        <ul class="uk-navbar-nav">
+          <li><a href="/user/questions">{{t .LangCode "nav.ask"}}</a></li>
+        </ul>
+        <ul class="uk-navbar-nav">
+          <li><a href="/user/profile">{{t .LangCode "nav.settings"}}</a></li>
+        </ul>
+        {{ else}}
+        <ul class="uk-navbar-nav">
+          <li><a href="/register">{{t .LangCode "nav.register"}}</a></li>
+        </ul>
+        <ul class="uk-navbar-nav">
+          <li><a href="/login">{{t .LangCode "nav.login"}}</a></li>
+        </ul>
+        {{ end }}
+        {{ if not .IsUserPage }}
+        <!-- 语言切换（紧凑图标，点击展开；移动端隐藏，见底部操作栏） -->
+        <ul class="uk-navbar-nav tb-nav-utils">
+          <li>
+            <a href="#" aria-label="{{t .LangCode "common.lang"}}" title="{{t .LangCode "common.lang"}}">🌐</a>
+            <div class="uk-navbar-dropdown" uk-drop="mode: click; pos: bottom-right">
+              <ul class="uk-nav uk-navbar-dropdown-nav">
+                {{ range .SupportedLangs }}
+                <li class="{{ if eq .Code $.LangCode }}uk-active{{ end }}">
+                  <a href="/i18n/{{ .Code }}?to={{ urlquery $.CurrentURI }}">{{ .Name }}</a>
+                </li>
+                {{ end }}
+              </ul>
+            </div>
+          </li>
+        </ul>
+        {{ end }}
+        <!-- 深色模式切换（紧凑图标；移动端隐藏，见底部操作栏） -->
+        <ul class="uk-navbar-nav tb-nav-utils">
+          <li>
+            <a href="#" id="theme-toggle" title="{{t .LangCode "common.theme"}}" aria-label="{{t .LangCode "common.theme"}}">
+              <span class="tb-icon-light">🌙</span><span class="tb-icon-dark">☀️</span>
+            </a>
+          </li>
+        </ul>
+      </div>
+    </div>
+  </div>
+</nav>
+
+<script>
+document.addEventListener("DOMContentLoaded", function() {
+    const emojis = ["🐺","🐗","🐻","🐨","🐼","🐹","🐭","🐰","🦊","🐮","🐷","🐽","🐸","🐒","🦍","🐔","🐧","🐦","🐤","🐦‍⬛","🦅","🦉","🦇","🐴","🦄","🐝","🦎","🦖","🦕","🐙","🦑","🦐","🦞","🦀","🐡","🐠","🐟","🐬","🐳","🐋","🦈","🐊","🐅","🐆","🦓","🦍","🦧","🐘","🦛","🦏","🐪","🐫","🦒","🦘","🐃","🐂","🐄","🐎","🐖","🐏","🐑","🦙","🐐","🦌","🐕","🐩","🦮","🐕‍🦺","🐈","🐋","🐳","🐬","🐉","🐲"];
+    const placeholder = document.querySelector('.emoji-placeholder');
+    if (placeholder) {
+        placeholder.textContent = emojis[Math.floor(Math.random() * emojis.length)];
+    }
+});
+</script>
+
+<!-- 移动端固定底部操作栏：语言切换 + 深色模式（桌面端隐藏） -->
+<div id="tb-mobile-utils">
+  {{ if not .IsUserPage }}
+  <select id="mobile-lang-select" class="uk-select uk-form-small" aria-label="{{t .LangCode "common.lang"}}">
+    {{ range .SupportedLangs }}
+    <option value="{{ .Code }}" {{ if eq .Code $.LangCode }}selected{{ end }}>{{ .Name }}</option>
+    {{ end }}
+  </select>
+  {{ end }}
+  <button type="button" id="theme-toggle-mobile" class="uk-button uk-button-default uk-button-small"
+          title="{{t .LangCode "common.theme"}}" aria-label="{{t .LangCode "common.theme"}}">
+    <span class="tb-icon-light">🌙</span><span class="tb-icon-dark">☀️</span>
+  </button>
+</div>
+
+<script>
+(function() {
+    // 深色模式：读取 cookie 应用主题，按钮切换并持久化
+    var THEME_COOKIE = 'theme';
+    function getTheme() {
+        var m = document.cookie.match(/(?:^|;\s*)theme=([^;]*)/);
+        return m ? m[1] : '';
+    }
+    function applyTheme(theme) {
+        if (theme === 'dark') {
+            document.documentElement.setAttribute('data-theme', 'dark');
+        } else {
+            document.documentElement.removeAttribute('data-theme');
+        }
+    }
+    function toggleTheme() {
+        var next = getTheme() === 'dark' ? 'light' : 'dark';
+        applyTheme(next);
+        var expires = new Date(Date.now() + 365 * 24 * 3600 * 1000).toUTCString();
+        document.cookie = THEME_COOKIE + '=' + next + '; path=/; max-age=' + (365 * 24 * 3600) + '; SameSite=Lax';
+    }
+    // 首屏前应用，避免闪烁
+    applyTheme(getTheme());
+    document.addEventListener('DOMContentLoaded', function() {
+        // 桌面顶栏按钮与移动端底部按钮都绑定
+        var buttons = document.querySelectorAll('#theme-toggle, #theme-toggle-mobile');
+        buttons.forEach(function(btn) {
+            btn.addEventListener('click', function(e) {
+                e.preventDefault();
+                toggleTheme();
+            });
+        });
+
+        // 移动端底部语言切换：onchange 跳转到 /i18n/{code}，保留当前页面位置
+        var langSel = document.getElementById('mobile-lang-select');
+        if (langSel) {
+            langSel.addEventListener('change', function() {
+                if (!this.value) return;
+                var to = window.location.pathname + window.location.search;
+                window.location.href = '/i18n/' + encodeURIComponent(this.value) + '?to=' + encodeURIComponent(to);
+            });
+        }
+    });
+})();
+</script>
+
+{{ if .IsPixel }}
+<div>
+{{ else }}
+<div class="uk-container uk-container-xsmall">
+{{ end }}
+
+{{ if eq .CaptchaType "math" }}
+<!-- 算数验证码弹窗 --><div id="math-captcha-modal" uk-modal>
+  <div class="uk-modal-dialog uk-modal-body uk-text-center">
+    <h3 class="uk-modal-title">{{t .LangCode "captcha.title"}}</h3>
+    <p class="uk-text-meta">{{t .LangCode "captcha.hint"}}</p>
+    <div class="captcha-equation-box">
+      <span id="captcha-modal-question" class="math-captcha-modal-question">{{t .LangCode "captcha.loading"}}</span>
+      <input type="number" id="captcha-modal-answer" placeholder="?" autocomplete="off" inputmode="numeric">
+    </div>
+    <div style="margin-top:6px;">
+      <button type="button" class="uk-button uk-button-text uk-text-small" id="captcha-modal-refresh">{{t .LangCode "captcha.refresh"}}</button>
+    </div>
+    <div id="captcha-modal-error" class="uk-text-danger uk-text-small" style="display:none;min-height:20px;"></div>
+    <div class="uk-margin-small-top">
+      <button type="button" class="uk-button uk-button-primary" id="captcha-modal-submit">{{t .LangCode "captcha.submit"}}</button>
+      <button type="button" class="uk-button uk-button-default uk-modal-close">{{t .LangCode "common.cancel"}}</button>
+    </div>
+  </div>
+</div>
+
+<script>
+var CAPTCHA_I18N = {
+  loading: "{{t .LangCode "captcha.loading"}}",
+  loadFailed: "{{t .LangCode "captcha.loadFailed"}}",
+  loadRetry: "{{t .LangCode "captcha.loadRetry"}}",
+  inputAnswer: "{{t .LangCode "captcha.inputAnswer"}}",
+  wrongAnswer: "{{t .LangCode "captcha.wrongAnswer"}}",
+  verifyFailed: "{{t .LangCode "captcha.verifyFailed"}}",
+  needPassword: "{{t .LangCode "ask.needPassword"}}",
+  needEmail: "{{t .LangCode "ask.pleaseEmail"}}"
+};
+</script>
+
+<script>
+(function() {
+  var captchaId = '';
+  var pendingForm = null;
+  var pendingNeedPassword = false;
+  var verifying = false;
+
+  function fetchCaptcha() {
+    var qEl = document.getElementById('captcha-modal-question');
+    var errEl = document.getElementById('captcha-modal-error');
+    var ansEl = document.getElementById('captcha-modal-answer');
+    qEl.textContent = CAPTCHA_I18N.loading;
+    fetch('/api/captcha/generate')
+      .then(function(r) { return r.json(); })
+      .then(function(data) {
+        if (data.code === 0 && data.data) {
+          captchaId = data.data.id;
+          qEl.textContent = data.data.question;
+          if (errEl) errEl.style.display = 'none';
+          if (ansEl) { ansEl.value = ''; ansEl.focus(); }
+        } else {
+          qEl.textContent = CAPTCHA_I18N.loadFailed;
+        }
+      })
+      .catch(function() {
+        qEl.textContent = CAPTCHA_I18N.loadRetry;
+      });
+  }
+
+  function getCSRFToken() {
+    var input = document.querySelector('input[name="_csrf"]');
+    return input ? input.value : '';
+  }
+
+  function doSubmit(form) {
+    // 将 captcha 答案填入隐藏字段
+    var ans = document.getElementById('captcha-modal-answer').value.trim();
+    var hidden = form.querySelector('[name="g-recaptcha-response"]');
+    if (hidden) hidden.value = captchaId + ':' + (ans || '0');
+
+    UIkit.modal('#math-captcha-modal').hide();
+
+    // 处理 AskPassword（提问箱密码）
+    if (pendingNeedPassword) {
+      UIkit.modal.prompt(CAPTCHA_I18N.needPassword, '', 'password')
+        .then(function(password) {
+          if (password) {
+            var pwInput = document.getElementById('ask_password_input');
+            if (pwInput) pwInput.value = password;
+            form.submit();
+          }
+        });
+    } else {
+      form.submit();
+    }
+  }
+
+  // 验证按钮
+  document.getElementById('captcha-modal-submit').addEventListener('click', function() {
+    if (verifying) return;
+    var ans = document.getElementById('captcha-modal-answer').value.trim();
+    if (!ans) {
+      var errEl = document.getElementById('captcha-modal-error');
+      errEl.textContent = CAPTCHA_I18N.inputAnswer;
+      errEl.style.display = 'block';
+      return;
+    }
+    verifying = true;
+    fetch('/api/captcha/verify', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'X-CSRF-Token': getCSRFToken()
+      },
+      body: JSON.stringify({ id: captchaId, answer: parseInt(ans, 10) })
+    })
+    .then(function(r) { return r.json(); })
+    .then(function(data) {
+      verifying = false;
+      if (data.correct) {
+        if (pendingForm) doSubmit(pendingForm);
+      } else {
+        var errEl = document.getElementById('captcha-modal-error');
+        errEl.textContent = CAPTCHA_I18N.wrongAnswer;
+        errEl.style.display = 'block';
+        fetchCaptcha(); // 自动刷新题目
+      }
+    })
+    .catch(function() {
+      verifying = false;
+      var errEl = document.getElementById('captcha-modal-error');
+      errEl.textContent = CAPTCHA_I18N.verifyFailed;
+      errEl.style.display = 'block';
+      fetchCaptcha();
+    });
+  });
+
+  // 回车提交
+  document.getElementById('captcha-modal-answer').addEventListener('keydown', function(e) {
+    if (e.key === 'Enter') {
+      e.preventDefault();
+      document.getElementById('captcha-modal-submit').click();
+    }
+  });
+
+  // 刷新按钮
+  document.getElementById('captcha-modal-refresh').addEventListener('click', fetchCaptcha);
+
+  // 拦截所有带 class="math-captcha-trigger" 的按钮
+  document.addEventListener('click', function(e) {
+    var btn = e.target.closest('.math-captcha-trigger');
+    if (!btn) return;
+    e.preventDefault();
+
+    var form = btn.closest('form');
+    if (!form) return;
+    pendingForm = form;
+
+    // 检查是否需要提问密码
+    pendingNeedPassword = !!(form.querySelector('#ask_password_input'));
+
+    // 邮箱校验（提问页面）
+    var notifyCb = document.getElementById('notify-checkbox');
+    var emailInput = document.getElementById('email-input');
+    if (notifyCb && notifyCb.checked && emailInput && emailInput.value.trim() === '') {
+      UIkit.modal.alert(CAPTCHA_I18N.needEmail);
+      return;
+    }
+
+    fetchCaptcha();
+    UIkit.modal('#math-captcha-modal').show();
+  });
+})();
+</script>
+{{ end }}
\ No newline at end of file
diff --git a/.workbuddy/backup/cdn-migration-20260905/list.html b/.workbuddy/backup/cdn-migration-20260905/list.html
new file mode 100644
index 0000000..4215219
--- /dev/null
+++ b/.workbuddy/backup/cdn-migration-20260905/list.html
@@ -0,0 +1,309 @@
+{{template "base/header" .}}
+<!-- 头像直连 R2：crossorigin 让 favicon 也以 CORS 模式请求，确保浏览器缓存的响应都带 ACAO；
+     ?v=2 击穿历史上被「无 ACAO 响应」污染的缓存条目（R2 对无 Origin 请求的响应无 Vary，可缓存 31 天） -->
+<link rel="shortcut icon" href="{{.PageUser.Avatar}}?v=2" crossorigin="anonymous"/>
+<link rel="apple-touch-icon" href="{{.PageUser.Avatar}}?v=2" crossorigin="anonymous"/>
+<link rel="icon" sizes="192x192" href="{{.PageUser.Avatar}}?v=2" crossorigin="anonymous">
+<style>
+  /* 投票列表：与探索页"全部投票"一致的列表行样式 */
+  .profile-votes-list { display: grid; gap: 0; }
+  .profile-vote-item {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 16px;
+    min-width: 0;
+    padding: 14px 16px;
+    border-bottom: 1px solid var(--tb-border, #e9e9e9);
+    text-decoration: none;
+  }
+  .profile-vote-item:first-child { border-top: 1px solid var(--tb-border, #e9e9e9); }
+  .profile-vote-item:hover { background: var(--tb-surface-hover, #f8fbff); text-decoration: none; }
+  .profile-vote-content { min-width: 0; }
+  .profile-vote-title {
+    display: block;
+    overflow: hidden;
+    color: var(--tb-text, #333);
+    font-size: 0.98rem;
+    font-weight: 600;
+    line-height: 1.45;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+  }
+  .profile-vote-meta {
+    display: flex;
+    flex-wrap: wrap;
+    align-items: center;
+    gap: 7px;
+    margin-top: 8px;
+  }
+  .profile-vote-meta .uk-label { font-size: 0.72rem; line-height: 1.6; }
+  .profile-vote-action {
+    flex: 0 0 auto;
+    color: var(--tb-primary, #1e87f0);
+    font-size: 0.82rem;
+    white-space: nowrap;
+  }
+  html[data-theme="dark"] .profile-vote-item { border-color: var(--tb-border); }
+  html[data-theme="dark"] .profile-vote-title { color: var(--tb-text); }
+  html[data-theme="dark"] .profile-vote-item:hover { background: rgba(78, 168, 245, 0.10); }
+  /* 个人主页 Tab：与探索页一致的胶囊切换样式 */
+  /* 个人主页 Tab：全宽等分，置于主体顶部，作为一级导航（移动端整行可点） */
+  .profile-tabs {
+    display: flex;
+    gap: 4px;
+    padding: 4px;
+    margin-top: 20px;
+    margin-bottom: 18px;
+    border: 1px solid var(--tb-border, #e5e5e5);
+    border-radius: 9px;
+    background: var(--tb-surface-2, #fafafa);
+  }
+  .profile-tab {
+    flex: 1;
+    border: 0;
+    border-radius: 6px;
+    padding: 9px 15px;
+    background: transparent;
+    color: var(--tb-text-muted, #666);
+    cursor: pointer;
+    font-size: 0.9rem;
+    transition: background 0.2s ease, color 0.2s ease;
+  }
+  .profile-tab:hover { color: var(--tb-primary, #1e87f0); }
+  .profile-tab.is-active {
+    background: var(--tb-surface, #fff);
+    box-shadow: 0 1px 3px rgba(0, 0, 0, 0.10);
+    color: var(--tb-primary, #1e87f0);
+    font-weight: 600;
+  }
+  /* 功能关闭时置灰禁用的 Tab（如投票功能关闭） */
+  .profile-tab.is-disabled,
+  .profile-tab:disabled {
+    cursor: not-allowed;
+    color: var(--tb-text-muted, #999);
+    opacity: 0.7;
+  }
+  .profile-tab.is-disabled:hover { color: var(--tb-text-muted, #999); }
+  .profile-panel[hidden] { display: none !important; }
+  html[data-theme="dark"] .profile-tabs {
+    border-color: var(--tb-border);
+    background: var(--tb-surface-2);
+  }
+  html[data-theme="dark"] .profile-tab { color: var(--tb-text-muted); }
+  html[data-theme="dark"] .profile-tab.is-active { background: var(--tb-surface); color: var(--tb-primary); }
+  html[data-theme="dark"] .profile-tab.is-disabled { color: var(--tb-text-muted); opacity: 0.55; }
+</style>
+<div class="uk-card uk-card-default uk-text-center">
+  <div class="uk-flex uk-flex-center uk-flex-middle uk-background-cover uk-light" style="min-height: 260px;" data-src="{{ .PageUser.Background }}" uk-img>
+    <div class="uk-card-body">
+      <img class="uk-border-circle uk-box-shadow-large" src="{{ if .PageUser.Avatar }}{{ .PageUser.Avatar }}?v=2{{ else }}{{ .DefaultAvatar }}{{ end }}" crossorigin="anonymous" style="width: 100px; height: 100px; max-width: 100%; max-height: 100%;">
+      <h3 id="usernamecolor">{{ .PageUser.Name }}</h3>
+      <p id="introcolor">{{ .PageUser.Intro }}</p>
+        <div class="icon-container">
+        {{ if and .PageUser.Acfunlink (ne .PageUser.Acfunlink "none") }}
+         <a href="https://{{.PageUser.Acfunlink}}" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/ailicili.png" alt="acfunlink" class="icon">
+         </a>
+        {{ end }}
+        {{ if and .PageUser.Bililink (ne .PageUser.Bililink "none") }}
+         <a href="https://{{.PageUser.Bililink}}" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/bili.png" alt="bililink" class="icon">
+         </a>
+        {{ end }}
+        {{ if and .PageUser.Weibolink (ne .PageUser.Weibolink "none") }}
+         <a href="https://{{.PageUser.Weibolink}}" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/weibo.png" alt="weibolink" class="icon">
+         </a>
+        {{ end }}
+        {{ if and .PageUser.Xiaohongshulink (ne .PageUser.Xiaohongshulink "none") }}
+         <a href="https://{{.PageUser.Xiaohongshulink}}" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/xiaohongshu.png" alt="xiaohongshulink" class="icon">
+         </a>
+        {{ end }}
+        {{ if and .PageUser.Bloglink (ne .PageUser.Bloglink "none") }}
+          <a href="https://{{.PageUser.Bloglink}}" target="_blank">
+           <img src="https://r2.337845818.best/tamabox/icon/social/blog.png" alt="bloglink" class="icon">
+         </a>
+        {{ end }}
+        </div>
+    </div>
+  </div>
+</div>
+<script>
+document.getElementById("usernamecolor").style.color = "{{.PageUser.Usernamecolor}}";
+document.getElementById("introcolor").style.color = "{{.PageUser.Introcolor}}";
+</script>
+<div>
+  <div class="uk-card uk-card-default uk-card-small uk-card-body">
+    {{ if .CanAsk }}
+    <!-- jQuery 已改为按需加载：defer 按文档顺序先于 easy.qrcode 执行，保证就绪 -->
+    <script defer src="https://r2.337845818.best/tamabox/cdn/lib/jquery/3.7.1/jquery.min.js"></script>
+    <script defer src='https://r2.337845818.best/tamabox/cdn/js/remake/easy.qrcode.min.js' type="text/javascript"  charset="utf-8"></script>
+    <center><div id="boxqrimg"></div></center>
+    <script type="text/javascript">
+    document.addEventListener('DOMContentLoaded', function () {
+        var options = {
+            text: window.location.href,
+            width: 200,
+            height: 200,
+            // 与 Profile 编辑器保持一致：仅当启用自定义前景色时，才把 Qrcodebackcolor 作为前景色；
+            // 否则强制黑色 #000000，避免未勾选却显示自定义前景色、与 Profile 预览不一致。
+            colorDark: ({{.PageUser.UseCustomQRColor}} ? "{{.PageUser.Qrcodebackcolor}}" : "#000000") || "#000000",
+            colorLight: "{{.PageUser.Qrcodecolor}}" || "#FFFFFF",
+            dotScale: parseFloat("{{.PageUser.Dotscale}}") || 0.4,
+            dotScaleTiming: parseFloat("{{.PageUser.Dotscale}}") || 0.4,
+            dotScaleA: parseFloat("{{.PageUser.Dotscale}}") || 0.4,
+            correctLevel: QRCode.CorrectLevel.H,
+            logo: (function () {
+                // ?v=2：击穿曾被无 ACAO 响应污染的浏览器缓存条目；仅对 http(s) 绝对地址追加
+                var a = "{{.PageUser.Avatar}}" || "{{.DefaultAvatar}}";
+                return a ? (a.indexOf("http") === 0 ? a + "?v=2" : a) : undefined;
+            })(),
+            logoWidth: 60,
+            logoHeight: 60,
+            logoBackgroundTransparent: true,
+            // 直连 R2 等跨域图片须以 CORS 模式加载，canvas 才不被污染、可正常导出
+            crossOrigin: 'anonymous',
+            backgroundImage: ("{{.PageUser.BackgroundImage}}" ? "{{.PageUser.BackgroundImage}}" : undefined),
+            backgroundImageAlpha: parseFloat("{{.PageUser.Backgroundimagealpha}}") || 0.8,
+            autoColor: false,
+            PO: "{{.PageUser.Qrcodepdpcolor}}" || "#000000",
+            PI: "{{.PageUser.Qrcodepdpcolor}}" || "#000000",
+            AO: '',
+            AI: '',
+            timing: "{{.PageUser.Qrcodepdpcolor}}" || "#000000"
+        };
+        new QRCode(document.getElementById("boxqrimg"), options);
+    });
+    </script>
+ 
+    <p class="uk-text-center uk-text-small">{{t .LangCode "ask.scan" .PageUser.Name}}<br>{{ if .RegisterOnlyAsk }}{{t .LangCode "ask.registerOnly"}}{{ else }}{{t .LangCode "ask.anonymous"}}{{ end }}</p>
+
+    <div class="uk-text-center uk-margin-small-top">
+        <a id="share-btn" href="/_/{{ .PageUser.Domain }}/share-card" download class="uk-button uk-button-default uk-button-small">
+            📤 {{t .LangCode "ask.share"}}
+        </a>
+    </div>
+
+    <div id="share-loading-overlay" style="display:none; position: fixed; top:0; left:0; width:100%; height:100%; background: rgba(255,255,255,0.85); z-index:9999;">
+        <div style="display:flex; flex-direction:column; align-items:center; justify-content:center; height:100%;">
+            <div uk-spinner="ratio: 2" class="uk-margin-bottom"></div>
+            <p class="uk-text-large uk-text-muted">{{t .LangCode "ask.generating"}}</p>
+        </div>
+    </div>
+
+    <script>
+    (function() {
+        var btn = document.getElementById('share-btn');
+        var overlay = document.getElementById('share-loading-overlay');
+        if (!btn || !overlay) return;
+        btn.addEventListener('click', function(e) {
+            e.preventDefault();
+            overlay.style.display = 'block';
+            btn.style.pointerEvents = 'none';
+            fetch(btn.href)
+                .then(function(response) {
+                    if (!response.ok) throw new Error('{{t .LangCode "ask.networkError"}}');
+                    return response.blob();
+                })
+                .then(function(blob) {
+                    var url = URL.createObjectURL(blob);
+                    var a = document.createElement('a');
+                    a.href = url;
+                    a.download = '{{t .LangCode "ask.shareFilename"}}';
+                    document.body.appendChild(a);
+                    a.click();
+                    setTimeout(function() {
+                        document.body.removeChild(a);
+                        URL.revokeObjectURL(url);
+                    }, 100);
+                })
+                .catch(function(err) {
+                    alert('{{t .LangCode "ask.genFailed"}}');
+                    console.error(err);
+                })
+                .finally(function() {
+                    overlay.style.display = 'none';
+                    btn.style.pointerEvents = 'auto';
+                });
+        });
+    })();
+    </script>
+    {{ end }}
+    {{template "base/alert" .}}
+
+    <!-- 提问 / 投票 切换：默认显示提问，支持 ?tab=votes 直达（服务端初始态）与 #votes hash 覆盖 -->
+    <div class="profile-tabs" role="tablist">
+      <button type="button" class="profile-tab{{ if eq .ActiveProfileTab "questions" }} is-active{{ end }}" data-profile-tab="questions" role="tab" aria-selected="{{ if eq .ActiveProfileTab "questions" }}true{{ else }}false{{ end }}">{{t .LangCode "explore.questionsTab"}}</button>
+      {{ if .VoteEnabled }}
+      <button type="button" class="profile-tab{{ if eq .ActiveProfileTab "votes" }} is-active{{ end }}" data-profile-tab="votes" role="tab" aria-selected="{{ if eq .ActiveProfileTab "votes" }}true{{ else }}false{{ end }}">{{t .LangCode "explore.votesTab"}}</button>
+      {{ else }}
+      <!-- 投票功能关闭：保留 Tab 展示但置灰禁用，hover 提示原因 -->
+      <button type="button" class="profile-tab is-disabled" disabled aria-disabled="true" uk-tooltip="{{ .VoteClosedMessage }}">{{t .LangCode "explore.votesTab"}} <span uk-icon="icon: lock; ratio: 0.8"></span></button>
+      {{ end }}
+    </div>
+
+    <div class="profile-panel" data-profile-panel="questions"{{ if eq .ActiveProfileTab "votes" }} hidden{{ end }}>
+    {{template "question/new-question-template" .}}
+
+    {{ if ne (len .PageQuestions) 0 }}
+    <p class="uk-text-left uk-text-muted uk-text-small">{{t .LangCode "ask.history" .PageUser.Name}} ({{ .AnsweredCount }})</p>
+    {{ template "question/history-template" . }}
+    {{ end }}
+    </div>
+
+    <div class="profile-panel" data-profile-panel="votes"{{ if ne .ActiveProfileTab "votes" }} hidden{{ end }}>
+    {{ if .PageVotes }}
+    <!-- 匿名投票板块：箱主"进行中"的公开投票（列表行样式，与探索页"全部投票"一致） -->
+    <div class="profile-votes-list">
+      {{ range .PageVotes }}
+      <a href="/vote/{{ .LinkToken }}" class="profile-vote-item">
+        <div class="profile-vote-content">
+          <span class="profile-vote-title" title="{{ .Title }}">{{ .Title }}</span>
+          <span class="profile-vote-meta">
+            {{ if eq .Type "single" }}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeSingle"}}</span>{{ end }}
+            {{ if eq .Type "multiple" }}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeMultiple"}}</span>{{ end }}
+            {{ if eq .Type "rating" }}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeRating"}}</span>{{ end }}
+            {{ if eq .Type "rank" }}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeRank"}}</span>{{ end }}
+            {{ if eq .Type "form" }}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeForm"}}</span>{{ end }}
+            <span class="uk-text-meta">{{ .CreatedAt.Format "2006-01-02" }}</span>
+          </span>
+        </div>
+        <span class="profile-vote-action">{{t $.LangCode "vote.page.goVote"}} <span uk-icon="icon: arrow-right; ratio: .8"></span></span>
+      </a>
+      {{ end }}
+    </div>
+    {{ else }}
+    <div class="uk-alert uk-alert-primary uk-margin-remove-top">{{t .LangCode "explore.noVotes"}}</div>
+    {{ end }}
+    </div>
+  </div>
+</div>
+<script>
+document.addEventListener('DOMContentLoaded', function() {
+  var tabs = document.querySelectorAll('[data-profile-tab]');
+  var panels = document.querySelectorAll('[data-profile-panel]');
+  function showPanel(name) {
+    tabs.forEach(function(tab) {
+      var active = tab.dataset.profileTab === name;
+      tab.classList.toggle('is-active', active);
+      tab.setAttribute('aria-selected', active ? 'true' : 'false');
+    });
+    panels.forEach(function(panel) {
+      panel.hidden = panel.dataset.profilePanel !== name;
+    });
+    if (window.history && window.history.replaceState) {
+      window.history.replaceState({}, document.title, window.location.pathname + window.location.search + (name === 'votes' ? '#votes' : ''));
+    }
+  }
+  tabs.forEach(function(tab) {
+    tab.addEventListener('click', function() { showPanel(tab.dataset.profileTab); });
+  });
+  // 仅当投票 Tab 可点击（功能开启）时才响应 #votes hash，避免投票关闭时切到空面板
+  if (window.location.hash === '#votes' && document.querySelector('[data-profile-tab="votes"]')) {
+    showPanel('votes');
+  }
+});
+</script>
+{{template "base/footer" .}}
\ No newline at end of file
diff --git a/.workbuddy/backup/cdn-migration-20260905/profile.html b/.workbuddy/backup/cdn-migration-20260905/profile.html
new file mode 100644
index 0000000..13ef910
--- /dev/null
+++ b/.workbuddy/backup/cdn-migration-20260905/profile.html
@@ -0,0 +1,1527 @@
+{{template "base/header" .}}
+
+<!-- 二维码预览依赖 jQuery（同步加载，保证下方 easy.qrcode 初始化就绪）；jQuery 统一使用 3.7.1 -->
+<script src="https://r2.337845818.best/tamabox/cdn/lib/jquery/3.7.1/jquery.min.js"></script>
+<script src='https://r2.337845818.best/tamabox/cdn/js/remake/easy.qrcode.min.js' type="text/javascript" charset="utf-8"></script>
+
+<!-- Pickr 颜色选择器 -->
+<link rel="stylesheet" href="https://r2.337845818.best/tamabox/cdn/lib/pickr/1.10.1/nano.min.css"/>
+<script src="https://r2.337845818.best/tamabox/cdn/lib/pickr/1.10.1/pickr.min.js"></script>
+
+<!-- Cropper.js 头像/背景裁剪（资源放自有 R2，见 lib/cropperjs/1.6.2/） -->
+<link rel="stylesheet" href="https://r2.337845818.best/tamabox/cdn/lib/cropperjs/1.6.2/cropper.css"/>
+<script src="https://r2.337845818.best/tamabox/cdn/lib/cropperjs/1.6.2/cropper.min.js"></script>
+
+<style>
+  .range-input-group {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+  }
+  .range-input-group input[type="range"] {
+    flex: 1;
+  }
+  .range-input-group input[type="number"] {
+    width: 70px;
+  }
+  .range-input-group .range-value {
+    min-width: 40px;
+    text-align: right;
+  }
+  .color-picker {
+    display: inline-block;
+    vertical-align: middle;
+  }
+  .preview-card {
+    background: #fff;
+    padding: 20px;
+    border: 1px solid #e5e5e5;
+    border-radius: 8px;
+    text-align: center;
+  }
+  .preview-card .qrcode-wrapper {
+    width: 100%;
+    max-width: 220px;
+    margin: 0 auto;
+  }
+  .theme-btn {
+    margin: 2px;
+    font-size: 0.8rem;
+  }
+  .social-item {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    flex-wrap: wrap;
+  }
+  .social-item label.checkbox-label {
+    margin: 0;
+    white-space: nowrap;
+  }
+  .social-item input[type="text"] {
+    flex: 1;
+  }
+  .social-item input[type="text"]:invalid {
+    border-color: #f0506e;
+  }
+  @media (max-width: 640px) {
+    .preview-card {
+      margin-top: 20px;
+    }
+  }
+
+  /* 面板切换：与提问箱主页一致的胶囊样式（用户设置 / 提问 / 私聊 / 投票） */
+  .profile-tabs {
+    display: flex;
+    gap: 4px;
+    padding: 4px;
+    margin-bottom: 18px;
+    border: 1px solid var(--tb-border, #e5e5e5);
+    border-radius: 9px;
+    background: var(--tb-surface-2, #fafafa);
+  }
+  .profile-tab {
+    flex: 1;
+    border: 0;
+    border-radius: 6px;
+    padding: 9px 8px;
+    background: transparent;
+    color: var(--tb-text-muted, #666);
+    cursor: pointer;
+    font-size: 0.9rem;
+    white-space: nowrap;
+    transition: background 0.2s ease, color 0.2s ease;
+  }
+  .profile-tab:hover { color: var(--tb-primary, #1e87f0); }
+  .profile-tab.is-active {
+    background: var(--tb-surface, #fff);
+    box-shadow: 0 1px 3px rgba(0, 0, 0, 0.10);
+    color: var(--tb-primary, #1e87f0);
+    font-weight: 600;
+  }
+  .profile-panel[hidden] { display: none !important; }
+  html[data-theme="dark"] .profile-tabs {
+    border-color: var(--tb-border);
+    background: var(--tb-surface-2);
+  }
+  html[data-theme="dark"] .profile-tab { color: var(--tb-text-muted); }
+  html[data-theme="dark"] .profile-tab.is-active { background: var(--tb-surface); color: var(--tb-primary); }
+
+  /* 功能控制卡片（部分模板 user/feature-control-form 使用） */
+  .feat-card {
+    display: flex;
+    flex-direction: column;
+    gap: 12px;
+    padding: 16px;
+    border: 1px solid #e5e5e5;
+    border-radius: 8px;
+    background: #fff;
+  }
+  .feat-card-head {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 8px;
+  }
+  .feat-card-head h3 { font-size: 1.05rem; }
+  .feat-status {
+    flex: 0 0 auto;
+    font-size: 0.72rem;
+    line-height: 1.6;
+    padding: 0 8px;
+    border-radius: 2px;
+  }
+  .feat-status.is-open { background: #32d296; color: #fff; }
+  .feat-status.is-closed { background: #f0506e; color: #fff; }
+  .feat-hint {
+    display: block;
+    font-size: 0.78rem;
+    line-height: 1.5;
+    color: #999;
+  }
+  .feat-field { display: block; }
+  .feat-field > label > span {
+    display: block;
+    margin-bottom: 4px;
+    font-size: 0.875rem;
+  }
+  .feat-field-label {
+    display: block;
+    margin-bottom: 4px;
+    font-size: 0.875rem;
+  }
+  /* 收集模式三选一（长期开放 / 定时收集 / 循环定时），胶囊样式复用 .feat-day */
+  .feat-modes {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 6px;
+    margin-bottom: 4px;
+  }
+  .is-hidden { display: none !important; }
+  .feat-field input[type="datetime-local"],
+  .feat-field input[type="number"] { width: 100%; }
+  /* 循环定时（每周开放日 + 每日时间段） */
+  .feat-schedule { display: flex; flex-direction: column; gap: 8px; }
+  .feat-schedule-days {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 6px;
+  }
+  .feat-day {
+    display: inline-flex;
+    align-items: center;
+    gap: 3px;
+    padding: 3px 8px;
+    border: 1px solid #e5e5e5;
+    border-radius: 999px;
+    font-size: 0.78rem;
+    color: #666;
+    cursor: pointer;
+    user-select: none;
+  }
+  .feat-day input { margin: 0; }
+  .feat-day.is-on {
+    border-color: #1e87f0;
+    background: rgba(30, 135, 240, 0.08);
+    color: #1e87f0;
+  }
+  .feat-schedule-times {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 12px;
+  }
+  .feat-schedule-times label {
+    display: flex;
+    align-items: center;
+    gap: 6px;
+    font-size: 0.82rem;
+    color: #666;
+  }
+  .feat-schedule-times input[type="time"] {
+    width: 130px;
+    padding: 4px 8px;
+    border: 1px solid #e5e5e5;
+    border-radius: 4px;
+  }
+  html[data-theme="dark"] .feat-day {
+    border-color: var(--tb-border);
+    color: var(--tb-text-muted);
+  }
+  html[data-theme="dark"] .feat-day.is-on {
+    border-color: #1e87f0;
+    background: rgba(30, 135, 240, 0.14);
+    color: #1e87f0;
+  }
+  html[data-theme="dark"] .feat-schedule-times input[type="time"] {
+    border-color: var(--tb-border);
+    background: var(--tb-surface);
+    color: var(--tb-text);
+  }
+  .feat-quota-line {
+    font-size: 0.82rem;
+    color: #666;
+    text-align: center;
+  }
+  .feat-actions {
+    display: flex;
+    flex-wrap: wrap;
+    justify-content: center;
+    gap: 8px;
+    align-items: center;
+    margin-top: auto;
+  }
+  .feat-actions form { margin: 0; }
+  html[data-theme="dark"] .feat-card {
+    border-color: var(--tb-border);
+    background: var(--tb-surface);
+  }
+  html[data-theme="dark"] .feat-card-head h3 { color: var(--tb-text); }
+  html[data-theme="dark"] .feat-hint,
+  html[data-theme="dark"] .feat-quota-line { color: var(--tb-text-muted); }
+
+  /* 私聊面板聚合卡：chat 专属（功能开关/收集窗口 + 消息上限设置）同卡呈现，
+     feat 卡去掉自身边框避免嵌套；第二区 legend 降级为小节标题 */
+  .chat-zone .feat-card {
+    padding: 0;
+    border: 0;
+    background: transparent;
+  }
+  .chat-zone hr { margin: 14px 0; }
+  .chat-zone .uk-legend {
+    font-size: 1.05rem;
+    margin: 0 0 10px;
+  }
+
+  /* 标签块输入：回车或逗号成词，每个词可独立删除；原 input 隐藏后作为提交载体 */
+  .tb-tag-box {
+    display: flex;
+    flex-wrap: wrap;
+    align-items: center;
+    gap: 6px;
+    padding: 6px 8px;
+    border: 1px solid #e5e5e5;
+    border-radius: 4px;
+    background: #fff;
+    cursor: text;
+  }
+  .tb-tag-box:focus-within { border-color: #1e87f0; }
+  .tb-tag-chip {
+    display: inline-flex;
+    align-items: center;
+    gap: 6px;
+    padding: 2px 8px;
+    border-radius: 3px;
+    background: #1e87f0;
+    color: #fff;
+    font-size: 0.875rem;
+    line-height: 1.8;
+  }
+  .tb-tag-chip button {
+    padding: 0;
+    border: 0;
+    background: transparent;
+    color: inherit;
+    font-size: 1rem;
+    line-height: 1;
+    cursor: pointer;
+    opacity: 0.75;
+  }
+  .tb-tag-chip button:hover { opacity: 1; }
+  .tb-tag-entry {
+    flex: 1;
+    min-width: 120px;
+    border: 0;
+    outline: 0;
+    background: transparent;
+    color: inherit;
+    font-size: 0.875rem;
+  }
+  .tb-tag-meta {
+    display: flex;
+    justify-content: space-between;
+    gap: 8px;
+    margin-top: 4px;
+    font-size: 0.75rem;
+    color: #999;
+  }
+  .tb-tag-error { color: #f0506e; }
+  html[data-theme="dark"] .tb-tag-box {
+    border-color: var(--tb-border);
+    background: var(--tb-surface);
+    color: var(--tb-text);
+  }
+  html[data-theme="dark"] .tb-tag-entry { color: var(--tb-text); }
+  html[data-theme="dark"] .tb-tag-meta { color: var(--tb-text-muted); }
+
+  /* ===== profile account 面板卡片化（复用 UIkit 变量体系，暗色自动跟随） ===== */
+  .tb-pcard {
+    background: #fff;
+    border: 1px solid #e5e5e5;
+    border-radius: 10px;
+    padding: 13px 14px 8px;
+    margin-bottom: 12px;
+  }
+  .tb-pcard-title {
+    margin: 0 0 10px;
+    font-size: 1.02rem;
+    font-weight: 600;
+  }
+  /* 全页纵向压缩：面板内表单字段间距由 UIkit 默认 20px 收紧到 12px */
+  .profile-panel .uk-margin { margin-bottom: 12px; }
+  .tb-pcard-title .tb-pcard-extra {
+    float: right;
+    font-size: 0.76rem;
+    font-weight: 400;
+    color: #999;
+    line-height: 1.6;
+  }
+  /* 头像与背景预览：两项同行、整体居中；头像框与背景框“显示高度”一致（150px） */
+  .tb-media-row {
+    display: flex;
+    flex-wrap: wrap;
+    justify-content: center;
+    align-items: flex-start;
+    gap: 14px 32px;
+  }
+  .tb-media-item {
+    /* 头像列与背景列等宽（280px），内部各自居中 → 两个“更换 xx”组件观感一致 */
+    flex: 0 0 280px;
+    max-width: 100%;
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    text-align: center;
+  }
+  .tb-media-frame {
+    display: block;
+    flex: none;
+    border: 1px solid #e5e5e5;
+    background: #f7f7f7;
+    overflow: hidden;
+  }
+  .tb-media-frame.tb-frame-avatar {
+    width: 150px;
+    height: 150px;
+    border-radius: 50%;
+  }
+  .tb-media-frame.tb-frame-bg {
+    /* 16:9 且高 150 ≈ 头像框直径 150：两框视觉等高 */
+    width: 267px;
+    max-width: 100%;
+    aspect-ratio: 16 / 9;
+    border-radius: 8px;
+  }
+  .tb-media-frame img {
+    width: 100%;
+    height: 100%;
+    object-fit: cover;
+    display: block;
+  }
+  .tb-ratio-tag {
+    display: inline-block;
+    margin: 8px 0 0;
+    font-size: 0.72rem;
+    line-height: 1;
+    color: #666;
+    background: #f4f4f4;
+    border: 1px solid #e5e5e5;
+    border-radius: 999px;
+    padding: 4px 9px;
+  }
+  .tb-file-hint {
+    display: block;
+    font-size: 0.78rem;
+    line-height: 1.5;
+    color: #999;
+    margin-top: 6px;
+  }
+  .tb-media-actions { margin-top: 10px; }
+  /* 更换头像 / 更换背景两个按钮同宽 */
+  .tb-media-actions .uk-button { min-width: 150px; }
+  /* 卡片级保存按钮行（居中）：头像背景、基础资料、二维码、社交、改密各块共用 */
+  .tb-card-save,
+  .tb-media-save {
+    margin-top: 6px;
+    text-align: center;
+  }
+  /* 账号操作：导出两按钮同行、退出登录与停用同行；按钮组居中、说明行小字居中 */
+  .tb-account-actions { margin-top: 0; }
+  .tb-account-pair {
+    display: flex;
+    flex-wrap: wrap;
+    justify-content: center;
+    align-items: center;
+    gap: 10px 14px;
+    padding: 8px 0;
+  }
+  .tb-account-pair form { margin: 0; }
+  .tb-account-note {
+    display: block;
+    margin: 0 0 10px;
+    text-align: center;
+    font-size: 0.78rem;
+    line-height: 1.6;
+    color: #999;
+  }
+  .tb-account-note:last-child { margin-bottom: 0; }
+  /* 裁剪弹窗：图片区域限制在视口内，移动端可用 */
+  .tb-crop-stage {
+    max-width: 100%;
+    text-align: center;
+  }
+  .tb-crop-stage img {
+    display: inline-block;
+    max-width: 100%;
+    max-height: 58vh;
+  }
+  #media-crop-modal .uk-modal-dialog { width: 640px; }
+  .tb-crop-hint { margin-top: 12px; }
+  html[data-theme="dark"] .tb-pcard {
+    border-color: var(--tb-border);
+    background: var(--tb-surface);
+  }
+  html[data-theme="dark"] .tb-pcard-title { color: var(--tb-text); }
+  html[data-theme="dark"] .tb-pcard-extra,
+  html[data-theme="dark"] .tb-file-hint { color: var(--tb-text-muted); }
+  html[data-theme="dark"] .tb-media-frame {
+    border-color: var(--tb-border);
+    background: var(--tb-surface-2);
+  }
+  html[data-theme="dark"] .tb-ratio-tag {
+    color: var(--tb-text-muted);
+    border-color: var(--tb-border);
+    background: var(--tb-surface-2);
+  }
+  html[data-theme="dark"] .tb-account-note { color: var(--tb-text-muted); }
+  html[data-theme="dark"] .tb-pcard .uk-accordion-title {
+    color: var(--tb-text);
+  }
+  html[data-theme="dark"] .tb-pcard .uk-accordion-title:hover {
+    color: var(--tb-primary);
+  }
+  /* 移动端：更紧凑的留白与全宽操作区 */
+  @media (max-width: 640px) {
+    .tb-pcard { padding: 13px 12px 8px; }
+    .tb-media-row { gap: 14px; }
+    .tb-media-item { flex-basis: 100%; width: auto; max-width: none; }
+    .tb-media-frame.tb-frame-avatar { width: 120px; height: 120px; }
+    .tb-media-frame.tb-frame-bg { width: 100%; max-width: none; }
+    .tb-media-actions .uk-button,
+    .tb-media-save .uk-button,
+    .tb-card-save .uk-button { width: 100%; }
+  }
+</style>
+
+<!-- 提示条置于面板之外：任何面板保存后的 flash 都可见（面板会被 hidden 隐藏） -->
+{{template "base/alert" .}}
+
+<!-- 头像/背景裁剪弹窗（Cropper.js）：确认后把裁剪结果写回对应的文件域，随主表单一并提交 -->
+<div id="media-crop-modal" uk-modal>
+  <div class="uk-modal-dialog">
+    <button class="uk-modal-close-default" type="button" uk-close></button>
+    <div class="uk-modal-header">
+      <h2 class="uk-modal-title">{{t .LangCode "profile.cropTitle"}}</h2>
+    </div>
+    <div class="uk-modal-body">
+      <div class="tb-crop-stage">
+        <img id="media-crop-image" alt="">
+      </div>
+      <p class="uk-text-meta tb-crop-hint" id="media-crop-hint"></p>
+    </div>
+    <div class="uk-modal-footer uk-text-right">
+      <button type="button" class="uk-button uk-button-default uk-modal-close">{{t .LangCode "common.cancel"}}</button>
+      <button type="button" class="uk-button uk-button-primary" id="media-crop-confirm">{{t .LangCode "profile.cropConfirm"}}</button>
+    </div>
+  </div>
+</div>
+
+<!-- 面板切换：用户设置 与 提问/私聊/投票 的功能管理分开 -->
+<div class="profile-tabs" role="tablist">
+  <button type="button" class="profile-tab{{ if eq .ActiveProfileTab "account" }} is-active{{ end }}" data-profile-tab="account" role="tab" aria-selected="{{ if eq .ActiveProfileTab "account" }}true{{ else }}false{{ end }}">{{t .LangCode "admin.tabAccount"}}</button>
+  <button type="button" class="profile-tab{{ if eq .ActiveProfileTab "question" }} is-active{{ end }}" data-profile-tab="question" role="tab" aria-selected="{{ if eq .ActiveProfileTab "question" }}true{{ else }}false{{ end }}">{{t .LangCode "explore.questionsTab"}}</button>
+  <button type="button" class="profile-tab{{ if eq .ActiveProfileTab "chat" }} is-active{{ end }}" data-profile-tab="chat" role="tab" aria-selected="{{ if eq .ActiveProfileTab "chat" }}true{{ else }}false{{ end }}">{{t .LangCode "qlist.chatsTab"}}</button>
+  <button type="button" class="profile-tab{{ if eq .ActiveProfileTab "vote" }} is-active{{ end }}" data-profile-tab="vote" role="tab" aria-selected="{{ if eq .ActiveProfileTab "vote" }}true{{ else }}false{{ end }}">{{t .LangCode "explore.votesTab"}}</button>
+</div>
+
+<!-- ===================== 用户设置面板 ===================== -->
+<div class="profile-panel" data-profile-panel="account"{{ if ne .ActiveProfileTab "account" }} hidden{{ end }}>
+<form id="profile-form" method="post" enctype="multipart/form-data" action="/user/profile/update">
+  {{ .CSRFTokenHTML }}
+
+  <!-- 1 基础资料：账号与展示基础信息 -->
+  <section class="tb-pcard">
+    <h3 class="tb-pcard-title">{{t .LangCode "profile.card.basic"}}</h3>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.email"}}</label>
+      <input class="uk-input" type="text" disabled value="{{.LoggedUser.Email}}">
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.name"}}</label>
+      <input name="name" class="uk-input" type="text" value="{{.LoggedUser.Name}}">
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.nameColor"}}</label>
+      <div class="color-picker" data-default="{{.LoggedUser.Usernamecolor}}"></div>
+      <input type="hidden" name="usernamecolor" value="{{.LoggedUser.Usernamecolor}}">
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.intro"}}</label>
+      <input name="intro" class="uk-input" type="text" value="{{.LoggedUser.Intro}}">
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.introColor"}}</label>
+      <div class="color-picker" data-default="{{.LoggedUser.Introcolor}}"></div>
+      <input type="hidden" name="introcolor" value="{{.LoggedUser.Introcolor}}">
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.lang"}}</label>
+      <select name="language" class="uk-select">
+        {{ range .SupportedLangs }}
+        <option value="{{.Code}}" {{ if eq $.LoggedUser.Language .Code }}selected{{ end }}>{{.Name}}</option>
+        {{ end }}
+      </select>
+      <span class="uk-text-small uk-text-muted">{{t .LangCode "admin.langHint"}}</span>
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.notify"}}</label>
+      <label>
+        <input name="notify_email" class="uk-checkbox" type="checkbox"
+               {{ if eq .LoggedUser.Notify "email"}}checked{{end}}>
+        <span class="uk-text-small"> {{t .LangCode "admin.notifyEmail"}}</span>
+      </label>
+    </div>
+    <div class="tb-card-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t .LangCode "profile.saveBasic"}}</button>
+    </div>
+  </section>
+
+  <!-- 2 头像与背景：选择文件即弹裁剪框，预览实时更新；头像 1:1、背景 16:9 -->
+  <section class="tb-pcard">
+    <h3 class="tb-pcard-title">{{t .LangCode "profile.card.avatarBg"}}</h3>
+    <div class="tb-media-row">
+      <div class="tb-media-item">
+        <span class="tb-media-frame tb-frame-avatar">
+          <img id="avatar-prev" alt="" src="{{ if .LoggedUser.Avatar }}{{.LoggedUser.Avatar}}{{ else }}{{.DefaultAvatar}}{{ end }}">
+        </span>
+        <span class="tb-ratio-tag">1:1</span>
+        <div class="tb-media-actions">
+          <input type="file" name="avatar" id="avatar-input" accept="image/*" class="uk-hidden">
+          <button type="button" class="uk-button uk-button-default uk-button-small" data-pick-image="avatar">{{t .LangCode "profile.pickAvatar"}}</button>
+        </div>
+        <span class="tb-file-hint">{{t .LangCode "profile.avatarCropHint"}}</span>
+      </div>
+      <div class="tb-media-item">
+        <span class="tb-media-frame tb-frame-bg">
+          <img id="bg-prev" alt=""{{ if .LoggedUser.Background }} src="{{.LoggedUser.Background}}"{{ end }}>
+        </span>
+        <span class="tb-ratio-tag">16:9</span>
+        <div class="tb-media-actions">
+          <input type="file" name="background" id="background-input" accept="image/*" class="uk-hidden">
+          <button type="button" class="uk-button uk-button-default uk-button-small" data-pick-image="background">{{t .LangCode "profile.pickBackground"}}</button>
+        </div>
+        <span class="tb-file-hint">{{t .LangCode "profile.backgroundCropHint"}}</span>
+      </div>
+    </div>
+    <!-- 图片更换后在此即时保存（与主表单共用提交，裁剪结果随文件域一并上传） -->
+    <div class="tb-media-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t .LangCode "profile.saveMedia"}}</button>
+    </div>
+  </section>
+
+  <!-- 3 二维码样式：默认展开（可折叠），独立保存 -->
+  <section class="tb-pcard">
+    <ul class="uk-accordion" uk-accordion="multiple: true">
+      <li class="uk-open">
+        <a class="uk-accordion-title" href="#">{{t .LangCode "profile.card.qr"}}</a>
+        <div class="uk-accordion-content">
+          <div class="uk-grid" uk-grid>
+            <div class="uk-width-2-3@m uk-width-1-1">
+              <div class="uk-margin">
+                <label class="uk-form-label">{{t .LangCode "admin.qrBgColor"}}</label>
+                <div class="color-picker" data-default="{{.LoggedUser.Qrcodecolor}}"></div>
+                <input type="hidden" name="qrcodecolor" value="{{.LoggedUser.Qrcodecolor}}">
+              </div>
+              <div class="uk-margin">
+                <label class="uk-form-label">{{t .LangCode "admin.qrPdColor"}}</label>
+                <div class="color-picker" data-default="{{.LoggedUser.Qrcodepdpcolor}}"></div>
+                <input type="hidden" name="qrcodepdpcolor" value="{{.LoggedUser.Qrcodepdpcolor}}">
+              </div>
+              <div class="uk-margin">
+                <label class="uk-form-label">{{t .LangCode "admin.qrFgColor"}}</label>
+                <div class="uk-margin-small">
+                  <label>
+                      <input type="checkbox" id="use-custom-fg" name="use_custom_qr_color"
+                             {{ if .LoggedUser.UseCustomQRColor }}checked{{ end }}>
+                      {{t .LangCode "admin.useCustomFg"}}
+                  </label>
+                </div>
+                <div class="color-picker" data-default="{{.LoggedUser.Qrcodebackcolor}}"></div>
+                <input type="hidden" name="qrcodebackcolor" value="{{.LoggedUser.Qrcodebackcolor}}">
+                <span class="uk-text-small uk-text-muted">{{t .LangCode "admin.customFgHint"}}</span>
+              </div>
+              <div class="uk-margin">
+                <label class="uk-form-label">{{t .LangCode "admin.qrDotSize"}}</label>
+                <div class="range-input-group">
+                  <input name="dotscale" class="uk-range" type="range" step="0.01" min="0" max="1" value="{{.LoggedUser.Dotscale}}">
+                  <span class="range-value" id="dotscale-val">{{.LoggedUser.Dotscale}}</span>
+                  <input class="uk-input uk-form-width-xsmall" type="number" step="0.01" min="0" max="1" id="dotscale-num" value="{{.LoggedUser.Dotscale}}">
+                </div>
+              </div>
+              <div class="uk-margin">
+                <label class="uk-form-label">{{t .LangCode "admin.qrBgAlpha"}}</label>
+                <div class="range-input-group">
+                  <input name="backgroundimagealpha" class="uk-range" type="range" step="0.01" min="0" max="1" value="{{.LoggedUser.Backgroundimagealpha}}">
+                  <span class="range-value" id="bgalpha-val">{{.LoggedUser.Backgroundimagealpha}}</span>
+                  <input class="uk-input uk-form-width-xsmall" type="number" step="0.01" min="0" max="1" id="bgalpha-num" value="{{.LoggedUser.Backgroundimagealpha}}">
+                </div>
+              </div>
+              <div class="uk-margin">
+                <label class="uk-form-label">{{t .LangCode "admin.qrBackground"}}</label>
+                <div uk-form-custom="target: true">
+                  <input type="file" name="backgroundimage" accept="image/*" id="backgroundimage-file">
+                  <input class="uk-input uk-form-width-large" type="text" placeholder="{{t .LangCode "admin.qrBackgroundPlaceholder"}}" disabled>
+                </div>
+                <span class="uk-text-small uk-text-muted">{{t .LangCode "admin.qrPreviewHint"}}</span>
+              </div>
+            </div>
+            <div class="uk-width-1-3@m uk-width-1-1">
+              <div class="preview-card">
+                <h4 class="uk-text-center">{{t .LangCode "admin.preview"}}</h4>
+                <div class="qrcode-wrapper" id="qrcode-preview"></div>
+                <hr class="uk-margin-small">
+                <div class="uk-text-small">
+                  <strong>{{t .LangCode "admin.themePreset"}}</strong>
+                  <div class="uk-flex uk-flex-wrap uk-flex-center">
+                    <button type="button" class="uk-button uk-button-default uk-button-small theme-btn" data-theme="default">{{t .LangCode "admin.themeDefault"}}</button>
+                    <button type="button" class="uk-button uk-button-default uk-button-small theme-btn" data-theme="dark">{{t .LangCode "admin.themeDark"}}</button>
+                    <button type="button" class="uk-button uk-button-default uk-button-small theme-btn" data-theme="ocean">{{t .LangCode "admin.themeOcean"}}</button>
+                    <button type="button" class="uk-button uk-button-default uk-button-small theme-btn" data-theme="sunset">{{t .LangCode "admin.themeSunset"}}</button>
+                  </div>
+                </div>
+                <div class="uk-margin-small-top">
+                  <button type="button" id="reset-qr-defaults" class="uk-button uk-button-default uk-button-small uk-width-1-1">{{t .LangCode "admin.resetDefaults"}}</button>
+                </div>
+                <p class="uk-text-meta uk-margin-small-top">{{t .LangCode "admin.previewHint"}}</p>
+              </div>
+            </div>
+          </div>
+        </div>
+      </li>
+    </ul>
+    <div class="tb-card-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t .LangCode "profile.saveQR"}}</button>
+    </div>
+  </section>
+
+  <!-- 4 社交主页：默认展开（可折叠），独立保存 -->
+  <section class="tb-pcard">
+    <ul class="uk-accordion" uk-accordion="multiple: true">
+      <li class="uk-open">
+        <a class="uk-accordion-title" href="#">{{t .LangCode "admin.social"}}</a>
+        <div class="uk-accordion-content">
+          <span class="uk-text-muted">{{t .LangCode "admin.socialHint"}}</span>
+          <div class="uk-margin social-item">
+            <label class="checkbox-label">
+              <input type="checkbox" class="social-enable" data-target="acfunlink"> {{t .LangCode "admin.enableAcfun"}}
+            </label>
+            <input name="acfunlink" class="uk-input social-input" type="text" placeholder="acfun.cn/xxx" value="{{.LoggedUser.Acfunlink}}">
+          </div>
+          <div class="uk-margin social-item">
+            <label class="checkbox-label">
+              <input type="checkbox" class="social-enable" data-target="bililink"> {{t .LangCode "admin.enableBili"}}
+            </label>
+            <input name="bililink" class="uk-input social-input" type="text" placeholder="bilibili.com/xxx" value="{{.LoggedUser.Bililink}}">
+          </div>
+          <div class="uk-margin social-item">
+            <label class="checkbox-label">
+              <input type="checkbox" class="social-enable" data-target="weibolink"> {{t .LangCode "admin.enableWeibo"}}
+            </label>
+            <input name="weibolink" class="uk-input social-input" type="text" placeholder="weibo.com/xxx" value="{{.LoggedUser.Weibolink}}">
+          </div>
+          <div class="uk-margin social-item">
+            <label class="checkbox-label">
+              <input type="checkbox" class="social-enable" data-target="xiaohongshulink"> {{t .LangCode "admin.enableXiaohongshu"}}
+            </label>
+            <input name="xiaohongshulink" class="uk-input social-input" type="text" placeholder="xiaohongshu.com/xxx" value="{{.LoggedUser.Xiaohongshulink}}">
+          </div>
+          <div class="uk-margin social-item">
+            <label class="checkbox-label">
+              <input type="checkbox" class="social-enable" data-target="bloglink"> {{t .LangCode "admin.enableBlog"}}
+            </label>
+            <input name="bloglink" class="uk-input social-input" type="text" placeholder="example.com" value="{{.LoggedUser.Bloglink}}">
+          </div>
+        </div>
+      </li>
+    </ul>
+    <div class="tb-card-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t .LangCode "profile.saveSocial"}}</button>
+    </div>
+  </section>
+
+  <!-- 5 修改密码：保存成功后强制登出，需重新登录 -->
+  <section class="tb-pcard">
+    <h3 class="tb-pcard-title">{{t .LangCode "profile.card.password"}}</h3>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.oldPassword"}}</label>
+      <input name="old_password" class="uk-input" type="password" placeholder="{{t .LangCode "admin.oldPasswordHint"}}" autocomplete="current-password">
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.newPassword"}}</label>
+      <input name="new_password" class="uk-input" type="password" placeholder="{{t .LangCode "admin.newPasswordHint"}}" autocomplete="new-password">
+    </div>
+    <p class="uk-text-small uk-text-muted">{{t .LangCode "profile.pwdNote"}}</p>
+    <hr class="uk-margin-small">
+    <div class="tb-card-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t .LangCode "profile.savePassword"}}</button>
+    </div>
+  </section>
+</form>
+
+<!-- 6 标签与展示：独立表单，保存即生效 -->
+<section class="tb-pcard">
+  <h3 class="tb-pcard-title">{{t .LangCode "admin.tags"}}</h3>
+  <form method="post" action="/user/tags/update">
+    {{ .CSRFTokenHTML }}
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.tagsHint"}}</label>
+      <input name="tags" class="uk-input" type="text" value="{{.LoggedUser.Tags}}" placeholder="{{t .LangCode "admin.tagsPlaceholder"}}"
+             data-tb-tag-input
+             {{ with $.TagLimits }}data-tb-max="{{ .MaxTags }}" data-tb-max-len="{{ .MaxTagLen }}"{{ end }}
+             data-tb-msg-too-many="{{t .LangCode "admin.flash.tagsTooMany"}}"
+             data-tb-msg-too-long="{{t .LangCode "admin.flash.tagTooLong"}}"
+             data-tb-msg-duplicate="{{t .LangCode "admin.tagInputDuplicate"}}"
+             data-tb-msg-hint="{{t .LangCode "admin.tagInputHint"}}">
+    </div>
+    <div class="uk-margin">
+      <label>
+        <input name="show_in_home" class="uk-checkbox" type="checkbox" {{ if .LoggedUser.ShowInHome }}checked{{end}}>
+        <span class="uk-text-small"> {{t .LangCode "admin.showInHome"}}</span>
+      </label>
+    </div>
+    <div class="tb-card-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t .LangCode "admin.updateTags"}}</button>
+    </div>
+  </form>
+</section>
+
+<!-- 7 页面访问密码：独立表单 -->
+<section class="tb-pcard">
+  <h3 class="tb-pcard-title">{{t .LangCode "admin.pagePassword"}}</h3>
+  <form method="post" action="/user/profile/update-page-password">
+    {{ .CSRFTokenHTML }}
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.pagePasswordHint"}}</label>
+      <input name="password" class="uk-input" type="password" placeholder="{{t .LangCode "admin.pagePasswordPlaceholder"}}">
+    </div>
+    <div class="tb-card-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t .LangCode "admin.updatePagePassword"}}</button>
+    </div>
+  </form>
+</section>
+
+<!-- 8 账号操作：导出两按钮同行；退出登录与停用我的账号同行 -->
+<section class="tb-pcard">
+  <h3 class="tb-pcard-title">{{t .LangCode "admin.account"}}</h3>
+  <div class="tb-account-actions">
+    <div class="tb-account-pair">
+      <form action="/user/profile/export" method="post" target="_blank" data-tb-skip-submit-feedback="1">
+        {{ .CSRFTokenHTML }}
+        <button class="uk-button uk-button-default">{{t .LangCode "admin.export"}}</button>
+      </form>
+      <form action="/user/profile/export-json" method="post" target="_blank" data-tb-skip-submit-feedback="1">
+        {{ .CSRFTokenHTML }}
+        <button class="uk-button uk-button-default">{{t .LangCode "admin.exportJSON"}}</button>
+      </form>
+    </div>
+    <span class="tb-account-note">{{t .LangCode "admin.exportHint" (t .LangCode "site.title")}} {{t .LangCode "admin.exportJSONHint"}}</span>
+    <div class="tb-account-pair">
+      <!-- Logout 使用独立 POST 表单（携带 CSRF token），GET 链接会留下 CSRF 风险 -->
+      <form method="post" action="/user/logout">
+        {{ .CSRFTokenHTML }}
+        <button type="submit" class="uk-button uk-button-danger">{{t .LangCode "admin.logout"}}</button>
+      </form>
+      <a class="uk-button uk-button-danger" href="/user/profile/deactivate">{{t .LangCode "admin.deactivate"}}</a>
+    </div>
+    <span class="tb-account-note">{{t .LangCode "admin.deactivateHint" | safe}}</span>
+  </div>
+</section>
+</div><!-- /用户设置面板 -->
+
+
+<!-- ===================== 提问功能管理面板 ===================== -->
+<div class="profile-panel" data-profile-panel="question"{{ if ne .ActiveProfileTab "question" }} hidden{{ end }}>
+  {{ with .FeatureQuestion }}{{template "user/feature-control-form" .}}{{ end }}
+
+  <hr>
+  <div class="uk-margin">
+    <form method="post" action="/user/harassment/update?tab=question">
+      {{ $.CSRFTokenHTML }}
+      <legend class="uk-legend">{{t $.LangCode "admin.harassment"}}</legend>
+      <div class="uk-margin">
+        <label class="uk-form-label">{{t $.LangCode "admin.askLimit"}}</label><br>
+        <label>
+          <input name="register_only" class="uk-checkbox" type="checkbox"
+                 {{ if eq $.LoggedUser.HarassmentSetting "register_only"}}checked{{end}} >
+          <span class="uk-text-small"> {{t $.LangCode "admin.registerOnly"}}</span>
+        </label>
+      </div>
+    <div class="tb-card-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t $.LangCode "admin.updateHarassment"}}</button>
+    </div>
+    </form>
+  </div>
+
+  <!-- 全局屏蔽词：三个功能面板共用同一份（见 user/global-blockwords 部分模板） -->
+  {{ template "user/global-blockwords" (dict "Root" $ "Action" "/user/blockwords/update?tab=question") }}
+
+  <hr>
+  <div class="uk-margin">
+    <form method="post" action="/user/profile/update-ask-password">
+      {{ $.CSRFTokenHTML }}
+      <legend class="uk-legend">{{t $.LangCode "admin.askPassword"}}</legend>
+      <div class="uk-margin">
+        <label class="uk-form-label">{{t $.LangCode "admin.askPasswordHint"}}</label>
+        <input name="password" class="uk-input" type="password" placeholder="{{t $.LangCode "admin.askPasswordPlaceholder"}}">
+      </div>
+    <div class="tb-card-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t $.LangCode "admin.updateAskPassword"}}</button>
+    </div>
+    </form>
+  </div>
+</div><!-- /提问功能管理面板 -->
+
+<!-- ===================== 私聊功能管理面板 ===================== -->
+<div class="profile-panel" data-profile-panel="chat"{{ if ne .ActiveProfileTab "chat" }} hidden{{ end }}>
+  <!-- 私聊专属聚合卡：功能开关/收集窗口 + 私聊设置（消息上限）同属私聊，归入一张卡片 -->
+  <section class="tb-pcard chat-zone">
+    {{ with .FeatureChat }}{{template "user/feature-control-form" .}}{{ end }}
+
+    <hr>
+    <form method="post" action="/user/profile/update-chat-settings">
+      {{ $.CSRFTokenHTML }}
+      <legend class="uk-legend">{{t $.LangCode "admin.chat"}}</legend>
+      <div class="uk-margin">
+        <label class="uk-form-label">{{t $.LangCode "admin.chatMaxMessages"}}</label>
+        {{ with $.ChatLimits }}
+        <input name="chat_max_messages" class="uk-input uk-width-small" type="number" min="1" max="{{ .MaxChatMessages }}" value="{{ $.LoggedUser.ChatMaxMessages }}">
+        {{ end }}
+      </div>
+      <div class="uk-margin">
+        <label class="uk-form-label">{{t $.LangCode "admin.chatDailyLimit"}}</label>
+        {{ with $.ChatLimits }}
+        <input name="chat_daily_limit" class="uk-input uk-width-small" type="number" min="0" max="{{ .DailyMessageLimitMax }}" value="{{ $.LoggedUser.DailyMessageLimit }}">
+        {{ end }}
+        <span class="uk-text-muted uk-text-small">{{t $.LangCode "admin.dailyLimitHint"}}</span>
+      </div>
+      <div class="tb-card-save">
+        <button type="submit" class="uk-button uk-button-primary">{{t $.LangCode "admin.updateChat"}}</button>
+      </div>
+    </form>
+  </section>
+
+  <hr>
+  <!-- 全局屏蔽词：提问/私聊/投票三面板共用同一份（见 user/global-blockwords 部分模板） -->
+  {{ template "user/global-blockwords" (dict "Root" $ "Action" "/user/blockwords/update?tab=chat") }}
+</div><!-- /私聊功能管理面板 -->
+
+<!-- ===================== 投票功能管理面板 ===================== -->
+<div class="profile-panel" data-profile-panel="vote"{{ if ne .ActiveProfileTab "vote" }} hidden{{ end }}>
+  {{ with .FeatureVote }}{{template "user/feature-control-form" .}}{{ end }}
+
+  <hr>
+  <!-- 全局屏蔽词：三个功能面板共用同一份（见 user/global-blockwords 部分模板） -->
+  {{ template "user/global-blockwords" (dict "Root" $ "Action" "/user/blockwords/update?tab=vote") }}
+</div><!-- /投票功能管理面板 -->
+
+<script>
+(function() {
+    // ========== 社交信息复选框交互 + 非空验证 ==========
+    function initSocialCheckboxes() {
+        document.querySelectorAll('.social-item').forEach(function(item) {
+            var checkbox = item.querySelector('.social-enable');
+            var input = item.querySelector('.social-input');
+            if (!checkbox || !input) return;
+
+            // 初始化状态
+            var currentVal = input.value.trim();
+            if (currentVal === 'none' || currentVal === '') {
+                checkbox.checked = false;
+                input.value = 'none';
+                input.disabled = true;
+                input.removeAttribute('required');
+            } else {
+                checkbox.checked = true;
+                input.disabled = false;
+                input.setAttribute('required', 'required');
+            }
+
+            // 复选框切换
+            checkbox.addEventListener('change', function() {
+                if (checkbox.checked) {
+                    input.disabled = false;
+                    if (input.value === 'none') input.value = '';
+                    input.setAttribute('required', 'required');
+                    input.focus();
+                } else {
+                    input.value = 'none';
+                    input.disabled = true;
+                    input.removeAttribute('required');
+                    // 清除可能出现的自定义验证消息
+                    input.setCustomValidity('');
+                }
+            });
+
+            // 输入时清除自定义验证消息
+            input.addEventListener('input', function() {
+                if (input.validity.customError) {
+                    input.setCustomValidity('');
+                }
+            });
+        });
+    }
+
+    // 主表单提交验证
+    var profileForm = document.getElementById('profile-form');
+    profileForm.addEventListener('submit', function(e) {
+        var valid = true;
+        document.querySelectorAll('.social-item').forEach(function(item) {
+            var checkbox = item.querySelector('.social-enable');
+            var input = item.querySelector('.social-input');
+            if (checkbox.checked && input.value.trim() === '') {
+                input.setCustomValidity('{{t .LangCode "admin.socialRequired"}}');
+                valid = false;
+            } else {
+                input.setCustomValidity('');
+            }
+        });
+
+        if (!valid) {
+            e.preventDefault();
+            // 触发第一个无效输入框的报告
+            profileForm.reportValidity();
+        } else {
+            // 提交前确保未启用的项值为 "none"
+            document.querySelectorAll('.social-item').forEach(function(item) {
+                var checkbox = item.querySelector('.social-enable');
+                var input = item.querySelector('.social-input');
+                if (!checkbox.checked) {
+                    input.value = 'none';
+                }
+            });
+        }
+    });
+
+    initSocialCheckboxes();
+
+    // ========== 其余脚本（颜色选择器、预览等） ==========
+    function debounce(func, wait) {
+        var timeout;
+        return function() {
+            var context = this, args = arguments;
+            clearTimeout(timeout);
+            timeout = setTimeout(function() { func.apply(context, args); }, wait);
+        };
+    }
+
+    // Pickr 初始化
+    document.querySelectorAll('.color-picker').forEach(function(el) {
+        var hiddenInput = el.nextElementSibling;
+        if (!hiddenInput || hiddenInput.type !== 'hidden') return;
+        var pickr = Pickr.create({
+            el: el,
+            theme: 'nano',
+            default: hiddenInput.value || '#000000',
+            defaultRepresentation: 'HEX',
+            components: {
+                preview: true,
+                opacity: false,
+                hue: true,
+                interaction: {
+                    hex: true,
+                    input: true,
+                    clear: true,
+                    save: true
+                }
+            }
+        });
+        pickr.on('save', function(color) {
+            var hex = color.toHEXA().toString();
+            hiddenInput.value = hex;
+            hiddenInput.dispatchEvent(new Event('input'));
+        });
+    });
+
+    // 滑块联动
+    function bindRangeNumber(range, num, span) {
+        if (!range || !num) return;
+        var update = function() {
+            num.value = range.value;
+            if (span) span.textContent = parseFloat(range.value).toFixed(2);
+            debouncedUpdatePreview();
+        };
+        range.addEventListener('input', update);
+        num.addEventListener('change', function() {
+            var val = parseFloat(num.value);
+            if (isNaN(val)) return;
+            range.value = val;
+            if (span) span.textContent = val.toFixed(2);
+            debouncedUpdatePreview();
+        });
+        if (span) span.textContent = parseFloat(range.value).toFixed(2);
+    }
+
+    var dotScaleRange = document.querySelector('input[name="dotscale"]');
+    var dotScaleNum = document.getElementById('dotscale-num');
+    var dotScaleSpan = document.getElementById('dotscale-val');
+    var bgAlphaRange = document.querySelector('input[name="backgroundimagealpha"]');
+    var bgAlphaNum = document.getElementById('bgalpha-num');
+    var bgAlphaSpan = document.getElementById('bgalpha-val');
+    bindRangeNumber(dotScaleRange, dotScaleNum, dotScaleSpan);
+    bindRangeNumber(bgAlphaRange, bgAlphaNum, bgAlphaSpan);
+
+    // 背景图即时预览
+    var bgImageFile = document.getElementById('backgroundimage-file');
+    window._bgImageDataURL = null;
+    if (bgImageFile) {
+        bgImageFile.addEventListener('change', function(e) {
+            var file = e.target.files[0];
+            if (!file) return;
+            var reader = new FileReader();
+            reader.onload = function(ev) {
+                window._bgImageDataURL = ev.target.result;
+                debouncedUpdatePreview();
+            };
+            reader.readAsDataURL(file);
+        });
+    }
+
+    // 二维码预览核心
+    var boxURL = window.location.origin + '/_/' + '{{.LoggedUser.Domain}}';
+    var previewEl = document.getElementById('qrcode-preview');
+    var useCustomFg = document.getElementById('use-custom-fg');
+    updatePreview();
+
+    function getInputVal(name, fallback) {
+        var input = document.querySelector('input[name="' + name + '"]');
+        var v = input ? (input.value || '').trim() : '';
+        return v || (fallback || '#000000');
+    }
+
+    function updatePreview() {
+        var useFg = useCustomFg.checked;
+        var containerWidth = previewEl.clientWidth || 220;
+        var size = Math.min(containerWidth, 220);
+        // 关键修复：禁止 autoColor。新用户未设颜色时 easy.qrcode 的 autoColor 会自动取一个
+        // ≈背景色的前景，导致整张二维码变成背景色方块、无法扫描。改为始终传入明确的
+        // colorDark / colorLight 兜底值（空字段时回退到标准黑白）。
+        var dotScaleVal = parseFloat(dotScaleRange.value) || 0.4;
+        var bgAlphaVal = parseFloat(bgAlphaRange.value) || 0.8;
+        var options = {
+            text: boxURL,
+            width: size,
+            height: size,
+            colorDark: useFg ? getInputVal('qrcodebackcolor', '#000000') : '#000000',
+            colorLight: getInputVal('qrcodecolor', '#FFFFFF'),
+            dotScale: dotScaleVal,
+            dotScaleTiming: dotScaleVal,
+            dotScaleA: dotScaleVal,
+            correctLevel: QRCode.CorrectLevel.H,
+            logo: (function () {
+                // ?v=2：击穿曾被无 ACAO 响应污染的浏览器缓存条目；仅对 http(s) 绝对地址追加
+                var a = "{{.LoggedUser.Avatar}}" || "{{.DefaultAvatar}}";
+                return a ? (a.indexOf("http") === 0 ? a + "?v=2" : a) : undefined;
+            })(),
+            logoWidth: Math.floor(size * 0.25),
+            logoHeight: Math.floor(size * 0.25),
+            logoBackgroundTransparent: true,
+            // 直连 R2 等跨域图片须以 CORS 模式加载，画布才不会被污染、可正常导出；
+            // 前提是图片所在桶/域名已配 Access-Control-Allow-Origin（如 R2 CORS Policy）。
+            crossOrigin: 'anonymous',
+            // 默认不注入任何二维码背景图：仅在用户自己上传/设置了 BackgroundImage 时才使用，
+            // 或本次会话通过本地文件选择器临时预览（window._bgImageDataURL）。
+            // 没有背景图时（autoColor:false + 显式 colorDark/colorLight）才能稳定输出可扫描的黑白二维码，
+            // 否则在「无背景图却勾选自定义前景色」时容易糊成一坨。
+            backgroundImage: window._bgImageDataURL || ("{{.LoggedUser.BackgroundImage}}" ? "{{.LoggedUser.BackgroundImage}}" : undefined),
+            backgroundImageAlpha: bgAlphaVal,
+            autoColor: false,
+            PO: getInputVal('qrcodepdpcolor', '#000000'),
+            PI: getInputVal('qrcodepdpcolor', '#000000'),
+            AO: '',
+            AI: '',
+            timing: getInputVal('qrcodepdpcolor', '#000000')
+        };
+        previewEl.innerHTML = '';
+        new QRCode(previewEl, options);
+    }
+
+    var debouncedUpdatePreview = debounce(updatePreview, 150);
+    // 二维码卡默认展开后：若初始不在 account 面板（?tab=question 等），容器曾 hidden 导致
+    // 预览按回退 220px 绘制；面板切回时由 tab 脚本调用本函数按真实宽度重绘。
+    window.__tbRefreshAccountPreview = debouncedUpdatePreview;
+
+    var colorInputs = document.querySelectorAll('input[type="hidden"][name="qrcodebackcolor"], input[type="hidden"][name="qrcodecolor"], input[type="hidden"][name="qrcodepdpcolor"]');
+    colorInputs.forEach(function(input) {
+        input.addEventListener('input', debouncedUpdatePreview);
+    });
+    useCustomFg.addEventListener('change', debouncedUpdatePreview);
+    window.addEventListener('resize', debouncedUpdatePreview);
+    // uk-accordion 展开/收起时按真实宽度重绘（初始默认展开；从其它面板切回见下方 tab 钩子）
+    document.addEventListener('shown', function(e) {
+      if (e.target && e.target.closest && e.target.closest('.uk-accordion')) {
+        debouncedUpdatePreview();
+      }
+    });
+    updatePreview();
+
+    // 预设主题
+    var themes = {
+        'default': {
+            qrcodecolor: '#FFFFFF',
+            qrcodebackcolor: '#000000',
+            qrcodepdpcolor: '#000000',
+            dotscale: 0.35,
+            bgalpha: 0.8
+        },
+        'dark': {
+            qrcodecolor: '#1a1a1a',
+            qrcodebackcolor: '#FFFFFF',
+            qrcodepdpcolor: '#FFFFFF',
+            dotscale: 0.5,
+            bgalpha: 0.9
+        },
+        'ocean': {
+            qrcodecolor: '#E0F7FA',
+            qrcodebackcolor: '#006064',
+            qrcodepdpcolor: '#004D40',
+            dotscale: 0.4,
+            bgalpha: 0.7
+        },
+        'sunset': {
+            qrcodecolor: '#FFF3E0',
+            qrcodebackcolor: '#BF360C',
+            qrcodepdpcolor: '#870000',
+            dotscale: 0.45,
+            bgalpha: 0.75
+        }
+    };
+
+    function applyTheme(theme) {
+        var t = themes[theme];
+        if (!t) return;
+        document.querySelector('input[name="qrcodecolor"]').value = t.qrcodecolor;
+        document.querySelector('input[name="qrcodebackcolor"]').value = t.qrcodebackcolor;
+        document.querySelector('input[name="qrcodepdpcolor"]').value = t.qrcodepdpcolor;
+        dotScaleRange.value = t.dotscale;
+        dotScaleNum.value = t.dotscale;
+        dotScaleSpan.textContent = parseFloat(t.dotscale).toFixed(2);
+        bgAlphaRange.value = t.bgalpha;
+        bgAlphaNum.value = t.bgalpha;
+        bgAlphaSpan.textContent = parseFloat(t.bgalpha).toFixed(2);
+
+        document.querySelector('input[name="qrcodecolor"]').dispatchEvent(new Event('input'));
+        document.querySelector('input[name="qrcodebackcolor"]').dispatchEvent(new Event('input'));
+        document.querySelector('input[name="qrcodepdpcolor"]').dispatchEvent(new Event('input'));
+        debouncedUpdatePreview();
+    }
+
+    document.querySelectorAll('.theme-btn').forEach(function(btn) {
+        btn.addEventListener('click', function() {
+            applyTheme(this.getAttribute('data-theme'));
+        });
+    });
+
+    document.getElementById('reset-qr-defaults').addEventListener('click', function() {
+        applyTheme('default');
+        useCustomFg.checked = false;
+        debouncedUpdatePreview();
+    });
+
+})();
+</script>
+
+<script>
+// 面板切换：用户设置 / 提问 / 私聊 / 投票。
+// 服务端已按 ?tab= 渲染初始面板，此处仅在前端切换，并用 hash 保持可分享。
+document.addEventListener('DOMContentLoaded', function() {
+  var tabs = document.querySelectorAll('[data-profile-tab]');
+  var panels = document.querySelectorAll('[data-profile-panel]');
+  function showPanel(name, pushToURL) {
+    tabs.forEach(function(tab) {
+      var active = tab.dataset.profileTab === name;
+      tab.classList.toggle('is-active', active);
+      tab.setAttribute('aria-selected', active ? 'true' : 'false');
+    });
+    panels.forEach(function(panel) {
+      panel.hidden = panel.dataset.profilePanel !== name;
+    });
+    // 切回用户设置面板时按真实宽度重绘二维码预览（展开状态不会再触发 accordion 'shown'）
+    if (name === 'account' && window.__tbRefreshAccountPreview) {
+      window.__tbRefreshAccountPreview();
+    }
+    if (pushToURL && window.history && window.history.replaceState) {
+      window.history.replaceState({}, document.title, '/user/profile?tab=' + name);
+    }
+  }
+  tabs.forEach(function(tab) {
+    tab.addEventListener('click', function() { showPanel(tab.dataset.profileTab, true); });
+  });
+  var hash = (window.location.hash || '').replace('#', '');
+  if (hash && document.querySelector('[data-profile-tab="' + hash + '"]')) {
+    showPanel(hash, false);
+  }
+});
+</script>
+
+<script>
+// 标签 / 屏蔽词的标签块输入：把原本的逗号分隔文本框升级为"回车或逗号成词 + 逐条删除"。
+// 渐进增强：接管前原 input 就是可用的普通文本框；接管后原 input 转为隐藏的提交载体，
+// 提交前把标签块拼回逗号串写回它，后端解析逻辑完全不变（仍按逗号分隔）。
+(function () {
+  // 后端兼容中文逗号，前端切分口径保持一致
+  function parseList(value) {
+    return String(value || '').split(/[,，]/).map(function (s) {
+      return s.trim();
+    }).filter(function (s) { return s !== ''; });
+  }
+
+  function initTagInput(input) {
+    var max = parseInt(input.getAttribute('data-tb-max'), 10);
+    var maxLen = parseInt(input.getAttribute('data-tb-max-len'), 10);
+    // data 属性缺失（如错误分支重渲染）时回落到与 db 常量一致的宽松值，后端仍是唯一权威
+    if (!max || max < 1) { max = 10; }
+    if (!maxLen || maxLen < 1) { maxLen = 10; }
+    var msgTooMany = input.getAttribute('data-tb-msg-too-many') || '';
+    var msgTooLong = input.getAttribute('data-tb-msg-too-long') || '';
+    var msgDuplicate = input.getAttribute('data-tb-msg-duplicate') || '';
+    var hint = input.getAttribute('data-tb-msg-hint') || '';
+
+    var items = parseList(input.value);
+
+    var box = document.createElement('div');
+    box.className = 'tb-tag-box';
+    var entry = document.createElement('input');
+    entry.type = 'text';
+    entry.className = 'tb-tag-entry';
+    box.appendChild(entry);
+
+    var meta = document.createElement('div');
+    meta.className = 'tb-tag-meta';
+    var count = document.createElement('span');
+    var error = document.createElement('span');
+    error.className = 'tb-tag-error';
+    meta.appendChild(count);
+    meta.appendChild(error);
+
+    var wrap = document.createElement('div');
+    wrap.appendChild(box);
+    wrap.appendChild(meta);
+
+    input.style.display = 'none';
+    if (input.parentNode) { input.parentNode.insertBefore(wrap, input.nextSibling); }
+
+    function sync() { input.value = items.join(','); }
+    function showError(msg) { error.textContent = msg || ''; }
+
+    function commit(raw) {
+      var v = String(raw || '').trim().replace(/[,，]/g, '');
+      if (v === '') { return; }
+      if (items.length >= max) { showError(msgTooMany); return; }
+      if (Array.from(v).length > maxLen) { showError(msgTooLong.replace('%s', v)); return; }
+      if (items.indexOf(v) >= 0) { showError(msgDuplicate); return; }
+      showError('');
+      items.push(v);
+      render();
+    }
+
+    function render() {
+      Array.prototype.slice.call(box.childNodes).forEach(function (node) {
+        if (node !== entry) { box.removeChild(node); }
+      });
+      items.forEach(function (text, i) {
+        var chip = document.createElement('span');
+        chip.className = 'tb-tag-chip';
+        chip.appendChild(document.createTextNode(text));
+        var del = document.createElement('button');
+        del.type = 'button';
+        del.textContent = '×';
+        del.title = text;
+        del.addEventListener('click', function () {
+          items.splice(i, 1);
+          showError('');
+          render();
+        });
+        chip.appendChild(del);
+        box.insertBefore(chip, entry);
+      });
+      entry.disabled = items.length >= max;
+      entry.placeholder = entry.disabled ? '' : hint;
+      count.textContent = items.length + ' / ' + max;
+      sync();
+    }
+
+    box.addEventListener('click', function (e) {
+      if (e.target === box) { entry.focus(); }
+    });
+    entry.addEventListener('input', function () {
+      if (entry.value.indexOf(',') >= 0 || entry.value.indexOf('，') >= 0) {
+        commit(entry.value);
+        entry.value = '';
+      }
+    });
+    entry.addEventListener('keydown', function (e) {
+      if (e.key === 'Enter') {
+        e.preventDefault();
+        commit(entry.value);
+        entry.value = '';
+      } else if (e.key === 'Backspace' && entry.value === '' && items.length > 0) {
+        items.pop();
+        showError('');
+        render();
+      }
+    });
+    // 失焦时收下残留输入，避免"打了字没回车就提交"导致内容丢失
+    entry.addEventListener('blur', function () {
+      if (entry.value.trim() !== '') {
+        commit(entry.value);
+        entry.value = '';
+      }
+    });
+
+    if (input.form) {
+      input.form.addEventListener('submit', function () {
+        commit(entry.value);
+        entry.value = '';
+        sync();
+      });
+    }
+
+    render();
+  }
+
+  document.addEventListener('DOMContentLoaded', function () {
+    document.querySelectorAll('[data-tb-tag-input]').forEach(initTagInput);
+  });
+})();
+</script>
+
+<script data-cfasync="false">
+// ========== 头像 / 背景：选择即弹裁剪框（1:1 / 16:9），确认后写回 file input 随主表单提交 ==========
+(function () {
+  var MSG_AVATAR_TOO_LARGE = '{{t .LangCode "profile.err.avatarTooLarge"}}';
+  var MSG_BG_TOO_LARGE = '{{t .LangCode "profile.err.backgroundTooLarge"}}';
+  var MSG_NO_CROPPER = '{{t .LangCode "profile.err.cropLibUnavailable"}}';
+  var HINT_AVATAR = '{{t .LangCode "profile.avatarCropHint"}}';
+  var HINT_BG = '{{t .LangCode "profile.backgroundCropHint"}}';
+
+  var MAX_FILE = 2 * 1024 * 1024; // 与 storage.MaxAvatarSize / MaxBackgroundSize 一致
+
+  var media = {
+    avatar: {
+      input: document.getElementById('avatar-input'),
+      prev: document.getElementById('avatar-prev'),
+      ratio: 1,
+      hint: HINT_AVATAR,
+      maxSizeMsg: MSG_AVATAR_TOO_LARGE,
+      // 仅限制输出上限，避免小图被强行放大；canvas 宽高比由裁剪框锁定保证
+      canvas: { maxWidth: 512 },
+      fileType: 'image/png', fileExt: 'png', quality: null
+    },
+    background: {
+      input: document.getElementById('background-input'),
+      prev: document.getElementById('bg-prev'),
+      ratio: 16 / 9,
+      hint: HINT_BG,
+      maxSizeMsg: MSG_BG_TOO_LARGE,
+      canvas: { maxWidth: 1920 },
+      fileType: 'image/jpeg', fileExt: 'jpg', quality: 0.92
+    }
+  };
+
+  var modalEl = document.getElementById('media-crop-modal');
+  var stageImg = document.getElementById('media-crop-image');
+  var hintEl = document.getElementById('media-crop-hint');
+  var confirmBtn = document.getElementById('media-crop-confirm');
+  var cropper = null;
+  var pendingKey = null;   // avatar | background
+  var pendingURL = null;   // 原始选中文件的 objectURL
+  var appliedURL = {};     // 已应用裁剪结果的 objectURL（替换新文件时回收）
+  // 不在解析期创建 UIkit 组件：Cloudflare Rocket Loader / defer 环境下 UIkit 可能尚未执行，
+  // 顶层写 UIkit.modal(...) 会抛 ReferenceError 中断整个脚本，导致下方按钮监听全部失效。
+  // 改为在使用前懒创建（见 startCrop），并统一经由 whenReady 等待 UIkit / Cropper 就绪。
+  var modalObj = null;
+
+  function notify(msg) {
+    // UIkit 不可用时退回原生 alert，保证任何环境下用户都能看到原因
+    if (window.UIkit) { UIkit.modal.alert(msg); } else { window.alert(msg); }
+  }
+
+  // UIkit（header defer）与 Cropper（R2 CDN）就绪后回调；Rocket Loader 会延迟第三方脚本执行，
+  // 但最多容忍 3s —— 超时说明资源确实缺失（如 Cropper 尚未上传），给出可理解提示而非静默失败。
+  function whenReady(cb) {
+    if (window.UIkit && window.Cropper) { cb(); return; }
+    var waited = 0;
+    var timer = setInterval(function () {
+      waited += 100;
+      if (window.UIkit && window.Cropper) {
+        clearInterval(timer);
+        cb();
+      } else if (waited >= 3000) {
+        clearInterval(timer);
+        notify(MSG_NO_CROPPER);
+      }
+    }, 100);
+  }
+
+  function revoke(store, key) {
+    if (store[key]) { URL.revokeObjectURL(store[key]); store[key] = null; }
+  }
+
+  function startCrop(key) {
+    var cfg = media[key];
+    if (!cfg) return;
+    // 文件大小即时校验（不依赖第三方库，立即反馈）
+    var file = cfg.input && cfg.input.files && cfg.input.files[0];
+    if (!file) return;
+    if (file.size > MAX_FILE) { notify(cfg.maxSizeMsg); cfg.input.value = ''; return; }
+
+    whenReady(function () {
+      // 等待期间用户可能重新选择了文件，重新读取
+      var f = cfg.input.files && cfg.input.files[0];
+      if (!f) return;
+      if (f.size > MAX_FILE) { notify(cfg.maxSizeMsg); cfg.input.value = ''; return; }
+      if (!modalObj) { modalObj = UIkit.modal(modalEl); }
+
+      revoke(appliedURL, key);
+      pendingKey = key;
+      if (pendingURL) { URL.revokeObjectURL(pendingURL); pendingURL = null; }
+      pendingURL = URL.createObjectURL(f);
+
+      hintEl.textContent = cfg.hint;
+      stageImg.onload = function () { initCropper(); };
+      stageImg.src = pendingURL;
+      modalObj.show();
+    });
+  }
+
+  function initCropper() {
+    if (cropper) { cropper.destroy(); cropper = null; }
+    if (!pendingKey) return;
+    var cfg = media[pendingKey];
+    // 容器宽度优先：modal 显示后再创建，保证测量准确（移动端可用手势拖拽/缩放）
+    var box = stageImg.parentElement;
+    cropper = new Cropper(stageImg, {
+      viewMode: 1,
+      dragMode: 'move',
+      aspectRatio: cfg.ratio,
+      autoCropArea: 1,
+      responsive: true,
+      background: false,
+      rotatable: true,
+      zoomable: true,
+      wheelZoomRatio: 0.08
+    });
+  }
+
+  // 收起时销毁实例，回收资源
+  modalEl.addEventListener('hidden', function () {
+    if (cropper) { cropper.destroy(); cropper = null; }
+    if (pendingURL) { URL.revokeObjectURL(pendingURL); pendingURL = null; }
+    stageImg.removeAttribute('src');
+    pendingKey = null;
+  });
+
+  confirmBtn.addEventListener('click', function () {
+    if (!cropper || !pendingKey || !modalObj) return;
+    var cfg = media[pendingKey];
+    var canvas = cropper.getCroppedCanvas(cfg.canvas);
+    if (!canvas) return;
+    canvas.toBlob(function (blob) {
+      if (!blob) return;
+      var dt = new DataTransfer();
+      dt.items.add(new File([blob], 'cropped-' + pendingKey + '.' + cfg.fileExt, { type: cfg.fileType }));
+      cfg.input.files = dt.files;
+      appliedURL[pendingKey] = URL.createObjectURL(blob);
+      if (cfg.prev) { cfg.prev.src = appliedURL[pendingKey]; cfg.prev.style.display = 'block'; }
+      modalObj.hide();
+    }, cfg.fileType, cfg.quality || undefined);
+  });
+
+  // 入口按钮触发文件选择
+  document.querySelectorAll('[data-pick-image]').forEach(function (btn) {
+    btn.addEventListener('click', function () {
+      var key = btn.getAttribute('data-pick-image');
+      var input = media[key] && media[key].input;
+      if (input) input.click();
+    });
+  });
+
+  // 选择文件后进入裁剪
+  Object.keys(media).forEach(function (key) {
+    var input = media[key].input;
+    if (!input) return;
+    input.addEventListener('change', function () { startCrop(key); });
+  });
+})();
+</script>
+
+{{template "base/footer" .}}
diff --git a/.workbuddy/backup/cdn-migration-20260905/question-not-found.html b/.workbuddy/backup/cdn-migration-20260905/question-not-found.html
new file mode 100644
index 0000000..a81806f
--- /dev/null
+++ b/.workbuddy/backup/cdn-migration-20260905/question-not-found.html
@@ -0,0 +1,105 @@
+{{template "base/header" .}}
+<!--<link rel="stylesheet" href="https://lf6-cdn-tos.bytecdntp.com/cdn/expire-1-y/uikit/3.3.3/css/uikit.min.css">-->
+<!-- 头像直连 R2：crossorigin 让 favicon 也以 CORS 模式请求，确保浏览器缓存的响应都带 ACAO；
+     ?v=2 击穿历史上被「无 ACAO 响应」污染的缓存条目 -->
+<link rel="shortcut icon"
+      href="{{.PageUser.Avatar}}?v=2" crossorigin="anonymous"/>
+<link rel="apple-touch-icon"
+      href="{{.PageUser.Avatar}}?v=2" crossorigin="anonymous"/>
+<link rel="icon" sizes="192x192"
+      href="{{.PageUser.Avatar}}?v=2" crossorigin="anonymous">
+<div class="uk-card uk-card-default uk-text-center">
+  <div class="uk-flex uk-flex-center uk-flex-middle uk-background-cover uk-light" style="min-height: 260px;" data-src="{{ .PageUser.Background }}" uk-img>
+    <div class="uk-card-body">
+      <img class="uk-border-circle uk-box-shadow-large" src="{{ if .PageUser.Avatar }}{{ .PageUser.Avatar }}?v=2{{ else }}{{ .DefaultAvatar }}{{ end }}" crossorigin="anonymous" style="width: 100px; height: 100px; max-width: 100%; max-height: 100%;">
+      <h3 id="usernamecolor">{{ .PageUser.Name }}</h3>
+      <p id="introcolor">{{ .PageUser.Intro }}</p>
+        <div class="icon-container">
+        {{ if and .PageUser.Acfunlink (ne .PageUser.Acfunlink "none") }}
+         <a href="https://{{.PageUser.Acfunlink}}" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/ailicili.png" alt="acfunlink" class="icon">
+         </a>
+        {{ end }}
+        {{ if and .PageUser.Bililink (ne .PageUser.Bililink "none") }}
+         <a href="https://{{.PageUser.Bililink}}" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/bili.png" alt="bililink" class="icon">
+         </a>
+        {{ end }}
+        {{ if and .PageUser.Weibolink (ne .PageUser.Weibolink "none") }}
+         <a href="https://{{.PageUser.Weibolink}}" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/weibo.png" alt="weibolink" class="icon">
+         </a>
+        {{ end }}
+        {{ if and .PageUser.Xiaohongshulink (ne .PageUser.Xiaohongshulink "none") }}
+         <a href="https://{{.PageUser.Xiaohongshulink}}" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/xiaohongshu.png" alt="xiaohongshulink" class="icon">
+         </a>
+        {{ end }}
+        {{ if and .PageUser.Bloglink (ne .PageUser.Bloglink "none") }}
+          <a href="https://{{.PageUser.Bloglink}}" target="_blank">
+           <img src="https://r2.337845818.best/tamabox/icon/social/blog.png" alt="bloglink" class="icon">
+         </a>
+        {{ end }}
+        </div>
+    </div>
+  </div>
+</div>
+<script>
+document.getElementById("usernamecolor").style.color = {{.PageUser.Usernamecolor}};
+document.getElementById("introcolor").style.color = {{.PageUser.Introcolor}};
+</script>
+<div>
+  <div class="uk-card uk-card-default uk-card-small uk-card-body">
+    {{ if .CanAsk }}
+    <!-- jQuery 按需加载（同步，保证下方内联二维码初始化就绪） -->
+    <script src="https://r2.337845818.best/tamabox/cdn/lib/jquery/3.7.1/jquery.min.js"></script>
+    <script src='https://r2.337845818.best/tamabox/cdn/js/remake/easy.qrcode.min.js' type="text/javascript"  charset="utf-8"></script>
+    <center><div id="boxqrimg"></div></center>
+    <script type="text/javascript">
+        var options = {
+            text: window.location.href,
+            width: 200,
+            height: 200,
+            // 与 Profile 编辑器保持一致：仅当启用自定义前景色时，才把 Qrcodebackcolor 作为前景色；
+            // 否则强制黑色 #000000，避免未勾选却显示自定义前景色、与 Profile 预览不一致。
+            colorDark: ({{.PageUser.UseCustomQRColor}} ? "{{.PageUser.Qrcodebackcolor}}" : "#000000") || "#000000",
+            colorLight: "{{.PageUser.Qrcodecolor}}" || "#FFFFFF",
+            dotScale: parseFloat("{{.PageUser.Dotscale}}") || 0.4,
+            dotScaleTiming: parseFloat("{{.PageUser.Dotscale}}") || 0.4,
+            dotScaleA: parseFloat("{{.PageUser.Dotscale}}") || 0.4,
+            correctLevel: QRCode.CorrectLevel.H,
+            logo: (function () {
+                // ?v=2：击穿曾被无 ACAO 响应污染的浏览器缓存条目；仅对 http(s) 绝对地址追加
+                var a = "{{.PageUser.Avatar}}" || "{{.DefaultAvatar}}";
+                return a ? (a.indexOf("http") === 0 ? a + "?v=2" : a) : undefined;
+            })(),
+            logoWidth: 60,
+            logoHeight: 60,
+            logoBackgroundTransparent: true,
+            // 直连 R2 等跨域图片须以 CORS 模式加载，canvas 才不被污染、可正常导出
+            crossOrigin: 'anonymous',
+            backgroundImage: ("{{.PageUser.BackgroundImage}}" ? "{{.PageUser.BackgroundImage}}" : undefined),
+            backgroundImageAlpha: parseFloat("{{.PageUser.Backgroundimagealpha}}") || 0.8,
+            autoColor: false,
+            PO: "{{.PageUser.Qrcodepdpcolor}}" || "#000000",
+            PI: "{{.PageUser.Qrcodepdpcolor}}" || "#000000",
+            AO: '',
+            AI: '',
+            timing: "{{.PageUser.Qrcodepdpcolor}}" || "#000000"
+        };
+        new QRCode(document.getElementById("boxqrimg"), options);
+    </script>
+ 
+    <p class="uk-text-center uk-text-small">扫码向@{{ .PageUser.Name }}提问<br>{{ if .RegisterOnlyAsk }}{{t .LangCode "ask.registerOnly"}}{{ else }}{{t .LangCode "ask.anonymous"}}{{ end }}</p>
+    {{ end }}
+    {{template "base/alert" .}}
+    {{template "question/new-question-template" .}}
+
+    <hr class="uk-divider-icon">
+    {{ if ne (len .PageQuestions) 0 }}
+    <p class="uk-text-left uk-text-muted uk-text-small">@{{ .PageUser.Name }} 以前回答过的问题 ({{ .AnsweredCount }})</p>
+    {{ template "question/history-template" . }}
+    {{ end }}
+  </div>
+</div>
+{{template "base/footer" .}}
\ No newline at end of file
diff --git a/.workbuddy/backup/domain-shiroko-20260906/footer.html b/.workbuddy/backup/domain-shiroko-20260906/footer.html
new file mode 100644
index 0000000..e6e0b60
--- /dev/null
+++ b/.workbuddy/backup/domain-shiroko-20260906/footer.html
@@ -0,0 +1,102 @@
+<p class="{{ if .IsPixel }}uk-container{{end}} uk-text-right uk-text-muted uk-text-small">
+  <br>Powered by NekoBox | {{ ICP }}<br>{{t .LangCode "site.footer.runtime"}}：<span id="box_runtime"></span>
+  <br>
+  <!--<a href="/pixel">画板</a> | -->
+  <a href="https://box.tama.guru/_/tamakyi" target="_blank">{{t .LangCode "site.footer.admin"}}</a>
+  | <a href="https://blog.tama.guru" target="_blank">{{t .LangCode "site.footer.notice"}}</a>
+  | <a href="https://chat.tama.guru" target="_blank">{{t .LangCode "site.footer.chat"}}</a>
+  | <a href="https://share.tama.guru" target="_blank">{{t .LangCode "site.footer.drive"}}</a>
+  | <a href="https://status.tama.guru" target="_blank">{{t .LangCode "site.footer.status"}}</a>
+  | <a href="https://tama.guru" target="_blank">{{t .LangCode "site.footer.nav"}}</a>
+</p>
+
+<script>
+// 页脚「提问箱已成功存活」倒计时：原 R2 cdn/time.box.js（1.6KB）内联于此，
+// 消除全站每页一个 R2 慢 defer（实测 0.7-1.7s 波动）。相对原脚本两处修复：
+// 1) 先判空再写入（原版先赋值后判空，box_runtime 缺失时会抛 ReferenceError 中断脚本）；
+// 2) 首帧立即填充（原版 DOMContentLoaded + 首个 1s 间隔后才显示，首秒为空）。
+(function () {
+  var create = Math.round(Date.UTC(2023, 6, 1, 18, 15, 43) / 1000); // 提问箱创建时刻(UTC)
+  function tick() {
+    var el = document.getElementById("box_runtime");
+    if (!el) return;
+    var s = Math.round((Date.now() + 8 * 3600 * 1000) / 1000) - create; // UTC+8 秒级存活
+    var t = [0, 0, 0, 0, 0];
+    if (s >= 31536000) { t[0] = s / 31536000 | 0; s %= 31536000; }
+    if (s >= 86400)    { t[1] = s / 86400    | 0; s %= 86400; }
+    if (s >= 3600)     { t[2] = s / 3600     | 0; s %= 3600; }
+    if (s >= 60)       { t[3] = s / 60       | 0; s %= 60; }
+    if (s > 0)         { t[4] = s; }
+    el.innerHTML = t[0] + '年 ' + t[1] + '天 ' + t[2] + '时 ' + t[3] + '分 ' + t[4] + '秒 ';
+  }
+  tick();
+  setInterval(tick, 1000);
+})();
+</script>
+<br>
+</div>
+
+<script>
+  // 提交反馈（P0）：点击任意表单的提交按钮后，立即把触发按钮变成「转圈 + 本地化文字」，
+  // 并禁用表单内全部按钮，物理阻止在上传/网络慢时的重复点击与重复提交。
+  // 浏览器前进/后退（bfcache）回到本页时自动复位，避免停留在禁用或转圈状态。
+  // 纯内联反馈，不使用全屏遮罩。
+  var SUBMIT_I18N = {
+    submitting: '{{t .LangCode "common.submitting"}}',
+    uploading:  '{{t .LangCode "common.uploading"}}'
+  };
+
+  function tbResetSubmitButtons() {
+    document.querySelectorAll('button[data-tb-submitting]').forEach(function(b) {
+      b.disabled = false;
+      b.removeAttribute('data-tb-submitting');
+      var orig = b.getAttribute('data-tb-restore');
+      if (orig !== null) {
+        b.innerHTML = orig;
+        b.removeAttribute('data-tb-restore');
+      }
+    });
+  }
+
+  document.addEventListener('submit', function(e) {
+    var form = e.target;
+    if (!form || form.tagName !== 'FORM') return;
+
+    // 页面级提交反馈必须尊重前置校验：投票编辑页等 onsubmit 返回 false 时，
+    // submit 事件仍可能继续到达此监听器；此时绝不能切换到“提交中”状态。
+    if (e.defaultPrevented || form.getAttribute('data-tb-skip-submit-feedback') === '1') {
+      form.removeAttribute('data-tb-skip-submit-feedback');
+      return;
+    }
+
+    // 下载 / 新窗口类表单（target="_blank"，如导出）：当前页不发生导航，也没有 bfcache
+    // 复位机会，进入“提交中”状态后按钮会永远卡在转圈 + 禁用。这类表单直接跳过提交反馈。
+    if (form.getAttribute('target') === '_blank') return;
+
+    // 触发提交的按钮（programmatic submit 时 e.submitter 为 null，回退到首个 submit 按钮）
+    var trigger = e.submitter || form.querySelector('button[type="submit"]');
+
+    // 表单含已选中的文件 → 提示“上传中”，否则“提交中”
+    var hasFile = false;
+    form.querySelectorAll('input[type="file"]').forEach(function(f) {
+      if (f.files && f.files.length > 0) hasFile = true;
+    });
+    var label = hasFile ? SUBMIT_I18N.uploading : SUBMIT_I18N.submitting;
+
+    if (trigger && trigger.tagName === 'BUTTON') {
+      trigger.setAttribute('data-tb-restore', trigger.innerHTML);
+      trigger.innerHTML = '<span uk-spinner="ratio: 0.6"></span> ' + label;
+    }
+
+    // 禁用表单内所有按钮，防止重复提交
+    form.querySelectorAll('button').forEach(function(b) {
+      b.disabled = true;
+      b.setAttribute('data-tb-submitting', '1');
+    });
+  });
+
+  // bfcache 还原时复位按钮
+  window.addEventListener('pageshow', tbResetSubmitButtons);
+</script>
+</body>
+</html>
diff --git a/.workbuddy/backup/domain-shiroko-20260906/header.html b/.workbuddy/backup/domain-shiroko-20260906/header.html
new file mode 100644
index 0000000..eb6c166
--- /dev/null
+++ b/.workbuddy/backup/domain-shiroko-20260906/header.html
@@ -0,0 +1,1029 @@
+<!DOCTYPE html>
+<html lang="{{.LangCode}}">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width">
+  <title>{{ .Title }}</title>
+  <meta name="msvalidate.01" content="2F185E8E63C93635F50B3574F3B31E42" />
+  <meta name="description" content="{{ if .MetaDescription }}{{ .MetaDescription }}{{ else }}{{ t .LangCode "site.description" }}{{ end }}">
+  <meta name="keywords" content="{{ t .LangCode "site.keywords" }}">
+  <!-- 预连接：UIkit 走公共 CDN（cdnjs.snrat.com），其余自托管库仍在本站 R2，均需预连接 -->
+  <link rel="preconnect" href="https://r2.337845818.best" crossorigin>
+  <link rel="preconnect" href="https://cdnjs.snrat.com" crossorigin>
+  <!-- UIkit 3.3.3 切到公共 CDN（cdnjs.snrat.com，国内实测全量下载 ~0.25s，原 R2 自建 ~1.4-2.0s） -->
+  <link rel="stylesheet" href="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/css/uikit.min.css"/>
+  <!-- Waline 评论区样式：非阻塞加载，不阻塞首屏渲染 -->
+  <link rel="stylesheet" href="https://r2.337845818.best/tamabox/cdn/waline/client/v2/waline-no-commits.css" media="print" onload="this.media='all'"/>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/js/uikit.min.js"></script>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/js/uikit-icons.min.js"></script>
+  <!-- UIkit 补丁：复刻原自建版 "modify-black-font"（官方版与自建版仅 3 处颜色差异——把有色容器内默认白字/白标题改为黑字）。
+       模板当前只用到 .uk-light 容器（用户背景封面，question/list.html、question-not-found.html；
+       其中 h3/p 已由 #usernamecolor/#introcolor 内联 style 覆盖），故只需补该容器的 3 处投影即可保持渲染一致。
+       若日后新增 .uk-card-primary/.uk-card-secondary/.uk-section-primary/.uk-tile-*/.uk-overlay-primary 等容器且需黑字，须同步扩展。 -->
+  <style>
+      .uk-light { color: rgba(0,0,0,.7); }
+      .uk-light .uk-h1, .uk-light .uk-h2, .uk-light .uk-h3, .uk-light .uk-h4, .uk-light .uk-h5, .uk-light .uk-h6,
+      .uk-light .uk-heading-2xlarge, .uk-light .uk-heading-large, .uk-light .uk-heading-medium, .uk-light .uk-heading-small, .uk-light .uk-heading-xlarge,
+      .uk-light h1, .uk-light h2, .uk-light h3, .uk-light h4, .uk-light h5, .uk-light h6 { color: #000; }
+      .uk-light .uk-table th { color: rgba(0,0,0,.7); }
+  </style>
+  <!-- dayjs/alpinejs/vconsole/waline.js 已迁 cdnjs.snrat.com（sha256 与官方一致，国内实测快 2-7x） -->
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/dayjs/1.10.8/dayjs.min.js"></script>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/alpinejs/3.9.0/cdn.min.js"></script>
+  {{ if .VConsole }}
+  <script src="https://cdnjs.snrat.com/ajax/libs/vConsole/3.12.1/vconsole.min.js" type="application/javascript"></script>
+  <script>new window.VConsole()</script>
+  {{ end }}
+  <!-- jQuery 已改为按需加载：仅 easy.qrcode 二维码页（list/question-not-found/profile）自行引入 -->
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/waline/2.15.8/waline.js"></script>
+  {{ if eq .CaptchaType "math" }}
+  <!-- 算数验证码：弹窗模式，不影响原布局 -->
+  <style>
+      .captcha-equation-box {
+          display: inline-flex;
+          align-items: center;
+          background: #f0f2f5;
+          border: 1px solid #dcdcdc;
+          border-radius: 8px;
+          padding: 8px 8px 8px 16px;
+          gap: 6px;
+          transition: border-color 0.2s;
+      }
+      .captcha-equation-box:focus-within {
+          border-color: #1e87f0;
+          box-shadow: 0 0 0 3px rgba(30,135,240,0.12);
+      }
+      .math-captcha-modal-question {
+          font-size: 1.4rem;
+          font-family: "Courier New", monospace;
+          font-weight: 700;
+          color: #333;
+          letter-spacing: 1px;
+          white-space: nowrap;
+      }
+      #captcha-modal-answer {
+          width: 80px;
+          padding: 6px 10px;
+          text-align: center;
+          font-size: 1.2rem;
+          font-family: "Courier New", monospace;
+          font-weight: 600;
+          border: 1px solid #ccc;
+          border-radius: 5px;
+          outline: none;
+          transition: border-color 0.15s, box-shadow 0.15s;
+          background: #fff;
+      }
+      #captcha-modal-answer:focus {
+          border-color: #1e87f0;
+          box-shadow: 0 0 0 2px rgba(30,135,240,0.2);
+      }
+      /* 隐藏数字输入框的上下箭头 */
+      #captcha-modal-answer::-webkit-inner-spin-button,
+      #captcha-modal-answer::-webkit-outer-spin-button {
+          -webkit-appearance: none;
+          margin: 0;
+      }
+      #captcha-modal-answer {
+          -moz-appearance: textfield;
+      }
+  </style>
+  {{ else if .RecaptchaTurnstileStyle }}
+  <script src="https://challenges.cloudflare.com/turnstile/v0/api.js?compat=recaptcha" async defer></script>
+  <script>
+      document.addEventListener('DOMContentLoaded', function () {
+          document.querySelectorAll('.g-recaptcha').forEach(item => {
+              item.disabled = true;
+          });
+      });
+
+      function onSubmit() {
+          document.querySelectorAll('.g-recaptcha').forEach(item => {
+              item.disabled = false;
+          })
+      }</script>
+  {{ else }}
+  <script src="{{.RecaptchaDomain}}/recaptcha/api.js" async defer></script>
+  <script>function onSubmit() {document.getElementById('form').submit();}</script>
+  {{ end }}
+  {{ if ne SentryDSN "" }}
+  <script
+          src="https://browser.sentry-cdn.com/7.37.2/bundle.tracing.replay.min.js"
+          integrity="sha384-o0mU2P+zsvXua0Y6f/J55PKWZt3sZCv3qDqJe6J5lZklyIQkpgjBVqNnPWYWqGhf"
+          crossorigin="anonymous"
+  ></script>
+  <script>
+      Sentry.init({
+          dsn: "{{ SentryDSN }}",
+          integrations: [new Sentry.BrowserTracing(), new Sentry.Replay()],
+          tracesSampleRate: 1.0,
+          replaysSessionSampleRate: 0.1,
+          replaysOnErrorSampleRate: 1.0,
+      });
+  </script>
+  {{ end }}
+  <style>
+      .grecaptcha-badge {visibility: hidden;}
+      .icon-container {
+         display: flex;
+         justify-content: center;
+         width: 100%;
+  }
+      .icon {
+         margin-left: 10px;
+         width: 20px; /* 设置图标的宽度 */
+         height: auto; /* 保持图标的高度自动调整 */
+      }
+      .emoji-placeholder {
+         display: inline-block;
+         animation: jump 0.5s ease-in-out;
+      }
+
+      @keyframes jump {
+         0%, 100% { transform: translateY(0); }
+         50% { transform: translateY(-5px); }
+      }
+     /* 防止 UIkit Dropbar 初始闪烁 */
+     .uk-dropbar {
+       opacity: 0;
+       visibility: hidden;
+       transition: opacity 0.2s ease, visibility 0.2s ease;
+     }
+     
+     .uk-dropbar.uk-open {
+       opacity: 1;
+       visibility: visible;
+     }
+     
+     a.uk-button.uk-button-link {
+       text-transform: none;
+     }
+
+     /* 移动端优化：缩小字体和间距，避免右侧空白 */
+     @media (max-width: 640px) {
+         .uk-logo {
+             font-size: 1rem;
+         }
+         .uk-navbar-nav a {
+             font-size: 0.78rem;
+             padding: 0 4px;
+         }
+         .emoji-placeholder {
+             font-size: 1rem;
+         }
+         /* 移动端用户名限宽省略，避免长英文用户名撑爆顶栏 */
+         .tb-nav-username {
+             max-width: 64px;
+             overflow: hidden;
+             text-overflow: ellipsis;
+             white-space: nowrap;
+             display: inline-block;
+             vertical-align: middle;
+         }
+     }
+  </style>
+
+  <!-- 深色模式：html[data-theme="dark"] 时覆盖 UIkit 3.3.3 编译主题的关键颜色 -->
+  <style>
+      html[data-theme="dark"] {
+          --tb-bg: #1a1d23;
+          --tb-surface: #242830;
+          --tb-surface-2: #2d323c;
+          --tb-border: #3a404c;
+          --tb-text: #d8dce4;
+          --tb-text-muted: #8b93a1;
+          --tb-primary: #5c8dff;
+      }
+      /* 根元素与 body 一起覆盖，确保整个视口（含内容不足一屏时的空白区）都是深色背景 */
+      html[data-theme="dark"],
+      html[data-theme="dark"] body {
+          background-color: var(--tb-bg) !important;
+          color: var(--tb-text) !important;
+      }
+      /* 通用表面容器 */
+      html[data-theme="dark"] .uk-card,
+      html[data-theme="dark"] .uk-card-default,
+      html[data-theme="dark"] .uk-card-secondary,
+      html[data-theme="dark"] .uk-dropbar,
+      html[data-theme="dark"] .uk-navbar-dropdown,
+      html[data-theme="dark"] .uk-modal-dialog,
+      html[data-theme="dark"] .uk-dropdown,
+      html[data-theme="dark"] .uk-offcanvas-bar,
+      html[data-theme="dark"] .uk-section,
+      html[data-theme="dark"] .uk-tile,
+      html[data-theme="dark"] .uk-panel,
+      html[data-theme="dark"] .uk-background-default,
+      html[data-theme="dark"] .uk-search-default .uk-search-input {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-navbar-container {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-navbar-nav > li > a,
+      html[data-theme="dark"] .uk-card a,
+      html[data-theme="dark"] .uk-link,
+      html[data-theme="dark"] a.uk-button-link,
+      html[data-theme="dark"] .uk-navbar-dropdown-nav > li > a,
+      html[data-theme="dark"] .uk-dropdown-nav > li > a,
+      html[data-theme="dark"] .uk-list a {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-navbar-nav > li > a:hover,
+      html[data-theme="dark"] .uk-card a:hover,
+      html[data-theme="dark"] .uk-navbar-dropdown-nav > li > a:hover,
+      html[data-theme="dark"] .uk-dropdown-nav > li > a:hover {
+          color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .uk-input,
+      html[data-theme="dark"] .uk-textarea,
+      html[data-theme="dark"] .uk-select {
+          background-color: var(--tb-surface-2) !important;
+          color: var(--tb-text) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] .uk-input:focus,
+      html[data-theme="dark"] .uk-textarea:focus,
+      html[data-theme="dark"] .uk-select:focus {
+          border-color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .uk-text-muted,
+      html[data-theme="dark"] .uk-text-meta,
+      html[data-theme="dark"] .uk-text-secondary,
+      html[data-theme="dark"] .uk-text-muted a,
+      html[data-theme="dark"] .uk-text-small.uk-text-muted {
+          color: var(--tb-text-muted) !important;
+      }
+      html[data-theme="dark"] .uk-divider-icon::after,
+      html[data-theme="dark"] hr,
+      html[data-theme="dark"] .uk-table th,
+      html[data-theme="dark"] .uk-table td,
+      html[data-theme="dark"] .uk-list-divider > li:nth-child(n+2) {
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] .uk-button-default {
+          background-color: var(--tb-surface-2) !important;
+          color: var(--tb-text) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] .uk-modal-title,
+      html[data-theme="dark"] h1, html[data-theme="dark"] h2, html[data-theme="dark"] h3,
+      html[data-theme="dark"] h4, html[data-theme="dark"] h5, html[data-theme="dark"] h6,
+      html[data-theme="dark"] .uk-card-title {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-alert-warning,
+      html[data-theme="dark"] .uk-alert-danger,
+      html[data-theme="dark"] .uk-alert-success,
+      html[data-theme="dark"] .uk-alert-primary {
+          background-color: var(--tb-surface-2) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .uk-modal-dialog {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .captcha-equation-box {
+          background-color: var(--tb-surface-2) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .math-captcha-modal-question {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-answer {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-answer::placeholder {
+          color: var(--tb-text-muted) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .uk-text-meta,
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-refresh {
+          color: var(--tb-text-muted) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-refresh:hover {
+          color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .uk-label {
+          color: #fff !important;
+      }
+      /* 自定义组件（探索页推荐卡片等）深色覆盖 */
+      html[data-theme="dark"] .recommend-card,
+      html[data-theme="dark"] .recommend-card:hover {
+          background-color: var(--tb-surface-2) !important;
+      }
+      html[data-theme="dark"] .explore-name a {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .explore-name a:hover {
+          color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .explore-intro {
+          color: var(--tb-text-muted) !important;
+      }
+      /* 切换按钮图标切换 */
+      #theme-toggle .tb-icon-dark, #theme-toggle-mobile .tb-icon-dark { display: none; }
+      html[data-theme="dark"] #theme-toggle .tb-icon-light,
+      html[data-theme="dark"] #theme-toggle-mobile .tb-icon-light { display: none; }
+      html[data-theme="dark"] #theme-toggle .tb-icon-dark,
+      html[data-theme="dark"] #theme-toggle-mobile .tb-icon-dark { display: inline; }
+  </style>
+
+  <!-- 顶栏自适应：导航全部直接显示，窄屏时分级缩小字号/间距，保证英文/日文等长文字不溢出 -->
+  <style>
+      .uk-navbar-nav a {
+          font-size: 0.95rem;
+          padding: 0 10px;
+      }
+      /* 未登录移动端占位：桌面端隐藏，仅 ≤640px 显示（见下方 media 查询）。
+         桌面端布局与改动前完全一致，不受影响。 */
+      .tb-mobile-balancer { display: none; }
+      /* 桌面端保持 UIkit 原生居中三列布局（无需额外 CSS） */
+      .tb-navbar .uk-logo {
+          white-space: nowrap;
+      }
+      @media (max-width: 1200px) {
+          .uk-navbar-nav a {
+              font-size: 0.88rem;
+              padding: 0 8px;
+          }
+      }
+      @media (max-width: 1000px) {
+          .uk-navbar-nav a {
+              font-size: 0.82rem;
+              padding: 0 6px;
+          }
+          .uk-logo {
+              font-size: 1.1rem;
+          }
+          /* 登录用户名限宽，过长省略号截断 */
+          .tb-nav-username {
+              max-width: 110px;
+              overflow: hidden;
+              text-overflow: ellipsis;
+              white-space: nowrap;
+              display: inline-block;
+              vertical-align: middle;
+          }
+      }
+      @media (max-width: 800px) {
+          .uk-navbar-nav a {
+              font-size: 0.78rem;
+              padding: 0 4px;
+          }
+          .uk-logo {
+              font-size: 1rem;
+          }
+          .tb-nav-username {
+              max-width: 80px;
+          }
+      }
+      /* 手机端（≤640px）：沿用 UIkit 桌面端 navbar 的原生三列定位。
+         不再重写 .uk-navbar-center / center-left / center-right 的定位，
+         避免 logo 被挤到下一行；底部语言与深色模式按钮仍由下方独立栏承载。 */
+      @media (max-width: 640px) {
+          .tb-navbar {
+              position: relative;
+              min-height: 56px;
+              overflow: visible;
+          }
+          .tb-navbar > .uk-navbar-center {
+              position: relative !important;
+              top: auto !important;
+              left: auto !important;
+              right: auto !important;
+              bottom: auto !important;
+              transform: none !important;
+              display: flex !important;
+              align-items: center;
+              justify-content: center;
+              width: 100%;
+              min-height: 56px;
+              white-space: nowrap;
+              flex-wrap: nowrap;
+          }
+          .tb-navbar .uk-navbar-center-left,
+          .tb-navbar .uk-navbar-center-right {
+              position: static !important;
+              top: auto !important;
+              left: auto !important;
+              right: auto !important;
+              bottom: auto !important;
+              transform: none !important;
+              display: flex !important;
+              align-items: center;
+              flex: 0 0 auto;
+              white-space: nowrap;
+          }
+          .tb-navbar .uk-navbar-center-left > div,
+          .tb-navbar .uk-navbar-center-right > div {
+              display: flex;
+              align-items: center;
+              white-space: nowrap;
+          }
+          .tb-navbar .uk-navbar-nav {
+              display: flex;
+              flex-wrap: nowrap;
+              flex: 0 0 auto;
+          }
+          .tb-navbar .uk-navbar-nav > li > a,
+          .tb-navbar .uk-logo {
+              white-space: nowrap;
+          }
+          /* 未登录：移动端显示与「我的」等宽的隐藏占位，使左栏「探索+占位」与
+             右栏「注册/登录」两项等宽，logo 真正居中，左右视觉平衡 */
+          .tb-mobile-balancer { display: block; }
+      }
+  </style>
+
+  <!-- 标签样式的按钮（管理页置顶等）：
+       尺寸完全继承 .uk-label（font-size/padding/line-height/text-transform 等），
+       仅覆盖 button 元素特有的默认样式（边框/字体族/光标等），保证与相邻 span 标签完全一致。 -->
+  <style>
+      .tb-label-btn {
+          border: none !important;
+          cursor: pointer;
+          font-family: inherit;
+          margin: 0;
+          vertical-align: middle;
+          outline: none;
+          background-image: none;
+          box-sizing: border-box;
+          -webkit-appearance: none;
+          appearance: none;
+      }
+      .tb-label-btn:hover {
+          opacity: 0.85;
+      }
+      /* 公开页置顶小图标：仅一个图钉，不占行高、不影响原布局 */
+      .tb-pin-flag {
+          font-size: 0.9em;
+          margin-right: 4px;
+          vertical-align: -1px;
+          cursor: default;
+      }
+  </style>
+
+  <!-- Markdown 渲染排版（问题/回答/追问正文，左对齐以保留排版格式） -->
+  <style>
+      /* 纯文本列表：保留换行与连续空格（pre-wrap），不渲染 Markdown 大字号/彩色 */
+      .tb-preline {
+          white-space: pre-wrap;
+      }
+      /* 纯文本列表：超过 5 行截断并显示省略号（不足 5 行则完整显示） */
+      .tb-clamp-5 {
+          display: -webkit-box;
+          -webkit-box-orient: vertical;
+          -webkit-line-clamp: 5;
+          overflow: hidden;
+      }
+      .md-body {
+          line-height: 1.7;
+          text-align: left;
+          word-break: break-word;
+      }
+      .md-body p { margin: 0.5em 0; }
+      .md-body h1, .md-body h2, .md-body h3,
+      .md-body h4, .md-body h5, .md-body h6 {
+          margin: 0.8em 0 0.4em;
+          font-weight: 600;
+          line-height: 1.4;
+      }
+      .md-body ul, .md-body ol { padding-left: 1.6em; margin: 0.5em 0; }
+      .md-body li { margin: 0.2em 0; }
+      .md-body blockquote {
+          border-left: 3px solid #d3d1c7;
+          margin: 0.6em 0;
+          padding: 0.2em 1em;
+          color: #5f5e5a;
+      }
+      .md-body pre {
+          background: #f5f5f5;
+          padding: 0.8em 1em;
+          border-radius: 6px;
+          overflow-x: auto;
+          margin: 0.6em 0;
+      }
+      .md-body code {
+          background: #f0f0f0;
+          padding: 0.1em 0.35em;
+          border-radius: 4px;
+          font-size: 0.9em;
+      }
+      .md-body pre code { background: none; padding: 0; }
+      .md-body img { max-width: 100%; height: auto; }
+      .md-body table { border-collapse: collapse; margin: 0.6em 0; }
+      .md-body th, .md-body td {
+          border: 1px solid #ddd;
+          padding: 0.4em 0.8em;
+      }
+      .md-body hr { margin: 1em 0; }
+      html[data-theme="dark"] .md-body blockquote {
+          border-color: #3a404c;
+          color: #8b93a1;
+      }
+      html[data-theme="dark"] .md-body pre,
+      html[data-theme="dark"] .md-body code { background: #2d323c; }
+      html[data-theme="dark"] .md-body th,
+      html[data-theme="dark"] .md-body td { border-color: #3a404c; }
+  </style>
+
+  <!-- 投票结果占比条：UIkit 3 已无 .uk-progressbar 类（那是 UIkit 2 的），
+       模板用 <div class="uk-progress"><div class="uk-progressbar"> 结构，需补一套填充样式，
+       否则内层填充无高度/背景，所有占比条都只剩外层灰色轨道，看起来一模一样。 -->
+  <style>
+      .uk-progress {
+          -webkit-appearance: none;
+          -moz-appearance: none;
+          appearance: none;
+          height: 10px;
+          margin: 0;
+          border: none;
+          border-radius: 6px;
+          background-color: #e5e5e5;
+          overflow: hidden;
+          box-shadow: none;
+      }
+      .uk-progressbar {
+          display: block;
+          height: 100%;
+          background-color: #1e87f0;
+          border-radius: 6px 0 0 6px;
+          transition: width 0.3s ease;
+      }
+      html[data-theme="dark"] .uk-progress {
+          background-color: var(--tb-border);
+      }
+      html[data-theme="dark"] .uk-progressbar {
+          background-color: var(--tb-primary);
+      }
+  </style>
+
+  <!-- 移动端底部操作栏：固定底栏承载语言切换与深色模式，桌面端隐藏 -->
+  <style>
+      #tb-mobile-utils {
+          display: none;
+      }
+      @media (max-width: 640px) {
+          /* 顶栏不再容纳语言/深色按钮，恢复原有导航空间 */
+          .tb-nav-utils {
+              display: none !important;
+          }
+          /* 手机端隐藏登录用户名（左边仅保留"探索"），保证 logo 居中、
+             两侧各不超过 2 个短按钮，避免用户名宽度挤压布局 */
+          .tb-nav-username {
+              display: none !important;
+          }
+          /* 固定底部操作栏 */
+          #tb-mobile-utils {
+              display: flex;
+              position: fixed;
+              left: 0;
+              right: 0;
+              bottom: 0;
+              z-index: 1000;
+              justify-content: center;
+              align-items: center;
+              gap: 10px;
+              padding: 8px 12px calc(8px + env(safe-area-inset-bottom));
+              background: rgba(255, 255, 255, 0.92);
+              -webkit-backdrop-filter: blur(8px);
+              backdrop-filter: blur(8px);
+              box-shadow: 0 -2px 12px rgba(0, 0, 0, 0.08);
+          }
+          #tb-mobile-utils .uk-select {
+              width: 110px;
+          }
+          html[data-theme="dark"] #tb-mobile-utils {
+              background: rgba(36, 40, 48, 0.92);
+              box-shadow: 0 -2px 12px rgba(0, 0, 0, 0.4);
+          }
+          /* 给页面底部预留空间，避免页脚内容被固定底栏遮挡 */
+          body {
+              padding-bottom: 56px;
+          }
+      }
+  </style>
+
+<!-- Commit 6d0a3ad -->
+  <meta property="og:site_name" content="{{ t .LangCode "site.title" }}" />
+  <meta property="og:type" content="website" />
+  <meta property="og:title" content="{{ if .IsUserPage }}{{ .PageUser.Name }} - {{ t .LangCode "site.title" }}{{ else }}{{ t .LangCode "site.title" }}{{ end }}" />
+  <meta property="og:url" content="{{ .ExternalURL }}{{ .CurrentURI }}" />
+  <meta property="og:description" content="{{ if .IsUserPage }}{{ .PageUser.Name }} - {{ t .LangCode "site.description" }}{{ else }}{{ t .LangCode "site.description" }}{{ end }}" />
+  {{ if .NoIndex }}<meta name="robots" content="noindex">{{ end }}
+  {{ if .IsUserPage }}
+   <meta property="og:image" content="{{ .PageUser.Avatar }}?og-image=1" />
+   <meta property="og:image:alt" content="{{ .PageUser.Name }}" />
+   <meta itemprop="image" content="{{ .PageUser.Avatar }}?og-image=1"/>
+   <meta name="msapplication-TileImage" content="{{ .PageUser.Avatar }}"/>
+   <link rel="shortcut icon" href="{{ .PageUser.Avatar }}?og-image=1"/>
+   <link rel="apple-touch-icon" href="{{ .PageUser.Avatar }}?og-image=1"/>
+   <link rel="icon" sizes="192x192" href="{{ .PageUser.Avatar }}?og-image=1">
+   <meta name="twitter:image:src" content="{{ .PageUser.Avatar }}?og-image=1" />
+   {{ else }}
+  <meta itemprop="image" content="https://r2.337845818.best/tamabox/tamabox_low.png"/>
+  <meta name="msapplication-TileImage" content="https://r2.337845818.best/tamabox/tamabox_low.png"/>
+  <link rel="shortcut icon" href="https://r2.337845818.best/tamabox/tamabox_low.png" />
+  <link rel="apple-touch-icon" href="https://r2.337845818.best/tamabox/tamabox_low.png"/>
+  <link rel="icon" sizes="192x192" href="https://r2.337845818.best/tamabox/tamabox_low.png">
+  <meta name="twitter:image:src" content="https://r2.337845818.best/tamabox/tamabox_low.png" />
+   {{ end }}
+
+<!-- Google and Bing -->
+  <meta name="google-site-verification" content="fEPwRRJfiGsgwc5SINBQwZhPK8F0cwRaOvRx0YRurI4" />
+  <meta name="msvalidate.01" content="2F185E8E63C93635F50B3574F3B31E42" />
+  <!-- 站点统计（umami）：非关键资源，window load 后再动态注入，避免 mami.tama.guru
+       （Vercel 托管、无国内节点）在高峰/冷访问时阻塞 DOMContentLoaded 与 load -->
+  <script>
+      window.addEventListener("load", function () {
+          var s = document.createElement("script");
+          s.src = "https://mami.shiroko.one/tamami.js";
+          s.setAttribute("data-website-id", "c42ebe8b-9281-4da0-83a4-8f18b3e710fe");
+          document.body.appendChild(s);
+      });
+  </script>
+</head>
+<body>
+<script>
+// 二维码降级渲染（P0-②）：easy.qrcode 的 logo（用户头像）/ 背景图加载失败或极慢时，
+// 库内部仅 console.error 且无降级 → 二维码区域会永久空白。
+// 策略：未知状态的远程图先不画（基础码立即可扫）→ 后台探针（Image 预载）→
+//       判定完成后再重绘带 logo/背景的升级版；失败则保持基础码，绝不空白。
+// 同会话记忆：探针结果按 URL 记忆（good/bad），编辑页拖动滑块高频重绘时零等待、不闪降级。
+// 使用：window.tbRenderQR(el, function(){ return options; })  // options 含完整 logo/backgroundImage
+window.tbRenderQR = function (el, getOptions) {
+  if (!el || typeof QRCode === 'undefined') return;
+  var opts = getOptions();
+  function remoteOf(o, key) {
+    var v = o[key];
+    return (typeof v === 'string' && v.indexOf('http') === 0) ? v : '';
+  }
+  var good = window._tbQrGood || (window._tbQrGood = {}); // URL -> true（可 CORS 加载）
+  var bad = window._tbQrBad || (window._tbQrBad = {});    // URL -> true（加载失败）
+  // 每层状态：''=无需, 1=已知可用, 0=已知失败, null=未知需探针
+  function layerState(url) { return !url ? '' : (good[url] ? 1 : (bad[url] ? 0 : null)); }
+  var layers = [
+    { url: remoteOf(opts, 'logo'), st: null, present: function (o, on) {
+        if (on) { /* 保留 */ } else { o.logo = undefined; o.logoWidth = undefined; o.logoHeight = undefined; o.logoBackgroundTransparent = undefined; }
+      } },
+    { url: remoteOf(opts, 'backgroundImage'), st: null, present: function (o, on) {
+        if (on) { /* 保留 */ } else { o.backgroundImage = undefined; o.backgroundImageAlpha = undefined; }
+      } }
+  ];
+  var needProbe = false;
+  for (var i = 0; i < layers.length; i++) {
+    layers[i].st = layerState(layers[i].url);
+    if (layers[i].st === null) needProbe = true;
+  }
+  function paint(states) {
+    var o = {};
+    for (var k in opts) o[k] = opts[k];
+    for (var j = 0; j < layers.length; j++) layers[j].present(o, states[j] === 1);
+    el.innerHTML = '';
+    new QRCode(el, o);
+  }
+  // 已知可用层立即带上；未知层先省略 → 立即绘制（logo 记忆命中时不会闪降级）
+  var initStates = [];
+  for (var n = 0; n < layers.length; n++) initStates.push(layers[n].st === 1 ? 1 : 0);
+  paint(initStates);
+  if (!needProbe) return;
+  // 后台探针未知层；全部判定后若有变化再重绘一次升级版
+  var pending = 0, cross = opts.crossOrigin || 'anonymous';
+  layers.forEach(function (L) {
+    if (L.st !== null) return;
+    pending++;
+    var im = new Image();
+    im.onload = function () { good[L.url] = true; L.st = 1; onDone(); };
+    im.onerror = function () { bad[L.url] = true; L.st = 0; onDone(); };
+    if (cross) im.crossOrigin = cross;
+    im.src = L.url;
+  });
+  function onDone() {
+    if (--pending > 0) return;
+    var finalStates = [];
+    for (var m = 0; m < layers.length; m++) finalStates.push(layers[m].st === 1 ? 1 : 0);
+    var changed = false;
+    for (var q = 0; q < finalStates.length; q++) if (finalStates[q] !== initStates[q]) changed = true;
+    if (changed) paint(finalStates);
+  }
+  // 超时保险：个别挂起连接永不回调时，3s 后按当前已知状态收尾（基础码早已可扫）
+  setTimeout(function () { if (pending > 0) { pending = 0; onDone(); } }, 3000);
+};
+</script>
+<nav class="uk-navbar-container uk-margin tb-navbar" uk-navbar>
+  <div class="uk-navbar-center">
+    <div class="uk-navbar-center-left">
+      <div>
+        <ul class="uk-navbar-nav">
+          <!-- 探索链接，始终显示 -->
+          <li><a href="/explore">{{t .LangCode "nav.explore"}}</a></li>
+          {{ if .IsLogged }}
+          <!-- 我的：进入自己的提问箱主页（与右侧「提问/设置」形成左右均衡） -->
+          <li><a href="/_/{{ .LoggedUser.Domain }}">{{t .LangCode "nav.mine"}}</a></li>
+          {{ else }}
+          <!-- 移动端占位：未登录时左栏仅「探索」一项，与右栏「注册/登录」两项不等宽，
+               导致 logo 整体被拉向左（偏左）。移动端(≤640px)显示一个与「我的」等宽的隐藏占位，
+               使左右视觉平衡；桌面端由 .tb-mobile-balancer 隐藏，保持原布局完全不变。 -->
+          <li class="tb-mobile-balancer" aria-hidden="true"><a tabindex="-1" style="visibility:hidden">{{t .LangCode "nav.mine"}}</a></li>
+          {{ end }}
+        </ul>
+      </div>
+    </div>
+
+    <a class="uk-navbar-item uk-logo" href="/"><span class="emoji-placeholder" aria-label="random animal">🐺</span>{{t .LangCode "site.logoSuffix"}}</a>
+
+    <div class="uk-navbar-center-right">
+      <div>
+        {{ if .IsLogged }}
+        <ul class="uk-navbar-nav">
+          <li><a href="/user/questions">{{t .LangCode "nav.ask"}}</a></li>
+        </ul>
+        <ul class="uk-navbar-nav">
+          <li><a href="/user/profile">{{t .LangCode "nav.settings"}}</a></li>
+        </ul>
+        {{ else}}
+        <ul class="uk-navbar-nav">
+          <li><a href="/register">{{t .LangCode "nav.register"}}</a></li>
+        </ul>
+        <ul class="uk-navbar-nav">
+          <li><a href="/login">{{t .LangCode "nav.login"}}</a></li>
+        </ul>
+        {{ end }}
+        {{ if not .IsUserPage }}
+        <!-- 语言切换（紧凑图标，点击展开；移动端隐藏，见底部操作栏） -->
+        <ul class="uk-navbar-nav tb-nav-utils">
+          <li>
+            <a href="#" aria-label="{{t .LangCode "common.lang"}}" title="{{t .LangCode "common.lang"}}">🌐</a>
+            <div class="uk-navbar-dropdown" uk-drop="mode: click; pos: bottom-right">
+              <ul class="uk-nav uk-navbar-dropdown-nav">
+                {{ range .SupportedLangs }}
+                <li class="{{ if eq .Code $.LangCode }}uk-active{{ end }}">
+                  <a href="/i18n/{{ .Code }}?to={{ urlquery $.CurrentURI }}">{{ .Name }}</a>
+                </li>
+                {{ end }}
+              </ul>
+            </div>
+          </li>
+        </ul>
+        {{ end }}
+        <!-- 深色模式切换（紧凑图标；移动端隐藏，见底部操作栏） -->
+        <ul class="uk-navbar-nav tb-nav-utils">
+          <li>
+            <a href="#" id="theme-toggle" title="{{t .LangCode "common.theme"}}" aria-label="{{t .LangCode "common.theme"}}">
+              <span class="tb-icon-light">🌙</span><span class="tb-icon-dark">☀️</span>
+            </a>
+          </li>
+        </ul>
+      </div>
+    </div>
+  </div>
+</nav>
+
+<script>
+document.addEventListener("DOMContentLoaded", function() {
+    const emojis = ["🐺","🐗","🐻","🐨","🐼","🐹","🐭","🐰","🦊","🐮","🐷","🐽","🐸","🐒","🦍","🐔","🐧","🐦","🐤","🐦‍⬛","🦅","🦉","🦇","🐴","🦄","🐝","🦎","🦖","🦕","🐙","🦑","🦐","🦞","🦀","🐡","🐠","🐟","🐬","🐳","🐋","🦈","🐊","🐅","🐆","🦓","🦍","🦧","🐘","🦛","🦏","🐪","🐫","🦒","🦘","🐃","🐂","🐄","🐎","🐖","🐏","🐑","🦙","🐐","🦌","🐕","🐩","🦮","🐕‍🦺","🐈","🐋","🐳","🐬","🐉","🐲"];
+    const placeholder = document.querySelector('.emoji-placeholder');
+    if (placeholder) {
+        placeholder.textContent = emojis[Math.floor(Math.random() * emojis.length)];
+    }
+});
+</script>
+
+<!-- 移动端固定底部操作栏：语言切换 + 深色模式（桌面端隐藏） -->
+<div id="tb-mobile-utils">
+  {{ if not .IsUserPage }}
+  <select id="mobile-lang-select" class="uk-select uk-form-small" aria-label="{{t .LangCode "common.lang"}}">
+    {{ range .SupportedLangs }}
+    <option value="{{ .Code }}" {{ if eq .Code $.LangCode }}selected{{ end }}>{{ .Name }}</option>
+    {{ end }}
+  </select>
+  {{ end }}
+  <button type="button" id="theme-toggle-mobile" class="uk-button uk-button-default uk-button-small"
+          title="{{t .LangCode "common.theme"}}" aria-label="{{t .LangCode "common.theme"}}">
+    <span class="tb-icon-light">🌙</span><span class="tb-icon-dark">☀️</span>
+  </button>
+</div>
+
+<script>
+(function() {
+    // 深色模式：读取 cookie 应用主题，按钮切换并持久化
+    var THEME_COOKIE = 'theme';
+    function getTheme() {
+        var m = document.cookie.match(/(?:^|;\s*)theme=([^;]*)/);
+        return m ? m[1] : '';
+    }
+    function applyTheme(theme) {
+        if (theme === 'dark') {
+            document.documentElement.setAttribute('data-theme', 'dark');
+        } else {
+            document.documentElement.removeAttribute('data-theme');
+        }
+    }
+    function toggleTheme() {
+        var next = getTheme() === 'dark' ? 'light' : 'dark';
+        applyTheme(next);
+        var expires = new Date(Date.now() + 365 * 24 * 3600 * 1000).toUTCString();
+        document.cookie = THEME_COOKIE + '=' + next + '; path=/; max-age=' + (365 * 24 * 3600) + '; SameSite=Lax';
+    }
+    // 首屏前应用，避免闪烁
+    applyTheme(getTheme());
+    document.addEventListener('DOMContentLoaded', function() {
+        // 桌面顶栏按钮与移动端底部按钮都绑定
+        var buttons = document.querySelectorAll('#theme-toggle, #theme-toggle-mobile');
+        buttons.forEach(function(btn) {
+            btn.addEventListener('click', function(e) {
+                e.preventDefault();
+                toggleTheme();
+            });
+        });
+
+        // 移动端底部语言切换：onchange 跳转到 /i18n/{code}，保留当前页面位置
+        var langSel = document.getElementById('mobile-lang-select');
+        if (langSel) {
+            langSel.addEventListener('change', function() {
+                if (!this.value) return;
+                var to = window.location.pathname + window.location.search;
+                window.location.href = '/i18n/' + encodeURIComponent(this.value) + '?to=' + encodeURIComponent(to);
+            });
+        }
+    });
+})();
+</script>
+
+{{ if .IsPixel }}
+<div>
+{{ else }}
+<div class="uk-container uk-container-xsmall">
+{{ end }}
+
+{{ if eq .CaptchaType "math" }}
+<!-- 算数验证码弹窗 --><div id="math-captcha-modal" uk-modal>
+  <div class="uk-modal-dialog uk-modal-body uk-text-center">
+    <h3 class="uk-modal-title">{{t .LangCode "captcha.title"}}</h3>
+    <p class="uk-text-meta">{{t .LangCode "captcha.hint"}}</p>
+    <div class="captcha-equation-box">
+      <span id="captcha-modal-question" class="math-captcha-modal-question">{{t .LangCode "captcha.loading"}}</span>
+      <input type="number" id="captcha-modal-answer" placeholder="?" autocomplete="off" inputmode="numeric">
+    </div>
+    <div style="margin-top:6px;">
+      <button type="button" class="uk-button uk-button-text uk-text-small" id="captcha-modal-refresh">{{t .LangCode "captcha.refresh"}}</button>
+    </div>
+    <div id="captcha-modal-error" class="uk-text-danger uk-text-small" style="display:none;min-height:20px;"></div>
+    <div class="uk-margin-small-top">
+      <button type="button" class="uk-button uk-button-primary" id="captcha-modal-submit">{{t .LangCode "captcha.submit"}}</button>
+      <button type="button" class="uk-button uk-button-default uk-modal-close">{{t .LangCode "common.cancel"}}</button>
+    </div>
+  </div>
+</div>
+
+<script>
+var CAPTCHA_I18N = {
+  loading: "{{t .LangCode "captcha.loading"}}",
+  loadFailed: "{{t .LangCode "captcha.loadFailed"}}",
+  loadRetry: "{{t .LangCode "captcha.loadRetry"}}",
+  inputAnswer: "{{t .LangCode "captcha.inputAnswer"}}",
+  wrongAnswer: "{{t .LangCode "captcha.wrongAnswer"}}",
+  verifyFailed: "{{t .LangCode "captcha.verifyFailed"}}",
+  needPassword: "{{t .LangCode "ask.needPassword"}}",
+  needEmail: "{{t .LangCode "ask.pleaseEmail"}}"
+};
+</script>
+
+<script>
+(function() {
+  var captchaId = '';
+  var pendingForm = null;
+  var pendingNeedPassword = false;
+  var verifying = false;
+
+  function fetchCaptcha() {
+    var qEl = document.getElementById('captcha-modal-question');
+    var errEl = document.getElementById('captcha-modal-error');
+    var ansEl = document.getElementById('captcha-modal-answer');
+    qEl.textContent = CAPTCHA_I18N.loading;
+    fetch('/api/captcha/generate')
+      .then(function(r) { return r.json(); })
+      .then(function(data) {
+        if (data.code === 0 && data.data) {
+          captchaId = data.data.id;
+          qEl.textContent = data.data.question;
+          if (errEl) errEl.style.display = 'none';
+          if (ansEl) { ansEl.value = ''; ansEl.focus(); }
+        } else {
+          qEl.textContent = CAPTCHA_I18N.loadFailed;
+        }
+      })
+      .catch(function() {
+        qEl.textContent = CAPTCHA_I18N.loadRetry;
+      });
+  }
+
+  function getCSRFToken() {
+    var input = document.querySelector('input[name="_csrf"]');
+    return input ? input.value : '';
+  }
+
+  function doSubmit(form) {
+    // 将 captcha 答案填入隐藏字段
+    var ans = document.getElementById('captcha-modal-answer').value.trim();
+    var hidden = form.querySelector('[name="g-recaptcha-response"]');
+    if (hidden) hidden.value = captchaId + ':' + (ans || '0');
+
+    UIkit.modal('#math-captcha-modal').hide();
+
+    // 处理 AskPassword（提问箱密码）
+    if (pendingNeedPassword) {
+      UIkit.modal.prompt(CAPTCHA_I18N.needPassword, '', 'password')
+        .then(function(password) {
+          if (password) {
+            var pwInput = document.getElementById('ask_password_input');
+            if (pwInput) pwInput.value = password;
+            form.submit();
+          }
+        });
+    } else {
+      form.submit();
+    }
+  }
+
+  // 验证按钮
+  document.getElementById('captcha-modal-submit').addEventListener('click', function() {
+    if (verifying) return;
+    var ans = document.getElementById('captcha-modal-answer').value.trim();
+    if (!ans) {
+      var errEl = document.getElementById('captcha-modal-error');
+      errEl.textContent = CAPTCHA_I18N.inputAnswer;
+      errEl.style.display = 'block';
+      return;
+    }
+    verifying = true;
+    fetch('/api/captcha/verify', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'X-CSRF-Token': getCSRFToken()
+      },
+      body: JSON.stringify({ id: captchaId, answer: parseInt(ans, 10) })
+    })
+    .then(function(r) { return r.json(); })
+    .then(function(data) {
+      verifying = false;
+      if (data.correct) {
+        if (pendingForm) doSubmit(pendingForm);
+      } else {
+        var errEl = document.getElementById('captcha-modal-error');
+        errEl.textContent = CAPTCHA_I18N.wrongAnswer;
+        errEl.style.display = 'block';
+        fetchCaptcha(); // 自动刷新题目
+      }
+    })
+    .catch(function() {
+      verifying = false;
+      var errEl = document.getElementById('captcha-modal-error');
+      errEl.textContent = CAPTCHA_I18N.verifyFailed;
+      errEl.style.display = 'block';
+      fetchCaptcha();
+    });
+  });
+
+  // 回车提交
+  document.getElementById('captcha-modal-answer').addEventListener('keydown', function(e) {
+    if (e.key === 'Enter') {
+      e.preventDefault();
+      document.getElementById('captcha-modal-submit').click();
+    }
+  });
+
+  // 刷新按钮
+  document.getElementById('captcha-modal-refresh').addEventListener('click', fetchCaptcha);
+
+  // 拦截所有带 class="math-captcha-trigger" 的按钮
+  document.addEventListener('click', function(e) {
+    var btn = e.target.closest('.math-captcha-trigger');
+    if (!btn) return;
+    e.preventDefault();
+
+    var form = btn.closest('form');
+    if (!form) return;
+    pendingForm = form;
+
+    // 检查是否需要提问密码
+    pendingNeedPassword = !!(form.querySelector('#ask_password_input'));
+
+    // 邮箱校验（提问页面）
+    var notifyCb = document.getElementById('notify-checkbox');
+    var emailInput = document.getElementById('email-input');
+    if (notifyCb && notifyCb.checked && emailInput && emailInput.value.trim() === '') {
+      UIkit.modal.alert(CAPTCHA_I18N.needEmail);
+      return;
+    }
+
+    fetchCaptcha();
+    UIkit.modal('#math-captcha-modal').show();
+  });
+})();
+</script>
+{{ end }}
\ No newline at end of file
diff --git a/.workbuddy/backup/domain-shiroko-20260906/home.html b/.workbuddy/backup/domain-shiroko-20260906/home.html
new file mode 100644
index 0000000..63c52a8
--- /dev/null
+++ b/.workbuddy/backup/domain-shiroko-20260906/home.html
@@ -0,0 +1,122 @@
+{{template "base/header" .}}
+<div class="uk-card uk-card-default uk-card-body">
+  <h1 class="uk-heading-small">{{t .LangCode "site.title"}}</h1>
+  <p><br>⭐一个无需注册即可提问的匿名提问箱。你不需要下载App，不需要绑定社交账号，甚至连邮箱都不需要是真的。<br>⭐本站在原版的基础上新增了问题页面的二维码、私聊、投票、追加提问等功能以及更多自定义内容。各位用户可自行修改二维码背景图、颜色等个性化配置。<br>⭐可以到站长唯一提问提问箱链接<a href="//box.tama.guru/_/tamakyi">小狼的提问箱</a>尝试相关功能或给我提意见。<br>⭐可以加群：<a href="http://qm.qq.com/cgi-bin/qm/qr?_wv=1027&k=rRy9g5XY34LIzOITGGmQHjX6BIICFpam&authKey=EjyNjp60KyG8BtKZGN8BXJaf1jl8okkCcUhVF2zAnGPRjhvuSdopnVqOSfSymnGg&noverify=0&group_code=777163254">小狼的群</a>一起水群。<br></p>
+  <hr><p style="color: red;">近期将国内段访问交由EdgeOne接管，境外访问照旧由CloudFlare提供，经测试国内访问速度有所提升。但因EdgeOne Free套餐不提供CIDR列表，IP放行采取自动抓取手动维护模式，如果出现521错误请刷新一下页面，过几天应该就好了。</p>
+  <hr><p style="color: red; font-weight: bold;">近期更新:<br>⭐2026.9 增加了提问、投票、私聊的总开关，可以设置定时收集、定量收集或关闭功能，顺便调整了前后端显示，看起来更易用了一些。<br>⭐2026.8 新增了<a href="https://box.tama.guru/vote/sANyLkiBNUGN">投票功能</a>、追加提问、多语言、<a href="https://box.tama.guru/_/tamakyi/2894">Markdown显示</a>、置顶显示等多个功能，详情见<a href="https://blog.tama.guru/record/tamabox_changelog_20260813">这里</a>。<br>⭐2026.8 放弃使用recaptcha等对国内用户非常不友好的验证方式，更新了密码加密方式，修复了图片上传等一系列问题。<br>⭐2026.5 增加了私聊功能，可进行连续性对话，详见<a href="https://blog.tama.guru/record/tamabox-update-20260513">介绍</a>；另有增加提问箱的卡片分享，更直观和美观。<br>⭐2026.2 新增了用户展示和标签功能，如果你希望陌生人给你提问，可以在设置页面给自己贴上5个标签并选择是否展示在探索页面：<a href="https://box.tama.guru/explore">点我访问</a>，详情见<a href="https://blog.tama.guru/record/tamabox-tags">狼的公告板</a><br></p>
+  <hr><p>一点提醒：<br>⭐本站唯一指定认证站长：<a href="//box.tama.guru/_/tamakyi">小狼</a>，注意不要被骗。
+  <br>⭐本站不允许垃圾信息、广告、辱骂、涉政、暴恐、色情、违禁、无意义、灌水提问的出现，如有涉证或不良言论将直接删除。</p>
+</div>
+<p>{{t .LangCode "site.stats"}}:<pre style="overflow: hidden;" id="site-stats-text">{{if .SiteStats}}{{.SiteStats.Text}}{{end}}</pre></p>
+<script type="text/javascript">
+    // 首页统计已改为程序内直接计算（服务端 30 分钟缓存），这里每 30 分钟定时拉取最新值刷新，
+    // 与原来 crontab 生成 question.count.txt 的节奏一致，且不再依赖外部静态文件。
+    document.addEventListener('DOMContentLoaded', function () {
+        setInterval(function () {
+            fetch("/api/v1/site-stats")
+                .then(function (r) { return r.json(); })
+                .then(function (resp) {
+                    var d = resp.data;
+                    if (!d || !d.text) return;
+                    var el = document.getElementById("site-stats-text");
+                    if (el) el.textContent = d.text;
+                })
+                .catch(function () {});
+        }, 30 * 60 * 1000);
+    });
+</script>
+<!--<script src="https://r2.337845818.best/oss-to-r2/nekobox/cdn/waline/client/v2/waline.js"></script>
+<link href='https://r2.337845818.best/oss-to-r2/nekobox/cdn/waline/client/v2/waline-no-commits.css' rel='stylesheet' />-->
+ <div id="waline"></div>
+ <script>
+     document.addEventListener('DOMContentLoaded', function () {
+     const waline = Waline.init({
+         el: '#waline',
+         //后端服务器地址
+         serverURL: 'https://waline.337845818.best/',
+         path: window.location.href,
+             // 中文默认
+         locale: {
+           nick: '昵称',
+           nickError: '昵称不能少于3个字符',
+           mail: '邮箱',
+           mailError: '请填写正确的邮件地址',
+           link: '网址',
+           optional: '可选',
+           placeholder: '欢迎评论（可以无需登录，但需要手工审核，不会立即展现）',
+           sofa: '来发评论吧~',
+           submit: '提交',
+           like: '喜欢',
+           cancelLike: '取消喜欢',
+           reply: '回复',
+           cancelReply: '取消回复',
+           comment: '评论',
+           refresh: '刷新',
+           more: '加载更多...',
+           preview: '预览',
+           emoji: '表情',
+           uploadImage: '上传图片',
+           seconds: '秒前',
+           minutes: '分钟前',
+           hours: '小时前',
+           days: '天前',
+           now: '刚刚',
+           uploading: '正在上传',
+           login: '登录',
+           logout: '退出',
+           admin: '博主',
+           sticky: '置顶',
+           word: '字',
+           wordHint: '评论字数应在 $0 到 $1 字之间！\n当前字数：$2',
+           anonymous: '无名小狼',
+           level0: '潜水',
+           level1: '冒泡',
+           level2: '吐槽',
+           level3: '活跃',
+           level4: '话痨',
+           level5: '传说',
+           gif: '表情包',
+           gifSearchPlaceholder: '搜索表情包',
+           profile: '个人资料',
+           approved: '通过',
+           waiting: '待审核',
+           spam: '垃圾',
+           unsticky: '取消置顶',
+           oldest: '按倒序',
+           latest: '按正序',
+           hottest: '按热度',
+           reactionTitle: '',
+           reaction0: '哇哦',
+           reaction1: 'prpr',
+           reaction2: '流汗',
+           reaction3: '生气',
+           reaction4: '流鼻血',
+           reaction5: 'あべ',
+         },
+         reaction: [
+          'https://ali-imgs.acfun.cn/kimg/bs2/zt-image-host/ChYwOGQ3OTRhYzRjMTBkZmZhZDVmZTA1EIjM1y8.gif',
+          'https://ali-imgs.acfun.cn/kimg/bs2/zt-image-host/ChQwOGEyOTlhYzRjMTBmOWFkZjAwYRCIzNcv.gif',
+          'https://ali-imgs.acfun.cn/kimg/bs2/zt-image-host/ChYwOGRhOTVhYzRjMTBkNmViYTVlNTA2EIjM1y8.gif',
+          'https://ali-imgs.acfun.cn/kimg/bs2/zt-image-host/ChYwOGU1OTJhYzRjMTBmMzk3ZmVmNTAyEIjM1y8.gif',
+          'https://ali-imgs.acfun.cn/kimg/bs2/zt-image-host/ChYwOGNkODdhYzRjMTBjYmEwOTFjNjAxEIjM1y8.gif',
+          'https://ali-imgs.acfun.cn/kimg/bs2/zt-image-host/ChQwODliOGVhYzRjMTBmOGM0ZWY1ZRCIzNcv.gif',
+         ],
+         meta: ['nick','mail'],
+         requiredMeta: ['mail'],
+         pageview: true,
+         search: false,
+         login: 'enable',
+         wordLimit: 50,
+         pageSize: 5,
+         avatar: 'identicon',
+         emoji: [
+             'https://gcore.jsdelivr.net/gh/tamakyi/emoji-collection@main/acfun-color/60x60',
+         ],
+         //禁止图片上传按钮
+         imageUploader: false,
+         //不显示版权标志
+         copyright: false,
+     });
+     });
+ </script>
+ {{template "base/footer" .}}
\ No newline at end of file
diff --git a/.workbuddy/backup/domain-shiroko-20260906/llms-full.txt b/.workbuddy/backup/domain-shiroko-20260906/llms-full.txt
new file mode 100644
index 0000000..8685afd
--- /dev/null
+++ b/.workbuddy/backup/domain-shiroko-20260906/llms-full.txt
@@ -0,0 +1,121 @@
+# 狼的提问箱 / Wolf's Question Box — 完整说明
+
+狼的提问箱（Wolf's Question Box）是一个免费、无需注册的匿名提问箱服务，是 NekoBox 的社区分支（community fork）。访客无需下载 App、绑定社交账号或提供邮箱，即可向箱主匿名提问；箱主可公开或私密回答，并与提问者进行追问式的多轮对话。
+
+> 隐私声明：单个提问箱内的问答内容属于用户隐私，不对外公开索引，也不写入 sitemap。本文件仅使用站点的公开功能信息，不包含任何具体提问箱或提问内容。
+
+## 1. 服务定位
+
+- 面向个人创作者、UP 主、博主等，提供一个让粉丝/陌生人匿名提问的入口。
+- 匿名是核心：提问者不需要任何账号、邮箱或社交登录。
+- 多语言界面：简体中文、繁体中文、英文、日文。
+- 内置浅色 / 深色主题切换。
+
+## 2. 核心功能详解
+
+### 2.1 匿名提问
+访客打开任意箱主的提问箱页面即可直接提问，全程无需登录。提问内容以纯文本或 Markdown 提交。
+
+### 2.2 回答与追问（多轮对话）
+- 箱主可对问题进行公开回答。
+- 提问者可就同一问题「继续追问」，箱主可再次回复，形成来回多轮对话，适合连续交流、澄清或访谈场景。
+- 已回答的追问，箱主可随时「更新回答」。
+
+### 2.3 Markdown 渲染
+问题与回答支持 Markdown 显示（标题、列表、引用、代码块、表格、图片等），保留排版格式。
+
+### 2.4 置顶
+箱主可将重要或精彩的问题「置顶」，固定展示在提问箱顶部，便于新访客一眼看到。
+
+### 2.5 访问密码 / 提问密码
+- **查看密码**：访问提问箱页面时需要输入密码，适合仅对特定人群开放。
+- **提问密码**：向某提问箱提问时需要输入密码，防止陌生人随意刷屏。
+- 密码采用加密方式存储，不保存明文。
+
+### 2.6 二维码分享
+每个问题页均可生成分享二维码，箱主可自定义二维码的背景图与颜色，方便线下或社媒直接扫码访问。
+
+### 2.7 标签与探索页
+- 箱主最多可设置 5 个标签，并选择是否展示在「探索」页面。
+- 「探索」页（`/explore`）按用户与标签发现其他公开提问箱，是站内唯一的公开内容发现入口。
+
+### 2.8 私聊
+箱主与访客之间可进行一对一的连续私密对话（私聊），区别于公开问答，内容不对外展示。
+
+### 2.9 多语言
+界面支持简体中文、繁体中文、英文、日文四种语言，跟随用户选择或浏览器/站点偏好。
+
+### 2.10 深色模式
+全站内置浅色 / 深色主题切换，偏好记忆在本地 cookie。
+
+### 2.11 验证码与图片上传
+- 为兼顾国内外用户，已弃用对国内不友好的 reCAPTCHA，改用更友好的验证方式（如算数验证码 / Turnstile）。
+- 提问与回答支持图片上传，上传前会做像素总量校验以防解压炸弹。
+
+## 3. 使用流程
+
+### 创建提问箱（箱主）
+1. 访问 `/register` 注册一个免费账号，获得专属提问箱与二级域名（如 `/_/你的用户名`）。
+2. 在 `/user/profile` 设置用户名、头像、简介与标签。
+3. 按需开启「查看密码」或「提问密码」，并设置是否参与探索页。
+
+### 匿名提问（访客）
+1. 打开某箱主的提问箱页面（如 `/_/用户名`）。
+2. 若箱主设置了提问密码，先输入密码。
+3. 填写问题并提交（可勾选邮件通知，但邮箱非必填）。
+4. 等待箱主公开回答；如需补充，可使用「追问」。
+
+### 分享
+- 复制提问箱链接，或使用问题页二维码分享。
+- 推荐国内用户使用主域名 `https://box.tama.guru`。
+
+## 4. 常见问题（FAQ）
+
+### 4.1 给提问者（访客）
+
+- **提问需要注册吗？** 不需要。任何人都能匿名提问；只有创建与管理提问箱（注册账号）才需要登录。
+- **我的匿名性能保证吗？** 提问者无需提供账号或邮箱即可提问；是否填写通知邮箱完全可选，不填也能正常使用。
+- **我可以追问吗？** 可以。对箱主已公开回答的问题，你可「继续追问」，箱主再次回复后形成来回多轮对话，适合澄清、访谈或连续交流。
+- **我能收到回答通知吗？** 可以。提问时若留下邮箱（可选），箱主首次公开回答后你会收到邮件通知；邮件内含一条私密链接，可凭其查看该问题、接收回复并继续追问。
+- **提问有数量限制吗？** 有基础频率限制（约 30 条/分钟/IP）以防刷屏滥用，正常使用基本无感。
+- **能上传图片吗？** 能。提问与回答均支持图片上传，上传前会做像素总量等安全校验以防解压炸弹。
+- **需要验证码吗？** 需要。提问前需通过验证码（算数验证码 / Turnstile），已弃用对国内不友好的 reCAPTCHA，兼顾国内外用户。
+- **提问内容会被搜索引擎收录吗？** 不会。单个提问箱及其问答内容属于用户隐私，已排除在索引与 sitemap 之外；仅首页、注册、登录、探索页等公开页可被收录。
+
+### 4.2 给箱主（创作者）
+
+- **如何创建提问箱？** 注册一个免费账号，即可获得专属路径（如 `/_/你的用户名`），作为你的匿名提问箱。
+- **如何设置个人资料？** 在 `/user/profile` 设置用户名、头像、简介与标签。
+- **如何限制谁能访问或提问？** 可开启「查看密码」（访问页面需密码）与「提问密码」（提问需密码），均以加密形式存储，服务端不保存明文。
+- **我能删除某条提问吗？** 可以。箱主可删除提问箱内的任意提问。
+- **我能隐藏某条提问/回答吗？** 可以。单条问题可设为「私密」不对外公开展示，也可随时改回公开。
+- **如何把精彩问题置顶？** 使用「置顶」功能，将重要或精彩的问题固定在提问箱顶部，便于新访客一眼看到。
+- **如何出现在探索页？** 设置最多 5 个标签，并选择是否展示在「探索」页（`/explore`），这是站内唯一的公开内容发现入口。
+- **我能和访客私聊吗？** 可以。支持一对一连续私密对话（区别于公开问答）；可拉黑对方、或删除整个对话，被拉黑方将无法继续发送。
+- **有新提问/新消息会通知我吗？** 会。若你已设置邮箱，有新提问、新私聊消息时会收到邮件通知。
+- **分享卡片 / 二维码能自定义吗？** 可以。问题页与提问箱页面均可生成分享卡片与二维码，并自定义二维码背景图与颜色，方便线下或社媒直接扫码访问。
+- **内容审核如何运作？** 采用自动与人工结合的审核，对垃圾信息、广告、辱骂、涉政、暴恐、色情、违禁及无意义灌水内容进行处置与删除。
+
+### 4.3 通用
+
+- **支持哪些语言？** 简体中文、繁体中文、英文、日文；可在页面切换，偏好记忆于本地 cookie。
+- **支持深色模式吗？** 支持。全站内置浅色 / 深色主题切换，偏好同样记忆于本地 cookie。
+- **这是 NekoBox 吗？** 不是。TamaBox（狼的提问箱）是 NekoBox 的社区分支（community fork），在功能与多语言方面做了扩展。
+- **收费吗？** 免费。
+- **数据安全吗？** 密码加密存储，图片上传前后均做安全校验，单个提问箱内容不对外索引。
+- **如何分享我的提问箱？** 复制提问箱链接，或使用页面二维码、分享卡片；国内用户推荐使用主域名 `https://box.tama.guru`。
+- **忘记密码怎么办？** 登录页提供找回密码流程（通过注册邮箱重置），具体以登录页提示为准。
+
+## 5. 隐私与使用政策
+
+- **隐私**：单个提问箱内容属于用户隐私，不对外索引、不写入 sitemap。
+- **内容规范**：禁止垃圾信息、广告、辱骂、涉政、暴恐、色情、违禁、无意义或灌水内容；违规内容将被删除。
+- **数据安全**：图片上传前后均做安全校验，密码加密存储。
+
+## 6. 资源
+
+- 更新日志（功能更新记录）：https://blog.tama.guru/record/tamabox_changelog_20260813
+- 站点首页：https://box.tama.guru/
+- 探索页：https://box.tama.guru/explore
+- 注册：https://box.tama.guru/register
+- 登录：https://box.tama.guru/login
diff --git a/.workbuddy/backup/domain-shiroko-20260906/llms.txt b/.workbuddy/backup/domain-shiroko-20260906/llms.txt
new file mode 100644
index 0000000..843add9
--- /dev/null
+++ b/.workbuddy/backup/domain-shiroko-20260906/llms.txt
@@ -0,0 +1,29 @@
+# 狼的提问箱 / Wolf's Question Box
+
+> 狼的提问箱（Wolf's Question Box）是一个免费、无需注册的匿名提问箱服务。访客无需下载 App、绑定社交账号或提供邮箱，即可向箱主匿名提问；箱主可公开或私密回答，并与提问者进行追问式的多轮对话。本站为 NekoBox 的社区分支（community fork）。单个提问箱内的问答内容属于用户隐私，不对外公开索引。
+
+## 概述
+- [首页](https://box.tama.guru/): 站点介绍与多语言落地页。
+- [探索](https://box.tama.guru/explore): 按用户与标签发现公开的提问箱。
+- [注册](https://box.tama.guru/register): 免费创建自己的提问箱。
+- [登录](https://box.tama.guru/login): 登录以管理你的提问箱。
+
+## 核心功能
+- 匿名提问：无需账号、邮箱或社交登录即可提问。
+- 回答与追问：箱主可公开回答；提问者可继续追问，箱主可回复，形成多轮来回对话。
+- Markdown 渲染：问题与回答支持 Markdown 显示。
+- 访问控制：可分别设置「查看提问箱密码」与「提问密码」，密码加密存储。
+- 置顶：将重要问题置顶展示。
+- 二维码分享：每个问题页生成可分享二维码，背景图与颜色可自定义。
+- 标签与发现：最多添加 5 个标签，展示于探索页。
+- 私聊：与箱主一对一的连续私密对话。
+- 多语言界面：简体中文、繁体中文、英文、日文。
+- 深色模式：内置浅色 / 深色主题切换。
+
+## 资源
+- [完整说明 (llms-full.txt)](https://box.tama.guru/llms-full.txt): 站点完整功能说明、使用流程、FAQ 与隐私政策。
+- [更新日志](https://blog.tama.guru/record/tamabox_changelog_20260813): 近期功能更新（追问、多语言、Markdown、置顶等）。
+
+## 使用政策
+- 隐私：单个提问箱内容属于隐私，已排除在搜索引擎索引与 sitemap 之外。
+- 内容规范：禁止垃圾信息、广告、辱骂、涉政、暴恐、色情、违禁、无意义或灌水内容，违规内容将被删除。
diff --git a/.workbuddy/backup/domain-shiroko-20260906/register.go b/.workbuddy/backup/domain-shiroko-20260906/register.go
new file mode 100644
index 0000000..1eab76d
--- /dev/null
+++ b/.workbuddy/backup/domain-shiroko-20260906/register.go
@@ -0,0 +1,92 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package auth
+
+import (
+	"github.com/flamego/recaptcha"
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+
+	"github.com/tamakyi/TamaBox/internal/captcha"
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/context"
+	"github.com/tamakyi/TamaBox/internal/db"
+	"github.com/tamakyi/TamaBox/internal/form"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+	"github.com/tamakyi/TamaBox/internal/shared"
+)
+
+func Register(ctx context.Context) {
+	ctx.Success("auth/register")
+}
+
+func RegisterAction(ctx context.Context, f form.Register, recaptcha recaptcha.RecaptchaV3) {
+	if ctx.HasError() {
+		ctx.Success("auth/register")
+		return
+	}
+
+	// Check captcha code (unified: recaptcha, turnstile, or math).
+	ok, err := captcha.Verify(f.Recaptcha, shared.ResolveClientIP(ctx.Request().Request), ctx.Session, recaptcha, ctx.Lang())
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to check captcha")
+		ctx.SetErrorFlash(err.Error())
+		ctx.Redirect("/register")
+		return
+	}
+	if !ok {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "captcha.error"))
+		ctx.Redirect("/register")
+		return
+	}
+
+	if err := db.Users.Create(ctx.Request().Context(), db.CreateUserOptions{
+		Name:                 f.Name,
+		Password:             f.Password,
+		Email:                f.Email,
+		Avatar:               conf.Upload.DefaultAvatarURL,
+		Domain:               f.Domain,
+		Background:           conf.Upload.DefaultBackground,
+		Intro:                "问你想问的",
+		Qrcodebackcolor:      "#FDF8F0",
+		Qrcodecolor:          "#C45500",
+		Usernamecolor:        "#000000",
+		Introcolor:           "#000000",
+		Dotscale:             "0.35",
+		BackgroundImage:      conf.Upload.DefaultBackgroundImageURL,
+		Backgroundimagealpha: "0.8",
+		Qrcodepdpcolor:       "#C45500",
+		Acfunlink:            "none",
+		Bililink:             "none",
+		Weibolink:            "none",
+		Bloglink:             "box.tama.guru",
+		Xiaohongshulink:      "none",
+		Language:             i18n.Resolve(f.Language), // 注册时选择的界面语言；留空回退站点默认
+	}); err != nil {
+		switch {
+		case errors.Is(err, db.ErrDuplicateEmail):
+			ctx.SetError(errors.New(i18n.T(ctx.Lang(), "auth.errDuplicateEmail")))
+		case errors.Is(err, db.ErrDuplicateDomain):
+			ctx.SetError(errors.New(i18n.T(ctx.Lang(), "auth.errDuplicateDomain")))
+		case errors.Is(err, db.ErrBadCredential):
+			ctx.SetError(errors.New(i18n.T(ctx.Lang(), "auth.errBadCredential")))
+
+		default:
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to create new user")
+			ctx.SetInternalError()
+		}
+
+		ctx.Success("auth/register")
+		return
+	}
+
+	// 成功提示跟随用户注册时选择的语言
+	lang := "zh-CN"
+	if l, ok := ctx.Data["Lang"].(string); ok && l != "" {
+		lang = l
+	}
+	ctx.SetSuccessFlash(i18n.T(lang, "auth.register.success"))
+	ctx.Redirect("/login")
+}
diff --git a/.workbuddy/backup/domain-shiroko-20260906/robots.txt b/.workbuddy/backup/domain-shiroko-20260906/robots.txt
new file mode 100644
index 0000000..4977c33
--- /dev/null
+++ b/.workbuddy/backup/domain-shiroko-20260906/robots.txt
@@ -0,0 +1,7 @@
+User-agent: *
+Disallow: /_/
+Disallow: /user/
+Allow: /explore
+Allow: /llms.txt
+Allow: /llms-full.txt
+Sitemap: https://box.tama.guru/sitemap.xml
diff --git a/.workbuddy/backup/domain-shiroko-20260906/route.go.bak b/.workbuddy/backup/domain-shiroko-20260906/route.go.bak
new file mode 100644
index 0000000..872608e
--- /dev/null
+++ b/.workbuddy/backup/domain-shiroko-20260906/route.go.bak
@@ -0,0 +1,414 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package route
+
+import (
+	"encoding/gob"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/flamego/cache"
+	cacheRedis "github.com/flamego/cache/redis"
+	"github.com/flamego/csrf"
+	"github.com/flamego/flamego"
+	"github.com/flamego/recaptcha"
+	"github.com/flamego/session"
+	"github.com/flamego/session/mysql"
+	sessionRedis "github.com/flamego/session/redis"
+	"github.com/flamego/template"
+	"github.com/sirupsen/logrus"
+
+	"github.com/tamakyi/TamaBox/internal/captcha"
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/context"
+	"github.com/tamakyi/TamaBox/internal/form"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+	"github.com/tamakyi/TamaBox/internal/mail"
+	"github.com/tamakyi/TamaBox/internal/route/chat" // 私聊路由
+	"github.com/tamakyi/TamaBox/internal/security/autoban"
+	"github.com/tamakyi/TamaBox/internal/shared"
+	templatepkg "github.com/tamakyi/TamaBox/internal/template"
+	"github.com/tamakyi/TamaBox/route"
+	"github.com/tamakyi/TamaBox/route/auth"
+	"github.com/tamakyi/TamaBox/route/pixel"
+	"github.com/tamakyi/TamaBox/route/question"
+	"github.com/tamakyi/TamaBox/route/service"
+	"github.com/tamakyi/TamaBox/route/user"
+	"github.com/tamakyi/TamaBox/route/vote"
+	"github.com/tamakyi/TamaBox/static"
+	"github.com/tamakyi/TamaBox/templates"
+)
+
+// CSRFUserSessionKey 是 CSRF token 绑定的会话键，必须与登录时写入的会话键一致
+// （见 route/auth/login.go 中 ctx.Session.Set("uid", ...)）。flamego/csrf 默认使用
+// "userID"，若不与之对齐，token 的 id 恒为 "0"，任意匿名访客从公开页面取到的 token
+// 对全部已登录用户均有效，CSRF 退化为全站公开常量。
+//
+// 本常量同时被 csrf_binding_test.go 引用，作为单一事实来源：一旦被误改，回归测试会在
+// CI 失败，避免修复悄悄倒退。
+const CSRFUserSessionKey = "uid"
+
+// securityHeaders adds security-related HTTP headers to every response.
+func securityHeaders() flamego.Handler {
+	return func(ctx flamego.Context) {
+		w := ctx.ResponseWriter()
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+		w.Header().Set("X-Frame-Options", "DENY")
+		w.Header().Set("X-XSS-Protection", "1; mode=block")
+		w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
+		// HSTS：仅当站点以 https 对外提供服务时下发，避免 http 部署下把用户锁死在 https。
+		if strings.HasPrefix(conf.App.ExternalURL, "https") {
+			w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
+		}
+	}
+}
+
+func New() *flamego.Flame {
+	f := flamego.Classic()
+	if conf.App.Production {
+		flamego.SetEnv(flamego.EnvTypeProd)
+	}
+
+	// 自动封禁实例：整个请求链路共享同一个，供中间件与 f.NotFound 复用，
+	// 避免对业务性 302→/（语言切换、登出、投票不存在等）误判为路径扫描。
+	// 404 是否参与统计由 ban_track_notfound 控制（默认 false：正常业务一律放行，
+	// 仅敏感扫描路径计数封禁，见 conf.Security.BanTrackNotFound）。
+	ab := autoban.New(autoban.Options{
+		Enabled:            conf.Security.EnableAutoBan,
+		TrackNotFound:      conf.Security.BanTrackNotFound,
+		ThresholdSensitive: conf.Security.BanThresholdSensitive,
+		Threshold404:       conf.Security.BanThreshold404,
+		Window:             time.Duration(conf.Security.BanWindowSeconds) * time.Second,
+		Duration:           time.Duration(conf.Security.BanDurationMinutes) * time.Minute,
+		AlertEmail:         conf.Security.SecurityAlertEmail,
+		SendAlert:          mail.SendSecurityAlertMail,
+	})
+	// 需要输出详细日志时配置如下
+	// if conf.App.Production {
+	//   	flamego.SetEnv(flamego.EnvTypeProd)
+	// }
+
+	templateFS, err := template.EmbedFS(templates.FS, ".", []string{".html"})
+	if err != nil {
+		logrus.WithError(err).Fatal("Failed to embed templates file system")
+	}
+
+	gob.Register(time.Time{})
+	gob.Register(context.Flash{})
+	gob.Register(captcha.StoredAnswer{})
+	var sessionStorage interface{}
+	initer := session.MemoryIniter()
+	if conf.Database.DSN != "" {
+		initer = mysql.Initer()
+		sessionStorage = mysql.Config{
+			DSN:      conf.Database.DSN,
+			Lifetime: 7 * 24 * time.Hour,
+		}
+	}
+	if conf.Redis.Addr != "" {
+		initer = sessionRedis.Initer()
+		sessionStorage = sessionRedis.Config{
+			Options: &sessionRedis.Options{
+				Addr:     conf.Redis.Addr,
+				Password: conf.Redis.Password,
+				DB:       1,
+			},
+			Lifetime: 7 * 24 * time.Hour,
+		}
+	}
+	sessioner := session.Sessioner(session.Options{
+		Initer: initer,
+		Config: sessionStorage,
+		// 显式声明 cookie 安全属性，不依赖库默认值：
+		//   - HTTPOnly：禁止 JS 读取，降低 XSS 窃取会话的风险
+		//   - SameSite=Lax：阻断经典跨站表单 POST（CSRF 的主要防线之一）
+		//   - Secure：仅在站点以 https 对外服务时下发，避免 http 本地开发下 cookie 不生效。
+		//     缺失 Secure 时，HSTS 尚未落地的首次访问可被主动 MITM 诱导明文请求窃取会话。
+		Cookie: session.CookieOptions{
+			HTTPOnly: true,
+			SameSite: http.SameSiteLaxMode,
+			Secure:   strings.HasPrefix(conf.App.ExternalURL, "https"),
+		},
+	})
+
+	f.Use(flamego.Static(flamego.StaticOptions{
+		FileSystem: http.FS(static.FS),
+		Prefix:     "/static",
+		// 静态资源随二进制发布，内容变更需重新部署；1 天缓存是安全折中
+		CacheControl: func() string {
+			return "public, max-age=86400"
+		},
+	}))
+
+	f.Use(securityHeaders())
+	f.Use(ipBlacklistMiddleware())
+	f.Use(autobanMiddleware(ab))
+	// 全局请求体上限：必须在任何会读取 body 的中间件（尤其 Contexter 内的 CSRF 校验）
+	// 之前执行，否则超大 multipart 会在 Bind 的路由级限制生效前落盘临时文件耗尽磁盘。
+	f.Use(requestBodyLimitMiddleware())
+
+	reqUserSignOut := context.Toggle(&context.ToggleOptions{UserSignOutRequired: true})
+	reqUserSignIn := context.Toggle(&context.ToggleOptions{UserSignInRequired: true})
+
+	f.Group("", func() {
+		f.Get("/", route.Home)
+		f.Get("/pixel", reqUserSignIn, pixel.Index)
+		f.Get("/sponsor", route.Sponsor)
+		f.Get("/change-logs", route.ChangeLogs)
+		f.Get("/about-me", route.AboutMe)
+		f.Get("/robots.txt", func(c context.Context) {
+			fs, err := static.FS.Open("robots.txt")
+			if err != nil {
+				c.ResponseWriter().WriteHeader(404)
+				return
+			}
+			defer func() { _ = fs.Close() }()
+			c.ResponseWriter().Header().Set("Content-Type", "text/plain; charset=utf-8")
+			c.ResponseWriter().Header().Set("Cache-Control", "public, max-age=86400")
+			_, _ = io.Copy(c.ResponseWriter(), fs)
+		})
+		f.Get("/favicon.ico", func(c context.Context) {
+			fs, _ := static.FS.Open("favicon.ico")
+			defer func() { _ = fs.Close() }()
+			c.ResponseWriter().Header().Set("Content-Type", "image/x-icon")
+			c.ResponseWriter().Header().Set("Cache-Control", "public, max-age=86400")
+			_, _ = io.Copy(c.ResponseWriter(), fs)
+		})
+
+		f.Get("/sitemap.xml", func(c context.Context) {
+			fs, err := static.FS.Open("sitemap.xml")
+			if err != nil {
+				c.ResponseWriter().WriteHeader(404)
+				return
+			}
+			defer func() { _ = fs.Close() }()
+			c.ResponseWriter().Header().Set("Content-Type", "application/xml")
+			c.ResponseWriter().Header().Set("Content-Type", "text/xml; charset=utf-8")
+			c.ResponseWriter().Header().Set("Cache-Control", "public, max-age=86400")
+			_, _ = io.Copy(c.ResponseWriter(), fs)
+		})
+
+		f.Get("/llms.txt", func(c context.Context) {
+			fs, err := static.FS.Open("llms.txt")
+			if err != nil {
+				c.ResponseWriter().WriteHeader(404)
+				return
+			}
+			defer func() { _ = fs.Close() }()
+			c.ResponseWriter().Header().Set("Content-Type", "text/plain; charset=utf-8")
+			c.ResponseWriter().Header().Set("Cache-Control", "public, max-age=86400")
+			_, _ = io.Copy(c.ResponseWriter(), fs)
+		})
+
+		f.Get("/llms-full.txt", func(c context.Context) {
+			fs, err := static.FS.Open("llms-full.txt")
+			if err != nil {
+				c.ResponseWriter().WriteHeader(404)
+				return
+			}
+			defer func() { _ = fs.Close() }()
+			c.ResponseWriter().Header().Set("Content-Type", "text/plain; charset=utf-8")
+			c.ResponseWriter().Header().Set("Cache-Control", "public, max-age=86400")
+			_, _ = io.Copy(c.ResponseWriter(), fs)
+		})
+
+		f.Group("", func() {
+			f.Combo("/register").Get(auth.Register).Post(form.Bind(form.Register{}), rateLimitMiddleware(10, 1*time.Minute), auth.RegisterAction)
+			f.Combo("/login").Get(auth.Login).Post(form.Bind(form.Login{}), rateLimitMiddleware(20, 1*time.Minute), auth.LoginAction)
+			f.Combo("/forgot-password").Get(auth.ForgotPassword).Post(form.Bind(form.ForgotPassword{}), rateLimitMiddleware(5, 5*time.Minute), auth.ForgotPasswordAction)
+			f.Combo("/recover-password").Get(auth.RecoverPassword).Post(form.Bind(form.RecoverPassword{}), auth.RecoverPasswordAction)
+		}, reqUserSignOut)
+
+		// 页面密码验证路由（独立于密码保护中间件）；限流防爆破
+		f.Combo("/_/{domain}/password").Get(question.PasswordPage).Post(rateLimitMiddleware(10, 1*time.Minute), question.VerifyPagePassword)
+
+		// 独立的分享图路由（不经过 Pager 中间件，直接返回图片）
+		// 注意：仍挂载 question.Pager，页面设置了密码时必须先通过密码验证，
+		// 否则分享图会绕过页面密码保护（与单题分享图行为一致）。
+		f.Group("/_/{domain}", func() {
+			f.Get("/share-card", question.ShareCard)
+		}, question.Pager)
+
+		f.Group("/_/{domain}", func() {
+			f.Combo("").Get(question.List).Post(form.Bind(form.NewQuestion{}), rateLimitMiddleware(30, 1*time.Minute), question.New)
+			f.Group("/{questionID}", func() {
+				f.Get("", question.Item)
+				f.Get("/share-card", question.QuestionShareCard)
+				f.Post("/delete", question.Delete)
+				f.Post("/set-private", question.SetPrivate)
+				f.Post("/set-public", question.SetPublic)
+				f.Post("/pin", question.TogglePin)
+				f.Post("/read", question.SetRead)
+				f.Post("/unread", question.SetUnread)
+				f.Post("/answer", reqUserSignIn, form.Bind(form.PublishAnswerQuestion{}), question.PublishAnswer)
+				f.Post("/follow-up", form.Bind(form.PublishFollowUpQuestion{}), question.PublishFollowUp)
+				f.Post("/follow-up/{followUpID}/answer", reqUserSignIn, form.Bind(form.AnswerFollowUpQuestion{}), question.AnswerFollowUp)
+			}, question.Questioner)
+
+			// 新增：私聊路由（需要登录，使用 Token 标识对话）
+			f.Group("/chat/{token}", func() {
+				f.Get("", chat.ConversationPage)
+				f.Post("/send", rateLimitMiddleware(20, 1*time.Minute), chat.SendMessage)
+				f.Post("/delete", chat.DeleteConversation)
+				f.Post("/block", chat.ToggleBlockUser)
+			}, reqUserSignIn)
+		}, question.Pager) // Pager 中间件已内置页面密码检查
+
+		f.Get("/explore", user.Explore)
+
+		// 匿名投票参与端（公开）：token 链接入口
+		f.Group("/vote/{token}", func() {
+			f.Get("", vote.Page)
+			// 提交限流优先按登录用户/签名 vote_fp 计数，IP 仅作高阈值兜底，避免共享出口误伤。
+			f.Post("/submit", voteSubmitRateLimitMiddleware(20, 1*time.Minute), vote.Submit)
+		})
+
+		// 公开页语言切换：把语言偏好写入 session（由 session 中间件随其 cookie 一并持久化）
+		// 后跳回原页面。此前写独立 lang cookie 会被 session 中间件的 Set-Cookie 整体覆盖而失效，
+		// 故改为托管在 session 中。仅允许站内相对路径，防开放重定向。
+		f.Get("/i18n/{lang}", func(c context.Context) {
+			lang := i18n.Resolve(c.Param("lang"))
+			// 写入 session，避免被 session 中间件的 Set-Cookie 覆盖（匿名用户也走 session 中间件）。
+			c.Session.Set("lang", lang)
+			to := c.Query("to")
+			// 仅允许站内相对路径，防开放重定向：
+			// 拒绝空、非 "/" 开头、以 "//" 开头的协议相对路径，以及含反斜杠/控制字符的变体。
+			if to == "" || !strings.HasPrefix(to, "/") ||
+				strings.HasPrefix(to, "//") || strings.ContainsAny(to, "\\\x00\r\n\t") {
+				to = "/"
+			}
+			c.Redirect(to)
+		})
+
+		// 算数验证码 API（仅在 captcha_type = "math" 时生效，但路由本身不依赖中间件）
+		// 加限流：防止匿名脚本无限生成/轮询爆破（答案本身对客户端可见，限流是主要节流手段）。
+		f.Get("/api/captcha/generate", rateLimitMiddleware(20, 1*time.Minute), captcha.GenerateHandler)
+		f.Post("/api/captcha/verify", rateLimitMiddleware(20, 1*time.Minute), captcha.VerifyHandler)
+
+		f.Group("/user", func() {
+			f.Get("/questions", user.QuestionList)
+
+			// 匿名投票管理（箱主侧）
+			f.Group("/votes", func() {
+				f.Get("", user.VoteList)
+				f.Get("/new", user.VoteNew)
+				f.Post("", rateLimitMiddleware(10, 1*time.Minute), user.VoteCreate)
+				f.Get("/{voteID}/edit", user.VoteEdit)
+				f.Post("/{voteID}", rateLimitMiddleware(10, 1*time.Minute), user.VoteUpdate)
+				f.Post("/{voteID}/publish", user.VotePublish)
+				f.Post("/{voteID}/close", user.VoteClose)
+				f.Post("/{voteID}/delete", user.VoteDelete)
+				f.Get("/{voteID}/results", user.VoteResults)
+				f.Get("/{voteID}/preview", user.VotePreview)
+				// 导出为只读操作（幂等、无副作用），用 GET 链接下载，避免表单提交
+				f.Get("/{voteID}/export", user.VoteExportCSV)
+			})
+
+			f.Group("/profile", func() {
+				f.Get("", user.Profile)
+				f.Post("/update", form.Bind(form.UpdateProfile{}), rateLimitMiddleware(10, 1*time.Minute), user.UpdateProfile)
+				f.Post("/export", user.ExportProfile)
+				f.Post("/export-json", user.ExportProfileJSON)
+				f.Combo("/deactivate").Get(user.DeactivateProfile).Post(user.DeactivateProfileAction)
+
+				f.Post("/update-page-password", form.Bind(form.UpdatePagePassword{}), rateLimitMiddleware(10, 1*time.Minute), user.UpdatePagePassword)
+				f.Post("/update-ask-password", form.Bind(form.UpdateAskPassword{}), rateLimitMiddleware(10, 1*time.Minute), user.UpdateAskPassword)
+
+				f.Post("/update-chat-settings", user.UpdateChatSettings)
+
+				// 功能管理（提问 / 私聊 / 投票 的开关、定时开关与定量收集）：
+				// 不单独开页面，作为账号设置页的三个面板，保存后回跳到对应面板。
+				f.Group("/features", func() {
+					f.Post("/update", rateLimitMiddleware(20, 1*time.Minute), user.FeaturesUpdate)
+					f.Post("/reset-quota", rateLimitMiddleware(20, 1*time.Minute), user.FeatureResetQuota)
+				})
+			})
+			// 防骚扰设置：注册限制（harassment/update）与全局屏蔽词（blockwords/update）
+			// 拆为两个独立入口。屏蔽词在提问/私聊/投票三个设置面板共用一份，保存后经
+			// ?tab= 参数回跳到来源面板。
+			f.Post("/harassment/update", form.Bind(form.UpdateHarassment{}), user.UpdateHarassment)
+			f.Post("/blockwords/update", form.Bind(form.UpdateBlockWords{}), user.UpdateBlockWords)
+			f.Post("/tags/update", form.Bind(form.UpdateTags{}), user.UpdateTags)
+			// Logout 必须用 POST：GET 会留下 CSRF 风险（第三方图片/链接可触发退出登录）
+			f.Post("/logout", auth.Logout)
+		}, reqUserSignIn)
+
+		f.Group("/api/v1", func() {
+			f.Group("/user", func() {
+				f.Get("", reqUserSignIn, user.ProfileAPI)
+				f.Group("/{domain}", func() {
+					f.Group("/questions", func() {
+						f.Get("", rateLimitMiddleware(60, 1*time.Minute), question.ListAPI)
+					})
+				})
+			})
+			// 像素追踪代理：仅暴露只读 GET（f.Any 会放行写方法，曾有 CSRF 豁免 + 写方法放行的风险），
+			// 并加限流防止被用作高频打点通道。
+			f.Get("/pixel/{**}", reqUserSignIn, rateLimitMiddleware(30, 1*time.Minute), pixel.Proxy)
+			// 服务反代仅暴露只读 GET：本网关是把已登录用户的请求转发到配置好的内部服务，
+			// 不应允许任意写方法，避免被用作对内网后端的越权操作入口。
+			f.Get("/service/{**}", reqUserSignIn, service.Proxy)
+			f.Get("/explore/random", rateLimitMiddleware(60, 1*time.Minute), user.RandomRecommend)
+			// 首页"提问箱信息统计"公开接口（服务端 30 分钟缓存），供前端定时刷新
+			f.Get("/site-stats", rateLimitMiddleware(60, 1*time.Minute), route.SiteStatsAPI)
+		}, context.APIEndpoint)
+	},
+		cache.Cacher(cache.Options{
+			Initer: cacheRedis.Initer(),
+			Config: cacheRedis.Config{
+				Options: &cacheRedis.Options{
+					Addr:     conf.Redis.Addr,
+					Password: conf.Redis.Password,
+					DB:       0,
+				},
+			},
+		}),
+		recaptcha.V3(
+			recaptcha.Options{
+				Secret: conf.Recaptcha.ServerKey,
+				VerifyURL: func() recaptcha.VerifyURL {
+					if conf.Recaptcha.TurnstileStyle {
+						return "https://challenges.cloudflare.com/turnstile/v0/siteverify"
+					}
+					return recaptcha.VerifyURLGlobal
+				}(),
+			},
+		),
+		sessioner,
+		csrf.Csrfer(csrf.Options{
+			Secret: conf.Server.XSRFKey,
+			Header: "X-CSRF-Token",
+			// ⚠️ 必须与 route/auth/login.go 中 ctx.Session.Set("uid", ...) 的 key 一致。
+			// flamego/csrf 默认 SessionKey 为 "userID"，若不显式指定，s.Get("userID")
+			// 恒为 nil，token 内绑定的 id 恒为 "0" —— 由于校验是无状态 HMAC 重算
+			// （不与 session 中存储的 token 比对），这会导致任意匿名访客从公开的
+			// /login 页面取到的 token 对所有已登录用户均有效，CSRF 退化为全站公开常量。
+			// 回归测试见 route/csrf_binding_test.go（引用 CSRFUserSessionKey）。
+			SessionKey: CSRFUserSessionKey,
+		}),
+		template.Templater(template.Options{
+			FileSystem: templateFS,
+			FuncMaps:   templatepkg.FuncMap(),
+		}),
+		context.Contexter(),
+	)
+	f.NotFound(func(ctx flamego.Context) {
+		// 真正的 404 探测在此记录（仅此处，不把业务 302→/ 误判为扫描）。
+		// 注意：flamego 的 NotFound 会先写入 404 状态再 Redirect 到 "/"，
+		// 因此这里在 Redirect 之前记录，确保状态为 404。
+		// 键必须与 autobanMiddleware 中的 IsBanned/Record 保持一致（同样经 LimitKey 聚合），
+		// 否则 404 计数会记在另一个键上，导致封禁永不生效。
+		// ⚠️ 该 404 计数受 ban_track_notfound 配置控制，默认关闭（正常业务一律放行，
+		// 仅敏感扫描路径计数封禁）；Record 内部对未开启的 KindNotFound 直接忽略。
+		if ip := shared.LimitKey(shared.ResolveClientIP(ctx.Request().Request)); ip != "" {
+			ab.Record(ip, ctx.Request().URL.Path, autoban.KindNotFound)
+		}
+		ctx.Redirect("/")
+	})
+
+	return f
+}
diff --git a/.workbuddy/backup/domain-shiroko-20260906/sitemap.xml b/.workbuddy/backup/domain-shiroko-20260906/sitemap.xml
new file mode 100644
index 0000000..d5e91c3
--- /dev/null
+++ b/.workbuddy/backup/domain-shiroko-20260906/sitemap.xml
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<urlset
+    xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://www.sitemaps.org/schemas/sitemap/0.9
+       http://www.sitemaps.org/schemas/sitemap/0.9/sitemap.xsd"
+>
+
+<url>
+ <loc>https://box.tama.guru/explore</loc>
+ <priority>0.3</priority>
+ <lastmod>2026-02-27</lastmod>
+ <changefreq>weekly</changefreq>
+</url>
+
+<url>
+ <loc>https://box.tama.guru/</loc>
+ <priority>0.3</priority>
+ <lastmod>2026-02-27</lastmod>
+ <changefreq>weekly</changefreq>
+</url>
+
+<url>
+ <loc>https://box.tama.guru/register</loc>
+ <priority>0.3</priority>
+ <lastmod>2026-02-27</lastmod>
+ <changefreq>weekly</changefreq>
+</url>
+
+<url>
+ <loc>https://box.tama.guru/login</loc>
+ <priority>0.3</priority>
+ <lastmod>2026-02-27</lastmod>
+ <changefreq>weekly</changefreq>
+</url>
+
+<url>
+ <loc>https://box.tama.guru/_/tamakyi</loc>
+ <priority>0.3</priority>
+ <lastmod>2026-02-27</lastmod>
+ <changefreq>weekly</changefreq>
+</url>
+
+<url>
+ <loc>https://box.tama.guru</loc>
+ <priority>0.3</priority>
+ <lastmod>2026-02-27</lastmod>
+ <changefreq>weekly</changefreq>
+</url>
+
+<url>
+ <loc>https://box.tama.guru/change-logs</loc>
+ <priority>0.3</priority>
+ <lastmod>2026-02-27</lastmod>
+ <changefreq>weekly</changefreq>
+</url>
+
+</urlset>
\ No newline at end of file
diff --git a/.workbuddy/backup/domain-shiroko-20260906/text.go b/.workbuddy/backup/domain-shiroko-20260906/text.go
new file mode 100644
index 0000000..60cc7f4
--- /dev/null
+++ b/.workbuddy/backup/domain-shiroko-20260906/text.go
@@ -0,0 +1,118 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package censor
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"strings"
+)
+
+type ForbiddenType string
+
+const (
+	ForbiddenTypeSpam        ForbiddenType = "spam"
+	ForbiddenTypeAd          ForbiddenType = "ad"
+	ForbiddenTypePolitics    ForbiddenType = "politics"
+	ForbiddenTypeTerrorism   ForbiddenType = "terrorism"
+	ForbiddenTypeAbuse       ForbiddenType = "abuse"
+	ForbiddenTypePorn        ForbiddenType = "porn"
+	ForbiddenTypeFlood       ForbiddenType = "flood"
+	ForbiddenTypeContraband  ForbiddenType = "contraband"
+	ForbiddenTypeMeaningless ForbiddenType = "meaningless"
+	ForbiddenTypeHarmful     ForbiddenType = "harmful"
+)
+
+func (f ForbiddenType) String() string {
+	return map[ForbiddenType]string{
+		ForbiddenTypeSpam:        "含垃圾信息",
+		ForbiddenTypeAd:          "广告",
+		ForbiddenTypePolitics:    "涉政",
+		ForbiddenTypeTerrorism:   "暴恐",
+		ForbiddenTypeAbuse:       "辱骂",
+		ForbiddenTypePorn:        "色情",
+		ForbiddenTypeFlood:       "灌水",
+		ForbiddenTypeContraband:  "违禁",
+		ForbiddenTypeMeaningless: "无意义",
+		ForbiddenTypeHarmful:     "不良场景",
+	}[f]
+}
+
+type TextCensorResponse struct {
+	SourceName    string          `json:"source_name"`
+	Pass          bool            `json:"pass"`
+	ForbiddenType ForbiddenType   `json:"forbidden_type"`
+	Hint          string          `json:"hint"`
+	Confidence    float64         `json:"confidence"`
+	RawResponse   json.RawMessage `json:"raw_response"`
+}
+
+func (r *TextCensorResponse) ToJSON() []byte {
+	jsonBytes, _ := json.Marshal(r)
+	return jsonBytes
+}
+
+func (r *TextCensorResponse) ErrorMessage() string {
+	errorMessage := "内容安全检查不通过"
+	if r.ForbiddenType != "" {
+		errorMessage += fmt.Sprintf(" [%s]", r.ForbiddenType.String())
+	}
+	if r.Hint != "" {
+		errorMessage += fmt.Sprintf("，相关标签：%q", r.Hint)
+	}
+	return errorMessage
+}
+
+type TextCensor interface {
+	Censor(ctx context.Context, text string) (*TextCensorResponse, error)
+	String() string
+}
+
+var TrustedHosts = []string{
+	"xhslink.com", // 小红书
+	"weibo.com",   // 微博
+	"b23.tv",      // Bilibili
+	"acfun.cn",
+	"aixifan.com",
+	"github.com",
+	"tama.guru",
+	"337845818.best",
+	"x.com",
+	"bilibili.com",
+}
+
+// RemoveTrustedURL removes the trusted URL from the text,
+// in order to bypass the URL censoring.
+// 仅当可信域名后紧跟路径分隔符（/ ? #）或位于字符串结尾时才视为可信，
+// 避免 github.com.evil.tld 被朴素替换误判为 github.com 之子域而漏审。
+func RemoveTrustedURL(str string) string {
+	for _, host := range TrustedHosts {
+		for _, protocol := range []string{"http://", "https://"} {
+			needle := protocol + host
+			var b strings.Builder
+			rest := str
+			for {
+				idx := strings.Index(rest, needle)
+				if idx < 0 {
+					b.WriteString(rest)
+					break
+				}
+				b.WriteString(rest[:idx])
+				after := rest[idx+len(needle):]
+				if len(after) == 0 || after[0] == '/' || after[0] == '?' || after[0] == '#' {
+					// 可信域名边界：跳过该前缀，从域名之后继续（域名本身被移除，不进入审核）。
+					rest = after
+				} else {
+					// 非可信域名边界（如 github.com.evil）：保留前缀，从其后继续扫描。
+					b.WriteString(needle)
+					rest = after
+				}
+			}
+			str = b.String()
+		}
+	}
+	return str
+}
diff --git a/.workbuddy/backup/p0-avatar-qrcode-20260905/internal/storage/s3.go b/.workbuddy/backup/p0-avatar-qrcode-20260905/internal/storage/s3.go
new file mode 100644
index 0000000..7f93ca5
--- /dev/null
+++ b/.workbuddy/backup/p0-avatar-qrcode-20260905/internal/storage/s3.go
@@ -0,0 +1,279 @@
+// Copyright 2024 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package storage
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"image"
+	_ "image/gif"
+	_ "image/jpeg"
+	_ "image/png"
+	"io"
+	"mime/multipart"
+	"os"
+	"os/exec"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/chai2010/webp"
+	"github.com/disintegration/imaging"
+	"github.com/pkg/errors"
+	"github.com/thanhpk/randstr"
+	"github.com/wuhan005/gadget"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/imagecheck"
+)
+
+// MaxUploadBytes 是单次图片上传的内存读取上限（8MB）。
+// 调用方虽在 HTTP 层对 fileHeader.Size 做了校验，但该值可被客户端伪造，
+// 因此在读取前用 io.LimitReader 兜底，避免超大文件将内存撑爆（DoS）。
+const MaxUploadBytes = 8 * 1024 * 1024
+
+// aspect 约束一次上传的宽高比（wantW:wantH，容差 DefaultAspectTolerance）。
+// 头像固定 1:1、页面背景固定 16:9：客户端裁剪后即为精确比例，
+// 服务端复校验用于拦截绕过前端直接 POST 的越界图片。
+type aspect struct {
+	W, H float64
+}
+
+func (a *aspect) check(data []byte) error {
+	if a == nil {
+		return nil
+	}
+	return imagecheck.CheckAspectRatio(bytes.NewReader(data), a.W, a.H, imagecheck.DefaultAspectTolerance)
+}
+
+// UploadAvatarToS3 上传头像：除通用校验/转换外强制 1:1 宽高比。
+func UploadAvatarToS3(file multipart.File, fileHeader *multipart.FileHeader) (string, error) {
+	return uploadPictureToS3(file, fileHeader, &aspect{W: 1, H: 1})
+}
+
+// UploadBackgroundToS3 上传页面背景：除通用校验/转换外强制 16:9 宽高比。
+func UploadBackgroundToS3(file multipart.File, fileHeader *multipart.FileHeader) (string, error) {
+	return uploadPictureToS3(file, fileHeader, &aspect{W: 16, H: 9})
+}
+
+// UploadPictureToS3 上传通用图片到 Cloudflare R2，自动转换为 WebP（动画 GIF 可选转换）
+func UploadPictureToS3(file multipart.File, fileHeader *multipart.FileHeader) (string, error) {
+	return uploadPictureToS3(file, fileHeader, nil)
+}
+
+// uploadPictureToS3 是上传管线实现：读入 → 魔数 → （可选）比例校验 → 像素总量校验
+// → 解码 → WebP 转换 → 落盘 R2。avatar/background 的固定比例校验复用同一管线，
+// 仅通过 aspect 参数区分，避免为一种用途复制一套上传代码。
+func uploadPictureToS3(file multipart.File, fileHeader *multipart.FileHeader, asp *aspect) (string, error) {
+	// 1. 限制读取大小，防止超大上传撑爆内存（DoS）。
+	//    先用 LimitReader 截断到 MaxUploadBytes+1 字节；若实际读到的字节数超过上限则直接拒绝。
+	limited := io.LimitReader(file, MaxUploadBytes+1)
+	fileData, err := io.ReadAll(limited)
+	if err != nil {
+		return "", errors.Wrap(err, "read file data")
+	}
+	if int64(len(fileData)) > MaxUploadBytes {
+		return "", errors.New("uploaded file is too large")
+	}
+
+	// 2. 校验文件魔数，仅允许 JPEG / PNG / GIF / WebP
+	if !isSupportedImage(fileData) {
+		return "", errors.New("unsupported file type: not a valid image")
+	}
+
+	// 2.5 用途宽高比校验（头像 1:1 / 背景 16:9），绕过前端裁剪的直传在此被拦截
+	if err := asp.check(fileData); err != nil {
+		return "", err
+	}
+
+	fileReader := bytes.NewReader(fileData)
+
+	// 3. 解码前先校验像素总量（防解压炸弹），再解码图片获取格式；解码失败则直接返回错误。
+	if err := imagecheck.CheckPixelLimit(bytes.NewReader(fileData)); err != nil {
+		return "", err
+	}
+
+	_, format, err := image.Decode(fileReader)
+	if err != nil {
+		return "", errors.Wrap(err, "image decode failed, file may be corrupted")
+	}
+
+	var uploadData []byte
+	var contentType string
+
+	// 重置 reader，以便后续可能的 resize 操作
+	if _, err := fileReader.Seek(0, io.SeekStart); err != nil {
+		return "", errors.Wrap(err, "reset reader")
+	}
+
+	// 4. 根据格式进行转换或直接使用原图
+	switch format {
+	case "gif":
+		webpData, err := convertGifToAnimatedWebP(fileData)
+		if err != nil {
+			// 转换失败则回退到原始 GIF
+			uploadData = fileData
+			contentType = "image/gif"
+		} else {
+			uploadData = webpData
+			contentType = "image/webp"
+		}
+	default:
+		// 静态图片（JPEG / PNG / WebP 等）转换为静态 WebP
+		webpData, err := ConvertStaticImageToWebP(fileReader)
+		if err != nil {
+			// 转换失败时回退到原始图片
+			uploadData = fileData
+			contentType = mimeTypeFromFormat(format)
+		} else {
+			uploadData = webpData
+			contentType = "image/webp"
+		}
+	}
+
+	// 5. 生成存储路径（无后缀名）
+	now := time.Now()
+	year := now.Year()
+	month := int(now.Month())
+	day := now.Day()
+	key := fmt.Sprintf("%s%d/%02d/%02d/%s", PictureKeyPrefix, year, month, day, randstr.Hex(15))
+
+	// 6. 获取共享 S3 客户端
+	client, err := GetS3Client()
+	if err != nil {
+		return "", errors.Wrap(err, "get S3 client")
+	}
+
+	// 7. 上传到 R2
+	if err := gadget.Retry(5, func() error {
+		_, err := client.PutObject(context.Background(), &s3.PutObjectInput{
+			Bucket:        aws.String(conf.Upload.ImageBucket),
+			Key:           aws.String(key),
+			Body:          bytes.NewReader(uploadData),
+			ContentLength: aws.Int64(int64(len(uploadData))),
+			ContentType:   aws.String(contentType),
+		})
+		return err
+	}); err != nil {
+		return "", errors.Wrap(err, "put object after retry")
+	}
+
+	// 8. 返回 CDN URL
+	return fmt.Sprintf("https://%s/%s", conf.Upload.ImageBucketCDNHost, key), nil
+}
+
+// ConvertStaticImageToWebP 将静态图片（JPEG/PNG等）转换为 WebP 格式
+// 限制最大宽度为 1920px，保持比例
+func ConvertStaticImageToWebP(r io.Reader) ([]byte, error) {
+	// 先整体读入并校验像素总量（防解压炸弹），再完整解码。
+	data, err := io.ReadAll(r)
+	if err != nil {
+		return nil, errors.Wrap(err, "read image")
+	}
+	if err := imagecheck.CheckPixelLimit(bytes.NewReader(data)); err != nil {
+		return nil, errors.Wrap(err, "check image pixel limit")
+	}
+
+	img, _, err := image.Decode(bytes.NewReader(data))
+	if err != nil {
+		return nil, errors.Wrap(err, "decode image")
+	}
+
+	maxWidth := 1920
+	if img.Bounds().Dx() > maxWidth {
+		img = imaging.Resize(img, maxWidth, 0, imaging.Lanczos)
+	}
+
+	buf := new(bytes.Buffer)
+	if err := webp.Encode(buf, img, &webp.Options{Quality: 80}); err != nil {
+		return nil, errors.Wrap(err, "webp encode")
+	}
+	return buf.Bytes(), nil
+}
+
+// convertGifToAnimatedWebP 将 GIF 文件数据转换为动画 WebP（需要系统安装 cwebp 工具）
+// 如果 cwebp 不可用，返回错误，调用方应回退到原始 GIF
+func convertGifToAnimatedWebP(gifData []byte) ([]byte, error) {
+	_, err := exec.LookPath("cwebp")
+	if err != nil {
+		return nil, errors.New("cwebp not found in PATH")
+	}
+
+	tmpGif, err := os.CreateTemp("", "input_*.gif")
+	if err != nil {
+		return nil, errors.Wrap(err, "create temp gif")
+	}
+	defer os.Remove(tmpGif.Name())
+	if _, err := tmpGif.Write(gifData); err != nil {
+		return nil, errors.Wrap(err, "write temp gif")
+	}
+	tmpGif.Close()
+
+	tmpWebp, err := os.CreateTemp("", "output_*.webp")
+	if err != nil {
+		return nil, errors.Wrap(err, "create temp webp")
+	}
+	defer os.Remove(tmpWebp.Name())
+	tmpWebp.Close()
+
+	cmd := exec.Command("cwebp", "-q", "80", "-mixed", "-mt", "-quiet", tmpGif.Name(), "-o", tmpWebp.Name())
+	if err := cmd.Run(); err != nil {
+		return nil, errors.Wrap(err, "run cwebp")
+	}
+
+	webpData, err := os.ReadFile(tmpWebp.Name())
+	if err != nil {
+		return nil, errors.Wrap(err, "read webp output")
+	}
+	return webpData, nil
+}
+
+// mimeTypeFromFormat 根据图片格式返回 MIME 类型
+func mimeTypeFromFormat(format string) string {
+	switch format {
+	case "jpeg":
+		return "image/jpeg"
+	case "png":
+		return "image/png"
+	case "gif":
+		return "image/gif"
+	case "webp":
+		return "image/webp"
+	default:
+		return "application/octet-stream"
+	}
+}
+
+// isSupportedImage 通过文件头魔数判断是否为支持的图片格式
+func isSupportedImage(data []byte) bool {
+	if len(data) < 4 {
+		return false
+	}
+
+	// JPEG: FF D8 FF
+	if data[0] == 0xFF && data[1] == 0xD8 && data[2] == 0xFF {
+		return true
+	}
+
+	// PNG: 89 50 4E 47
+	if bytes.Equal(data[:4], []byte{0x89, 0x50, 0x4E, 0x47}) {
+		return true
+	}
+
+	// GIF: GIF87a / GIF89a
+	if len(data) >= 6 {
+		if bytes.Equal(data[:6], []byte("GIF87a")) || bytes.Equal(data[:6], []byte("GIF89a")) {
+			return true
+		}
+	}
+
+	// WebP: RIFF ... WEBP
+	if len(data) >= 12 && bytes.Equal(data[:4], []byte("RIFF")) && bytes.Equal(data[8:12], []byte("WEBP")) {
+		return true
+	}
+
+	return false
+}
diff --git a/.workbuddy/backup/p0-avatar-qrcode-20260905/templates/base/header.html b/.workbuddy/backup/p0-avatar-qrcode-20260905/templates/base/header.html
new file mode 100644
index 0000000..09c4e2e
--- /dev/null
+++ b/.workbuddy/backup/p0-avatar-qrcode-20260905/templates/base/header.html
@@ -0,0 +1,977 @@
+<!DOCTYPE html>
+<html lang="{{.LangCode}}">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width">
+  <title>{{ .Title }}</title>
+  <meta name="description" content="{{ if .MetaDescription }}{{ .MetaDescription }}{{ else }}{{ t .LangCode "site.description" }}{{ end }}">
+  <meta name="keywords" content="{{ t .LangCode "site.keywords" }}">
+  <!-- 预连接：UIkit 走公共 CDN（cdnjs.snrat.com），其余自托管库仍在本站 R2，均需预连接 -->
+  <link rel="preconnect" href="https://r2.337845818.best" crossorigin>
+  <link rel="preconnect" href="https://cdnjs.snrat.com" crossorigin>
+  <link rel="dns-prefetch" href="https://cn.vercount.one">
+  <!-- UIkit 3.3.3 切到公共 CDN（cdnjs.snrat.com，国内实测全量下载 ~0.25s，原 R2 自建 ~1.4-2.0s） -->
+  <link rel="stylesheet" href="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/css/uikit.min.css"/>
+  <!-- Waline 评论区样式：非阻塞加载，不阻塞首屏渲染 -->
+  <link rel="stylesheet" href="https://r2.337845818.best/tamabox/cdn/waline/client/v2/waline-no-commits.css" media="print" onload="this.media='all'"/>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/js/uikit.min.js"></script>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/js/uikit-icons.min.js"></script>
+  <!-- UIkit 补丁：复刻原自建版 "modify-black-font"（官方版与自建版仅 3 处颜色差异——把有色容器内默认白字/白标题改为黑字）。
+       模板当前只用到 .uk-light 容器（用户背景封面，question/list.html、question-not-found.html；
+       其中 h3/p 已由 #usernamecolor/#introcolor 内联 style 覆盖），故只需补该容器的 3 处投影即可保持渲染一致。
+       若日后新增 .uk-card-primary/.uk-card-secondary/.uk-section-primary/.uk-tile-*/.uk-overlay-primary 等容器且需黑字，须同步扩展。 -->
+  <style>
+      .uk-light { color: rgba(0,0,0,.7); }
+      .uk-light .uk-h1, .uk-light .uk-h2, .uk-light .uk-h3, .uk-light .uk-h4, .uk-light .uk-h5, .uk-light .uk-h6,
+      .uk-light .uk-heading-2xlarge, .uk-light .uk-heading-large, .uk-light .uk-heading-medium, .uk-light .uk-heading-small, .uk-light .uk-heading-xlarge,
+      .uk-light h1, .uk-light h2, .uk-light h3, .uk-light h4, .uk-light h5, .uk-light h6 { color: #000; }
+      .uk-light .uk-table th { color: rgba(0,0,0,.7); }
+  </style>
+  <!-- dayjs/alpinejs/vconsole/waline.js 已迁 cdnjs.snrat.com（sha256 与官方一致，国内实测快 2-7x） -->
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/dayjs/1.10.8/dayjs.min.js"></script>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/alpinejs/3.9.0/cdn.min.js"></script>
+  {{ if .VConsole }}
+  <script src="https://cdnjs.snrat.com/ajax/libs/vConsole/3.12.1/vconsole.min.js" type="application/javascript"></script>
+  <script>new window.VConsole()</script>
+  {{ end }}
+  <!-- jQuery 已改为按需加载：仅 easy.qrcode 二维码页（list/question-not-found/profile）自行引入 -->
+  <script defer src="https://r2.337845818.best/tamabox/cdn/time.box.js"></script>
+  <!--<script src="https://r2.337845818.best/tamabox/cdn/busuanzi.pure.mini.js"/></script>-->
+  <script defer src="https://cn.vercount.one/js"></script>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/waline/2.15.8/waline.js"></script>
+  {{ if eq .CaptchaType "math" }}
+  <!-- 算数验证码：弹窗模式，不影响原布局 -->
+  <style>
+      .captcha-equation-box {
+          display: inline-flex;
+          align-items: center;
+          background: #f0f2f5;
+          border: 1px solid #dcdcdc;
+          border-radius: 8px;
+          padding: 8px 8px 8px 16px;
+          gap: 6px;
+          transition: border-color 0.2s;
+      }
+      .captcha-equation-box:focus-within {
+          border-color: #1e87f0;
+          box-shadow: 0 0 0 3px rgba(30,135,240,0.12);
+      }
+      .math-captcha-modal-question {
+          font-size: 1.4rem;
+          font-family: "Courier New", monospace;
+          font-weight: 700;
+          color: #333;
+          letter-spacing: 1px;
+          white-space: nowrap;
+      }
+      #captcha-modal-answer {
+          width: 80px;
+          padding: 6px 10px;
+          text-align: center;
+          font-size: 1.2rem;
+          font-family: "Courier New", monospace;
+          font-weight: 600;
+          border: 1px solid #ccc;
+          border-radius: 5px;
+          outline: none;
+          transition: border-color 0.15s, box-shadow 0.15s;
+          background: #fff;
+      }
+      #captcha-modal-answer:focus {
+          border-color: #1e87f0;
+          box-shadow: 0 0 0 2px rgba(30,135,240,0.2);
+      }
+      /* 隐藏数字输入框的上下箭头 */
+      #captcha-modal-answer::-webkit-inner-spin-button,
+      #captcha-modal-answer::-webkit-outer-spin-button {
+          -webkit-appearance: none;
+          margin: 0;
+      }
+      #captcha-modal-answer {
+          -moz-appearance: textfield;
+      }
+  </style>
+  {{ else if .RecaptchaTurnstileStyle }}
+  <script src="https://challenges.cloudflare.com/turnstile/v0/api.js?compat=recaptcha" async defer></script>
+  <script>
+      document.addEventListener('DOMContentLoaded', function () {
+          document.querySelectorAll('.g-recaptcha').forEach(item => {
+              item.disabled = true;
+          });
+      });
+
+      function onSubmit() {
+          document.querySelectorAll('.g-recaptcha').forEach(item => {
+              item.disabled = false;
+          })
+      }</script>
+  {{ else }}
+  <script src="{{.RecaptchaDomain}}/recaptcha/api.js" async defer></script>
+  <script>function onSubmit() {document.getElementById('form').submit();}</script>
+  {{ end }}
+  {{ if ne SentryDSN "" }}
+  <script
+          src="https://browser.sentry-cdn.com/7.37.2/bundle.tracing.replay.min.js"
+          integrity="sha384-o0mU2P+zsvXua0Y6f/J55PKWZt3sZCv3qDqJe6J5lZklyIQkpgjBVqNnPWYWqGhf"
+          crossorigin="anonymous"
+  ></script>
+  <script>
+      Sentry.init({
+          dsn: "{{ SentryDSN }}",
+          integrations: [new Sentry.BrowserTracing(), new Sentry.Replay()],
+          tracesSampleRate: 1.0,
+          replaysSessionSampleRate: 0.1,
+          replaysOnErrorSampleRate: 1.0,
+      });
+  </script>
+  {{ end }}
+  <style>
+      .grecaptcha-badge {visibility: hidden;}
+      .icon-container {
+         display: flex;
+         justify-content: center;
+         width: 100%;
+  }
+      .icon {
+         margin-left: 10px;
+         width: 20px; /* 设置图标的宽度 */
+         height: auto; /* 保持图标的高度自动调整 */
+      }
+      .emoji-placeholder {
+         display: inline-block;
+         animation: jump 0.5s ease-in-out;
+      }
+
+      @keyframes jump {
+         0%, 100% { transform: translateY(0); }
+         50% { transform: translateY(-5px); }
+      }
+     /* 防止 UIkit Dropbar 初始闪烁 */
+     .uk-dropbar {
+       opacity: 0;
+       visibility: hidden;
+       transition: opacity 0.2s ease, visibility 0.2s ease;
+     }
+     
+     .uk-dropbar.uk-open {
+       opacity: 1;
+       visibility: visible;
+     }
+     
+     a.uk-button.uk-button-link {
+       text-transform: none;
+     }
+
+     /* 移动端优化：缩小字体和间距，避免右侧空白 */
+     @media (max-width: 640px) {
+         .uk-logo {
+             font-size: 1rem;
+         }
+         .uk-navbar-nav a {
+             font-size: 0.78rem;
+             padding: 0 4px;
+         }
+         .emoji-placeholder {
+             font-size: 1rem;
+         }
+         /* 移动端用户名限宽省略，避免长英文用户名撑爆顶栏 */
+         .tb-nav-username {
+             max-width: 64px;
+             overflow: hidden;
+             text-overflow: ellipsis;
+             white-space: nowrap;
+             display: inline-block;
+             vertical-align: middle;
+         }
+     }
+  </style>
+
+  <!-- 深色模式：html[data-theme="dark"] 时覆盖 UIkit 3.3.3 编译主题的关键颜色 -->
+  <style>
+      html[data-theme="dark"] {
+          --tb-bg: #1a1d23;
+          --tb-surface: #242830;
+          --tb-surface-2: #2d323c;
+          --tb-border: #3a404c;
+          --tb-text: #d8dce4;
+          --tb-text-muted: #8b93a1;
+          --tb-primary: #5c8dff;
+      }
+      /* 根元素与 body 一起覆盖，确保整个视口（含内容不足一屏时的空白区）都是深色背景 */
+      html[data-theme="dark"],
+      html[data-theme="dark"] body {
+          background-color: var(--tb-bg) !important;
+          color: var(--tb-text) !important;
+      }
+      /* 通用表面容器 */
+      html[data-theme="dark"] .uk-card,
+      html[data-theme="dark"] .uk-card-default,
+      html[data-theme="dark"] .uk-card-secondary,
+      html[data-theme="dark"] .uk-dropbar,
+      html[data-theme="dark"] .uk-navbar-dropdown,
+      html[data-theme="dark"] .uk-modal-dialog,
+      html[data-theme="dark"] .uk-dropdown,
+      html[data-theme="dark"] .uk-offcanvas-bar,
+      html[data-theme="dark"] .uk-section,
+      html[data-theme="dark"] .uk-tile,
+      html[data-theme="dark"] .uk-panel,
+      html[data-theme="dark"] .uk-background-default,
+      html[data-theme="dark"] .uk-search-default .uk-search-input {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-navbar-container {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-navbar-nav > li > a,
+      html[data-theme="dark"] .uk-card a,
+      html[data-theme="dark"] .uk-link,
+      html[data-theme="dark"] a.uk-button-link,
+      html[data-theme="dark"] .uk-navbar-dropdown-nav > li > a,
+      html[data-theme="dark"] .uk-dropdown-nav > li > a,
+      html[data-theme="dark"] .uk-list a {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-navbar-nav > li > a:hover,
+      html[data-theme="dark"] .uk-card a:hover,
+      html[data-theme="dark"] .uk-navbar-dropdown-nav > li > a:hover,
+      html[data-theme="dark"] .uk-dropdown-nav > li > a:hover {
+          color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .uk-input,
+      html[data-theme="dark"] .uk-textarea,
+      html[data-theme="dark"] .uk-select {
+          background-color: var(--tb-surface-2) !important;
+          color: var(--tb-text) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] .uk-input:focus,
+      html[data-theme="dark"] .uk-textarea:focus,
+      html[data-theme="dark"] .uk-select:focus {
+          border-color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .uk-text-muted,
+      html[data-theme="dark"] .uk-text-meta,
+      html[data-theme="dark"] .uk-text-secondary,
+      html[data-theme="dark"] .uk-text-muted a,
+      html[data-theme="dark"] .uk-text-small.uk-text-muted {
+          color: var(--tb-text-muted) !important;
+      }
+      html[data-theme="dark"] .uk-divider-icon::after,
+      html[data-theme="dark"] hr,
+      html[data-theme="dark"] .uk-table th,
+      html[data-theme="dark"] .uk-table td,
+      html[data-theme="dark"] .uk-list-divider > li:nth-child(n+2) {
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] .uk-button-default {
+          background-color: var(--tb-surface-2) !important;
+          color: var(--tb-text) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] .uk-modal-title,
+      html[data-theme="dark"] h1, html[data-theme="dark"] h2, html[data-theme="dark"] h3,
+      html[data-theme="dark"] h4, html[data-theme="dark"] h5, html[data-theme="dark"] h6,
+      html[data-theme="dark"] .uk-card-title {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-alert-warning,
+      html[data-theme="dark"] .uk-alert-danger,
+      html[data-theme="dark"] .uk-alert-success,
+      html[data-theme="dark"] .uk-alert-primary {
+          background-color: var(--tb-surface-2) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .uk-modal-dialog {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .captcha-equation-box {
+          background-color: var(--tb-surface-2) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .math-captcha-modal-question {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-answer {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-answer::placeholder {
+          color: var(--tb-text-muted) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .uk-text-meta,
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-refresh {
+          color: var(--tb-text-muted) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-refresh:hover {
+          color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .uk-label {
+          color: #fff !important;
+      }
+      /* 自定义组件（探索页推荐卡片等）深色覆盖 */
+      html[data-theme="dark"] .recommend-card,
+      html[data-theme="dark"] .recommend-card:hover {
+          background-color: var(--tb-surface-2) !important;
+      }
+      html[data-theme="dark"] .explore-name a {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .explore-name a:hover {
+          color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .explore-intro {
+          color: var(--tb-text-muted) !important;
+      }
+      /* 切换按钮图标切换 */
+      #theme-toggle .tb-icon-dark, #theme-toggle-mobile .tb-icon-dark { display: none; }
+      html[data-theme="dark"] #theme-toggle .tb-icon-light,
+      html[data-theme="dark"] #theme-toggle-mobile .tb-icon-light { display: none; }
+      html[data-theme="dark"] #theme-toggle .tb-icon-dark,
+      html[data-theme="dark"] #theme-toggle-mobile .tb-icon-dark { display: inline; }
+  </style>
+
+  <!-- 顶栏自适应：导航全部直接显示，窄屏时分级缩小字号/间距，保证英文/日文等长文字不溢出 -->
+  <style>
+      .uk-navbar-nav a {
+          font-size: 0.95rem;
+          padding: 0 10px;
+      }
+      /* 未登录移动端占位：桌面端隐藏，仅 ≤640px 显示（见下方 media 查询）。
+         桌面端布局与改动前完全一致，不受影响。 */
+      .tb-mobile-balancer { display: none; }
+      /* 桌面端保持 UIkit 原生居中三列布局（无需额外 CSS） */
+      .tb-navbar .uk-logo {
+          white-space: nowrap;
+      }
+      @media (max-width: 1200px) {
+          .uk-navbar-nav a {
+              font-size: 0.88rem;
+              padding: 0 8px;
+          }
+      }
+      @media (max-width: 1000px) {
+          .uk-navbar-nav a {
+              font-size: 0.82rem;
+              padding: 0 6px;
+          }
+          .uk-logo {
+              font-size: 1.1rem;
+          }
+          /* 登录用户名限宽，过长省略号截断 */
+          .tb-nav-username {
+              max-width: 110px;
+              overflow: hidden;
+              text-overflow: ellipsis;
+              white-space: nowrap;
+              display: inline-block;
+              vertical-align: middle;
+          }
+      }
+      @media (max-width: 800px) {
+          .uk-navbar-nav a {
+              font-size: 0.78rem;
+              padding: 0 4px;
+          }
+          .uk-logo {
+              font-size: 1rem;
+          }
+          .tb-nav-username {
+              max-width: 80px;
+          }
+      }
+      /* 手机端（≤640px）：沿用 UIkit 桌面端 navbar 的原生三列定位。
+         不再重写 .uk-navbar-center / center-left / center-right 的定位，
+         避免 logo 被挤到下一行；底部语言与深色模式按钮仍由下方独立栏承载。 */
+      @media (max-width: 640px) {
+          .tb-navbar {
+              position: relative;
+              min-height: 56px;
+              overflow: visible;
+          }
+          .tb-navbar > .uk-navbar-center {
+              position: relative !important;
+              top: auto !important;
+              left: auto !important;
+              right: auto !important;
+              bottom: auto !important;
+              transform: none !important;
+              display: flex !important;
+              align-items: center;
+              justify-content: center;
+              width: 100%;
+              min-height: 56px;
+              white-space: nowrap;
+              flex-wrap: nowrap;
+          }
+          .tb-navbar .uk-navbar-center-left,
+          .tb-navbar .uk-navbar-center-right {
+              position: static !important;
+              top: auto !important;
+              left: auto !important;
+              right: auto !important;
+              bottom: auto !important;
+              transform: none !important;
+              display: flex !important;
+              align-items: center;
+              flex: 0 0 auto;
+              white-space: nowrap;
+          }
+          .tb-navbar .uk-navbar-center-left > div,
+          .tb-navbar .uk-navbar-center-right > div {
+              display: flex;
+              align-items: center;
+              white-space: nowrap;
+          }
+          .tb-navbar .uk-navbar-nav {
+              display: flex;
+              flex-wrap: nowrap;
+              flex: 0 0 auto;
+          }
+          .tb-navbar .uk-navbar-nav > li > a,
+          .tb-navbar .uk-logo {
+              white-space: nowrap;
+          }
+          /* 未登录：移动端显示与「我的」等宽的隐藏占位，使左栏「探索+占位」与
+             右栏「注册/登录」两项等宽，logo 真正居中，左右视觉平衡 */
+          .tb-mobile-balancer { display: block; }
+      }
+  </style>
+
+  <!-- 标签样式的按钮（管理页置顶等）：
+       尺寸完全继承 .uk-label（font-size/padding/line-height/text-transform 等），
+       仅覆盖 button 元素特有的默认样式（边框/字体族/光标等），保证与相邻 span 标签完全一致。 -->
+  <style>
+      .tb-label-btn {
+          border: none !important;
+          cursor: pointer;
+          font-family: inherit;
+          margin: 0;
+          vertical-align: middle;
+          outline: none;
+          background-image: none;
+          box-sizing: border-box;
+          -webkit-appearance: none;
+          appearance: none;
+      }
+      .tb-label-btn:hover {
+          opacity: 0.85;
+      }
+      /* 公开页置顶小图标：仅一个图钉，不占行高、不影响原布局 */
+      .tb-pin-flag {
+          font-size: 0.9em;
+          margin-right: 4px;
+          vertical-align: -1px;
+          cursor: default;
+      }
+  </style>
+
+  <!-- 页脚统计加载动画：替代 fontawesome 的 fa-spinner（纯 CSS，不引字体库） -->
+  <style>
+      .tb-spinner {
+          display: inline-block;
+          width: 0.9em;
+          height: 0.9em;
+          border: 2px solid rgba(128, 128, 128, 0.25);
+          border-top-color: #666;
+          border-radius: 50%;
+          vertical-align: -2px;
+          animation: tb-spin 0.8s linear infinite;
+      }
+      html[data-theme="dark"] .tb-spinner {
+          border-color: rgba(255, 255, 255, 0.2);
+          border-top-color: #bbb;
+      }
+      @keyframes tb-spin {
+          to { transform: rotate(360deg); }
+      }
+  </style>
+
+  <!-- Markdown 渲染排版（问题/回答/追问正文，左对齐以保留排版格式） -->
+  <style>
+      /* 纯文本列表：保留换行与连续空格（pre-wrap），不渲染 Markdown 大字号/彩色 */
+      .tb-preline {
+          white-space: pre-wrap;
+      }
+      /* 纯文本列表：超过 5 行截断并显示省略号（不足 5 行则完整显示） */
+      .tb-clamp-5 {
+          display: -webkit-box;
+          -webkit-box-orient: vertical;
+          -webkit-line-clamp: 5;
+          overflow: hidden;
+      }
+      .md-body {
+          line-height: 1.7;
+          text-align: left;
+          word-break: break-word;
+      }
+      .md-body p { margin: 0.5em 0; }
+      .md-body h1, .md-body h2, .md-body h3,
+      .md-body h4, .md-body h5, .md-body h6 {
+          margin: 0.8em 0 0.4em;
+          font-weight: 600;
+          line-height: 1.4;
+      }
+      .md-body ul, .md-body ol { padding-left: 1.6em; margin: 0.5em 0; }
+      .md-body li { margin: 0.2em 0; }
+      .md-body blockquote {
+          border-left: 3px solid #d3d1c7;
+          margin: 0.6em 0;
+          padding: 0.2em 1em;
+          color: #5f5e5a;
+      }
+      .md-body pre {
+          background: #f5f5f5;
+          padding: 0.8em 1em;
+          border-radius: 6px;
+          overflow-x: auto;
+          margin: 0.6em 0;
+      }
+      .md-body code {
+          background: #f0f0f0;
+          padding: 0.1em 0.35em;
+          border-radius: 4px;
+          font-size: 0.9em;
+      }
+      .md-body pre code { background: none; padding: 0; }
+      .md-body img { max-width: 100%; height: auto; }
+      .md-body table { border-collapse: collapse; margin: 0.6em 0; }
+      .md-body th, .md-body td {
+          border: 1px solid #ddd;
+          padding: 0.4em 0.8em;
+      }
+      .md-body hr { margin: 1em 0; }
+      html[data-theme="dark"] .md-body blockquote {
+          border-color: #3a404c;
+          color: #8b93a1;
+      }
+      html[data-theme="dark"] .md-body pre,
+      html[data-theme="dark"] .md-body code { background: #2d323c; }
+      html[data-theme="dark"] .md-body th,
+      html[data-theme="dark"] .md-body td { border-color: #3a404c; }
+  </style>
+
+  <!-- 投票结果占比条：UIkit 3 已无 .uk-progressbar 类（那是 UIkit 2 的），
+       模板用 <div class="uk-progress"><div class="uk-progressbar"> 结构，需补一套填充样式，
+       否则内层填充无高度/背景，所有占比条都只剩外层灰色轨道，看起来一模一样。 -->
+  <style>
+      .uk-progress {
+          -webkit-appearance: none;
+          -moz-appearance: none;
+          appearance: none;
+          height: 10px;
+          margin: 0;
+          border: none;
+          border-radius: 6px;
+          background-color: #e5e5e5;
+          overflow: hidden;
+          box-shadow: none;
+      }
+      .uk-progressbar {
+          display: block;
+          height: 100%;
+          background-color: #1e87f0;
+          border-radius: 6px 0 0 6px;
+          transition: width 0.3s ease;
+      }
+      html[data-theme="dark"] .uk-progress {
+          background-color: var(--tb-border);
+      }
+      html[data-theme="dark"] .uk-progressbar {
+          background-color: var(--tb-primary);
+      }
+  </style>
+
+  <!-- 移动端底部操作栏：固定底栏承载语言切换与深色模式，桌面端隐藏 -->
+  <style>
+      #tb-mobile-utils {
+          display: none;
+      }
+      @media (max-width: 640px) {
+          /* 顶栏不再容纳语言/深色按钮，恢复原有导航空间 */
+          .tb-nav-utils {
+              display: none !important;
+          }
+          /* 手机端隐藏登录用户名（左边仅保留"探索"），保证 logo 居中、
+             两侧各不超过 2 个短按钮，避免用户名宽度挤压布局 */
+          .tb-nav-username {
+              display: none !important;
+          }
+          /* 固定底部操作栏 */
+          #tb-mobile-utils {
+              display: flex;
+              position: fixed;
+              left: 0;
+              right: 0;
+              bottom: 0;
+              z-index: 1000;
+              justify-content: center;
+              align-items: center;
+              gap: 10px;
+              padding: 8px 12px calc(8px + env(safe-area-inset-bottom));
+              background: rgba(255, 255, 255, 0.92);
+              -webkit-backdrop-filter: blur(8px);
+              backdrop-filter: blur(8px);
+              box-shadow: 0 -2px 12px rgba(0, 0, 0, 0.08);
+          }
+          #tb-mobile-utils .uk-select {
+              width: 110px;
+          }
+          html[data-theme="dark"] #tb-mobile-utils {
+              background: rgba(36, 40, 48, 0.92);
+              box-shadow: 0 -2px 12px rgba(0, 0, 0, 0.4);
+          }
+          /* 给页面底部预留空间，避免页脚内容被固定底栏遮挡 */
+          body {
+              padding-bottom: 56px;
+          }
+      }
+  </style>
+
+<!-- Commit 6d0a3ad -->
+  <meta property="og:site_name" content="{{ t .LangCode "site.title" }}" />
+  <meta property="og:type" content="website" />
+  <meta property="og:title" content="{{ if .IsUserPage }}{{ .PageUser.Name }} - {{ t .LangCode "site.title" }}{{ else }}{{ t .LangCode "site.title" }}{{ end }}" />
+  <meta property="og:url" content="{{ .ExternalURL }}{{ .CurrentURI }}" />
+  <meta property="og:description" content="{{ if .IsUserPage }}{{ .PageUser.Name }} - {{ t .LangCode "site.description" }}{{ else }}{{ t .LangCode "site.description" }}{{ end }}" />
+  {{ if .NoIndex }}<meta name="robots" content="noindex">{{ end }}
+  {{ if .IsUserPage }}
+   <meta property="og:image" content="{{ .PageUser.Avatar }}?og-image=1" />
+   <meta property="og:image:alt" content="{{ .PageUser.Name }}" />
+   <meta itemprop="image" content="{{ .PageUser.Avatar }}?og-image=1"/>
+   <meta name="msapplication-TileImage" content="{{ .PageUser.Avatar }}"/>
+   <link rel="shortcut icon" href="{{ .PageUser.Avatar }}?og-image=1"/>
+   <link rel="apple-touch-icon" href="{{ .PageUser.Avatar }}?og-image=1"/>
+   <link rel="icon" sizes="192x192" href="{{ .PageUser.Avatar }}?og-image=1">
+   <meta name="twitter:image:src" content="{{ .PageUser.Avatar }}?og-image=1" />
+   {{ else }}
+  <meta itemprop="image" content="https://r2.337845818.best/tamabox/tamabox_low.png"/>
+  <meta name="msapplication-TileImage" content="https://r2.337845818.best/tamabox/tamabox_low.png"/>
+  <link rel="shortcut icon" href="https://r2.337845818.best/tamabox/tamabox_low.png" />
+  <link rel="apple-touch-icon" href="https://r2.337845818.best/tamabox/tamabox_low.png"/>
+  <link rel="icon" sizes="192x192" href="https://r2.337845818.best/tamabox/tamabox_low.png">
+  <meta name="twitter:image:src" content="https://r2.337845818.best/tamabox/tamabox_low.png" />
+   {{ end }}
+
+<!-- Google and Bing -->
+  <meta name="google-site-verification" content="fEPwRRJfiGsgwc5SINBQwZhPK8F0cwRaOvRx0YRurI4" />
+  <meta name="msvalidate.01" content="2F185E8E63C93635F50B3574F3B31E42" />
+  <script defer src="https://mami.tama.guru/tamami.js" data-website-id="c42ebe8b-9281-4da0-83a4-8f18b3e710fe"></script>
+</head>
+<nav class="uk-navbar-container uk-margin tb-navbar" uk-navbar>
+  <div class="uk-navbar-center">
+    <div class="uk-navbar-center-left">
+      <div>
+        <ul class="uk-navbar-nav">
+          <!-- 探索链接，始终显示 -->
+          <li><a href="/explore">{{t .LangCode "nav.explore"}}</a></li>
+          {{ if .IsLogged }}
+          <!-- 我的：进入自己的提问箱主页（与右侧「提问/设置」形成左右均衡） -->
+          <li><a href="/_/{{ .LoggedUser.Domain }}">{{t .LangCode "nav.mine"}}</a></li>
+          {{ else }}
+          <!-- 移动端占位：未登录时左栏仅「探索」一项，与右栏「注册/登录」两项不等宽，
+               导致 logo 整体被拉向左（偏左）。移动端(≤640px)显示一个与「我的」等宽的隐藏占位，
+               使左右视觉平衡；桌面端由 .tb-mobile-balancer 隐藏，保持原布局完全不变。 -->
+          <li class="tb-mobile-balancer" aria-hidden="true"><a tabindex="-1" style="visibility:hidden">{{t .LangCode "nav.mine"}}</a></li>
+          {{ end }}
+        </ul>
+      </div>
+    </div>
+
+    <a class="uk-navbar-item uk-logo" href="/"><span class="emoji-placeholder" aria-label="random animal">🐺</span>{{t .LangCode "site.logoSuffix"}}</a>
+
+    <div class="uk-navbar-center-right">
+      <div>
+        {{ if .IsLogged }}
+        <ul class="uk-navbar-nav">
+          <li><a href="/user/questions">{{t .LangCode "nav.ask"}}</a></li>
+        </ul>
+        <ul class="uk-navbar-nav">
+          <li><a href="/user/profile">{{t .LangCode "nav.settings"}}</a></li>
+        </ul>
+        {{ else}}
+        <ul class="uk-navbar-nav">
+          <li><a href="/register">{{t .LangCode "nav.register"}}</a></li>
+        </ul>
+        <ul class="uk-navbar-nav">
+          <li><a href="/login">{{t .LangCode "nav.login"}}</a></li>
+        </ul>
+        {{ end }}
+        {{ if not .IsUserPage }}
+        <!-- 语言切换（紧凑图标，点击展开；移动端隐藏，见底部操作栏） -->
+        <ul class="uk-navbar-nav tb-nav-utils">
+          <li>
+            <a href="#" aria-label="{{t .LangCode "common.lang"}}" title="{{t .LangCode "common.lang"}}">🌐</a>
+            <div class="uk-navbar-dropdown" uk-drop="mode: click; pos: bottom-right">
+              <ul class="uk-nav uk-navbar-dropdown-nav">
+                {{ range .SupportedLangs }}
+                <li class="{{ if eq .Code $.LangCode }}uk-active{{ end }}">
+                  <a href="/i18n/{{ .Code }}?to={{ urlquery $.CurrentURI }}">{{ .Name }}</a>
+                </li>
+                {{ end }}
+              </ul>
+            </div>
+          </li>
+        </ul>
+        {{ end }}
+        <!-- 深色模式切换（紧凑图标；移动端隐藏，见底部操作栏） -->
+        <ul class="uk-navbar-nav tb-nav-utils">
+          <li>
+            <a href="#" id="theme-toggle" title="{{t .LangCode "common.theme"}}" aria-label="{{t .LangCode "common.theme"}}">
+              <span class="tb-icon-light">🌙</span><span class="tb-icon-dark">☀️</span>
+            </a>
+          </li>
+        </ul>
+      </div>
+    </div>
+  </div>
+</nav>
+
+<script>
+document.addEventListener("DOMContentLoaded", function() {
+    const emojis = ["🐺","🐗","🐻","🐨","🐼","🐹","🐭","🐰","🦊","🐮","🐷","🐽","🐸","🐒","🦍","🐔","🐧","🐦","🐤","🐦‍⬛","🦅","🦉","🦇","🐴","🦄","🐝","🦎","🦖","🦕","🐙","🦑","🦐","🦞","🦀","🐡","🐠","🐟","🐬","🐳","🐋","🦈","🐊","🐅","🐆","🦓","🦍","🦧","🐘","🦛","🦏","🐪","🐫","🦒","🦘","🐃","🐂","🐄","🐎","🐖","🐏","🐑","🦙","🐐","🦌","🐕","🐩","🦮","🐕‍🦺","🐈","🐋","🐳","🐬","🐉","🐲"];
+    const placeholder = document.querySelector('.emoji-placeholder');
+    if (placeholder) {
+        placeholder.textContent = emojis[Math.floor(Math.random() * emojis.length)];
+    }
+});
+</script>
+
+<!-- 移动端固定底部操作栏：语言切换 + 深色模式（桌面端隐藏） -->
+<div id="tb-mobile-utils">
+  {{ if not .IsUserPage }}
+  <select id="mobile-lang-select" class="uk-select uk-form-small" aria-label="{{t .LangCode "common.lang"}}">
+    {{ range .SupportedLangs }}
+    <option value="{{ .Code }}" {{ if eq .Code $.LangCode }}selected{{ end }}>{{ .Name }}</option>
+    {{ end }}
+  </select>
+  {{ end }}
+  <button type="button" id="theme-toggle-mobile" class="uk-button uk-button-default uk-button-small"
+          title="{{t .LangCode "common.theme"}}" aria-label="{{t .LangCode "common.theme"}}">
+    <span class="tb-icon-light">🌙</span><span class="tb-icon-dark">☀️</span>
+  </button>
+</div>
+
+<script>
+(function() {
+    // 深色模式：读取 cookie 应用主题，按钮切换并持久化
+    var THEME_COOKIE = 'theme';
+    function getTheme() {
+        var m = document.cookie.match(/(?:^|;\s*)theme=([^;]*)/);
+        return m ? m[1] : '';
+    }
+    function applyTheme(theme) {
+        if (theme === 'dark') {
+            document.documentElement.setAttribute('data-theme', 'dark');
+        } else {
+            document.documentElement.removeAttribute('data-theme');
+        }
+    }
+    function toggleTheme() {
+        var next = getTheme() === 'dark' ? 'light' : 'dark';
+        applyTheme(next);
+        var expires = new Date(Date.now() + 365 * 24 * 3600 * 1000).toUTCString();
+        document.cookie = THEME_COOKIE + '=' + next + '; path=/; max-age=' + (365 * 24 * 3600) + '; SameSite=Lax';
+    }
+    // 首屏前应用，避免闪烁
+    applyTheme(getTheme());
+    document.addEventListener('DOMContentLoaded', function() {
+        // 桌面顶栏按钮与移动端底部按钮都绑定
+        var buttons = document.querySelectorAll('#theme-toggle, #theme-toggle-mobile');
+        buttons.forEach(function(btn) {
+            btn.addEventListener('click', function(e) {
+                e.preventDefault();
+                toggleTheme();
+            });
+        });
+
+        // 移动端底部语言切换：onchange 跳转到 /i18n/{code}，保留当前页面位置
+        var langSel = document.getElementById('mobile-lang-select');
+        if (langSel) {
+            langSel.addEventListener('change', function() {
+                if (!this.value) return;
+                var to = window.location.pathname + window.location.search;
+                window.location.href = '/i18n/' + encodeURIComponent(this.value) + '?to=' + encodeURIComponent(to);
+            });
+        }
+    });
+})();
+</script>
+
+{{ if .IsPixel }}
+<div>
+{{ else }}
+<div class="uk-container uk-container-xsmall">
+{{ end }}
+
+{{ if eq .CaptchaType "math" }}
+<!-- 算数验证码弹窗 --><div id="math-captcha-modal" uk-modal>
+  <div class="uk-modal-dialog uk-modal-body uk-text-center">
+    <h3 class="uk-modal-title">{{t .LangCode "captcha.title"}}</h3>
+    <p class="uk-text-meta">{{t .LangCode "captcha.hint"}}</p>
+    <div class="captcha-equation-box">
+      <span id="captcha-modal-question" class="math-captcha-modal-question">{{t .LangCode "captcha.loading"}}</span>
+      <input type="number" id="captcha-modal-answer" placeholder="?" autocomplete="off" inputmode="numeric">
+    </div>
+    <div style="margin-top:6px;">
+      <button type="button" class="uk-button uk-button-text uk-text-small" id="captcha-modal-refresh">{{t .LangCode "captcha.refresh"}}</button>
+    </div>
+    <div id="captcha-modal-error" class="uk-text-danger uk-text-small" style="display:none;min-height:20px;"></div>
+    <div class="uk-margin-small-top">
+      <button type="button" class="uk-button uk-button-primary" id="captcha-modal-submit">{{t .LangCode "captcha.submit"}}</button>
+      <button type="button" class="uk-button uk-button-default uk-modal-close">{{t .LangCode "common.cancel"}}</button>
+    </div>
+  </div>
+</div>
+
+<script>
+var CAPTCHA_I18N = {
+  loading: "{{t .LangCode "captcha.loading"}}",
+  loadFailed: "{{t .LangCode "captcha.loadFailed"}}",
+  loadRetry: "{{t .LangCode "captcha.loadRetry"}}",
+  inputAnswer: "{{t .LangCode "captcha.inputAnswer"}}",
+  wrongAnswer: "{{t .LangCode "captcha.wrongAnswer"}}",
+  verifyFailed: "{{t .LangCode "captcha.verifyFailed"}}",
+  needPassword: "{{t .LangCode "ask.needPassword"}}",
+  needEmail: "{{t .LangCode "ask.pleaseEmail"}}"
+};
+</script>
+
+<script>
+(function() {
+  var captchaId = '';
+  var pendingForm = null;
+  var pendingNeedPassword = false;
+  var verifying = false;
+
+  function fetchCaptcha() {
+    var qEl = document.getElementById('captcha-modal-question');
+    var errEl = document.getElementById('captcha-modal-error');
+    var ansEl = document.getElementById('captcha-modal-answer');
+    qEl.textContent = CAPTCHA_I18N.loading;
+    fetch('/api/captcha/generate')
+      .then(function(r) { return r.json(); })
+      .then(function(data) {
+        if (data.code === 0 && data.data) {
+          captchaId = data.data.id;
+          qEl.textContent = data.data.question;
+          if (errEl) errEl.style.display = 'none';
+          if (ansEl) { ansEl.value = ''; ansEl.focus(); }
+        } else {
+          qEl.textContent = CAPTCHA_I18N.loadFailed;
+        }
+      })
+      .catch(function() {
+        qEl.textContent = CAPTCHA_I18N.loadRetry;
+      });
+  }
+
+  function getCSRFToken() {
+    var input = document.querySelector('input[name="_csrf"]');
+    return input ? input.value : '';
+  }
+
+  function doSubmit(form) {
+    // 将 captcha 答案填入隐藏字段
+    var ans = document.getElementById('captcha-modal-answer').value.trim();
+    var hidden = form.querySelector('[name="g-recaptcha-response"]');
+    if (hidden) hidden.value = captchaId + ':' + (ans || '0');
+
+    UIkit.modal('#math-captcha-modal').hide();
+
+    // 处理 AskPassword（提问箱密码）
+    if (pendingNeedPassword) {
+      UIkit.modal.prompt(CAPTCHA_I18N.needPassword, '', 'password')
+        .then(function(password) {
+          if (password) {
+            var pwInput = document.getElementById('ask_password_input');
+            if (pwInput) pwInput.value = password;
+            form.submit();
+          }
+        });
+    } else {
+      form.submit();
+    }
+  }
+
+  // 验证按钮
+  document.getElementById('captcha-modal-submit').addEventListener('click', function() {
+    if (verifying) return;
+    var ans = document.getElementById('captcha-modal-answer').value.trim();
+    if (!ans) {
+      var errEl = document.getElementById('captcha-modal-error');
+      errEl.textContent = CAPTCHA_I18N.inputAnswer;
+      errEl.style.display = 'block';
+      return;
+    }
+    verifying = true;
+    fetch('/api/captcha/verify', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'X-CSRF-Token': getCSRFToken()
+      },
+      body: JSON.stringify({ id: captchaId, answer: parseInt(ans, 10) })
+    })
+    .then(function(r) { return r.json(); })
+    .then(function(data) {
+      verifying = false;
+      if (data.correct) {
+        if (pendingForm) doSubmit(pendingForm);
+      } else {
+        var errEl = document.getElementById('captcha-modal-error');
+        errEl.textContent = CAPTCHA_I18N.wrongAnswer;
+        errEl.style.display = 'block';
+        fetchCaptcha(); // 自动刷新题目
+      }
+    })
+    .catch(function() {
+      verifying = false;
+      var errEl = document.getElementById('captcha-modal-error');
+      errEl.textContent = CAPTCHA_I18N.verifyFailed;
+      errEl.style.display = 'block';
+      fetchCaptcha();
+    });
+  });
+
+  // 回车提交
+  document.getElementById('captcha-modal-answer').addEventListener('keydown', function(e) {
+    if (e.key === 'Enter') {
+      e.preventDefault();
+      document.getElementById('captcha-modal-submit').click();
+    }
+  });
+
+  // 刷新按钮
+  document.getElementById('captcha-modal-refresh').addEventListener('click', fetchCaptcha);
+
+  // 拦截所有带 class="math-captcha-trigger" 的按钮
+  document.addEventListener('click', function(e) {
+    var btn = e.target.closest('.math-captcha-trigger');
+    if (!btn) return;
+    e.preventDefault();
+
+    var form = btn.closest('form');
+    if (!form) return;
+    pendingForm = form;
+
+    // 检查是否需要提问密码
+    pendingNeedPassword = !!(form.querySelector('#ask_password_input'));
+
+    // 邮箱校验（提问页面）
+    var notifyCb = document.getElementById('notify-checkbox');
+    var emailInput = document.getElementById('email-input');
+    if (notifyCb && notifyCb.checked && emailInput && emailInput.value.trim() === '') {
+      UIkit.modal.alert(CAPTCHA_I18N.needEmail);
+      return;
+    }
+
+    fetchCaptcha();
+    UIkit.modal('#math-captcha-modal').show();
+  });
+})();
+</script>
+{{ end }}
\ No newline at end of file
diff --git a/.workbuddy/backup/p0-avatar-qrcode-20260905/templates/question/list.html b/.workbuddy/backup/p0-avatar-qrcode-20260905/templates/question/list.html
new file mode 100644
index 0000000..35f243c
--- /dev/null
+++ b/.workbuddy/backup/p0-avatar-qrcode-20260905/templates/question/list.html
@@ -0,0 +1,309 @@
+{{template "base/header" .}}
+<!-- 头像直连 R2：crossorigin 让 favicon 也以 CORS 模式请求，确保浏览器缓存的响应都带 ACAO；
+     ?v=2 击穿历史上被「无 ACAO 响应」污染的缓存条目（R2 对无 Origin 请求的响应无 Vary，可缓存 31 天） -->
+<link rel="shortcut icon" href="{{.PageUser.Avatar}}?v=2" crossorigin="anonymous"/>
+<link rel="apple-touch-icon" href="{{.PageUser.Avatar}}?v=2" crossorigin="anonymous"/>
+<link rel="icon" sizes="192x192" href="{{.PageUser.Avatar}}?v=2" crossorigin="anonymous">
+<style>
+  /* 投票列表：与探索页"全部投票"一致的列表行样式 */
+  .profile-votes-list { display: grid; gap: 0; }
+  .profile-vote-item {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 16px;
+    min-width: 0;
+    padding: 14px 16px;
+    border-bottom: 1px solid var(--tb-border, #e9e9e9);
+    text-decoration: none;
+  }
+  .profile-vote-item:first-child { border-top: 1px solid var(--tb-border, #e9e9e9); }
+  .profile-vote-item:hover { background: var(--tb-surface-hover, #f8fbff); text-decoration: none; }
+  .profile-vote-content { min-width: 0; }
+  .profile-vote-title {
+    display: block;
+    overflow: hidden;
+    color: var(--tb-text, #333);
+    font-size: 0.98rem;
+    font-weight: 600;
+    line-height: 1.45;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+  }
+  .profile-vote-meta {
+    display: flex;
+    flex-wrap: wrap;
+    align-items: center;
+    gap: 7px;
+    margin-top: 8px;
+  }
+  .profile-vote-meta .uk-label { font-size: 0.72rem; line-height: 1.6; }
+  .profile-vote-action {
+    flex: 0 0 auto;
+    color: var(--tb-primary, #1e87f0);
+    font-size: 0.82rem;
+    white-space: nowrap;
+  }
+  html[data-theme="dark"] .profile-vote-item { border-color: var(--tb-border); }
+  html[data-theme="dark"] .profile-vote-title { color: var(--tb-text); }
+  html[data-theme="dark"] .profile-vote-item:hover { background: rgba(78, 168, 245, 0.10); }
+  /* 个人主页 Tab：与探索页一致的胶囊切换样式 */
+  /* 个人主页 Tab：全宽等分，置于主体顶部，作为一级导航（移动端整行可点） */
+  .profile-tabs {
+    display: flex;
+    gap: 4px;
+    padding: 4px;
+    margin-top: 20px;
+    margin-bottom: 18px;
+    border: 1px solid var(--tb-border, #e5e5e5);
+    border-radius: 9px;
+    background: var(--tb-surface-2, #fafafa);
+  }
+  .profile-tab {
+    flex: 1;
+    border: 0;
+    border-radius: 6px;
+    padding: 9px 15px;
+    background: transparent;
+    color: var(--tb-text-muted, #666);
+    cursor: pointer;
+    font-size: 0.9rem;
+    transition: background 0.2s ease, color 0.2s ease;
+  }
+  .profile-tab:hover { color: var(--tb-primary, #1e87f0); }
+  .profile-tab.is-active {
+    background: var(--tb-surface, #fff);
+    box-shadow: 0 1px 3px rgba(0, 0, 0, 0.10);
+    color: var(--tb-primary, #1e87f0);
+    font-weight: 600;
+  }
+  /* 功能关闭时置灰禁用的 Tab（如投票功能关闭） */
+  .profile-tab.is-disabled,
+  .profile-tab:disabled {
+    cursor: not-allowed;
+    color: var(--tb-text-muted, #999);
+    opacity: 0.7;
+  }
+  .profile-tab.is-disabled:hover { color: var(--tb-text-muted, #999); }
+  .profile-panel[hidden] { display: none !important; }
+  html[data-theme="dark"] .profile-tabs {
+    border-color: var(--tb-border);
+    background: var(--tb-surface-2);
+  }
+  html[data-theme="dark"] .profile-tab { color: var(--tb-text-muted); }
+  html[data-theme="dark"] .profile-tab.is-active { background: var(--tb-surface); color: var(--tb-primary); }
+  html[data-theme="dark"] .profile-tab.is-disabled { color: var(--tb-text-muted); opacity: 0.55; }
+</style>
+<div class="uk-card uk-card-default uk-text-center">
+  <div class="uk-flex uk-flex-center uk-flex-middle uk-background-cover uk-light" style="min-height: 260px;" data-src="{{ .PageUser.Background }}" uk-img>
+    <div class="uk-card-body">
+      <img class="uk-border-circle uk-box-shadow-large" src="{{ if .PageUser.Avatar }}{{ .PageUser.Avatar }}?v=2{{ else }}{{ .DefaultAvatar }}{{ end }}" crossorigin="anonymous" style="width: 100px; height: 100px; max-width: 100%; max-height: 100%;">
+      <h3 id="usernamecolor">{{ .PageUser.Name }}</h3>
+      <p id="introcolor">{{ .PageUser.Intro }}</p>
+        <div class="icon-container">
+        {{ if and .PageUser.Acfunlink (ne .PageUser.Acfunlink "none") }}
+         <a href="https://{{.PageUser.Acfunlink}}" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/ailicili.png" alt="acfunlink" class="icon">
+         </a>
+        {{ end }}
+        {{ if and .PageUser.Bililink (ne .PageUser.Bililink "none") }}
+         <a href="https://{{.PageUser.Bililink}}" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/bili.png" alt="bililink" class="icon">
+         </a>
+        {{ end }}
+        {{ if and .PageUser.Weibolink (ne .PageUser.Weibolink "none") }}
+         <a href="https://{{.PageUser.Weibolink}}" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/weibo.png" alt="weibolink" class="icon">
+         </a>
+        {{ end }}
+        {{ if and .PageUser.Xiaohongshulink (ne .PageUser.Xiaohongshulink "none") }}
+         <a href="https://{{.PageUser.Xiaohongshulink}}" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/xiaohongshu.png" alt="xiaohongshulink" class="icon">
+         </a>
+        {{ end }}
+        {{ if and .PageUser.Bloglink (ne .PageUser.Bloglink "none") }}
+          <a href="https://{{.PageUser.Bloglink}}" target="_blank">
+           <img src="https://r2.337845818.best/tamabox/icon/social/blog.png" alt="bloglink" class="icon">
+         </a>
+        {{ end }}
+        </div>
+    </div>
+  </div>
+</div>
+<script>
+document.getElementById("usernamecolor").style.color = "{{.PageUser.Usernamecolor}}";
+document.getElementById("introcolor").style.color = "{{.PageUser.Introcolor}}";
+</script>
+<div>
+  <div class="uk-card uk-card-default uk-card-small uk-card-body">
+    {{ if .CanAsk }}
+    <!-- jQuery 已改为按需加载：defer 按文档顺序先于 easy.qrcode 执行，保证就绪 -->
+    <script defer src="https://cdnjs.snrat.com/ajax/libs/jquery/3.7.1/jquery.min.js"></script>
+    <script defer src='https://r2.337845818.best/tamabox/cdn/js/remake/easy.qrcode.min.js' type="text/javascript"  charset="utf-8"></script>
+    <center><div id="boxqrimg"></div></center>
+    <script type="text/javascript">
+    document.addEventListener('DOMContentLoaded', function () {
+        var options = {
+            text: window.location.href,
+            width: 200,
+            height: 200,
+            // 与 Profile 编辑器保持一致：仅当启用自定义前景色时，才把 Qrcodebackcolor 作为前景色；
+            // 否则强制黑色 #000000，避免未勾选却显示自定义前景色、与 Profile 预览不一致。
+            colorDark: ({{.PageUser.UseCustomQRColor}} ? "{{.PageUser.Qrcodebackcolor}}" : "#000000") || "#000000",
+            colorLight: "{{.PageUser.Qrcodecolor}}" || "#FFFFFF",
+            dotScale: parseFloat("{{.PageUser.Dotscale}}") || 0.4,
+            dotScaleTiming: parseFloat("{{.PageUser.Dotscale}}") || 0.4,
+            dotScaleA: parseFloat("{{.PageUser.Dotscale}}") || 0.4,
+            correctLevel: QRCode.CorrectLevel.H,
+            logo: (function () {
+                // ?v=2：击穿曾被无 ACAO 响应污染的浏览器缓存条目；仅对 http(s) 绝对地址追加
+                var a = "{{.PageUser.Avatar}}" || "{{.DefaultAvatar}}";
+                return a ? (a.indexOf("http") === 0 ? a + "?v=2" : a) : undefined;
+            })(),
+            logoWidth: 60,
+            logoHeight: 60,
+            logoBackgroundTransparent: true,
+            // 直连 R2 等跨域图片须以 CORS 模式加载，canvas 才不被污染、可正常导出
+            crossOrigin: 'anonymous',
+            backgroundImage: ("{{.PageUser.BackgroundImage}}" ? "{{.PageUser.BackgroundImage}}" : undefined),
+            backgroundImageAlpha: parseFloat("{{.PageUser.Backgroundimagealpha}}") || 0.8,
+            autoColor: false,
+            PO: "{{.PageUser.Qrcodepdpcolor}}" || "#000000",
+            PI: "{{.PageUser.Qrcodepdpcolor}}" || "#000000",
+            AO: '',
+            AI: '',
+            timing: "{{.PageUser.Qrcodepdpcolor}}" || "#000000"
+        };
+        new QRCode(document.getElementById("boxqrimg"), options);
+    });
+    </script>
+ 
+    <p class="uk-text-center uk-text-small">{{t .LangCode "ask.scan" .PageUser.Name}}<br>{{ if .RegisterOnlyAsk }}{{t .LangCode "ask.registerOnly"}}{{ else }}{{t .LangCode "ask.anonymous"}}{{ end }}</p>
+
+    <div class="uk-text-center uk-margin-small-top">
+        <a id="share-btn" href="/_/{{ .PageUser.Domain }}/share-card" download class="uk-button uk-button-default uk-button-small">
+            📤 {{t .LangCode "ask.share"}}
+        </a>
+    </div>
+
+    <div id="share-loading-overlay" style="display:none; position: fixed; top:0; left:0; width:100%; height:100%; background: rgba(255,255,255,0.85); z-index:9999;">
+        <div style="display:flex; flex-direction:column; align-items:center; justify-content:center; height:100%;">
+            <div uk-spinner="ratio: 2" class="uk-margin-bottom"></div>
+            <p class="uk-text-large uk-text-muted">{{t .LangCode "ask.generating"}}</p>
+        </div>
+    </div>
+
+    <script>
+    (function() {
+        var btn = document.getElementById('share-btn');
+        var overlay = document.getElementById('share-loading-overlay');
+        if (!btn || !overlay) return;
+        btn.addEventListener('click', function(e) {
+            e.preventDefault();
+            overlay.style.display = 'block';
+            btn.style.pointerEvents = 'none';
+            fetch(btn.href)
+                .then(function(response) {
+                    if (!response.ok) throw new Error('{{t .LangCode "ask.networkError"}}');
+                    return response.blob();
+                })
+                .then(function(blob) {
+                    var url = URL.createObjectURL(blob);
+                    var a = document.createElement('a');
+                    a.href = url;
+                    a.download = '{{t .LangCode "ask.shareFilename"}}';
+                    document.body.appendChild(a);
+                    a.click();
+                    setTimeout(function() {
+                        document.body.removeChild(a);
+                        URL.revokeObjectURL(url);
+                    }, 100);
+                })
+                .catch(function(err) {
+                    alert('{{t .LangCode "ask.genFailed"}}');
+                    console.error(err);
+                })
+                .finally(function() {
+                    overlay.style.display = 'none';
+                    btn.style.pointerEvents = 'auto';
+                });
+        });
+    })();
+    </script>
+    {{ end }}
+    {{template "base/alert" .}}
+
+    <!-- 提问 / 投票 切换：默认显示提问，支持 ?tab=votes 直达（服务端初始态）与 #votes hash 覆盖 -->
+    <div class="profile-tabs" role="tablist">
+      <button type="button" class="profile-tab{{ if eq .ActiveProfileTab "questions" }} is-active{{ end }}" data-profile-tab="questions" role="tab" aria-selected="{{ if eq .ActiveProfileTab "questions" }}true{{ else }}false{{ end }}">{{t .LangCode "explore.questionsTab"}}</button>
+      {{ if .VoteEnabled }}
+      <button type="button" class="profile-tab{{ if eq .ActiveProfileTab "votes" }} is-active{{ end }}" data-profile-tab="votes" role="tab" aria-selected="{{ if eq .ActiveProfileTab "votes" }}true{{ else }}false{{ end }}">{{t .LangCode "explore.votesTab"}}</button>
+      {{ else }}
+      <!-- 投票功能关闭：保留 Tab 展示但置灰禁用，hover 提示原因 -->
+      <button type="button" class="profile-tab is-disabled" disabled aria-disabled="true" uk-tooltip="{{ .VoteClosedMessage }}">{{t .LangCode "explore.votesTab"}} <span uk-icon="icon: lock; ratio: 0.8"></span></button>
+      {{ end }}
+    </div>
+
+    <div class="profile-panel" data-profile-panel="questions"{{ if eq .ActiveProfileTab "votes" }} hidden{{ end }}>
+    {{template "question/new-question-template" .}}
+
+    {{ if ne (len .PageQuestions) 0 }}
+    <p class="uk-text-left uk-text-muted uk-text-small">{{t .LangCode "ask.history" .PageUser.Name}} ({{ .AnsweredCount }})</p>
+    {{ template "question/history-template" . }}
+    {{ end }}
+    </div>
+
+    <div class="profile-panel" data-profile-panel="votes"{{ if ne .ActiveProfileTab "votes" }} hidden{{ end }}>
+    {{ if .PageVotes }}
+    <!-- 匿名投票板块：箱主"进行中"的公开投票（列表行样式，与探索页"全部投票"一致） -->
+    <div class="profile-votes-list">
+      {{ range .PageVotes }}
+      <a href="/vote/{{ .LinkToken }}" class="profile-vote-item">
+        <div class="profile-vote-content">
+          <span class="profile-vote-title" title="{{ .Title }}">{{ .Title }}</span>
+          <span class="profile-vote-meta">
+            {{ if eq .Type "single" }}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeSingle"}}</span>{{ end }}
+            {{ if eq .Type "multiple" }}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeMultiple"}}</span>{{ end }}
+            {{ if eq .Type "rating" }}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeRating"}}</span>{{ end }}
+            {{ if eq .Type "rank" }}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeRank"}}</span>{{ end }}
+            {{ if eq .Type "form" }}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeForm"}}</span>{{ end }}
+            <span class="uk-text-meta">{{ .CreatedAt.Format "2006-01-02" }}</span>
+          </span>
+        </div>
+        <span class="profile-vote-action">{{t $.LangCode "vote.page.goVote"}} <span uk-icon="icon: arrow-right; ratio: .8"></span></span>
+      </a>
+      {{ end }}
+    </div>
+    {{ else }}
+    <div class="uk-alert uk-alert-primary uk-margin-remove-top">{{t .LangCode "explore.noVotes"}}</div>
+    {{ end }}
+    </div>
+  </div>
+</div>
+<script>
+document.addEventListener('DOMContentLoaded', function() {
+  var tabs = document.querySelectorAll('[data-profile-tab]');
+  var panels = document.querySelectorAll('[data-profile-panel]');
+  function showPanel(name) {
+    tabs.forEach(function(tab) {
+      var active = tab.dataset.profileTab === name;
+      tab.classList.toggle('is-active', active);
+      tab.setAttribute('aria-selected', active ? 'true' : 'false');
+    });
+    panels.forEach(function(panel) {
+      panel.hidden = panel.dataset.profilePanel !== name;
+    });
+    if (window.history && window.history.replaceState) {
+      window.history.replaceState({}, document.title, window.location.pathname + window.location.search + (name === 'votes' ? '#votes' : ''));
+    }
+  }
+  tabs.forEach(function(tab) {
+    tab.addEventListener('click', function() { showPanel(tab.dataset.profileTab); });
+  });
+  // 仅当投票 Tab 可点击（功能开启）时才响应 #votes hash，避免投票关闭时切到空面板
+  if (window.location.hash === '#votes' && document.querySelector('[data-profile-tab="votes"]')) {
+    showPanel('votes');
+  }
+});
+</script>
+{{template "base/footer" .}}
\ No newline at end of file
diff --git a/.workbuddy/backup/p0-avatar-qrcode-20260905/templates/question/question-not-found.html b/.workbuddy/backup/p0-avatar-qrcode-20260905/templates/question/question-not-found.html
new file mode 100644
index 0000000..eeb6bde
--- /dev/null
+++ b/.workbuddy/backup/p0-avatar-qrcode-20260905/templates/question/question-not-found.html
@@ -0,0 +1,105 @@
+{{template "base/header" .}}
+<!--<link rel="stylesheet" href="https://lf6-cdn-tos.bytecdntp.com/cdn/expire-1-y/uikit/3.3.3/css/uikit.min.css">-->
+<!-- 头像直连 R2：crossorigin 让 favicon 也以 CORS 模式请求，确保浏览器缓存的响应都带 ACAO；
+     ?v=2 击穿历史上被「无 ACAO 响应」污染的缓存条目 -->
+<link rel="shortcut icon"
+      href="{{.PageUser.Avatar}}?v=2" crossorigin="anonymous"/>
+<link rel="apple-touch-icon"
+      href="{{.PageUser.Avatar}}?v=2" crossorigin="anonymous"/>
+<link rel="icon" sizes="192x192"
+      href="{{.PageUser.Avatar}}?v=2" crossorigin="anonymous">
+<div class="uk-card uk-card-default uk-text-center">
+  <div class="uk-flex uk-flex-center uk-flex-middle uk-background-cover uk-light" style="min-height: 260px;" data-src="{{ .PageUser.Background }}" uk-img>
+    <div class="uk-card-body">
+      <img class="uk-border-circle uk-box-shadow-large" src="{{ if .PageUser.Avatar }}{{ .PageUser.Avatar }}?v=2{{ else }}{{ .DefaultAvatar }}{{ end }}" crossorigin="anonymous" style="width: 100px; height: 100px; max-width: 100%; max-height: 100%;">
+      <h3 id="usernamecolor">{{ .PageUser.Name }}</h3>
+      <p id="introcolor">{{ .PageUser.Intro }}</p>
+        <div class="icon-container">
+        {{ if and .PageUser.Acfunlink (ne .PageUser.Acfunlink "none") }}
+         <a href="https://{{.PageUser.Acfunlink}}" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/ailicili.png" alt="acfunlink" class="icon">
+         </a>
+        {{ end }}
+        {{ if and .PageUser.Bililink (ne .PageUser.Bililink "none") }}
+         <a href="https://{{.PageUser.Bililink}}" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/bili.png" alt="bililink" class="icon">
+         </a>
+        {{ end }}
+        {{ if and .PageUser.Weibolink (ne .PageUser.Weibolink "none") }}
+         <a href="https://{{.PageUser.Weibolink}}" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/weibo.png" alt="weibolink" class="icon">
+         </a>
+        {{ end }}
+        {{ if and .PageUser.Xiaohongshulink (ne .PageUser.Xiaohongshulink "none") }}
+         <a href="https://{{.PageUser.Xiaohongshulink}}" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/xiaohongshu.png" alt="xiaohongshulink" class="icon">
+         </a>
+        {{ end }}
+        {{ if and .PageUser.Bloglink (ne .PageUser.Bloglink "none") }}
+          <a href="https://{{.PageUser.Bloglink}}" target="_blank">
+           <img src="https://r2.337845818.best/tamabox/icon/social/blog.png" alt="bloglink" class="icon">
+         </a>
+        {{ end }}
+        </div>
+    </div>
+  </div>
+</div>
+<script>
+document.getElementById("usernamecolor").style.color = {{.PageUser.Usernamecolor}};
+document.getElementById("introcolor").style.color = {{.PageUser.Introcolor}};
+</script>
+<div>
+  <div class="uk-card uk-card-default uk-card-small uk-card-body">
+    {{ if .CanAsk }}
+    <!-- jQuery 按需加载（同步，保证下方内联二维码初始化就绪） -->
+    <script src="https://cdnjs.snrat.com/ajax/libs/jquery/3.7.1/jquery.min.js"></script>
+    <script src='https://r2.337845818.best/tamabox/cdn/js/remake/easy.qrcode.min.js' type="text/javascript"  charset="utf-8"></script>
+    <center><div id="boxqrimg"></div></center>
+    <script type="text/javascript">
+        var options = {
+            text: window.location.href,
+            width: 200,
+            height: 200,
+            // 与 Profile 编辑器保持一致：仅当启用自定义前景色时，才把 Qrcodebackcolor 作为前景色；
+            // 否则强制黑色 #000000，避免未勾选却显示自定义前景色、与 Profile 预览不一致。
+            colorDark: ({{.PageUser.UseCustomQRColor}} ? "{{.PageUser.Qrcodebackcolor}}" : "#000000") || "#000000",
+            colorLight: "{{.PageUser.Qrcodecolor}}" || "#FFFFFF",
+            dotScale: parseFloat("{{.PageUser.Dotscale}}") || 0.4,
+            dotScaleTiming: parseFloat("{{.PageUser.Dotscale}}") || 0.4,
+            dotScaleA: parseFloat("{{.PageUser.Dotscale}}") || 0.4,
+            correctLevel: QRCode.CorrectLevel.H,
+            logo: (function () {
+                // ?v=2：击穿曾被无 ACAO 响应污染的浏览器缓存条目；仅对 http(s) 绝对地址追加
+                var a = "{{.PageUser.Avatar}}" || "{{.DefaultAvatar}}";
+                return a ? (a.indexOf("http") === 0 ? a + "?v=2" : a) : undefined;
+            })(),
+            logoWidth: 60,
+            logoHeight: 60,
+            logoBackgroundTransparent: true,
+            // 直连 R2 等跨域图片须以 CORS 模式加载，canvas 才不被污染、可正常导出
+            crossOrigin: 'anonymous',
+            backgroundImage: ("{{.PageUser.BackgroundImage}}" ? "{{.PageUser.BackgroundImage}}" : undefined),
+            backgroundImageAlpha: parseFloat("{{.PageUser.Backgroundimagealpha}}") || 0.8,
+            autoColor: false,
+            PO: "{{.PageUser.Qrcodepdpcolor}}" || "#000000",
+            PI: "{{.PageUser.Qrcodepdpcolor}}" || "#000000",
+            AO: '',
+            AI: '',
+            timing: "{{.PageUser.Qrcodepdpcolor}}" || "#000000"
+        };
+        new QRCode(document.getElementById("boxqrimg"), options);
+    </script>
+ 
+    <p class="uk-text-center uk-text-small">扫码向@{{ .PageUser.Name }}提问<br>{{ if .RegisterOnlyAsk }}{{t .LangCode "ask.registerOnly"}}{{ else }}{{t .LangCode "ask.anonymous"}}{{ end }}</p>
+    {{ end }}
+    {{template "base/alert" .}}
+    {{template "question/new-question-template" .}}
+
+    <hr class="uk-divider-icon">
+    {{ if ne (len .PageQuestions) 0 }}
+    <p class="uk-text-left uk-text-muted uk-text-small">@{{ .PageUser.Name }} 以前回答过的问题 ({{ .AnsweredCount }})</p>
+    {{ template "question/history-template" . }}
+    {{ end }}
+  </div>
+</div>
+{{template "base/footer" .}}
\ No newline at end of file
diff --git a/.workbuddy/backup/p0-avatar-qrcode-20260905/templates/user/profile.html b/.workbuddy/backup/p0-avatar-qrcode-20260905/templates/user/profile.html
new file mode 100644
index 0000000..5e337d6
--- /dev/null
+++ b/.workbuddy/backup/p0-avatar-qrcode-20260905/templates/user/profile.html
@@ -0,0 +1,1527 @@
+{{template "base/header" .}}
+
+<!-- 二维码预览依赖 jQuery（同步加载，保证下方 easy.qrcode 初始化就绪）；jQuery 统一使用 3.7.1 -->
+<script src="https://cdnjs.snrat.com/ajax/libs/jquery/3.7.1/jquery.min.js"></script>
+<script src='https://r2.337845818.best/tamabox/cdn/js/remake/easy.qrcode.min.js' type="text/javascript" charset="utf-8"></script>
+
+<!-- Pickr 颜色选择器 -->
+<link rel="stylesheet" href="https://r2.337845818.best/tamabox/cdn/lib/pickr/1.10.1/nano.min.css"/>
+<script src="https://r2.337845818.best/tamabox/cdn/lib/pickr/1.10.1/pickr.min.js"></script>
+
+<!-- Cropper.js 头像/背景裁剪（迁 cdnjs.snrat.com，sha256 与官方一致；R2 原存非 min 版，snrat 为 min 版语义等价） -->
+<link rel="stylesheet" href="https://cdnjs.snrat.com/ajax/libs/cropperjs/1.6.2/cropper.min.css"/>
+<script src="https://cdnjs.snrat.com/ajax/libs/cropperjs/1.6.2/cropper.min.js"></script>
+
+<style>
+  .range-input-group {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+  }
+  .range-input-group input[type="range"] {
+    flex: 1;
+  }
+  .range-input-group input[type="number"] {
+    width: 70px;
+  }
+  .range-input-group .range-value {
+    min-width: 40px;
+    text-align: right;
+  }
+  .color-picker {
+    display: inline-block;
+    vertical-align: middle;
+  }
+  .preview-card {
+    background: #fff;
+    padding: 20px;
+    border: 1px solid #e5e5e5;
+    border-radius: 8px;
+    text-align: center;
+  }
+  .preview-card .qrcode-wrapper {
+    width: 100%;
+    max-width: 220px;
+    margin: 0 auto;
+  }
+  .theme-btn {
+    margin: 2px;
+    font-size: 0.8rem;
+  }
+  .social-item {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    flex-wrap: wrap;
+  }
+  .social-item label.checkbox-label {
+    margin: 0;
+    white-space: nowrap;
+  }
+  .social-item input[type="text"] {
+    flex: 1;
+  }
+  .social-item input[type="text"]:invalid {
+    border-color: #f0506e;
+  }
+  @media (max-width: 640px) {
+    .preview-card {
+      margin-top: 20px;
+    }
+  }
+
+  /* 面板切换：与提问箱主页一致的胶囊样式（用户设置 / 提问 / 私聊 / 投票） */
+  .profile-tabs {
+    display: flex;
+    gap: 4px;
+    padding: 4px;
+    margin-bottom: 18px;
+    border: 1px solid var(--tb-border, #e5e5e5);
+    border-radius: 9px;
+    background: var(--tb-surface-2, #fafafa);
+  }
+  .profile-tab {
+    flex: 1;
+    border: 0;
+    border-radius: 6px;
+    padding: 9px 8px;
+    background: transparent;
+    color: var(--tb-text-muted, #666);
+    cursor: pointer;
+    font-size: 0.9rem;
+    white-space: nowrap;
+    transition: background 0.2s ease, color 0.2s ease;
+  }
+  .profile-tab:hover { color: var(--tb-primary, #1e87f0); }
+  .profile-tab.is-active {
+    background: var(--tb-surface, #fff);
+    box-shadow: 0 1px 3px rgba(0, 0, 0, 0.10);
+    color: var(--tb-primary, #1e87f0);
+    font-weight: 600;
+  }
+  .profile-panel[hidden] { display: none !important; }
+  html[data-theme="dark"] .profile-tabs {
+    border-color: var(--tb-border);
+    background: var(--tb-surface-2);
+  }
+  html[data-theme="dark"] .profile-tab { color: var(--tb-text-muted); }
+  html[data-theme="dark"] .profile-tab.is-active { background: var(--tb-surface); color: var(--tb-primary); }
+
+  /* 功能控制卡片（部分模板 user/feature-control-form 使用） */
+  .feat-card {
+    display: flex;
+    flex-direction: column;
+    gap: 12px;
+    padding: 16px;
+    border: 1px solid #e5e5e5;
+    border-radius: 8px;
+    background: #fff;
+  }
+  .feat-card-head {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 8px;
+  }
+  .feat-card-head h3 { font-size: 1.05rem; }
+  .feat-status {
+    flex: 0 0 auto;
+    font-size: 0.72rem;
+    line-height: 1.6;
+    padding: 0 8px;
+    border-radius: 2px;
+  }
+  .feat-status.is-open { background: #32d296; color: #fff; }
+  .feat-status.is-closed { background: #f0506e; color: #fff; }
+  .feat-hint {
+    display: block;
+    font-size: 0.78rem;
+    line-height: 1.5;
+    color: #999;
+  }
+  .feat-field { display: block; }
+  .feat-field > label > span {
+    display: block;
+    margin-bottom: 4px;
+    font-size: 0.875rem;
+  }
+  .feat-field-label {
+    display: block;
+    margin-bottom: 4px;
+    font-size: 0.875rem;
+  }
+  /* 收集模式三选一（长期开放 / 定时收集 / 循环定时），胶囊样式复用 .feat-day */
+  .feat-modes {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 6px;
+    margin-bottom: 4px;
+  }
+  .is-hidden { display: none !important; }
+  .feat-field input[type="datetime-local"],
+  .feat-field input[type="number"] { width: 100%; }
+  /* 循环定时（每周开放日 + 每日时间段） */
+  .feat-schedule { display: flex; flex-direction: column; gap: 8px; }
+  .feat-schedule-days {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 6px;
+  }
+  .feat-day {
+    display: inline-flex;
+    align-items: center;
+    gap: 3px;
+    padding: 3px 8px;
+    border: 1px solid #e5e5e5;
+    border-radius: 999px;
+    font-size: 0.78rem;
+    color: #666;
+    cursor: pointer;
+    user-select: none;
+  }
+  .feat-day input { margin: 0; }
+  .feat-day.is-on {
+    border-color: #1e87f0;
+    background: rgba(30, 135, 240, 0.08);
+    color: #1e87f0;
+  }
+  .feat-schedule-times {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 12px;
+  }
+  .feat-schedule-times label {
+    display: flex;
+    align-items: center;
+    gap: 6px;
+    font-size: 0.82rem;
+    color: #666;
+  }
+  .feat-schedule-times input[type="time"] {
+    width: 130px;
+    padding: 4px 8px;
+    border: 1px solid #e5e5e5;
+    border-radius: 4px;
+  }
+  html[data-theme="dark"] .feat-day {
+    border-color: var(--tb-border);
+    color: var(--tb-text-muted);
+  }
+  html[data-theme="dark"] .feat-day.is-on {
+    border-color: #1e87f0;
+    background: rgba(30, 135, 240, 0.14);
+    color: #1e87f0;
+  }
+  html[data-theme="dark"] .feat-schedule-times input[type="time"] {
+    border-color: var(--tb-border);
+    background: var(--tb-surface);
+    color: var(--tb-text);
+  }
+  .feat-quota-line {
+    font-size: 0.82rem;
+    color: #666;
+    text-align: center;
+  }
+  .feat-actions {
+    display: flex;
+    flex-wrap: wrap;
+    justify-content: center;
+    gap: 8px;
+    align-items: center;
+    margin-top: auto;
+  }
+  .feat-actions form { margin: 0; }
+  html[data-theme="dark"] .feat-card {
+    border-color: var(--tb-border);
+    background: var(--tb-surface);
+  }
+  html[data-theme="dark"] .feat-card-head h3 { color: var(--tb-text); }
+  html[data-theme="dark"] .feat-hint,
+  html[data-theme="dark"] .feat-quota-line { color: var(--tb-text-muted); }
+
+  /* 私聊面板聚合卡：chat 专属（功能开关/收集窗口 + 消息上限设置）同卡呈现，
+     feat 卡去掉自身边框避免嵌套；第二区 legend 降级为小节标题 */
+  .chat-zone .feat-card {
+    padding: 0;
+    border: 0;
+    background: transparent;
+  }
+  .chat-zone hr { margin: 14px 0; }
+  .chat-zone .uk-legend {
+    font-size: 1.05rem;
+    margin: 0 0 10px;
+  }
+
+  /* 标签块输入：回车或逗号成词，每个词可独立删除；原 input 隐藏后作为提交载体 */
+  .tb-tag-box {
+    display: flex;
+    flex-wrap: wrap;
+    align-items: center;
+    gap: 6px;
+    padding: 6px 8px;
+    border: 1px solid #e5e5e5;
+    border-radius: 4px;
+    background: #fff;
+    cursor: text;
+  }
+  .tb-tag-box:focus-within { border-color: #1e87f0; }
+  .tb-tag-chip {
+    display: inline-flex;
+    align-items: center;
+    gap: 6px;
+    padding: 2px 8px;
+    border-radius: 3px;
+    background: #1e87f0;
+    color: #fff;
+    font-size: 0.875rem;
+    line-height: 1.8;
+  }
+  .tb-tag-chip button {
+    padding: 0;
+    border: 0;
+    background: transparent;
+    color: inherit;
+    font-size: 1rem;
+    line-height: 1;
+    cursor: pointer;
+    opacity: 0.75;
+  }
+  .tb-tag-chip button:hover { opacity: 1; }
+  .tb-tag-entry {
+    flex: 1;
+    min-width: 120px;
+    border: 0;
+    outline: 0;
+    background: transparent;
+    color: inherit;
+    font-size: 0.875rem;
+  }
+  .tb-tag-meta {
+    display: flex;
+    justify-content: space-between;
+    gap: 8px;
+    margin-top: 4px;
+    font-size: 0.75rem;
+    color: #999;
+  }
+  .tb-tag-error { color: #f0506e; }
+  html[data-theme="dark"] .tb-tag-box {
+    border-color: var(--tb-border);
+    background: var(--tb-surface);
+    color: var(--tb-text);
+  }
+  html[data-theme="dark"] .tb-tag-entry { color: var(--tb-text); }
+  html[data-theme="dark"] .tb-tag-meta { color: var(--tb-text-muted); }
+
+  /* ===== profile account 面板卡片化（复用 UIkit 变量体系，暗色自动跟随） ===== */
+  .tb-pcard {
+    background: #fff;
+    border: 1px solid #e5e5e5;
+    border-radius: 10px;
+    padding: 13px 14px 8px;
+    margin-bottom: 12px;
+  }
+  .tb-pcard-title {
+    margin: 0 0 10px;
+    font-size: 1.02rem;
+    font-weight: 600;
+  }
+  /* 全页纵向压缩：面板内表单字段间距由 UIkit 默认 20px 收紧到 12px */
+  .profile-panel .uk-margin { margin-bottom: 12px; }
+  .tb-pcard-title .tb-pcard-extra {
+    float: right;
+    font-size: 0.76rem;
+    font-weight: 400;
+    color: #999;
+    line-height: 1.6;
+  }
+  /* 头像与背景预览：两项同行、整体居中；头像框与背景框“显示高度”一致（150px） */
+  .tb-media-row {
+    display: flex;
+    flex-wrap: wrap;
+    justify-content: center;
+    align-items: flex-start;
+    gap: 14px 32px;
+  }
+  .tb-media-item {
+    /* 头像列与背景列等宽（280px），内部各自居中 → 两个“更换 xx”组件观感一致 */
+    flex: 0 0 280px;
+    max-width: 100%;
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    text-align: center;
+  }
+  .tb-media-frame {
+    display: block;
+    flex: none;
+    border: 1px solid #e5e5e5;
+    background: #f7f7f7;
+    overflow: hidden;
+  }
+  .tb-media-frame.tb-frame-avatar {
+    width: 150px;
+    height: 150px;
+    border-radius: 50%;
+  }
+  .tb-media-frame.tb-frame-bg {
+    /* 16:9 且高 150 ≈ 头像框直径 150：两框视觉等高 */
+    width: 267px;
+    max-width: 100%;
+    aspect-ratio: 16 / 9;
+    border-radius: 8px;
+  }
+  .tb-media-frame img {
+    width: 100%;
+    height: 100%;
+    object-fit: cover;
+    display: block;
+  }
+  .tb-ratio-tag {
+    display: inline-block;
+    margin: 8px 0 0;
+    font-size: 0.72rem;
+    line-height: 1;
+    color: #666;
+    background: #f4f4f4;
+    border: 1px solid #e5e5e5;
+    border-radius: 999px;
+    padding: 4px 9px;
+  }
+  .tb-file-hint {
+    display: block;
+    font-size: 0.78rem;
+    line-height: 1.5;
+    color: #999;
+    margin-top: 6px;
+  }
+  .tb-media-actions { margin-top: 10px; }
+  /* 更换头像 / 更换背景两个按钮同宽 */
+  .tb-media-actions .uk-button { min-width: 150px; }
+  /* 卡片级保存按钮行（居中）：头像背景、基础资料、二维码、社交、改密各块共用 */
+  .tb-card-save,
+  .tb-media-save {
+    margin-top: 6px;
+    text-align: center;
+  }
+  /* 账号操作：导出两按钮同行、退出登录与停用同行；按钮组居中、说明行小字居中 */
+  .tb-account-actions { margin-top: 0; }
+  .tb-account-pair {
+    display: flex;
+    flex-wrap: wrap;
+    justify-content: center;
+    align-items: center;
+    gap: 10px 14px;
+    padding: 8px 0;
+  }
+  .tb-account-pair form { margin: 0; }
+  .tb-account-note {
+    display: block;
+    margin: 0 0 10px;
+    text-align: center;
+    font-size: 0.78rem;
+    line-height: 1.6;
+    color: #999;
+  }
+  .tb-account-note:last-child { margin-bottom: 0; }
+  /* 裁剪弹窗：图片区域限制在视口内，移动端可用 */
+  .tb-crop-stage {
+    max-width: 100%;
+    text-align: center;
+  }
+  .tb-crop-stage img {
+    display: inline-block;
+    max-width: 100%;
+    max-height: 58vh;
+  }
+  #media-crop-modal .uk-modal-dialog { width: 640px; }
+  .tb-crop-hint { margin-top: 12px; }
+  html[data-theme="dark"] .tb-pcard {
+    border-color: var(--tb-border);
+    background: var(--tb-surface);
+  }
+  html[data-theme="dark"] .tb-pcard-title { color: var(--tb-text); }
+  html[data-theme="dark"] .tb-pcard-extra,
+  html[data-theme="dark"] .tb-file-hint { color: var(--tb-text-muted); }
+  html[data-theme="dark"] .tb-media-frame {
+    border-color: var(--tb-border);
+    background: var(--tb-surface-2);
+  }
+  html[data-theme="dark"] .tb-ratio-tag {
+    color: var(--tb-text-muted);
+    border-color: var(--tb-border);
+    background: var(--tb-surface-2);
+  }
+  html[data-theme="dark"] .tb-account-note { color: var(--tb-text-muted); }
+  html[data-theme="dark"] .tb-pcard .uk-accordion-title {
+    color: var(--tb-text);
+  }
+  html[data-theme="dark"] .tb-pcard .uk-accordion-title:hover {
+    color: var(--tb-primary);
+  }
+  /* 移动端：更紧凑的留白与全宽操作区 */
+  @media (max-width: 640px) {
+    .tb-pcard { padding: 13px 12px 8px; }
+    .tb-media-row { gap: 14px; }
+    .tb-media-item { flex-basis: 100%; width: auto; max-width: none; }
+    .tb-media-frame.tb-frame-avatar { width: 120px; height: 120px; }
+    .tb-media-frame.tb-frame-bg { width: 100%; max-width: none; }
+    .tb-media-actions .uk-button,
+    .tb-media-save .uk-button,
+    .tb-card-save .uk-button { width: 100%; }
+  }
+</style>
+
+<!-- 提示条置于面板之外：任何面板保存后的 flash 都可见（面板会被 hidden 隐藏） -->
+{{template "base/alert" .}}
+
+<!-- 头像/背景裁剪弹窗（Cropper.js）：确认后把裁剪结果写回对应的文件域，随主表单一并提交 -->
+<div id="media-crop-modal" uk-modal>
+  <div class="uk-modal-dialog">
+    <button class="uk-modal-close-default" type="button" uk-close></button>
+    <div class="uk-modal-header">
+      <h2 class="uk-modal-title">{{t .LangCode "profile.cropTitle"}}</h2>
+    </div>
+    <div class="uk-modal-body">
+      <div class="tb-crop-stage">
+        <img id="media-crop-image" alt="">
+      </div>
+      <p class="uk-text-meta tb-crop-hint" id="media-crop-hint"></p>
+    </div>
+    <div class="uk-modal-footer uk-text-right">
+      <button type="button" class="uk-button uk-button-default uk-modal-close">{{t .LangCode "common.cancel"}}</button>
+      <button type="button" class="uk-button uk-button-primary" id="media-crop-confirm">{{t .LangCode "profile.cropConfirm"}}</button>
+    </div>
+  </div>
+</div>
+
+<!-- 面板切换：用户设置 与 提问/私聊/投票 的功能管理分开 -->
+<div class="profile-tabs" role="tablist">
+  <button type="button" class="profile-tab{{ if eq .ActiveProfileTab "account" }} is-active{{ end }}" data-profile-tab="account" role="tab" aria-selected="{{ if eq .ActiveProfileTab "account" }}true{{ else }}false{{ end }}">{{t .LangCode "admin.tabAccount"}}</button>
+  <button type="button" class="profile-tab{{ if eq .ActiveProfileTab "question" }} is-active{{ end }}" data-profile-tab="question" role="tab" aria-selected="{{ if eq .ActiveProfileTab "question" }}true{{ else }}false{{ end }}">{{t .LangCode "explore.questionsTab"}}</button>
+  <button type="button" class="profile-tab{{ if eq .ActiveProfileTab "chat" }} is-active{{ end }}" data-profile-tab="chat" role="tab" aria-selected="{{ if eq .ActiveProfileTab "chat" }}true{{ else }}false{{ end }}">{{t .LangCode "qlist.chatsTab"}}</button>
+  <button type="button" class="profile-tab{{ if eq .ActiveProfileTab "vote" }} is-active{{ end }}" data-profile-tab="vote" role="tab" aria-selected="{{ if eq .ActiveProfileTab "vote" }}true{{ else }}false{{ end }}">{{t .LangCode "explore.votesTab"}}</button>
+</div>
+
+<!-- ===================== 用户设置面板 ===================== -->
+<div class="profile-panel" data-profile-panel="account"{{ if ne .ActiveProfileTab "account" }} hidden{{ end }}>
+<form id="profile-form" method="post" enctype="multipart/form-data" action="/user/profile/update">
+  {{ .CSRFTokenHTML }}
+
+  <!-- 1 基础资料：账号与展示基础信息 -->
+  <section class="tb-pcard">
+    <h3 class="tb-pcard-title">{{t .LangCode "profile.card.basic"}}</h3>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.email"}}</label>
+      <input class="uk-input" type="text" disabled value="{{.LoggedUser.Email}}">
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.name"}}</label>
+      <input name="name" class="uk-input" type="text" value="{{.LoggedUser.Name}}">
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.nameColor"}}</label>
+      <div class="color-picker" data-default="{{.LoggedUser.Usernamecolor}}"></div>
+      <input type="hidden" name="usernamecolor" value="{{.LoggedUser.Usernamecolor}}">
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.intro"}}</label>
+      <input name="intro" class="uk-input" type="text" value="{{.LoggedUser.Intro}}">
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.introColor"}}</label>
+      <div class="color-picker" data-default="{{.LoggedUser.Introcolor}}"></div>
+      <input type="hidden" name="introcolor" value="{{.LoggedUser.Introcolor}}">
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.lang"}}</label>
+      <select name="language" class="uk-select">
+        {{ range .SupportedLangs }}
+        <option value="{{.Code}}" {{ if eq $.LoggedUser.Language .Code }}selected{{ end }}>{{.Name}}</option>
+        {{ end }}
+      </select>
+      <span class="uk-text-small uk-text-muted">{{t .LangCode "admin.langHint"}}</span>
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.notify"}}</label>
+      <label>
+        <input name="notify_email" class="uk-checkbox" type="checkbox"
+               {{ if eq .LoggedUser.Notify "email"}}checked{{end}}>
+        <span class="uk-text-small"> {{t .LangCode "admin.notifyEmail"}}</span>
+      </label>
+    </div>
+    <div class="tb-card-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t .LangCode "profile.saveBasic"}}</button>
+    </div>
+  </section>
+
+  <!-- 2 头像与背景：选择文件即弹裁剪框，预览实时更新；头像 1:1、背景 16:9 -->
+  <section class="tb-pcard">
+    <h3 class="tb-pcard-title">{{t .LangCode "profile.card.avatarBg"}}</h3>
+    <div class="tb-media-row">
+      <div class="tb-media-item">
+        <span class="tb-media-frame tb-frame-avatar">
+          <img id="avatar-prev" alt="" src="{{ if .LoggedUser.Avatar }}{{.LoggedUser.Avatar}}{{ else }}{{.DefaultAvatar}}{{ end }}">
+        </span>
+        <span class="tb-ratio-tag">1:1</span>
+        <div class="tb-media-actions">
+          <input type="file" name="avatar" id="avatar-input" accept="image/*" class="uk-hidden">
+          <button type="button" class="uk-button uk-button-default uk-button-small" data-pick-image="avatar">{{t .LangCode "profile.pickAvatar"}}</button>
+        </div>
+        <span class="tb-file-hint">{{t .LangCode "profile.avatarCropHint"}}</span>
+      </div>
+      <div class="tb-media-item">
+        <span class="tb-media-frame tb-frame-bg">
+          <img id="bg-prev" alt=""{{ if .LoggedUser.Background }} src="{{.LoggedUser.Background}}"{{ end }}>
+        </span>
+        <span class="tb-ratio-tag">16:9</span>
+        <div class="tb-media-actions">
+          <input type="file" name="background" id="background-input" accept="image/*" class="uk-hidden">
+          <button type="button" class="uk-button uk-button-default uk-button-small" data-pick-image="background">{{t .LangCode "profile.pickBackground"}}</button>
+        </div>
+        <span class="tb-file-hint">{{t .LangCode "profile.backgroundCropHint"}}</span>
+      </div>
+    </div>
+    <!-- 图片更换后在此即时保存（与主表单共用提交，裁剪结果随文件域一并上传） -->
+    <div class="tb-media-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t .LangCode "profile.saveMedia"}}</button>
+    </div>
+  </section>
+
+  <!-- 3 二维码样式：默认展开（可折叠），独立保存 -->
+  <section class="tb-pcard">
+    <ul class="uk-accordion" uk-accordion="multiple: true">
+      <li class="uk-open">
+        <a class="uk-accordion-title" href="#">{{t .LangCode "profile.card.qr"}}</a>
+        <div class="uk-accordion-content">
+          <div class="uk-grid" uk-grid>
+            <div class="uk-width-2-3@m uk-width-1-1">
+              <div class="uk-margin">
+                <label class="uk-form-label">{{t .LangCode "admin.qrBgColor"}}</label>
+                <div class="color-picker" data-default="{{.LoggedUser.Qrcodecolor}}"></div>
+                <input type="hidden" name="qrcodecolor" value="{{.LoggedUser.Qrcodecolor}}">
+              </div>
+              <div class="uk-margin">
+                <label class="uk-form-label">{{t .LangCode "admin.qrPdColor"}}</label>
+                <div class="color-picker" data-default="{{.LoggedUser.Qrcodepdpcolor}}"></div>
+                <input type="hidden" name="qrcodepdpcolor" value="{{.LoggedUser.Qrcodepdpcolor}}">
+              </div>
+              <div class="uk-margin">
+                <label class="uk-form-label">{{t .LangCode "admin.qrFgColor"}}</label>
+                <div class="uk-margin-small">
+                  <label>
+                      <input type="checkbox" id="use-custom-fg" name="use_custom_qr_color"
+                             {{ if .LoggedUser.UseCustomQRColor }}checked{{ end }}>
+                      {{t .LangCode "admin.useCustomFg"}}
+                  </label>
+                </div>
+                <div class="color-picker" data-default="{{.LoggedUser.Qrcodebackcolor}}"></div>
+                <input type="hidden" name="qrcodebackcolor" value="{{.LoggedUser.Qrcodebackcolor}}">
+                <span class="uk-text-small uk-text-muted">{{t .LangCode "admin.customFgHint"}}</span>
+              </div>
+              <div class="uk-margin">
+                <label class="uk-form-label">{{t .LangCode "admin.qrDotSize"}}</label>
+                <div class="range-input-group">
+                  <input name="dotscale" class="uk-range" type="range" step="0.01" min="0" max="1" value="{{.LoggedUser.Dotscale}}">
+                  <span class="range-value" id="dotscale-val">{{.LoggedUser.Dotscale}}</span>
+                  <input class="uk-input uk-form-width-xsmall" type="number" step="0.01" min="0" max="1" id="dotscale-num" value="{{.LoggedUser.Dotscale}}">
+                </div>
+              </div>
+              <div class="uk-margin">
+                <label class="uk-form-label">{{t .LangCode "admin.qrBgAlpha"}}</label>
+                <div class="range-input-group">
+                  <input name="backgroundimagealpha" class="uk-range" type="range" step="0.01" min="0" max="1" value="{{.LoggedUser.Backgroundimagealpha}}">
+                  <span class="range-value" id="bgalpha-val">{{.LoggedUser.Backgroundimagealpha}}</span>
+                  <input class="uk-input uk-form-width-xsmall" type="number" step="0.01" min="0" max="1" id="bgalpha-num" value="{{.LoggedUser.Backgroundimagealpha}}">
+                </div>
+              </div>
+              <div class="uk-margin">
+                <label class="uk-form-label">{{t .LangCode "admin.qrBackground"}}</label>
+                <div uk-form-custom="target: true">
+                  <input type="file" name="backgroundimage" accept="image/*" id="backgroundimage-file">
+                  <input class="uk-input uk-form-width-large" type="text" placeholder="{{t .LangCode "admin.qrBackgroundPlaceholder"}}" disabled>
+                </div>
+                <span class="uk-text-small uk-text-muted">{{t .LangCode "admin.qrPreviewHint"}}</span>
+              </div>
+            </div>
+            <div class="uk-width-1-3@m uk-width-1-1">
+              <div class="preview-card">
+                <h4 class="uk-text-center">{{t .LangCode "admin.preview"}}</h4>
+                <div class="qrcode-wrapper" id="qrcode-preview"></div>
+                <hr class="uk-margin-small">
+                <div class="uk-text-small">
+                  <strong>{{t .LangCode "admin.themePreset"}}</strong>
+                  <div class="uk-flex uk-flex-wrap uk-flex-center">
+                    <button type="button" class="uk-button uk-button-default uk-button-small theme-btn" data-theme="default">{{t .LangCode "admin.themeDefault"}}</button>
+                    <button type="button" class="uk-button uk-button-default uk-button-small theme-btn" data-theme="dark">{{t .LangCode "admin.themeDark"}}</button>
+                    <button type="button" class="uk-button uk-button-default uk-button-small theme-btn" data-theme="ocean">{{t .LangCode "admin.themeOcean"}}</button>
+                    <button type="button" class="uk-button uk-button-default uk-button-small theme-btn" data-theme="sunset">{{t .LangCode "admin.themeSunset"}}</button>
+                  </div>
+                </div>
+                <div class="uk-margin-small-top">
+                  <button type="button" id="reset-qr-defaults" class="uk-button uk-button-default uk-button-small uk-width-1-1">{{t .LangCode "admin.resetDefaults"}}</button>
+                </div>
+                <p class="uk-text-meta uk-margin-small-top">{{t .LangCode "admin.previewHint"}}</p>
+              </div>
+            </div>
+          </div>
+        </div>
+      </li>
+    </ul>
+    <div class="tb-card-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t .LangCode "profile.saveQR"}}</button>
+    </div>
+  </section>
+
+  <!-- 4 社交主页：默认展开（可折叠），独立保存 -->
+  <section class="tb-pcard">
+    <ul class="uk-accordion" uk-accordion="multiple: true">
+      <li class="uk-open">
+        <a class="uk-accordion-title" href="#">{{t .LangCode "admin.social"}}</a>
+        <div class="uk-accordion-content">
+          <span class="uk-text-muted">{{t .LangCode "admin.socialHint"}}</span>
+          <div class="uk-margin social-item">
+            <label class="checkbox-label">
+              <input type="checkbox" class="social-enable" data-target="acfunlink"> {{t .LangCode "admin.enableAcfun"}}
+            </label>
+            <input name="acfunlink" class="uk-input social-input" type="text" placeholder="acfun.cn/xxx" value="{{.LoggedUser.Acfunlink}}">
+          </div>
+          <div class="uk-margin social-item">
+            <label class="checkbox-label">
+              <input type="checkbox" class="social-enable" data-target="bililink"> {{t .LangCode "admin.enableBili"}}
+            </label>
+            <input name="bililink" class="uk-input social-input" type="text" placeholder="bilibili.com/xxx" value="{{.LoggedUser.Bililink}}">
+          </div>
+          <div class="uk-margin social-item">
+            <label class="checkbox-label">
+              <input type="checkbox" class="social-enable" data-target="weibolink"> {{t .LangCode "admin.enableWeibo"}}
+            </label>
+            <input name="weibolink" class="uk-input social-input" type="text" placeholder="weibo.com/xxx" value="{{.LoggedUser.Weibolink}}">
+          </div>
+          <div class="uk-margin social-item">
+            <label class="checkbox-label">
+              <input type="checkbox" class="social-enable" data-target="xiaohongshulink"> {{t .LangCode "admin.enableXiaohongshu"}}
+            </label>
+            <input name="xiaohongshulink" class="uk-input social-input" type="text" placeholder="xiaohongshu.com/xxx" value="{{.LoggedUser.Xiaohongshulink}}">
+          </div>
+          <div class="uk-margin social-item">
+            <label class="checkbox-label">
+              <input type="checkbox" class="social-enable" data-target="bloglink"> {{t .LangCode "admin.enableBlog"}}
+            </label>
+            <input name="bloglink" class="uk-input social-input" type="text" placeholder="example.com" value="{{.LoggedUser.Bloglink}}">
+          </div>
+        </div>
+      </li>
+    </ul>
+    <div class="tb-card-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t .LangCode "profile.saveSocial"}}</button>
+    </div>
+  </section>
+
+  <!-- 5 修改密码：保存成功后强制登出，需重新登录 -->
+  <section class="tb-pcard">
+    <h3 class="tb-pcard-title">{{t .LangCode "profile.card.password"}}</h3>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.oldPassword"}}</label>
+      <input name="old_password" class="uk-input" type="password" placeholder="{{t .LangCode "admin.oldPasswordHint"}}" autocomplete="current-password">
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.newPassword"}}</label>
+      <input name="new_password" class="uk-input" type="password" placeholder="{{t .LangCode "admin.newPasswordHint"}}" autocomplete="new-password">
+    </div>
+    <p class="uk-text-small uk-text-muted">{{t .LangCode "profile.pwdNote"}}</p>
+    <hr class="uk-margin-small">
+    <div class="tb-card-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t .LangCode "profile.savePassword"}}</button>
+    </div>
+  </section>
+</form>
+
+<!-- 6 标签与展示：独立表单，保存即生效 -->
+<section class="tb-pcard">
+  <h3 class="tb-pcard-title">{{t .LangCode "admin.tags"}}</h3>
+  <form method="post" action="/user/tags/update">
+    {{ .CSRFTokenHTML }}
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.tagsHint"}}</label>
+      <input name="tags" class="uk-input" type="text" value="{{.LoggedUser.Tags}}" placeholder="{{t .LangCode "admin.tagsPlaceholder"}}"
+             data-tb-tag-input
+             {{ with $.TagLimits }}data-tb-max="{{ .MaxTags }}" data-tb-max-len="{{ .MaxTagLen }}"{{ end }}
+             data-tb-msg-too-many="{{t .LangCode "admin.flash.tagsTooMany"}}"
+             data-tb-msg-too-long="{{t .LangCode "admin.flash.tagTooLong"}}"
+             data-tb-msg-duplicate="{{t .LangCode "admin.tagInputDuplicate"}}"
+             data-tb-msg-hint="{{t .LangCode "admin.tagInputHint"}}">
+    </div>
+    <div class="uk-margin">
+      <label>
+        <input name="show_in_home" class="uk-checkbox" type="checkbox" {{ if .LoggedUser.ShowInHome }}checked{{end}}>
+        <span class="uk-text-small"> {{t .LangCode "admin.showInHome"}}</span>
+      </label>
+    </div>
+    <div class="tb-card-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t .LangCode "admin.updateTags"}}</button>
+    </div>
+  </form>
+</section>
+
+<!-- 7 页面访问密码：独立表单 -->
+<section class="tb-pcard">
+  <h3 class="tb-pcard-title">{{t .LangCode "admin.pagePassword"}}</h3>
+  <form method="post" action="/user/profile/update-page-password">
+    {{ .CSRFTokenHTML }}
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.pagePasswordHint"}}</label>
+      <input name="password" class="uk-input" type="password" placeholder="{{t .LangCode "admin.pagePasswordPlaceholder"}}">
+    </div>
+    <div class="tb-card-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t .LangCode "admin.updatePagePassword"}}</button>
+    </div>
+  </form>
+</section>
+
+<!-- 8 账号操作：导出两按钮同行；退出登录与停用我的账号同行 -->
+<section class="tb-pcard">
+  <h3 class="tb-pcard-title">{{t .LangCode "admin.account"}}</h3>
+  <div class="tb-account-actions">
+    <div class="tb-account-pair">
+      <form action="/user/profile/export" method="post" target="_blank" data-tb-skip-submit-feedback="1">
+        {{ .CSRFTokenHTML }}
+        <button class="uk-button uk-button-default">{{t .LangCode "admin.export"}}</button>
+      </form>
+      <form action="/user/profile/export-json" method="post" target="_blank" data-tb-skip-submit-feedback="1">
+        {{ .CSRFTokenHTML }}
+        <button class="uk-button uk-button-default">{{t .LangCode "admin.exportJSON"}}</button>
+      </form>
+    </div>
+    <span class="tb-account-note">{{t .LangCode "admin.exportHint" (t .LangCode "site.title")}} {{t .LangCode "admin.exportJSONHint"}}</span>
+    <div class="tb-account-pair">
+      <!-- Logout 使用独立 POST 表单（携带 CSRF token），GET 链接会留下 CSRF 风险 -->
+      <form method="post" action="/user/logout">
+        {{ .CSRFTokenHTML }}
+        <button type="submit" class="uk-button uk-button-danger">{{t .LangCode "admin.logout"}}</button>
+      </form>
+      <a class="uk-button uk-button-danger" href="/user/profile/deactivate">{{t .LangCode "admin.deactivate"}}</a>
+    </div>
+    <span class="tb-account-note">{{t .LangCode "admin.deactivateHint" | safe}}</span>
+  </div>
+</section>
+</div><!-- /用户设置面板 -->
+
+
+<!-- ===================== 提问功能管理面板 ===================== -->
+<div class="profile-panel" data-profile-panel="question"{{ if ne .ActiveProfileTab "question" }} hidden{{ end }}>
+  {{ with .FeatureQuestion }}{{template "user/feature-control-form" .}}{{ end }}
+
+  <hr>
+  <div class="uk-margin">
+    <form method="post" action="/user/harassment/update?tab=question">
+      {{ $.CSRFTokenHTML }}
+      <legend class="uk-legend">{{t $.LangCode "admin.harassment"}}</legend>
+      <div class="uk-margin">
+        <label class="uk-form-label">{{t $.LangCode "admin.askLimit"}}</label><br>
+        <label>
+          <input name="register_only" class="uk-checkbox" type="checkbox"
+                 {{ if eq $.LoggedUser.HarassmentSetting "register_only"}}checked{{end}} >
+          <span class="uk-text-small"> {{t $.LangCode "admin.registerOnly"}}</span>
+        </label>
+      </div>
+    <div class="tb-card-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t $.LangCode "admin.updateHarassment"}}</button>
+    </div>
+    </form>
+  </div>
+
+  <!-- 全局屏蔽词：三个功能面板共用同一份（见 user/global-blockwords 部分模板） -->
+  {{ template "user/global-blockwords" (dict "Root" $ "Action" "/user/blockwords/update?tab=question") }}
+
+  <hr>
+  <div class="uk-margin">
+    <form method="post" action="/user/profile/update-ask-password">
+      {{ $.CSRFTokenHTML }}
+      <legend class="uk-legend">{{t $.LangCode "admin.askPassword"}}</legend>
+      <div class="uk-margin">
+        <label class="uk-form-label">{{t $.LangCode "admin.askPasswordHint"}}</label>
+        <input name="password" class="uk-input" type="password" placeholder="{{t $.LangCode "admin.askPasswordPlaceholder"}}">
+      </div>
+    <div class="tb-card-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t $.LangCode "admin.updateAskPassword"}}</button>
+    </div>
+    </form>
+  </div>
+</div><!-- /提问功能管理面板 -->
+
+<!-- ===================== 私聊功能管理面板 ===================== -->
+<div class="profile-panel" data-profile-panel="chat"{{ if ne .ActiveProfileTab "chat" }} hidden{{ end }}>
+  <!-- 私聊专属聚合卡：功能开关/收集窗口 + 私聊设置（消息上限）同属私聊，归入一张卡片 -->
+  <section class="tb-pcard chat-zone">
+    {{ with .FeatureChat }}{{template "user/feature-control-form" .}}{{ end }}
+
+    <hr>
+    <form method="post" action="/user/profile/update-chat-settings">
+      {{ $.CSRFTokenHTML }}
+      <legend class="uk-legend">{{t $.LangCode "admin.chat"}}</legend>
+      <div class="uk-margin">
+        <label class="uk-form-label">{{t $.LangCode "admin.chatMaxMessages"}}</label>
+        {{ with $.ChatLimits }}
+        <input name="chat_max_messages" class="uk-input uk-width-small" type="number" min="1" max="{{ .MaxChatMessages }}" value="{{ $.LoggedUser.ChatMaxMessages }}">
+        {{ end }}
+      </div>
+      <div class="uk-margin">
+        <label class="uk-form-label">{{t $.LangCode "admin.chatDailyLimit"}}</label>
+        {{ with $.ChatLimits }}
+        <input name="chat_daily_limit" class="uk-input uk-width-small" type="number" min="0" max="{{ .DailyMessageLimitMax }}" value="{{ $.LoggedUser.DailyMessageLimit }}">
+        {{ end }}
+        <span class="uk-text-muted uk-text-small">{{t $.LangCode "admin.dailyLimitHint"}}</span>
+      </div>
+      <div class="tb-card-save">
+        <button type="submit" class="uk-button uk-button-primary">{{t $.LangCode "admin.updateChat"}}</button>
+      </div>
+    </form>
+  </section>
+
+  <hr>
+  <!-- 全局屏蔽词：提问/私聊/投票三面板共用同一份（见 user/global-blockwords 部分模板） -->
+  {{ template "user/global-blockwords" (dict "Root" $ "Action" "/user/blockwords/update?tab=chat") }}
+</div><!-- /私聊功能管理面板 -->
+
+<!-- ===================== 投票功能管理面板 ===================== -->
+<div class="profile-panel" data-profile-panel="vote"{{ if ne .ActiveProfileTab "vote" }} hidden{{ end }}>
+  {{ with .FeatureVote }}{{template "user/feature-control-form" .}}{{ end }}
+
+  <hr>
+  <!-- 全局屏蔽词：三个功能面板共用同一份（见 user/global-blockwords 部分模板） -->
+  {{ template "user/global-blockwords" (dict "Root" $ "Action" "/user/blockwords/update?tab=vote") }}
+</div><!-- /投票功能管理面板 -->
+
+<script>
+(function() {
+    // ========== 社交信息复选框交互 + 非空验证 ==========
+    function initSocialCheckboxes() {
+        document.querySelectorAll('.social-item').forEach(function(item) {
+            var checkbox = item.querySelector('.social-enable');
+            var input = item.querySelector('.social-input');
+            if (!checkbox || !input) return;
+
+            // 初始化状态
+            var currentVal = input.value.trim();
+            if (currentVal === 'none' || currentVal === '') {
+                checkbox.checked = false;
+                input.value = 'none';
+                input.disabled = true;
+                input.removeAttribute('required');
+            } else {
+                checkbox.checked = true;
+                input.disabled = false;
+                input.setAttribute('required', 'required');
+            }
+
+            // 复选框切换
+            checkbox.addEventListener('change', function() {
+                if (checkbox.checked) {
+                    input.disabled = false;
+                    if (input.value === 'none') input.value = '';
+                    input.setAttribute('required', 'required');
+                    input.focus();
+                } else {
+                    input.value = 'none';
+                    input.disabled = true;
+                    input.removeAttribute('required');
+                    // 清除可能出现的自定义验证消息
+                    input.setCustomValidity('');
+                }
+            });
+
+            // 输入时清除自定义验证消息
+            input.addEventListener('input', function() {
+                if (input.validity.customError) {
+                    input.setCustomValidity('');
+                }
+            });
+        });
+    }
+
+    // 主表单提交验证
+    var profileForm = document.getElementById('profile-form');
+    profileForm.addEventListener('submit', function(e) {
+        var valid = true;
+        document.querySelectorAll('.social-item').forEach(function(item) {
+            var checkbox = item.querySelector('.social-enable');
+            var input = item.querySelector('.social-input');
+            if (checkbox.checked && input.value.trim() === '') {
+                input.setCustomValidity('{{t .LangCode "admin.socialRequired"}}');
+                valid = false;
+            } else {
+                input.setCustomValidity('');
+            }
+        });
+
+        if (!valid) {
+            e.preventDefault();
+            // 触发第一个无效输入框的报告
+            profileForm.reportValidity();
+        } else {
+            // 提交前确保未启用的项值为 "none"
+            document.querySelectorAll('.social-item').forEach(function(item) {
+                var checkbox = item.querySelector('.social-enable');
+                var input = item.querySelector('.social-input');
+                if (!checkbox.checked) {
+                    input.value = 'none';
+                }
+            });
+        }
+    });
+
+    initSocialCheckboxes();
+
+    // ========== 其余脚本（颜色选择器、预览等） ==========
+    function debounce(func, wait) {
+        var timeout;
+        return function() {
+            var context = this, args = arguments;
+            clearTimeout(timeout);
+            timeout = setTimeout(function() { func.apply(context, args); }, wait);
+        };
+    }
+
+    // Pickr 初始化
+    document.querySelectorAll('.color-picker').forEach(function(el) {
+        var hiddenInput = el.nextElementSibling;
+        if (!hiddenInput || hiddenInput.type !== 'hidden') return;
+        var pickr = Pickr.create({
+            el: el,
+            theme: 'nano',
+            default: hiddenInput.value || '#000000',
+            defaultRepresentation: 'HEX',
+            components: {
+                preview: true,
+                opacity: false,
+                hue: true,
+                interaction: {
+                    hex: true,
+                    input: true,
+                    clear: true,
+                    save: true
+                }
+            }
+        });
+        pickr.on('save', function(color) {
+            var hex = color.toHEXA().toString();
+            hiddenInput.value = hex;
+            hiddenInput.dispatchEvent(new Event('input'));
+        });
+    });
+
+    // 滑块联动
+    function bindRangeNumber(range, num, span) {
+        if (!range || !num) return;
+        var update = function() {
+            num.value = range.value;
+            if (span) span.textContent = parseFloat(range.value).toFixed(2);
+            debouncedUpdatePreview();
+        };
+        range.addEventListener('input', update);
+        num.addEventListener('change', function() {
+            var val = parseFloat(num.value);
+            if (isNaN(val)) return;
+            range.value = val;
+            if (span) span.textContent = val.toFixed(2);
+            debouncedUpdatePreview();
+        });
+        if (span) span.textContent = parseFloat(range.value).toFixed(2);
+    }
+
+    var dotScaleRange = document.querySelector('input[name="dotscale"]');
+    var dotScaleNum = document.getElementById('dotscale-num');
+    var dotScaleSpan = document.getElementById('dotscale-val');
+    var bgAlphaRange = document.querySelector('input[name="backgroundimagealpha"]');
+    var bgAlphaNum = document.getElementById('bgalpha-num');
+    var bgAlphaSpan = document.getElementById('bgalpha-val');
+    bindRangeNumber(dotScaleRange, dotScaleNum, dotScaleSpan);
+    bindRangeNumber(bgAlphaRange, bgAlphaNum, bgAlphaSpan);
+
+    // 背景图即时预览
+    var bgImageFile = document.getElementById('backgroundimage-file');
+    window._bgImageDataURL = null;
+    if (bgImageFile) {
+        bgImageFile.addEventListener('change', function(e) {
+            var file = e.target.files[0];
+            if (!file) return;
+            var reader = new FileReader();
+            reader.onload = function(ev) {
+                window._bgImageDataURL = ev.target.result;
+                debouncedUpdatePreview();
+            };
+            reader.readAsDataURL(file);
+        });
+    }
+
+    // 二维码预览核心
+    var boxURL = window.location.origin + '/_/' + '{{.LoggedUser.Domain}}';
+    var previewEl = document.getElementById('qrcode-preview');
+    var useCustomFg = document.getElementById('use-custom-fg');
+    updatePreview();
+
+    function getInputVal(name, fallback) {
+        var input = document.querySelector('input[name="' + name + '"]');
+        var v = input ? (input.value || '').trim() : '';
+        return v || (fallback || '#000000');
+    }
+
+    function updatePreview() {
+        var useFg = useCustomFg.checked;
+        var containerWidth = previewEl.clientWidth || 220;
+        var size = Math.min(containerWidth, 220);
+        // 关键修复：禁止 autoColor。新用户未设颜色时 easy.qrcode 的 autoColor 会自动取一个
+        // ≈背景色的前景，导致整张二维码变成背景色方块、无法扫描。改为始终传入明确的
+        // colorDark / colorLight 兜底值（空字段时回退到标准黑白）。
+        var dotScaleVal = parseFloat(dotScaleRange.value) || 0.4;
+        var bgAlphaVal = parseFloat(bgAlphaRange.value) || 0.8;
+        var options = {
+            text: boxURL,
+            width: size,
+            height: size,
+            colorDark: useFg ? getInputVal('qrcodebackcolor', '#000000') : '#000000',
+            colorLight: getInputVal('qrcodecolor', '#FFFFFF'),
+            dotScale: dotScaleVal,
+            dotScaleTiming: dotScaleVal,
+            dotScaleA: dotScaleVal,
+            correctLevel: QRCode.CorrectLevel.H,
+            logo: (function () {
+                // ?v=2：击穿曾被无 ACAO 响应污染的浏览器缓存条目；仅对 http(s) 绝对地址追加
+                var a = "{{.LoggedUser.Avatar}}" || "{{.DefaultAvatar}}";
+                return a ? (a.indexOf("http") === 0 ? a + "?v=2" : a) : undefined;
+            })(),
+            logoWidth: Math.floor(size * 0.25),
+            logoHeight: Math.floor(size * 0.25),
+            logoBackgroundTransparent: true,
+            // 直连 R2 等跨域图片须以 CORS 模式加载，画布才不会被污染、可正常导出；
+            // 前提是图片所在桶/域名已配 Access-Control-Allow-Origin（如 R2 CORS Policy）。
+            crossOrigin: 'anonymous',
+            // 默认不注入任何二维码背景图：仅在用户自己上传/设置了 BackgroundImage 时才使用，
+            // 或本次会话通过本地文件选择器临时预览（window._bgImageDataURL）。
+            // 没有背景图时（autoColor:false + 显式 colorDark/colorLight）才能稳定输出可扫描的黑白二维码，
+            // 否则在「无背景图却勾选自定义前景色」时容易糊成一坨。
+            backgroundImage: window._bgImageDataURL || ("{{.LoggedUser.BackgroundImage}}" ? "{{.LoggedUser.BackgroundImage}}" : undefined),
+            backgroundImageAlpha: bgAlphaVal,
+            autoColor: false,
+            PO: getInputVal('qrcodepdpcolor', '#000000'),
+            PI: getInputVal('qrcodepdpcolor', '#000000'),
+            AO: '',
+            AI: '',
+            timing: getInputVal('qrcodepdpcolor', '#000000')
+        };
+        previewEl.innerHTML = '';
+        new QRCode(previewEl, options);
+    }
+
+    var debouncedUpdatePreview = debounce(updatePreview, 150);
+    // 二维码卡默认展开后：若初始不在 account 面板（?tab=question 等），容器曾 hidden 导致
+    // 预览按回退 220px 绘制；面板切回时由 tab 脚本调用本函数按真实宽度重绘。
+    window.__tbRefreshAccountPreview = debouncedUpdatePreview;
+
+    var colorInputs = document.querySelectorAll('input[type="hidden"][name="qrcodebackcolor"], input[type="hidden"][name="qrcodecolor"], input[type="hidden"][name="qrcodepdpcolor"]');
+    colorInputs.forEach(function(input) {
+        input.addEventListener('input', debouncedUpdatePreview);
+    });
+    useCustomFg.addEventListener('change', debouncedUpdatePreview);
+    window.addEventListener('resize', debouncedUpdatePreview);
+    // uk-accordion 展开/收起时按真实宽度重绘（初始默认展开；从其它面板切回见下方 tab 钩子）
+    document.addEventListener('shown', function(e) {
+      if (e.target && e.target.closest && e.target.closest('.uk-accordion')) {
+        debouncedUpdatePreview();
+      }
+    });
+    updatePreview();
+
+    // 预设主题
+    var themes = {
+        'default': {
+            qrcodecolor: '#FFFFFF',
+            qrcodebackcolor: '#000000',
+            qrcodepdpcolor: '#000000',
+            dotscale: 0.35,
+            bgalpha: 0.8
+        },
+        'dark': {
+            qrcodecolor: '#1a1a1a',
+            qrcodebackcolor: '#FFFFFF',
+            qrcodepdpcolor: '#FFFFFF',
+            dotscale: 0.5,
+            bgalpha: 0.9
+        },
+        'ocean': {
+            qrcodecolor: '#E0F7FA',
+            qrcodebackcolor: '#006064',
+            qrcodepdpcolor: '#004D40',
+            dotscale: 0.4,
+            bgalpha: 0.7
+        },
+        'sunset': {
+            qrcodecolor: '#FFF3E0',
+            qrcodebackcolor: '#BF360C',
+            qrcodepdpcolor: '#870000',
+            dotscale: 0.45,
+            bgalpha: 0.75
+        }
+    };
+
+    function applyTheme(theme) {
+        var t = themes[theme];
+        if (!t) return;
+        document.querySelector('input[name="qrcodecolor"]').value = t.qrcodecolor;
+        document.querySelector('input[name="qrcodebackcolor"]').value = t.qrcodebackcolor;
+        document.querySelector('input[name="qrcodepdpcolor"]').value = t.qrcodepdpcolor;
+        dotScaleRange.value = t.dotscale;
+        dotScaleNum.value = t.dotscale;
+        dotScaleSpan.textContent = parseFloat(t.dotscale).toFixed(2);
+        bgAlphaRange.value = t.bgalpha;
+        bgAlphaNum.value = t.bgalpha;
+        bgAlphaSpan.textContent = parseFloat(t.bgalpha).toFixed(2);
+
+        document.querySelector('input[name="qrcodecolor"]').dispatchEvent(new Event('input'));
+        document.querySelector('input[name="qrcodebackcolor"]').dispatchEvent(new Event('input'));
+        document.querySelector('input[name="qrcodepdpcolor"]').dispatchEvent(new Event('input'));
+        debouncedUpdatePreview();
+    }
+
+    document.querySelectorAll('.theme-btn').forEach(function(btn) {
+        btn.addEventListener('click', function() {
+            applyTheme(this.getAttribute('data-theme'));
+        });
+    });
+
+    document.getElementById('reset-qr-defaults').addEventListener('click', function() {
+        applyTheme('default');
+        useCustomFg.checked = false;
+        debouncedUpdatePreview();
+    });
+
+})();
+</script>
+
+<script>
+// 面板切换：用户设置 / 提问 / 私聊 / 投票。
+// 服务端已按 ?tab= 渲染初始面板，此处仅在前端切换，并用 hash 保持可分享。
+document.addEventListener('DOMContentLoaded', function() {
+  var tabs = document.querySelectorAll('[data-profile-tab]');
+  var panels = document.querySelectorAll('[data-profile-panel]');
+  function showPanel(name, pushToURL) {
+    tabs.forEach(function(tab) {
+      var active = tab.dataset.profileTab === name;
+      tab.classList.toggle('is-active', active);
+      tab.setAttribute('aria-selected', active ? 'true' : 'false');
+    });
+    panels.forEach(function(panel) {
+      panel.hidden = panel.dataset.profilePanel !== name;
+    });
+    // 切回用户设置面板时按真实宽度重绘二维码预览（展开状态不会再触发 accordion 'shown'）
+    if (name === 'account' && window.__tbRefreshAccountPreview) {
+      window.__tbRefreshAccountPreview();
+    }
+    if (pushToURL && window.history && window.history.replaceState) {
+      window.history.replaceState({}, document.title, '/user/profile?tab=' + name);
+    }
+  }
+  tabs.forEach(function(tab) {
+    tab.addEventListener('click', function() { showPanel(tab.dataset.profileTab, true); });
+  });
+  var hash = (window.location.hash || '').replace('#', '');
+  if (hash && document.querySelector('[data-profile-tab="' + hash + '"]')) {
+    showPanel(hash, false);
+  }
+});
+</script>
+
+<script>
+// 标签 / 屏蔽词的标签块输入：把原本的逗号分隔文本框升级为"回车或逗号成词 + 逐条删除"。
+// 渐进增强：接管前原 input 就是可用的普通文本框；接管后原 input 转为隐藏的提交载体，
+// 提交前把标签块拼回逗号串写回它，后端解析逻辑完全不变（仍按逗号分隔）。
+(function () {
+  // 后端兼容中文逗号，前端切分口径保持一致
+  function parseList(value) {
+    return String(value || '').split(/[,，]/).map(function (s) {
+      return s.trim();
+    }).filter(function (s) { return s !== ''; });
+  }
+
+  function initTagInput(input) {
+    var max = parseInt(input.getAttribute('data-tb-max'), 10);
+    var maxLen = parseInt(input.getAttribute('data-tb-max-len'), 10);
+    // data 属性缺失（如错误分支重渲染）时回落到与 db 常量一致的宽松值，后端仍是唯一权威
+    if (!max || max < 1) { max = 10; }
+    if (!maxLen || maxLen < 1) { maxLen = 10; }
+    var msgTooMany = input.getAttribute('data-tb-msg-too-many') || '';
+    var msgTooLong = input.getAttribute('data-tb-msg-too-long') || '';
+    var msgDuplicate = input.getAttribute('data-tb-msg-duplicate') || '';
+    var hint = input.getAttribute('data-tb-msg-hint') || '';
+
+    var items = parseList(input.value);
+
+    var box = document.createElement('div');
+    box.className = 'tb-tag-box';
+    var entry = document.createElement('input');
+    entry.type = 'text';
+    entry.className = 'tb-tag-entry';
+    box.appendChild(entry);
+
+    var meta = document.createElement('div');
+    meta.className = 'tb-tag-meta';
+    var count = document.createElement('span');
+    var error = document.createElement('span');
+    error.className = 'tb-tag-error';
+    meta.appendChild(count);
+    meta.appendChild(error);
+
+    var wrap = document.createElement('div');
+    wrap.appendChild(box);
+    wrap.appendChild(meta);
+
+    input.style.display = 'none';
+    if (input.parentNode) { input.parentNode.insertBefore(wrap, input.nextSibling); }
+
+    function sync() { input.value = items.join(','); }
+    function showError(msg) { error.textContent = msg || ''; }
+
+    function commit(raw) {
+      var v = String(raw || '').trim().replace(/[,，]/g, '');
+      if (v === '') { return; }
+      if (items.length >= max) { showError(msgTooMany); return; }
+      if (Array.from(v).length > maxLen) { showError(msgTooLong.replace('%s', v)); return; }
+      if (items.indexOf(v) >= 0) { showError(msgDuplicate); return; }
+      showError('');
+      items.push(v);
+      render();
+    }
+
+    function render() {
+      Array.prototype.slice.call(box.childNodes).forEach(function (node) {
+        if (node !== entry) { box.removeChild(node); }
+      });
+      items.forEach(function (text, i) {
+        var chip = document.createElement('span');
+        chip.className = 'tb-tag-chip';
+        chip.appendChild(document.createTextNode(text));
+        var del = document.createElement('button');
+        del.type = 'button';
+        del.textContent = '×';
+        del.title = text;
+        del.addEventListener('click', function () {
+          items.splice(i, 1);
+          showError('');
+          render();
+        });
+        chip.appendChild(del);
+        box.insertBefore(chip, entry);
+      });
+      entry.disabled = items.length >= max;
+      entry.placeholder = entry.disabled ? '' : hint;
+      count.textContent = items.length + ' / ' + max;
+      sync();
+    }
+
+    box.addEventListener('click', function (e) {
+      if (e.target === box) { entry.focus(); }
+    });
+    entry.addEventListener('input', function () {
+      if (entry.value.indexOf(',') >= 0 || entry.value.indexOf('，') >= 0) {
+        commit(entry.value);
+        entry.value = '';
+      }
+    });
+    entry.addEventListener('keydown', function (e) {
+      if (e.key === 'Enter') {
+        e.preventDefault();
+        commit(entry.value);
+        entry.value = '';
+      } else if (e.key === 'Backspace' && entry.value === '' && items.length > 0) {
+        items.pop();
+        showError('');
+        render();
+      }
+    });
+    // 失焦时收下残留输入，避免"打了字没回车就提交"导致内容丢失
+    entry.addEventListener('blur', function () {
+      if (entry.value.trim() !== '') {
+        commit(entry.value);
+        entry.value = '';
+      }
+    });
+
+    if (input.form) {
+      input.form.addEventListener('submit', function () {
+        commit(entry.value);
+        entry.value = '';
+        sync();
+      });
+    }
+
+    render();
+  }
+
+  document.addEventListener('DOMContentLoaded', function () {
+    document.querySelectorAll('[data-tb-tag-input]').forEach(initTagInput);
+  });
+})();
+</script>
+
+<script data-cfasync="false">
+// ========== 头像 / 背景：选择即弹裁剪框（1:1 / 16:9），确认后写回 file input 随主表单提交 ==========
+(function () {
+  var MSG_AVATAR_TOO_LARGE = '{{t .LangCode "profile.err.avatarTooLarge"}}';
+  var MSG_BG_TOO_LARGE = '{{t .LangCode "profile.err.backgroundTooLarge"}}';
+  var MSG_NO_CROPPER = '{{t .LangCode "profile.err.cropLibUnavailable"}}';
+  var HINT_AVATAR = '{{t .LangCode "profile.avatarCropHint"}}';
+  var HINT_BG = '{{t .LangCode "profile.backgroundCropHint"}}';
+
+  var MAX_FILE = 2 * 1024 * 1024; // 与 storage.MaxAvatarSize / MaxBackgroundSize 一致
+
+  var media = {
+    avatar: {
+      input: document.getElementById('avatar-input'),
+      prev: document.getElementById('avatar-prev'),
+      ratio: 1,
+      hint: HINT_AVATAR,
+      maxSizeMsg: MSG_AVATAR_TOO_LARGE,
+      // 仅限制输出上限，避免小图被强行放大；canvas 宽高比由裁剪框锁定保证
+      canvas: { maxWidth: 512 },
+      fileType: 'image/png', fileExt: 'png', quality: null
+    },
+    background: {
+      input: document.getElementById('background-input'),
+      prev: document.getElementById('bg-prev'),
+      ratio: 16 / 9,
+      hint: HINT_BG,
+      maxSizeMsg: MSG_BG_TOO_LARGE,
+      canvas: { maxWidth: 1920 },
+      fileType: 'image/jpeg', fileExt: 'jpg', quality: 0.92
+    }
+  };
+
+  var modalEl = document.getElementById('media-crop-modal');
+  var stageImg = document.getElementById('media-crop-image');
+  var hintEl = document.getElementById('media-crop-hint');
+  var confirmBtn = document.getElementById('media-crop-confirm');
+  var cropper = null;
+  var pendingKey = null;   // avatar | background
+  var pendingURL = null;   // 原始选中文件的 objectURL
+  var appliedURL = {};     // 已应用裁剪结果的 objectURL（替换新文件时回收）
+  // 不在解析期创建 UIkit 组件：Cloudflare Rocket Loader / defer 环境下 UIkit 可能尚未执行，
+  // 顶层写 UIkit.modal(...) 会抛 ReferenceError 中断整个脚本，导致下方按钮监听全部失效。
+  // 改为在使用前懒创建（见 startCrop），并统一经由 whenReady 等待 UIkit / Cropper 就绪。
+  var modalObj = null;
+
+  function notify(msg) {
+    // UIkit 不可用时退回原生 alert，保证任何环境下用户都能看到原因
+    if (window.UIkit) { UIkit.modal.alert(msg); } else { window.alert(msg); }
+  }
+
+  // UIkit（header defer）与 Cropper（R2 CDN）就绪后回调；Rocket Loader 会延迟第三方脚本执行，
+  // 但最多容忍 3s —— 超时说明资源确实缺失（如 Cropper 尚未上传），给出可理解提示而非静默失败。
+  function whenReady(cb) {
+    if (window.UIkit && window.Cropper) { cb(); return; }
+    var waited = 0;
+    var timer = setInterval(function () {
+      waited += 100;
+      if (window.UIkit && window.Cropper) {
+        clearInterval(timer);
+        cb();
+      } else if (waited >= 3000) {
+        clearInterval(timer);
+        notify(MSG_NO_CROPPER);
+      }
+    }, 100);
+  }
+
+  function revoke(store, key) {
+    if (store[key]) { URL.revokeObjectURL(store[key]); store[key] = null; }
+  }
+
+  function startCrop(key) {
+    var cfg = media[key];
+    if (!cfg) return;
+    // 文件大小即时校验（不依赖第三方库，立即反馈）
+    var file = cfg.input && cfg.input.files && cfg.input.files[0];
+    if (!file) return;
+    if (file.size > MAX_FILE) { notify(cfg.maxSizeMsg); cfg.input.value = ''; return; }
+
+    whenReady(function () {
+      // 等待期间用户可能重新选择了文件，重新读取
+      var f = cfg.input.files && cfg.input.files[0];
+      if (!f) return;
+      if (f.size > MAX_FILE) { notify(cfg.maxSizeMsg); cfg.input.value = ''; return; }
+      if (!modalObj) { modalObj = UIkit.modal(modalEl); }
+
+      revoke(appliedURL, key);
+      pendingKey = key;
+      if (pendingURL) { URL.revokeObjectURL(pendingURL); pendingURL = null; }
+      pendingURL = URL.createObjectURL(f);
+
+      hintEl.textContent = cfg.hint;
+      stageImg.onload = function () { initCropper(); };
+      stageImg.src = pendingURL;
+      modalObj.show();
+    });
+  }
+
+  function initCropper() {
+    if (cropper) { cropper.destroy(); cropper = null; }
+    if (!pendingKey) return;
+    var cfg = media[pendingKey];
+    // 容器宽度优先：modal 显示后再创建，保证测量准确（移动端可用手势拖拽/缩放）
+    var box = stageImg.parentElement;
+    cropper = new Cropper(stageImg, {
+      viewMode: 1,
+      dragMode: 'move',
+      aspectRatio: cfg.ratio,
+      autoCropArea: 1,
+      responsive: true,
+      background: false,
+      rotatable: true,
+      zoomable: true,
+      wheelZoomRatio: 0.08
+    });
+  }
+
+  // 收起时销毁实例，回收资源
+  modalEl.addEventListener('hidden', function () {
+    if (cropper) { cropper.destroy(); cropper = null; }
+    if (pendingURL) { URL.revokeObjectURL(pendingURL); pendingURL = null; }
+    stageImg.removeAttribute('src');
+    pendingKey = null;
+  });
+
+  confirmBtn.addEventListener('click', function () {
+    if (!cropper || !pendingKey || !modalObj) return;
+    var cfg = media[pendingKey];
+    var canvas = cropper.getCroppedCanvas(cfg.canvas);
+    if (!canvas) return;
+    canvas.toBlob(function (blob) {
+      if (!blob) return;
+      var dt = new DataTransfer();
+      dt.items.add(new File([blob], 'cropped-' + pendingKey + '.' + cfg.fileExt, { type: cfg.fileType }));
+      cfg.input.files = dt.files;
+      appliedURL[pendingKey] = URL.createObjectURL(blob);
+      if (cfg.prev) { cfg.prev.src = appliedURL[pendingKey]; cfg.prev.style.display = 'block'; }
+      modalObj.hide();
+    }, cfg.fileType, cfg.quality || undefined);
+  });
+
+  // 入口按钮触发文件选择
+  document.querySelectorAll('[data-pick-image]').forEach(function (btn) {
+    btn.addEventListener('click', function () {
+      var key = btn.getAttribute('data-pick-image');
+      var input = media[key] && media[key].input;
+      if (input) input.click();
+    });
+  });
+
+  // 选择文件后进入裁剪
+  Object.keys(media).forEach(function (key) {
+    var input = media[key].input;
+    if (!input) return;
+    input.addEventListener('change', function () { startCrop(key); });
+  });
+})();
+</script>
+
+{{template "base/footer" .}}
diff --git a/.workbuddy/backup/remove-vercount-20260906/dict_en.go b/.workbuddy/backup/remove-vercount-20260906/dict_en.go
new file mode 100644
index 0000000..c3c7f1c
--- /dev/null
+++ b/.workbuddy/backup/remove-vercount-20260906/dict_en.go
@@ -0,0 +1,842 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package i18n
+
+// enDict English copy.
+var enDict = map[string]string{
+	// Navigation
+	"nav.explore":  "Explore",
+	"nav.mine":     "Mine",
+	"nav.register": "Sign up",
+	"nav.login":    "Log in",
+	"nav.ask":      "Ask",
+	"nav.settings": "Settings",
+	"nav.lang":     "Language",
+
+	// Common
+	"common.login":      "Log in",
+	"common.forgot":     "Forgot password",
+	"common.submit":     "Submit",
+	"common.cancel":     "Cancel",
+	"common.save":       "Save",
+	"common.close":      "Close",
+	"common.delete":     "Delete",
+	"common.moveUp":     "Move up",
+	"common.moveDown":   "Move down",
+	"common.share":      "Share",
+	"common.verifying":  "Verifying...",
+	"common.submitting": "Submitting...",
+	"common.uploading":  "Uploading...",
+	"common.lang":       "Language",
+	"common.menu":       "Menu",
+
+	"common.pleaseWait": "Please wait...",
+	"common.backHome":   "Back to Home",
+	"common.theme":      "Toggle dark/light mode",
+
+	// Site
+	"site.title":           "Wolf's Question Box | Anonymous Question Box",
+	"site.description":     "Wolf's Question Box is an anonymous question box — ask me anything without signing up, a safe space to share and respond.",
+	"site.keywords":        "Anonymous Question Box,question box,anonymous ask,ask anonymously,Wolf's Question Box,anonymous Q&A",
+	"site.footer.visitor":  "You are visitor #%s",
+	"site.footer.pageview": "This page has been viewed %s times",
+	"site.footer.runtime":  "The box has been alive for",
+	"site.footer.admin":    "Contact admin",
+	"site.footer.notice":   "Announcements",
+	"site.footer.chat":     "Chat room",
+	"site.footer.drive":    "Drive",
+	"site.footer.status":   "Status",
+	"site.footer.nav":      "Links",
+	"site.maintenance":     "The site is under maintenance. Please come back later ~",
+
+	// Auth
+	"auth.login.title":       "User Log in",
+	"auth.login.email":       "Email",
+	"auth.login.password":    "Password",
+	"auth.login.submit":      "Log in",
+	"auth.login.forgot":      "Forgot password",
+	"auth.register.title":    "User Sign up",
+	"auth.register.name":     "Nickname",
+	"auth.register.email":    "Email",
+	"auth.register.password": "Password",
+	"auth.register.submit":   "Sign up",
+	"auth.forgot.title":      "Forgot password",
+	"auth.forgot.email":      "Email",
+	"auth.forgot.submit":     "Send reset email",
+	"auth.forgot.submitBtn":  "Recover password",
+	"auth.forgot.sent":       "An email has been sent to %s, please check your inbox.",
+	"auth.recover.title":     "Reset password",
+	"auth.recover.greeting":  "%s, you are resetting your password:",
+	"auth.recover.password":  "New password",
+	"auth.recover.confirm":   "Confirm password",
+	"auth.recover.submit":    "Reset password",
+
+	// Explore
+	"explore.title":        "Explore User Tags",
+	"explore.notice":       "Here you can find users who enabled <span class=\"uk-text-bold\">\"Show my tags on the homepage\"</span>. This feature is off by default. To get discovered here, go to <a href=\"/user/profile\" class=\"uk-text-bold\">your profile settings</a> and enable it.",
+	"explore.shuffle":      "Shuffle",
+	"explore.empty":        "No users to show yet. Enable it and be the first!",
+	"explore.hotVotes":     "Hot polls",
+	"explore.questionsTab": "Questions",
+	"explore.votesTab":     "Polls",
+	"explore.votesTitle":   "Public polls",
+	"explore.votesDesc":    "Browse active public polls and join the topics that interest you.",
+	"explore.randomVote":   "Random pick",
+	"explore.allVotes":     "All polls",
+	"explore.noVotes":      "There are no public polls available right now.",
+
+	// Ask page
+	"ask.scan":              "Scan to ask @%s",
+	"ask.anonymous":         "Anyone can ask anonymously",
+	"ask.registerOnly":      "Only registered users can ask",
+	"ask.nextOpenAt":        "Next opening: %s",
+	"ask.lastCloseAt":       "Last closed: %s",
+	"weekday.0":             "Sun",
+	"weekday.1":             "Mon",
+	"weekday.2":             "Tue",
+	"weekday.3":             "Wed",
+	"weekday.4":             "Thu",
+	"weekday.5":             "Fri",
+	"weekday.6":             "Sat",
+	"ask.pinned":            "Pinned",
+	"ask.share":             "Share this box",
+	"ask.placeholder":       "Write your question here...",
+	"ask.chatPlaceholder":   "Write your chat message here...",
+	"ask.addImage":          "Add image",
+	"ask.private":           "Don't publish after reply",
+	"ask.notify":            "Notify me",
+	"ask.emailPlaceholder":  "Enter your email address",
+	"ask.submit":            "Send question",
+	"ask.chat":              "Start a chat",
+	"ask.chatDisabled":      "Chat is disabled on this box",
+	"ask.chatLimit":         "Message limit: %d",
+	"ask.history":           "Previously answered by @%s",
+	"ask.loginRequired":     "Log in required",
+	"ask.loginRequiredChat": "You need to log in to start a chat",
+	"ask.goLogin":           "Go to login",
+	"ask.needPassword":      "This box requires a password",
+	"ask.needLogin":         "The owner only allows registered users to ask questions. Please log in first.",
+	"ask.pleaseEmail":       "Please enter your email to receive notifications",
+	"ask.generating":        "Generating share card…",
+	"ask.genFailed":         "Failed to generate share card. Please try again later",
+	"ask.networkError":      "Network error",
+	"ask.shareFilename":     "share.png",
+
+	// Question item
+	"qitem.answer":            "Answer",
+	"qitem.delete":            "Delete",
+	"qitem.private":           "Make private",
+	"qitem.public":            "Make public",
+	"qitem.asked":             "Asked",
+	"qitem.pending":           "Pending reply",
+	"qitem.answeredBy":        "Answer by @%s on %s",
+	"qitem.danger":            "Danger!",
+	"qitem.deleteConfirm":     "Are you sure you want to delete this question? This cannot be undone.",
+	"qitem.deleteConfirmBtn":  "Yes, delete",
+	"qitem.backToBox":         "Back to %s's question box",
+	"qitem.answerTitle":       "Answer the question",
+	"qitem.answerPlaceholder": "Write your answer here...",
+	"qitem.emailNotifyHint":   "The asker left their email. Once you answer this question for the first time, they will receive an email notification.",
+	"qitem.submitAnswer":      "Answer",
+	"qitem.updateAnswer":      "Update answer",
+	"qitem.askMore":           "Ask something else?",
+	"qitem.markRead":          "Mark as read",
+	"qitem.markUnread":        "Mark as unread",
+	"qitem.readLocked":        "Answered, locked as read",
+
+	// Admin / profile page
+	"admin.profile":           "Profile",
+	"admin.lang":              "Language",
+	"admin.langHint":          "Choose the language visitors see when they open your question box (admin pages follow this too)",
+	"admin.email":             "Email",
+	"admin.name":              "Nickname",
+	"admin.nameColor":         "Nickname color",
+	"admin.oldPassword":       "Old password",
+	"admin.newPassword":       "New password",
+	"admin.notify":            "New question notifications",
+	"admin.personalize":       "Customization",
+	"admin.intro":             "Box introduction",
+	"admin.introColor":        "Introduction color",
+	"admin.qrBgColor":         "QR background color (light part)",
+	"admin.qrPdColor":         "QR finder pattern color (corner squares)",
+	"admin.qrFgColor":         "QR foreground color",
+	"admin.qrDotSize":         "QR dot size (←small large→)",
+	"admin.qrBgAlpha":         "QR background opacity (←opaque transparent→)",
+	"admin.avatar":            "Avatar",
+	"admin.background":        "Box background",
+	"admin.qrBackground":      "QR background image",
+	"admin.social":            "Social links",
+	"admin.harassment":        "Anti-harassment",
+	"admin.askLimit":          "Asking restriction",
+	"admin.blockWords":        "Blocked words (press Enter or comma to add, up to 10 words, 10 characters each)",
+	"admin.chat":              "Chat settings",
+	"admin.chatMaxMessages":   "Max messages per chat",
+	"admin.chatDailyLimit":    "Daily message limit per user",
+	"admin.tags":              "Tags",
+	"admin.tagsHint":          "Tags (up to 5, 5 characters each, press Enter or comma to add)",
+	"admin.tagsPlaceholder":   "e.g. anime, music, games",
+	"admin.tagInputHint":      "Type and press Enter or comma to add",
+	"admin.tagInputDuplicate": "Already exists, ignored",
+	"admin.pagePassword":      "Page access password",
+	"admin.pagePasswordHint":  "Set a page password (leave empty to disable)",
+	"admin.askPassword":       "Ask password",
+	"admin.askPasswordHint":   "Set a password for asking (leave empty to disable)",
+	"admin.saveProfile":       "Save changes",
+	"admin.updated":           "Profile updated successfully",
+	"admin.logout":            "Log out",
+	"admin.export":            "Export data",
+
+	// Admin settings (additional)
+	"admin.oldPasswordHint":         "Only needed when changing password; leave empty to keep it unchanged",
+	"admin.newPasswordHint":         "6-64 characters; leave empty to keep it unchanged",
+	"admin.notifyEmail":             "Email",
+	"admin.useCustomFg":             "Use custom foreground color (otherwise auto-matched)",
+	"admin.customFgHint":            "Only takes effect when enabled; otherwise the color is auto-generated",
+	"admin.avatarPlaceholder":       "Upload avatar (non-1:1 images will be squished)",
+	"admin.backgroundPlaceholder":   "Upload box background",
+	"admin.qrBackgroundPlaceholder": "Upload QR background (a background that is too dark may make the QR code unreadable)",
+	"admin.qrPreviewHint":           "The preview updates instantly after choosing an image",
+	"admin.preview":                 "Live preview",
+	"admin.themePreset":             "Preset themes",
+	"admin.themeDefault":            "Default",
+	"admin.themeDark":               "Dark",
+	"admin.themeOcean":              "Ocean",
+	"admin.themeSunset":             "Sunset",
+	"admin.resetDefaults":           "🔄 Reset to defaults",
+	"admin.previewHint":             "Adjustments are for preview only; click \"Save changes\" to apply",
+	"admin.socialHint":              "Check the box and fill in the profile URL (no https:// needed). Unchecked items won't be shown on your page.",
+	"admin.enableAcfun":             "Enable AcFun",
+	"admin.enableBili":              "Enable Bilibili",
+	"admin.enableWeibo":             "Enable Weibo",
+	"admin.enableXiaohongshu":       "Enable Xiaohongshu",
+	"admin.enableBlog":              "Enable Personal Blog",
+	"admin.registerOnly":            "Only allow registered users to ask me questions",
+	"admin.updateHarassment":        "Update anti-harassment settings",
+	"admin.globalBlockWords":        "Global blocked words",
+	"admin.globalBlockWordsHint":    "Blocked words apply to questions, chat messages sent to you, and vote submissions. This single setting is shared across the question / chat / vote panels and takes effect immediately from any of them.",
+	"admin.updateBlockWords":        "Save blocked words",
+	"admin.allowChat":               "Allow registered users to start a chat with me",
+	"admin.dailyLimitHint":          "0 means unlimited",
+	"admin.updateChat":              "Update chat settings",
+	"admin.showInHome":              "Show my tags on the home page (let other users find me by tags)",
+	"admin.updateTags":              "Update tags",
+	"admin.updatePagePassword":      "Update page password",
+	"admin.pagePasswordPlaceholder": "Enter page access password",
+	"admin.updateAskPassword":       "Update ask password",
+	"admin.askPasswordPlaceholder":  "Enter ask password",
+	"admin.account":                 "Account settings",
+	"admin.exportHint":              "You can export all your personal data from %s, including your basic information, received questions and answers.",
+	"admin.exportJSON":              "Export all data (JSON)",
+	"admin.exportJSONHint":          "Includes questions, answers, follow-ups and chats for full backup or migration.",
+	"admin.deactivate":              "Deactivate my account",
+	"admin.deactivateHint":          "You can deactivate your account at any time. After deactivation, your account can no longer log in, your question box page and questions will be inaccessible, and others won't be able to send you new questions.<b>This action cannot be undone. Please be careful!</b>",
+	"admin.socialRequired":          "Please fill in the link or uncheck the box",
+
+	// Question management
+	"qlist.title":              "My Questions",
+	"qlist.answered":           "Answered",
+	"qlist.pending":            "Pending",
+	"qlist.private":            "Private",
+	"qlist.empty":              "No questions yet. Share your box and get some!",
+	"qlist.action":             "Actions",
+	"qlist.answerNow":          "Answer",
+	"qlist.sort":               "Sort",
+	"qlist.status":             "Status",
+	"qlist.type":               "Type",
+	"qlist.latest":             "Latest",
+	"qlist.oldest":             "Oldest",
+	"qlist.all":                "All",
+	"qlist.public":             "Normal question",
+	"qlist.privateQuestion":    "Private question",
+	"qlist.received":           "Questions I received",
+	"qlist.myChats":            "Chats I started",
+	"qlist.statsTotal":         "Total questions",
+	"qlist.statsAnswered":      "Answered",
+	"qlist.statsUnanswered":    "Unanswered",
+	"qlist.statsPrivate":       "Private",
+	"qlist.statsPinned":        "Pinned",
+	"qlist.statsChats":         "Chats",
+	"qlist.searchPlaceholder":  "Search questions or answers...",
+	"qlist.searchBtn":          "Search",
+	"qlist.searchClear":        "Clear",
+	"qlist.questionsTab":       "Questions",
+	"qlist.votesTab":           "Votes",
+	"qlist.chatsTab":           "Chats",
+	"qlist.receivedChats":      "Chats I received",
+	"qlist.chatEmpty":          "No chats yet. Share your question box to start chatting!",
+	"qlist.pinnedShort":        "Pin",
+	"qlist.privateShort":       "Pvt",
+	"qlist.chatStatsTotal":     "Total chats",
+	"qlist.chatStatsReceived":  "Received",
+	"qlist.chatStatsInitiated": "Initiated",
+	"qlist.chatStatsClosed":    "Closed",
+	"qlist.unansweredShort":    "Open",
+	"qlist.readShort":          "Read",
+	"qlist.unreadShort":        "Unread",
+	"qitem.markReadShort":      "Mark",
+	"qlist.pinShort":           "Pin",
+	"qlist.unpinShort":         "Unpin",
+	"qlist.myVotes":            "My votes",
+	"qlist.loadMore":           "Load more",
+	"qlist.newVote":            "New vote",
+	"qlist.edit":               "Edit",
+	"qlist.untitledVote":       "Untitled vote",
+	"qlist.blocked":            "Blocked",
+	"qlist.unanswered":         "Unanswered",
+
+	// Site logo suffix (random animal emoji + suffix)
+	"site.logoSuffix": "'s Question Box",
+	"site.stats":      "Question Box Statistics",
+
+	// Captcha modal
+	"captcha.title":        "Verification",
+	"captcha.hint":         "Solve the math problem below to prove you are not a robot",
+	"captcha.refresh":      "New problem",
+	"captcha.submit":       "Verify & submit",
+	"captcha.loading":      "Loading...",
+	"captcha.loadFailed":   "Load failed",
+	"captcha.loadRetry":    "Load failed, please retry",
+	"captcha.inputAnswer":  "Please enter the answer",
+	"captcha.wrongAnswer":  "Wrong answer, please recalculate",
+	"captcha.verifyFailed": "Verification failed, please retry",
+
+	// Register page extras
+	"auth.register.domain.prefix":   "Custom domain (your box URL will be: %s + ",
+	"auth.register.domain.suffix":   " + what you fill in below)",
+	"auth.register.confirm":         "Confirm password",
+	"auth.register.language":        "Language",
+	"auth.register.languageDefault": "Use site default",
+	"auth.register.success":         "Registration successful, welcome to TamaBox!",
+
+	// Explore page extras
+	"explore.recommend":    "Random picks",
+	"explore.search":       "Search tags...",
+	"explore.sortLatest":   "Newest",
+	"explore.sortOldest":   "Oldest",
+	"explore.noTags":       "No tags",
+	"explore.noRecommend":  "No recommendations yet",
+	"explore.hotTags":      "Hot Tags",
+	"explore.hotQuestions": "Hot Questions",
+	"explore.noResult":     "No users match your criteria.",
+	"explore.lazy":         "This user is too lazy to write anything~",
+	"explore.prevPage":     "Previous",
+	"explore.nextPage":     "Next",
+	"explore.loading":      "Loading...",
+	"explore.loadFailed":   "Load failed",
+
+	// Question box password page
+	"password.title":  "This question box is password protected",
+	"password.desc":   "This question box is password protected. Enter the password to view its contents.",
+	"password.input":  "Enter the access password",
+	"password.enter":  "Enter",
+	"password.submit": "Confirm",
+
+	// Question not found
+	"qitem.notFound": "Question not found or has been deleted",
+
+	// Chat page
+	"chat.title":          "Chat",
+	"chat.input":          "Type a message...",
+	"chat.send":           "Send",
+	"chat.delete":         "Delete conversation",
+	"chat.block":          "Block user",
+	"chat.unblock":        "Unblock user",
+	"chat.empty":          "No messages yet. Say something~",
+	"chat.withAsker":      "Chat with the asker",
+	"chat.withUser":       "Chat with %s",
+	"chat.closed":         "Conversation closed",
+	"chat.closedNoSend":   "The conversation is closed. You cannot send new messages.",
+	"chat.remaining":      "Messages left: %d (of %d total)",
+	"chat.me":             "Me",
+	"chat.other":          "Other",
+	"chat.userBlocked":    "This user has been blocked",
+	"chat.addImage":       "Add image (optional, max 5MB)",
+	"chat.confirm":        "Confirm",
+	"chat.confirmBlock":   "Block this user? They won't be able to send you messages anymore.",
+	"chat.confirmUnblock": "Unblock this user? They will be able to send you messages again.",
+	"chat.deleteConfirm":  "Delete this conversation? The other party will no longer be able to see it, and this cannot be undone.",
+	"maintenance.title":   "NekoBox is under maintenance...",
+	"maintenance.desc":    "NekoBox is currently under maintenance and temporarily unavailable. Please come back later~",
+
+	// Single-question share (v4)
+	"qitem.shareCard": "Share this question",
+
+	// Follow-ups (v4)
+	"followup.title":              "Follow-ups",
+	"followup.content":            "Follow-up: ",
+	"followup.answerPlaceholder":  "Answer this follow-up...",
+	"followup.answerBtn":          "Answer",
+	"followup.waiting":            "Waiting for answer...",
+	"followup.askMore":            "Add a follow-up",
+	"followup.remaining":          "%d / %d follow-ups remaining",
+	"followup.contentPlaceholder": "Add more details...",
+	"followup.waitingReply":       "Your follow-up has been sent. Waiting for the box owner to reply...",
+	"followup.submit":             "Submit",
+
+	// Pinning (v4)
+	"qlist.pinned":      "Pinned",
+	"qlist.pin":         "Pin",
+	"qlist.unpin":       "Unpin",
+	"qlist.readStatus":  "Read status",
+	"qlist.read":        "Read",
+	"qlist.unread":      "Unread",
+	"qlist.statsRead":   "Read",
+	"qlist.statsUnread": "Unread",
+
+	// Question submitted page (v4)
+	"success.title":        "Question sent successfully!",
+	"success.yourQuestion": "Your question:",
+	"success.emailSent":    "A private link to this question was sent to your email. You can also use the link below to view the question, receive replies, and follow up.",
+	"success.saveLink":     "<strong>Please save the private link below!</strong> Since you didn't leave an email, this link (including the token) is your <strong>only credential</strong> to view the question, receive replies, and follow up. If you lose it, it cannot be recovered.",
+	"success.privateLink":  "Your private link (click to copy)",
+	"success.copy":         "Copy",
+	"success.copied":       "Copied ✓",
+	"success.copyFailed":   "Copy failed",
+	"success.token":        "Token: %s (the asker uses this token to access the private link)",
+	"success.viewQuestion": "View my question",
+	"success.backToBox":    "Back to %s's box",
+	"success.pageTitle":    "Question Sent - %s",
+
+	// Deactivate page
+	"deactivate.title":   "Deactivate account",
+	"deactivate.desc":    "After deactivation your question box will be inaccessible and all data will be deleted. This cannot be undone!",
+	"deactivate.confirm": "I confirm I want to deactivate my account",
+	"deactivate.submit":  "Deactivate account",
+
+	// Anonymous voting
+	"nav.votes": "Polls",
+
+	"common.back": "Back",
+
+	"vote.listTitle":              "Poll Management",
+	"vote.newTitle":               "New Poll",
+	"vote.editTitle":              "Edit Poll",
+	"vote.resultsTitle":           "Poll Results",
+	"vote.statsTotal":             "Total Polls",
+	"vote.statsPublished":         "Active",
+	"vote.createNew":              "New Poll",
+	"vote.typeSingle":             "Single choice",
+	"vote.typeMultiple":           "Multiple choice",
+	"vote.typeRating":             "Rating",
+	"vote.typeRank":               "Ranking",
+	"vote.typeForm":               "Form",
+	"vote.statusNotStarted":       "Not started",
+	"vote.statusDraft":            "Draft",
+	"vote.statusPublished":        "Active",
+	"vote.statusEnded":            "Ended",
+	"vote.statusArchived":         "Archived",
+	"vote.participants":           "Participants",
+	"vote.remainLabel":            "Remaining",
+	"vote.perpetual":              "No deadline",
+	"vote.durationDay":            "d",
+	"vote.durationHour":           "h",
+	"vote.durationMinute":         "m",
+	"vote.createdAt":              "Created",
+	"vote.edit":                   "Edit",
+	"vote.results":                "Results",
+	"vote.preview":                "Preview",
+	"vote.page.mustComplete":      "Please complete",
+	"vote.page.rankHintRequired":  "Rank 1-N (required)",
+	"vote.page.rankHintOptional":  "Rank 1-N (optional, partial OK)",
+	"vote.page.previewHint":       "Preview mode: this is a sample of the live page; submitting is disabled",
+	"vote.page.previewSubmitHint": "Preview mode; submitting is enabled after publish",
+	"vote.publish":                "Publish",
+	"vote.close":                  "End",
+	"vote.share":                  "Copy link",
+	"vote.copied":                 "Copied",
+	"vote.shareURL":               "Poll share link",
+	"vote.confirmPublish":         "Publish this poll? A shareable link will be generated.",
+	"vote.confirmClose":           "End this poll? Participants will no longer be able to vote.",
+	"vote.confirmDelete":          "Delete this poll? All vote data will be removed and cannot be recovered!",
+	"vote.manageEntry":            "Manage polls",
+
+	"vote.manageTitle": "Manage polls",
+	"vote.manageDesc":  "Create and manage your anonymous polls", "vote.empty": "No polls yet. Click \"New Poll\" in the top right to get started.",
+	"vote.formLockedHint":              "This poll is live. Only basic info can be edited; type and options are locked to protect collected votes.",
+	"vote.formBasic":                   "Basic Settings",
+	"vote.formTitle":                   "Poll Title",
+	"vote.formTitlePlaceholder":        "e.g. What should we eat today?",
+	"vote.formDescription":             "Description",
+	"vote.formDescriptionPlaceholder":  "Optional details",
+	"vote.formType":                    "Poll Type",
+	"vote.formVisibility":              "Visibility",
+	"vote.formVisibilityPublic":        "Public (Explore + question box)",
+	"vote.formVisibilityLinkOnly":      "Link only",
+	"vote.formVoterScope":              "Voting Scope",
+	"vote.formVoterScopeAnyone":        "Anyone (including anonymous)",
+	"vote.formVoterScopeRegistered":    "Registered users only",
+	"vote.formShowResult":              "Result Visibility",
+	"vote.formShowResultAfterVote":     "Visible right after voting",
+	"vote.formShowResultAfterEnd":      "Visible after the poll ends",
+	"vote.formShowResultOwnerOnly":     "Owner only",
+	"vote.formStartAt":                 "Start time (empty = now)",
+	"vote.formEndAt":                   "End time (empty = no limit)",
+	"vote.formMaxChoices":              "Max choices",
+	"vote.formMaxVotesPerFingerprint":  "One vote per device per poll; repeated submissions from the same browser are blocked.",
+	"vote.formMaxVotesPerAccount":      "One vote per registered account per poll; repeated submissions from the same account are blocked.",
+	"vote.formAllowCustom":             "Allow participants to add custom options",
+	"vote.formRequireCaptcha":          "Require captcha for anonymous voting",
+	"vote.formOptions":                 "Poll Options",
+	"vote.formRatingHint":              "Rating polls need no options (1-10).",
+	"vote.addOption":                   "Add option",
+	"vote.optionPlaceholder":           "Option text",
+	"vote.formFields":                  "Form Fields",
+	"vote.addField":                    "Add field",
+	"vote.field":                       "Field",
+	"vote.formFieldType":               "Field Type",
+	"vote.fieldTypeText":               "Single-line text",
+	"vote.fieldTypeTextarea":           "Multi-line text",
+	"vote.fieldTypeSelect":             "Dropdown select",
+	"vote.fieldTypeRadio":              "Single choice",
+	"vote.fieldTypeCheckbox":           "Multiple choice",
+	"vote.fieldTypeNumber":             "Number",
+	"vote.fieldTypeRank":               "Ranking",
+	"vote.page.selectPlaceholder":      "Select...",
+	"vote.page.avgNumber":              "Average",
+	"vote.page.fieldFilled":            "Filled",
+	"vote.fieldTypeRating":             "Rating",
+	"vote.formFieldLabel":              "Field Label",
+	"vote.formFieldRequired":           "Required",
+	"vote.formFieldMaxLength":          "Max length (0 = unlimited)",
+	"vote.formFieldOptions":            "Options",
+	"vote.formFieldOptionsHint":        "Click \"Add option\" to add each option; no comma needed",
+	"vote.fieldAllowCustom":            "Allow participants to add a custom option",
+	"vote.formFieldOptionsPlaceholder": "e.g. Great,Okay,Poor",
+	"vote.createDraft":                 "Save draft",
+	"vote.builderHintOptions":          "At least 2 options are required",
+	"vote.builderHintFields":           "Add at least 1 field",
+	"vote.builderHintFieldOptions":     "Choice/rank fields need options (rank needs at least 2)",
+	"vote.resultsAnswered":             "Answered",
+	"vote.page.rankedTimes":            "Ranked",
+	"vote.resultsTotal":                "Total participants",
+	"vote.resultsSubmissions":          "Form responses",
+	"vote.resultsViewTexts":            "View text responses",
+	"vote.resultsToggleHint":           "Click to expand or collapse text responses",
+	"vote.resultsOptions":              "Poll results",
+	"vote.resultsVotes":                "votes",
+	"vote.export":                      "Export CSV",
+	"vote.resultsEmpty":                "No participation yet. Share the link!",
+
+	// Poll participation page
+	"vote.inlineTitle":                 "Polls",
+	"vote.page.by":                     "poll",
+	"vote.page.goVote":                 "Vote",
+	"vote.page.notStarted":             "Not started",
+	"vote.page.notStartedHint":         "This poll has not started yet.",
+	"vote.page.ended":                  "Ended",
+	"vote.page.endedHint":              "This poll has ended.",
+	"vote.page.active":                 "Active",
+	"vote.page.participated":           "Participated",
+	"vote.page.loginRequired":          "This poll is limited to registered users. Please log in first.",
+	"vote.page.anonymousHint":          "Anonymous participation is allowed and your identity is not recorded (max 1 per device).",
+	"vote.page.submit":                 "Submit vote",
+	"vote.page.alreadyVoted":           "You have already participated in this poll. Thanks!",
+	"vote.page.resultsTitle":           "Poll Results",
+	"vote.page.totalVotes":             "Total",
+	"vote.page.avgRating":              "Average",
+	"vote.page.avgRank":                "Avg rank",
+	"vote.page.optionColumn":           "Option",
+	"vote.page.ratingLabel":            "Rate",
+	"vote.page.ratingUnit":             "pts",
+	"vote.page.rankHint":               "Rank each option 1-N (smaller = higher, no duplicates)",
+	"vote.page.rankPlaceholder":        "Rank",
+	"vote.page.multipleHint":           "Multiple choice",
+	"vote.page.customOption":           "Custom option (optional)",
+	"vote.page.customPlaceholder":      "Type your own option",
+	"vote.page.customOther":            "Other",
+	"vote.page.customFieldPlaceholder": "Type a custom option...",
+	"vote.page.customStats":            "Custom options",
+	"vote.page.formCount":              "Responses received",
+	"vote.page.ownerManage":            "Manage this poll (results visible only to you)",
+
+	// Per-poll quota collection
+	"vote.formQuotaLimit":          "Collection quota (responses)",
+	"vote.formQuotaHint":           "0 means unlimited; the poll ends automatically once the quota is reached.",
+	"vote.flash.notFound":          "This poll does not exist or is no longer available",
+	"vote.flash.notPublished":      "This poll has not been published yet",
+	"vote.flash.archived":          "This poll has been archived and is closed",
+	"vote.flash.ended":             "This poll has ended",
+	"vote.flash.notStarted":        "This poll has not started yet",
+	"vote.flash.success":           "Vote submitted. Thanks for participating!",
+	"vote.err.noChoice":            "Please select at least one option",
+	"vote.err.tooManyChoices":      "You can select at most %d options",
+	"vote.err.pickOne":             "Please select an option",
+	"vote.err.invalidOption":       "Invalid option",
+	"vote.err.optionDuplicate":     "Options cannot be duplicated",
+	"vote.err.ratingRequired":      "Please provide a rating from 1 to 10",
+	"vote.err.rankRequired":        "Please rank every option from 1 to %d",
+	"vote.err.rankDuplicate":       "Rankings must not repeat",
+	"vote.err.fieldRequired":       "Please fill in \"%s\"",
+	"vote.err.fieldCustomRequired": "Please fill in the custom option for \"%s\"",
+	"vote.err.fieldCustomTooLong":  "The custom option for \"%s\" must be at most %d characters",
+	"vote.err.fieldInvalidOption":  "Invalid option for \"%s\"",
+	"vote.err.fieldConfigError":    "Misconfigured options for \"%s\"",
+	"vote.err.fieldRankIncomplete": "Please provide a complete ranking for \"%s\"",
+	"vote.err.fieldRankRange":      "The ranking for \"%s\" must be a number between 1 and %d",
+	"vote.err.fieldRankDuplicate":  "Rankings for \"%s\" must not repeat",
+	"vote.err.fieldTooLong":        "\"%s\" exceeds the length limit (max %d characters)",
+	"vote.err.fieldNotNumber":      "\"%s\" must be a number",
+	"vote.err.fieldRating":         "\"%s\" requires a rating from 1 to 10",
+	"vote.err.unknownType":         "Unknown poll type",
+	"vote.err.customTooLong":       "The custom option must be at most %d characters",
+	"vote.err.blockWords":          "Your submission contains a blocked word set by the poll creator and could not be submitted",
+	"vote.err.serialize":           "Failed to serialize the submission",
+	"captcha.error":                "Captcha verification failed",
+	"captcha.errEmpty":             "Captcha cannot be empty",
+	"captcha.errFormat":            "Invalid captcha format, please refresh and try again",
+	"captcha.errAnswerFormat":      "Invalid captcha answer format",
+	"captcha.errExpired":           "Captcha expired, please refresh and try again",
+	"captcha.errService":           "Captcha service error, please try again later",
+	"captcha.errAnswerWrong":       "Incorrect captcha answer",
+	"censor.unavailable":           "The content moderation service is temporarily unavailable. Please try again later.",
+
+	// Feature management: switch / schedule / quota for questions, chats and polls
+	"admin.tabAccount":            "Settings",
+	"admin.featuresHint":          "Manage the switch, opening hours and collection quota of each feature on the Questions / Chats / Polls panels. A feature closes automatically once its quota is reached.",
+	"admin.featuresEntry":         "Settings",
+	"admin.featureHint.question":  "Visitors cannot submit new questions while closed; collection stops automatically once the quota is reached (private questions included).",
+	"admin.featureHint.chat":      "Visitors cannot start new chats while closed; existing conversations are unaffected.",
+	"admin.featureHint.vote":      "Your polls are hidden from your box page and cannot be answered while closed. Each poll can also define its own quota on the edit page.",
+	"admin.featureEnabled":        "Enable this feature",
+	"admin.featureOpenAt":         "Open at",
+	"admin.featureCloseAt":        "Close at",
+	"admin.featureTimeHint":       "Leave blank for no limit; the feature is unavailable before the open time and after the close time.",
+	"admin.featureSchedule":       "Recurring schedule (weekly)",
+	"admin.featureScheduleStart":  "Daily start",
+	"admin.featureScheduleEnd":    "Daily end",
+	"admin.featureScheduleHint":   "Select the weekdays and a daily time window to open every week. Leave all empty to disable. Days without a time window open all day; a time window with no weekday selected opens every day.",
+	"admin.featureMode":           "Schedule mode",
+	"admin.featureModeAlways":     "Always open",
+	"admin.featureModeWindow":     "One-time window",
+	"admin.featureModeRecurring":  "Weekly schedule",
+	"admin.featureModeHint":       "Always open: no time limit until manually disabled. One-time window: a single open/close time window. Weekly schedule: recurring weekly open days and hours. Modes are mutually exclusive; settings of unselected modes are cleared on save.",
+	"admin.featureQuotaLimit":     "Collection quota (items)",
+	"admin.featureQuotaHint":      "0 means unlimited; the feature closes automatically once the quota is reached. Reset the counter to start a new round.",
+	"admin.featureQuotaCount":     "Collected",
+	"admin.featureQuotaUnlimited": "Unlimited",
+	"admin.featureQuotaResetAt":   "Last reset: ",
+	"admin.featureResetQuota":     "Reset counter",
+	"admin.featureSave":           "Save this feature",
+
+	// Feature management: states and messages
+	"feature.name.question":        "Questions",
+	"feature.name.chat":            "Chats",
+	"feature.name.vote":            "Polls",
+	"feature.statusOpen":           "Open",
+	"feature.status.disabled":      "Closed",
+	"feature.status.not_started":   "Not started",
+	"feature.status.ended":         "Ended",
+	"feature.status.quota_reached": "Quota reached",
+	"feature.saved":                "Feature settings saved",
+	"feature.errTime":              "Invalid date for %s, please use the date-time picker",
+	"feature.errTimeRange":         "The close time of %s must be later than the open time",
+	"feature.errQuota":             "The collection quota of %s must be an integer between 0 and 1000000",
+	"feature.errInvalid":           "Unknown feature",
+	"feature.quotaReset":           "The collection counter of %s has been reset",
+	"feature.errScheduleHalf":      "The recurring start and end times of %s must be filled in together",
+	"feature.errScheduleTime":      "Invalid recurring time for %s, please use the time picker",
+	"feature.errScheduleRange":     "The recurring end time of %s must be later than the start time",
+
+	// Messages shown to visitors when a feature is closed
+	"feature.disabled.question":      "The box owner has closed questions",
+	"feature.disabled.chat":          "This box does not accept chats",
+	"feature.disabled.vote":          "This box has closed polls",
+	"feature.not_started.question":   "Questions are not open yet",
+	"feature.not_started.chat":       "Chats are not open yet",
+	"feature.not_started.vote":       "Polls are not open yet",
+	"feature.ended.question":         "Question collection has ended",
+	"feature.ended.chat":             "Chats have ended",
+	"feature.ended.vote":             "Polls have ended",
+	"feature.quota_reached.question": "The question quota has been reached",
+	"feature.quota_reached.chat":     "The chat quota has been reached",
+	"feature.quota_reached.vote":     "The poll quota has been reached",
+
+	// Auth: visitor-visible messages (P0)
+	"auth.errBadCredential":   "Incorrect email or password",
+	"auth.errUserNotFound":    "User does not exist",
+	"auth.errEmailFrequent":   "Emails are sent too frequently, please try again later",
+	"auth.errEmailFailed":     "Failed to send email, please try again later",
+	"auth.errCodeExpired":     "The verification code has expired",
+	"auth.errPasswordChanged": "Password changed successfully",
+	"auth.errLoginRequired":   "Please log in first",
+	"auth.errDuplicateEmail":  "This email is already registered",
+	"auth.errDuplicateDomain": "This custom domain is already taken",
+
+	// Question box page: visitor-visible (P0)
+	"question.errWrongPassword":     "Wrong password",
+	"question.errAskPasswordWrong":  "Wrong ask password",
+	"question.errLoginRequired":     "The owner only allows registered users to ask questions. Please log in first.",
+	"question.errSelfChat":          "You cannot start a chat with yourself",
+	"question.errBlockedChat":       "You have been blocked by the other party and cannot start a chat",
+	"question.errChatDailyLimit":    "You have reached today's message limit (%d). Please try again tomorrow",
+	"question.errDuplicateSubmit":   "Duplicate submission detected, please try again later",
+	"question.errImageTooLarge":     "Image file size cannot exceed 5Mb",
+	"question.errUploadImageFailed": "Failed to upload image",
+	"question.errBlockWords":        "The question contains a blocked word set by the box owner, and could not be sent",
+	"question.errAnsweredLocked":    "An answered question cannot be marked as unread",
+	"question.flash.chatSent":       "Chat request sent! You can view the conversation via this link: %s",
+	"question.flash.answered":       "Answer published successfully!",
+	"question.flash.operated":       "Operation successful",
+	"question.flash.markedRead":     "Marked as read",
+	"question.flash.markedUnread":   "Marked as unread",
+
+	// Follow-ups: visitor/owner visible (P0)
+	"followup.errNoPermission": "Permission denied",
+	"followup.errNotAnswered":  "This question has not been answered yet, so you cannot follow up",
+	"followup.errLimit":        "Each question allows at most %d follow-ups, and the limit has been reached",
+	"followup.errWaitReply":    "Please wait for the owner to reply to your previous follow-up before continuing",
+	"followup.errNotFound":     "The follow-up does not exist",
+	"followup.flash.sent":      "Follow-up sent successfully!",
+	"followup.flash.answered":  "Answer posted successfully!",
+
+	// Admin settings: owner visible (P1)
+	"admin.flash.profileUpdated":    "Profile updated successfully",
+	"admin.flash.chatUpdated":       "Chat settings updated successfully",
+	"admin.flash.pagePwdOff":        "Page password access disabled",
+	"admin.flash.pagePwdUpdated":    "Page access password updated",
+	"admin.flash.askPwdOff":         "Ask password disabled",
+	"admin.flash.askPwdUpdated":     "Ask password updated",
+	"admin.flash.tagsTooMany":       "You can have at most 5 tags",
+	"admin.flash.tagsUpdated":       "Tags updated successfully",
+	"admin.flash.tagTooLong":        "Each tag cannot exceed 5 characters: %s",
+	"admin.flash.blockWordsTooMany": "You can have at most 10 blocked words",
+	"admin.flash.blockWordTooLong":  "A blocked word cannot exceed 10 characters: %s",
+	"admin.flash.harassmentUpdated": "Anti-harassment settings updated successfully",
+	"admin.flash.blockWordsUpdated": "Blocked words updated",
+	"admin.flash.deactivated":       "Your account has been deactivated. Thank you for using Wolf's Question Box. We hope to see you again 👋🏻",
+	"admin.export.errUser":          "Export failed: could not get user information",
+	"admin.export.errQuestion":      "Export failed: could not get question information",
+
+	// Vote management: owner visible (P1)
+	"vote.err.invalidID":                 "Invalid vote ID",
+	"vote.err.notExist":                  "The vote does not exist",
+	"vote.err.noPermission":              "You are not allowed to operate this vote",
+	"vote.err.type":                      "Unknown poll type",
+	"vote.err.titleRequired":             "Please fill in the poll title",
+	"vote.err.titleTooLong":              "The poll title cannot exceed 100 characters",
+	"vote.err.visibility":                "Unknown visibility setting",
+	"vote.err.voterScope":                "Unknown voting scope setting",
+	"vote.err.showResult":                "Unknown result visibility setting",
+	"vote.err.timeRange":                 "The end time must be later than the start time",
+	"vote.err.quota":                     "The collection quota must be an integer between 0 and 1000000",
+	"vote.err.optionsTooFew":             "Please add at least 2 options",
+	"vote.err.optionsFormat":             "Invalid options data format",
+	"vote.err.optionTooLong":             "A single option cannot exceed %d characters",
+	"vote.err.maxChoicesExceed":          "The max choices cannot exceed the total number of options",
+	"vote.err.fieldsTooFew":              "Please add at least 1 form field",
+	"vote.err.fieldsFormat":              "Invalid form fields data format",
+	"vote.err.fieldsTooMany":             "You can have at most 50 form fields",
+	"vote.err.fieldType":                 "Unknown form field type",
+	"vote.err.fieldLabelMissing":         "Field #%d is missing a label",
+	"vote.err.fieldLabelTooLong":         "Field #%d label cannot exceed 100 characters",
+	"vote.err.fieldLabelDuplicate":       "The field label \"%s\" is duplicated, please use a different label",
+	"vote.err.fieldMaxLength":            "Field #%d max length must be between 0 and 2000",
+	"vote.err.fieldReservedOption":       "Field #%d (%s) contains a reserved option value, please change it",
+	"vote.err.fieldOptionsTooFew":        "Field #%d (%s) needs at least 1 option",
+	"vote.err.fieldRankTooFew":           "Field #%d (%s) ranking questions need at least 2 options",
+	"vote.err.fieldSerialize":            "Failed to serialize field options",
+	"vote.err.editClosed":                "Votes that are ended or archived cannot be edited",
+	"vote.err.publishDraftOnly":          "Only draft polls can be published",
+	"vote.err.closePublishedOnly":        "Only active polls can be closed",
+	"vote.err.publishTitleRequired":      "Please fill in the poll title before publishing",
+	"vote.err.publishFormFieldsRequired": "Form polls need at least 1 field",
+	"vote.err.publishOptionsRequired":    "Choice polls need at least 2 options",
+	"vote.err.optionUpdateFailed":        "Failed to update options, please retry",
+	"vote.err.fieldUpdateFailed":         "Failed to update form fields, please retry",
+	"vote.flash.published":               "Poll published! Share link: %s",
+	"vote.flash.updated":                 "Poll info updated (active polls cannot change type or options)",
+	"vote.flash.draftSaved":              "Saved to draft",
+	"vote.flash.closed":                  "Poll ended",
+	"vote.flash.deleted":                 "Poll deleted",
+	"vote.err.timeFormat":                "Invalid time format, please use the datetime picker",
+	"vote.err.maxChoicesLimit":           "Maximum number of choices cannot exceed 20",
+	"vote.err.descriptionTooLong":        "Vote description cannot exceed 5000 characters",
+	"profile.err.avatarTooLarge":         "Avatar file is too large, maximum 2MB",
+	"profile.err.backgroundTooLarge":     "Background image is too large, maximum 2MB",
+	"profile.err.newPasswordTooShort":    "New password must be at least 8 characters",
+	"profile.err.badOldPassword":         "Incorrect old password",
+	"admin.export.errCreateExcel":        "Export failed: could not create Excel file",
+	"admin.export.errWriteExcel":         "Export failed: could not write Excel file",
+
+	// Profile page UI rework: card sections / avatar & background cropping / force re-login after password change
+	"profile.card.basic":             "Basic info",
+	"profile.card.avatarBg":          "Avatar & background",
+	"profile.card.qr":                "QR code style",
+	"profile.card.password":          "Change password",
+	"profile.avatarCropHint":         "Crop frame is locked to 1:1 (square)",
+	"profile.backgroundCropHint":     "Crop frame is locked to 16:9",
+	"profile.cropTitle":              "Crop image",
+	"profile.cropConfirm":            "Apply crop",
+	"profile.err.avatarRatio":        "Avatar image must be a 1:1 square. Please crop it and upload again.",
+	"profile.err.backgroundRatio":    "Background image must have a 16:9 aspect ratio. Please crop it and upload again.",
+	"profile.flash.passwordChanged":  "Password changed. You have been signed out; please sign in again with your new password.",
+	"profile.pwdNote":                "After saving, your current session will end immediately and you will need to sign in again with the new password.",
+	"profile.pickAvatar":             "Change avatar",
+	"profile.pickBackground":         "Change background",
+	"profile.saveBasic":              "Save basic info",
+	"profile.saveMedia":              "Save avatar & background",
+	"profile.savePassword":           "Update password",
+	"profile.saveQR":                 "Save QR code style",
+	"profile.saveSocial":             "Save social links",
+	"profile.err.cropLibUnavailable": "The image cropper failed to load. Please refresh the page and try again.",
+
+	// Captcha JSON endpoint: consumed by frontend (P2)
+	"captcha.json.badRequest": "Invalid request format",
+	"captcha.json.idRequired": "Captcha ID cannot be empty",
+	"captcha.json.genFailed":  "Failed to generate captcha",
+	"chat.errDeletedByOwner":  "This private conversation has been deleted by the other party.",
+	"chat.errBlockedView":     "You have been blocked by the other party and cannot view this chat",
+	"chat.errEmpty":           "Message cannot be empty",
+	"chat.errTooLong":         "Message is too long, please keep it within %d characters",
+	"chat.errConvDeletedSend": "This conversation has been deleted and messages cannot be sent",
+	"chat.errBlockedSend":     "You have been blocked by the other party and cannot send messages",
+	"chat.errBlockWords":      "Your message contains a blocked word set by the box owner and could not be sent",
+	"chat.errDailyLimit":      "You have reached today's message limit (%d), please try again tomorrow",
+	"chat.errLimitReached":    "The conversation has reached its limit and no new messages can be sent",
+	"chat.errChatClosed":      "The box owner has disabled private chat and messages cannot be sent",
+	"chat.errImageTooLarge":   "Image size cannot exceed %dMB",
+	"chat.errUploadFailed":    "Image upload failed, please try again later",
+	"chat.errNoPermission":    "You are not authorized to perform this action",
+	"chat.flash.sent":         "Message sent successfully",
+	"chat.flash.deleted":      "Private conversation deleted",
+	"chat.flash.operated":     "Operation successful",
+	"image.errTooLarge":       "Image is too large, maximum supported size is %d×%d pixels, please compress and re-upload",
+	"internal.errFlash":       "Internal server error, please try again later.",
+	"internal.errServer":      "Internal server error",
+	"home.errStats":           "Failed to retrieve statistics",
+	"pixel.errPath":           "Invalid request path",
+	"proxy.errNotFound":       "Page not found",
+	"proxy.errInternal":       "Service gateway internal error",
+	"explore.errRandomUser":   "Failed to retrieve random users",
+	// 表单校验
+	"form.answer.content":               "Answer content is required",
+	"form.answer.contentTooLong":        "Answer content must be within %d characters",
+	"form.email.required":               "Please enter a valid email address",
+	"form.followup.answer":              "Follow-up answer is required",
+	"form.followup.answerTooLong":       "Follow-up answer must be within %d characters",
+	"form.followup.content":             "Follow-up content is required",
+	"form.followup.contentTooLong":      "Follow-up content must be within %d characters",
+	"form.login.password":               "Please enter your password",
+	"form.profile.backgroundimagealpha": "Please enter the QR code background opacity",
+	"form.profile.colorHex":             "Please enter a 7-character hex color code (including #)",
+	"form.profile.dotscale":             "Please enter the QR code dot size",
+	"form.profile.intro":                "Bio is required and must be at most 100 characters",
+	"form.profile.linkMax":              "Profile link must be at most 30 characters",
+	"form.profile.name":                 "Nickname is required and must be at most 20 characters",
+	"form.profile.newPassword":          "New password must be at most 30 characters",
+	"form.profile.passwordMax":          "Password must be at most 30 characters",
+	"form.question.content":             "Question content is required",
+	"form.question.contentTooLong":      "Question content must be within %d characters",
+	"form.question.receiveReplyEmail":   "Please enter a valid email address to receive replies",
+	"form.recaptcha":                    "Please complete the CAPTCHA verification",
+	"form.recover.newPassword":          "Please set a new password of 8–30 characters",
+	"form.recover.repeatPassword":       "The two new passwords do not match",
+	"form.register.domain":              "The custom domain may only contain letters, digits and underscores, and must be 3–20 characters long",
+	"form.register.email":               "Please enter a valid email address (max 100 characters)",
+	"form.register.name":                "Nickname is required and must be at most 20 characters",
+	"form.register.password":            "Please set a password of 8–30 characters",
+	"form.register.recaptcha":           "Unable to load the CAPTCHA. Please refresh the page or switch your network and try again",
+	"form.register.repeatPassword":      "The two passwords do not match",
+}
diff --git a/.workbuddy/backup/remove-vercount-20260906/dict_ja.go b/.workbuddy/backup/remove-vercount-20260906/dict_ja.go
new file mode 100644
index 0000000..bc96681
--- /dev/null
+++ b/.workbuddy/backup/remove-vercount-20260906/dict_ja.go
@@ -0,0 +1,842 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package i18n
+
+// jaDict 日本語文案。
+var jaDict = map[string]string{
+	// ナビゲーション
+	"nav.explore":  "探索",
+	"nav.mine":     "マイ",
+	"nav.register": "登録",
+	"nav.login":    "ログイン",
+	"nav.ask":      "質問",
+	"nav.settings": "設定",
+	"nav.lang":     "言語",
+
+	// 共通
+	"common.login":      "ログイン",
+	"common.forgot":     "パスワードを忘れた",
+	"common.submit":     "送信",
+	"common.cancel":     "キャンセル",
+	"common.save":       "保存",
+	"common.close":      "閉じる",
+	"common.delete":     "削除",
+	"common.moveUp":     "上へ移動",
+	"common.moveDown":   "下へ移動",
+	"common.share":      "共有",
+	"common.verifying":  "認証中...",
+	"common.submitting": "送信中...",
+	"common.uploading":  "アップロード中...",
+	"common.lang":       "言語",
+	"common.menu":       "メニュー",
+
+	"common.pleaseWait": "お待ちください...",
+	"common.backHome":   "ホームに戻る",
+	"common.theme":      "ダーク/ライトモード切替",
+
+	// サイト
+	"site.title":           "狼の質問箱 | 匿名質問箱",
+	"site.description":     "狼の質問箱は登録不要で使える匿名質問箱。誰でも匿名で質問でき、安心してやり取りできる場所です。",
+	"site.keywords":        "匿名質問箱,質問箱,匿名質問,狼の質問箱,匿名で質問,匿名Q&A",
+	"site.footer.visitor":  "あなたは %s 人目の訪問者です",
+	"site.footer.pageview": "このページは %s 回閲覧されました",
+	"site.footer.runtime":  "質問箱は稼働中",
+	"site.footer.admin":    "管理者へ",
+	"site.footer.notice":   "お知らせ",
+	"site.footer.chat":     "チャット",
+	"site.footer.drive":    "ドライブ",
+	"site.footer.status":   "ステータス",
+	"site.footer.nav":      "リンク",
+	"site.maintenance":     "メンテナンス中です。しばらくお待ちください～",
+
+	// 認証
+	"auth.login.title":       "ログイン",
+	"auth.login.email":       "メールアドレス",
+	"auth.login.password":    "パスワード",
+	"auth.login.submit":      "ログイン",
+	"auth.login.forgot":      "パスワードを忘れた",
+	"auth.register.title":    "ユーザー登録",
+	"auth.register.name":     "ニックネーム",
+	"auth.register.email":    "メールアドレス",
+	"auth.register.password": "パスワード",
+	"auth.register.submit":   "登録",
+	"auth.forgot.title":      "パスワードを忘れた",
+	"auth.forgot.email":      "メールアドレス",
+	"auth.forgot.submit":     "再設定メールを送信",
+	"auth.forgot.submitBtn":  "パスワードを再取得",
+	"auth.forgot.sent":       "%s にメールを送信しました。ご確認ください。",
+	"auth.recover.title":     "パスワード再設定",
+	"auth.recover.greeting":  "%s さん、パスワードを再設定しています：",
+	"auth.recover.password":  "新しいパスワード",
+	"auth.recover.confirm":   "パスワード（確認）",
+	"auth.recover.submit":    "パスワードを再設定",
+
+	// 探索ページ
+	"explore.title":        "ユーザータグを探索",
+	"explore.notice":       "ここでは<span class=\"uk-text-bold\">「ホームでタグを表示」</span>を有効にしたユーザーを紹介しています。この機能は初期状態でオフです。自分の質問箱を見つけてもらいたい場合は <a href=\"/user/profile\" class=\"uk-text-bold\">個人設定</a> から有効にしてください。",
+	"explore.shuffle":      "シャッフル",
+	"explore.empty":        "表示できるユーザーがいません。有効にしてみましょう～",
+	"explore.hotVotes":     "人気の投票",
+	"explore.questionsTab": "質問",
+	"explore.votesTab":     "投票",
+	"explore.votesTitle":   "公開投票",
+	"explore.votesDesc":    "開催中の公開投票を見て、興味のあるテーマに参加できます。",
+	"explore.randomVote":   "ランダムおすすめ",
+	"explore.allVotes":     "すべての投票",
+	"explore.noVotes":      "現在、参加できる公開投票はありません。",
+
+	// 質問ページ
+	"ask.scan":              "QRコードで@%sに質問",
+	"ask.anonymous":         "誰でも匿名で質問できます",
+	"ask.registerOnly":      "登録ユーザーのみ質問できます",
+	"ask.nextOpenAt":        "次回開放：%s",
+	"ask.lastCloseAt":       "前回終了：%s",
+	"weekday.0":             "日",
+	"weekday.1":             "月",
+	"weekday.2":             "火",
+	"weekday.3":             "水",
+	"weekday.4":             "木",
+	"weekday.5":             "金",
+	"weekday.6":             "土",
+	"ask.pinned":            "ピン留め済み",
+	"ask.share":             "質問箱を共有",
+	"ask.placeholder":       "ここに質問を書いてください...",
+	"ask.chatPlaceholder":   "ここにチャットメッセージを書いてください...",
+	"ask.addImage":          "画像を追加",
+	"ask.private":           "返信後に公開しない",
+	"ask.notify":            "通知を受け取る",
+	"ask.emailPlaceholder":  "メールアドレスを入力してください",
+	"ask.submit":            "質問を送信",
+	"ask.chat":              "チャットを開始",
+	"ask.chatDisabled":      "この質問箱ではチャットが無効です",
+	"ask.chatLimit":         "メッセージ上限：%d件",
+	"ask.history":           "@%s が以前回答した質問",
+	"ask.loginRequired":     "ログインが必要",
+	"ask.loginRequiredChat": "チャットを開始するにはログインが必要です",
+	"ask.goLogin":           "ログインへ",
+	"ask.needPassword":      "この質問箱にはパスワードが必要です",
+	"ask.needLogin":         "質問箱の所有者は登録ユーザーのみ質問できるように設定しています。先にログインしてください。",
+	"ask.pleaseEmail":       "通知を受け取るメールアドレスを入力してください",
+	"ask.generating":        "共有カードを生成中…",
+	"ask.genFailed":         "共有カードの生成に失敗しました。しばらくしてからお試しください",
+	"ask.networkError":      "ネットワークエラー",
+	"ask.shareFilename":     "share.png",
+
+	// 質問アイテム
+	"qitem.answer":            "回答",
+	"qitem.delete":            "削除",
+	"qitem.private":           "非公開にする",
+	"qitem.public":            "公開にする",
+	"qitem.asked":             "質問",
+	"qitem.pending":           "回答待ち",
+	"qitem.answeredBy":        "@%s による %s の回答",
+	"qitem.danger":            "危険！",
+	"qitem.deleteConfirm":     "この質問を削除してもよろしいですか？この操作は取り消せません。",
+	"qitem.deleteConfirmBtn":  "削除する",
+	"qitem.backToBox":         "%sの質問箱に戻る",
+	"qitem.answerTitle":       "質問に回答する",
+	"qitem.answerPlaceholder": "ここに回答を入力...",
+	"qitem.emailNotifyHint":   "質問者はメールアドレスを残しています。最初に回答すると、質問者にメール通知が送信されます。",
+	"qitem.submitAnswer":      "回答",
+	"qitem.updateAnswer":      "回答を更新",
+	"qitem.askMore":           "ほかの質問は？",
+	"qitem.markRead":          "既読にする",
+	"qitem.markUnread":        "未読にする",
+	"qitem.readLocked":        "回答済みのため既読に固定",
+
+	// 個人設定ページ
+	"admin.profile":           "プロフィール",
+	"admin.lang":              "表示言語",
+	"admin.langHint":          "訪問者があなたの質問箱を開いたときに表示する言語を選択します（管理画面もこの設定に従います）",
+	"admin.email":             "メールアドレス",
+	"admin.name":              "ニックネーム",
+	"admin.nameColor":         "ニックネームの色",
+	"admin.oldPassword":       "現在のパスワード",
+	"admin.newPassword":       "新しいパスワード",
+	"admin.notify":            "新着質問の通知",
+	"admin.personalize":       "カスタマイズ",
+	"admin.intro":             "質問箱の紹介文",
+	"admin.introColor":        "紹介文の色",
+	"admin.qrBgColor":         "QRコードの背景色（明るい部分）",
+	"admin.qrPdColor":         "QRコードのファインダーパターン色（角の四角）",
+	"admin.qrFgColor":         "QRコードの前景色",
+	"admin.qrDotSize":         "QRコードのドットサイズ (←小 大→)",
+	"admin.qrBgAlpha":         "QRコードの背景透明度 (←不透明 透明→)",
+	"admin.avatar":            "アバター",
+	"admin.background":        "質問箱の背景",
+	"admin.qrBackground":      "QRコードの背景画像",
+	"admin.social":            "ソーシャルリンク",
+	"admin.harassment":        "迷惑行為対策",
+	"admin.askLimit":          "質問制限",
+	"admin.blockWords":        "ブロックワード設定（Enter またはカンマ区切り、最大10個、各10文字まで）",
+	"admin.chat":              "チャット設定",
+	"admin.chatMaxMessages":   "チャットのメッセージ上限",
+	"admin.chatDailyLimit":    "1ユーザーあたりの1日のメッセージ上限",
+	"admin.tags":              "タグ設定",
+	"admin.tagsHint":          "タグ（最大5個、各5文字まで、Enter またはカンマ区切り）",
+	"admin.tagsPlaceholder":   "例：アニメ,音楽,ゲーム",
+	"admin.tagInputHint":      "入力して Enter またはカンマで追加",
+	"admin.tagInputDuplicate": "既に存在するため無視しました",
+	"admin.pagePassword":      "ページアクセスパスワード",
+	"admin.pagePasswordHint":  "アクセスパスワードを設定（空欄で無効）",
+	"admin.askPassword":       "質問パスワード",
+	"admin.askPasswordHint":   "質問用パスワードを設定（空欄で無効）",
+	"admin.saveProfile":       "変更を保存",
+	"admin.updated":           "プロフィールを更新しました",
+	"admin.logout":            "ログアウト",
+	"admin.export":            "データをエクスポート",
+
+	// 管理画面設定（追加）
+	"admin.oldPasswordHint":         "パスワード変更時のみ使用。空欄のままなら変更されません",
+	"admin.newPasswordHint":         "6〜64文字。空欄のままなら変更されません",
+	"admin.notifyEmail":             "メール",
+	"admin.useCustomFg":             "カスタム前景色を使用（それ以外は自動マッチ）",
+	"admin.customFgHint":            "有効時のみ適用されます。それ以外は自動生成されます",
+	"admin.avatarPlaceholder":       "アバターをアップロード（1:1 以外は縦横比が崩れます）",
+	"admin.backgroundPlaceholder":   "質問箱の背景をアップロード",
+	"admin.qrBackgroundPlaceholder": "QRコードの背景画像をアップロード（暗すぎる背景はQRコードが読み取れなくなることがあります）",
+	"admin.qrPreviewHint":           "画像を選択するとプレビューが即時更新されます",
+	"admin.preview":                 "ライブプレビュー",
+	"admin.themePreset":             "プリセットテーマ",
+	"admin.themeDefault":            "デフォルト",
+	"admin.themeDark":               "ダーク",
+	"admin.themeOcean":              "オーシャン",
+	"admin.themeSunset":             "サンセット",
+	"admin.resetDefaults":           "🔄 デフォルトに戻す",
+	"admin.previewHint":             "調整はプレビューのみです。「変更を保存」をクリックすると反映されます",
+	"admin.socialHint":              "チェックを入れてプロフィールURLを入力してください（https:// は不要）。チェックのない項目は表示されません。",
+	"admin.enableAcfun":             "AcFun を有効にする",
+	"admin.enableBili":              "Bilibili を有効にする",
+	"admin.enableWeibo":             "Weibo を有効にする",
+	"admin.enableXiaohongshu":       "小紅書 を有効にする",
+	"admin.enableBlog":              "個人ブログを有効にする",
+	"admin.registerOnly":            "登録ユーザーのみ質問を許可",
+	"admin.updateHarassment":        "迷惑行為対策を更新",
+	"admin.globalBlockWords":        "共通ブロックワード",
+	"admin.globalBlockWordsHint":    "ブロックワードは質問・チャット（相手からあなたへのメッセージ）・投票の投稿内容に適用されます。この設定は質問/チャット/投票の3つのタブで共有され、どこで変更してもすぐに反映されます。",
+	"admin.updateBlockWords":        "ブロックワードを保存",
+	"admin.allowChat":               "登録ユーザーからのチャットを許可",
+	"admin.dailyLimitHint":          "0 は無制限",
+	"admin.updateChat":              "チャット設定を更新",
+	"admin.showInHome":              "ホームページでタグを表示（タグで検索されることを許可）",
+	"admin.updateTags":              "タグを更新",
+	"admin.updatePagePassword":      "ページパスワードを更新",
+	"admin.pagePasswordPlaceholder": "ページアクセスパスワードを入力",
+	"admin.updateAskPassword":       "質問パスワードを更新",
+	"admin.askPasswordPlaceholder":  "質問パスワードを入力",
+	"admin.account":                 "アカウント設定",
+	"admin.exportHint":              "%s のすべての個人データ（基本情報、受け取った質問と回答を含む）をエクスポートできます。",
+	"admin.exportJSON":              "全データをエクスポート（JSON）",
+	"admin.exportJSONHint":          "質問・回答・追加質問・チャットを含む完全バックアップ。",
+	"admin.deactivate":              "アカウントを停止",
+	"admin.deactivateHint":          "いつでもアカウントを停止できます。停止後はログインできなくなり、質問箱のページや質問にもアクセスできなくなります。新しい質問も受け付けられません。<b>この操作は取り消せません。ご注意ください！</b>",
+	"admin.socialRequired":          "リンクを入力するか、チェックを外してください",
+
+	// 質問管理ページ
+	"qlist.title":              "マイ質問",
+	"qlist.answered":           "回答済み",
+	"qlist.pending":            "回答待ち",
+	"qlist.private":            "非公開",
+	"qlist.empty":              "質問はまだありません。質問箱を共有しましょう～",
+	"qlist.action":             "操作",
+	"qlist.answerNow":          "回答する",
+	"qlist.sort":               "並び替え",
+	"qlist.status":             "状態",
+	"qlist.type":               "種類",
+	"qlist.latest":             "最新",
+	"qlist.oldest":             "最古",
+	"qlist.all":                "すべて",
+	"qlist.public":             "通常の質問",
+	"qlist.privateQuestion":    "非公開の質問",
+	"qlist.received":           "受け取った質問",
+	"qlist.myChats":            "開始したチャット",
+	"qlist.statsTotal":         "質問総数",
+	"qlist.statsAnswered":      "回答済み",
+	"qlist.statsUnanswered":    "未回答",
+	"qlist.statsPrivate":       "非公開質問",
+	"qlist.statsPinned":        "ピン留め",
+	"qlist.statsChats":         "チャット",
+	"qlist.searchPlaceholder":  "質問や回答を検索...",
+	"qlist.searchBtn":          "検索",
+	"qlist.searchClear":        "クリア",
+	"qlist.questionsTab":       "質問",
+	"qlist.votesTab":           "投票",
+	"qlist.chatsTab":           "チャット",
+	"qlist.receivedChats":      "受け取ったチャット",
+	"qlist.chatEmpty":          "まだチャットがありません。質問箱を共有してチャットを始めましょう！",
+	"qlist.pinnedShort":        "ピン",
+	"qlist.privateShort":       "非公開",
+	"qlist.chatStatsTotal":     "チャット総数",
+	"qlist.chatStatsReceived":  "受け取った",
+	"qlist.chatStatsInitiated": "開始した",
+	"qlist.chatStatsClosed":    "終了",
+	"qlist.unansweredShort":    "未答",
+	"qlist.readShort":          "既読",
+	"qlist.unreadShort":        "未読",
+	"qitem.markReadShort":      "既読に",
+	"qlist.pinShort":           "ピン",
+	"qlist.unpinShort":         "解除",
+	"qlist.myVotes":            "作成した投票",
+	"qlist.loadMore":           "もっと読み込む",
+	"qlist.newVote":            "投票を作成",
+	"qlist.edit":               "編集",
+	"qlist.untitledVote":       "無題の投票",
+	"qlist.blocked":            "ブロック済み",
+	"qlist.unanswered":         "未回答",
+
+	// サイトロゴの接尾辞
+	"site.logoSuffix": "の質問箱",
+	"site.stats":      "質問箱の統計",
+
+	// キャプチャモーダル
+	"captcha.title":        "人機認証",
+	"captcha.hint":         "以下の計算問題を解いて、ロボットでないことを証明してください",
+	"captcha.refresh":      "別の問題",
+	"captcha.submit":       "認証して送信",
+	"captcha.loading":      "読み込み中...",
+	"captcha.loadFailed":   "読み込み失敗",
+	"captcha.loadRetry":    "読み込み失敗、再試行してください",
+	"captcha.inputAnswer":  "答えを入力してください",
+	"captcha.wrongAnswer":  "答えが違います。もう一度計算してください",
+	"captcha.verifyFailed": "認証失敗、再試行してください",
+
+	// 登録ページ補足
+	"auth.register.domain.prefix":   "カスタムドメイン（あなたの質問箱URLは %s + ",
+	"auth.register.domain.suffix":   " + 下記に入力した内容になります）",
+	"auth.register.confirm":         "パスワード（確認）",
+	"auth.register.language":        "表示言語",
+	"auth.register.languageDefault": "サイト既定に従う",
+	"auth.register.success":         "登録が完了しました。狼の質問箱へようこそ！",
+
+	// 探索ページ補足
+	"explore.recommend":    "ランダムおすすめ",
+	"explore.search":       "タグを検索...",
+	"explore.sortLatest":   "新着順",
+	"explore.sortOldest":   "古い順",
+	"explore.noTags":       "タグなし",
+	"explore.noRecommend":  "おすすめユーザーはいません",
+	"explore.hotTags":      "人気タグ",
+	"explore.hotQuestions": "人気質問",
+	"explore.noResult":     "条件に一致するユーザーはいません。",
+	"explore.lazy":         "このユーザーは何も書いていません~",
+	"explore.prevPage":     "前へ",
+	"explore.nextPage":     "次へ",
+	"explore.loading":      "読み込み中...",
+	"explore.loadFailed":   "読み込み失敗",
+
+	// 質問箱パスワードページ
+	"password.title":  "この質問箱はパスワード保護されています",
+	"password.desc":   "この質問箱はパスワード保護されています。パスワードを入力して内容を表示してください",
+	"password.input":  "アクセスパスワードを入力してください",
+	"password.enter":  "認証して入る",
+	"password.submit": "確認",
+
+	// 質問が見つかりません
+	"qitem.notFound": "質問が見つからないか、削除されました",
+
+	// チャットページ
+	"chat.title":          "チャット",
+	"chat.input":          "メッセージを入力...",
+	"chat.send":           "送信",
+	"chat.delete":         "会話を削除",
+	"chat.block":          "相手をブロック",
+	"chat.unblock":        "ブロック解除",
+	"chat.empty":          "メッセージはまだありません。何か書いてみましょう~",
+	"chat.withAsker":      "質問者とのチャット",
+	"chat.withUser":       "%s とのチャット",
+	"chat.closed":         "会話は終了しました",
+	"chat.closedNoSend":   "会話は終了したため、新しいメッセージを送信できません",
+	"chat.remaining":      "残りメッセージ：%d 件（全 %d 件）",
+	"chat.me":             "自分",
+	"chat.other":          "相手",
+	"chat.userBlocked":    "このユーザーはブロックされています",
+	"chat.addImage":       "画像を追加（任意、最大5MB）",
+	"chat.confirm":        "確認",
+	"chat.confirmBlock":   "このユーザーをブロックしますか？ブロック後はメッセージを送信できなくなります。",
+	"chat.confirmUnblock": "このユーザーのブロックを解除しますか？再度メッセージを送信できるようになります。",
+	"chat.deleteConfirm":  "このチャットを削除しますか？相手はこの会話を見られなくなり、この操作は取り消せません。",
+	"maintenance.title":   "NekoBox メンテナンス中...",
+	"maintenance.desc":    "NekoBox はメンテナンス中のため、一時的にご利用いただけません。また後でお越しください~",
+
+	// 質問の個別シェア（v4）
+	"qitem.shareCard": "この質問をシェア",
+
+	// 追加質問（v4）
+	"followup.title":              "追加質問",
+	"followup.content":            "追加質問：",
+	"followup.answerPlaceholder":  "この追加質問に回答...",
+	"followup.answerBtn":          "回答する",
+	"followup.waiting":            "回答待ち...",
+	"followup.askMore":            "追加で質問する",
+	"followup.remaining":          "追加質問可能: %d / %d 回",
+	"followup.contentPlaceholder": "質問を補足...",
+	"followup.submit":             "送信",
+	"followup.waitingReply":       "追記を送信しました。ボックス所有者の返信をお待ちください...",
+
+	// ピン留め（v4）
+	"qlist.pinned":      "ピン留め中",
+	"qlist.pin":         "ピン留め",
+	"qlist.unpin":       "ピン留め解除",
+	"qlist.readStatus":  "既読ステータス",
+	"qlist.read":        "既読",
+	"qlist.unread":      "未読",
+	"qlist.statsRead":   "既読",
+	"qlist.statsUnread": "未読",
+
+	// 質問送信完了ページ（v4）
+	"success.title":        "質問を送信しました！",
+	"success.yourQuestion": "あなたの質問：",
+	"success.emailSent":    "この質問のプライベートリンクをメールで送信しました。以下のリンクからいつでも質問の確認、回答の受信、追加質問ができます。",
+	"success.saveLink":     "<strong>以下のプライベートリンクを必ず保存してください！</strong>メールアドレスを入力しなかったため、このリンク（トークンを含む）が質問の確認・回答の受信・追加質問のための<strong>唯一の証拠</strong>です。失くすと復元できません。",
+	"success.privateLink":  "あなたのプライベートリンク（クリックしてコピー）",
+	"success.copy":         "コピー",
+	"success.copied":       "コピーしました ✓",
+	"success.copyFailed":   "コピーに失敗",
+	"success.token":        "トークン: %s（質問者はこのトークンでプライベートリンクにアクセス）",
+	"success.viewQuestion": "質問を確認する",
+	"success.backToBox":    "%sの質問箱に戻る",
+	"success.pageTitle":    "質問送信完了 - %s",
+
+	// アカウント停止ページ
+	"deactivate.title":   "アカウント停止",
+	"deactivate.desc":    "停止後、あなたの質問箱にはアクセスできなくなり、すべてのデータが削除されます。この操作は取り消せません！",
+	"deactivate.confirm": "アカウントを停止することに同意します",
+	"deactivate.submit":  "アカウントを停止",
+
+	// 匿名投票
+	"nav.votes": "投票",
+
+	"common.back": "戻る",
+
+	"vote.listTitle":              "投票管理",
+	"vote.newTitle":               "投票を作成",
+	"vote.editTitle":              "投票を編集",
+	"vote.resultsTitle":           "投票結果",
+	"vote.statsTotal":             "投票総数",
+	"vote.statsPublished":         "進行中",
+	"vote.createNew":              "投票を作成",
+	"vote.typeSingle":             "単一選択",
+	"vote.typeMultiple":           "複数選択",
+	"vote.typeRating":             "評価",
+	"vote.typeRank":               "順位付け",
+	"vote.typeForm":               "フォーム",
+	"vote.statusNotStarted":       "未開始",
+	"vote.statusDraft":            "下書き",
+	"vote.statusPublished":        "進行中",
+	"vote.statusEnded":            "終了",
+	"vote.statusArchived":         "アーカイブ",
+	"vote.participants":           "参加者",
+	"vote.remainLabel":            "残り",
+	"vote.perpetual":              "期限なし",
+	"vote.durationDay":            "日",
+	"vote.durationHour":           "時間",
+	"vote.durationMinute":         "分",
+	"vote.createdAt":              "作成日時",
+	"vote.edit":                   "編集",
+	"vote.results":                "結果",
+	"vote.preview":                "プレビュー",
+	"vote.page.mustComplete":      "入力してください",
+	"vote.page.rankHintRequired":  "順位 1-N（必須）",
+	"vote.page.rankHintOptional":  "順位 1-N（任意、一部のみ可）",
+	"vote.page.previewHint":       "プレビューモード：公開前のサンプルです。送信は無効です",
+	"vote.page.previewSubmitHint": "プレビューモード。公開後に送信できます",
+	"vote.publish":                "公開",
+	"vote.close":                  "終了",
+	"vote.share":                  "リンクをコピー",
+	"vote.copied":                 "コピーしました",
+	"vote.shareURL":               "投票の共有リンク",
+	"vote.confirmPublish":         "この投票を公開しますか？公開後、共有リンクが生成されます。",
+	"vote.confirmClose":           "この投票を終了しますか？終了後、参加者は投票できなくなります。",
+	"vote.confirmDelete":          "この投票を削除しますか？投票データもすべて削除され、元に戻せません！",
+	"vote.manageEntry":            "投票を管理",
+
+	"vote.manageTitle": "投票管理",
+	"vote.manageDesc":  "匿名投票の作成と管理", "vote.empty": "投票はまだありません。右上の\"投票を作成\"から始めましょう。",
+	"vote.formLockedHint":              "この投票は公開中です。基本情報のみ編集可能です（収集済みデータを守るため、タイプと選択肢はロックされています）",
+	"vote.formBasic":                   "基本設定",
+	"vote.formTitle":                   "投票タイトル",
+	"vote.formTitlePlaceholder":        "例：今日の昼ごはんは？",
+	"vote.formDescription":             "説明",
+	"vote.formDescriptionPlaceholder":  "補足説明（任意）",
+	"vote.formType":                    "投票タイプ",
+	"vote.formVisibility":              "表示方法",
+	"vote.formVisibilityPublic":        "公開（探索ページ + 質問箱ページ）",
+	"vote.formVisibilityLinkOnly":      "リンクのみ",
+	"vote.formVoterScope":              "投票範囲",
+	"vote.formVoterScopeAnyone":        "誰でも（匿名含む）",
+	"vote.formVoterScopeRegistered":    "登録ユーザーのみ",
+	"vote.formShowResult":              "結果の表示タイミング",
+	"vote.formShowResultAfterVote":     "投票後すぐに表示",
+	"vote.formShowResultAfterEnd":      "終了後に表示",
+	"vote.formShowResultOwnerOnly":     "本人のみ",
+	"vote.formStartAt":                 "開始時間（空欄=すぐ開始）",
+	"vote.formEndAt":                   "終了時間（空欄=制限なし）",
+	"vote.formMaxChoices":              "最大選択数",
+	"vote.formMaxVotesPerFingerprint":  "投票ごとに1台の端末につき1回まで。同じブラウザからの再送信は拒否されます。",
+	"vote.formMaxVotesPerAccount":      "投票ごとに1つの登録アカウントにつき1回まで。同じアカウントからの再送信は拒否されます。",
+	"vote.formAllowCustom":             "参加者がカスタム選択肢を追加できる",
+	"vote.formRequireCaptcha":          "匿名投票にキャプチャを要求",
+	"vote.formOptions":                 "投票の選択肢",
+	"vote.formRatingHint":              "評価投票は選択肢不要（1-10点）",
+	"vote.addOption":                   "選択肢を追加",
+	"vote.optionPlaceholder":           "選択肢の内容",
+	"vote.formFields":                  "フォーム項目",
+	"vote.addField":                    "項目を追加",
+	"vote.field":                       "項目",
+	"vote.formFieldType":               "項目タイプ",
+	"vote.fieldTypeText":               "一行テキスト",
+	"vote.fieldTypeTextarea":           "複数行テキスト",
+	"vote.fieldTypeSelect":             "ドロップダウン選択",
+	"vote.fieldTypeRadio":              "単一選択",
+	"vote.fieldTypeCheckbox":           "複数選択",
+	"vote.fieldTypeNumber":             "数値",
+	"vote.fieldTypeRank":               "順位",
+	"vote.page.selectPlaceholder":      "選択してください",
+	"vote.page.avgNumber":              "平均",
+	"vote.page.fieldFilled":            "回答数",
+	"vote.fieldTypeRating":             "評価",
+	"vote.formFieldLabel":              "項目ラベル",
+	"vote.formFieldRequired":           "必須",
+	"vote.formFieldMaxLength":          "文字数上限（0=制限なし）",
+	"vote.formFieldOptions":            "選択肢",
+	"vote.formFieldOptionsHint":        "下の「選択肢を追加」で一つずつ追加してください（カンマ不要）",
+	"vote.fieldAllowCustom":            "参加者がカスタム選択肢を追加できる",
+	"vote.formFieldOptionsPlaceholder": "例：良い,普通,悪い",
+	"vote.createDraft":                 "下書きを保存",
+	"vote.builderHintOptions":          "選択肢は最低 2 つ必要です",
+	"vote.builderHintFields":           "フィールドを最低 1 つ追加してください",
+	"vote.builderHintFieldOptions":     "選択・順位題には選択肢が必要です（順位は最低 2 つ）",
+	"vote.resultsAnswered":             "回答数",
+	"vote.page.rankedTimes":            "順位付け数",
+	"vote.resultsTotal":                "総参加人数",
+	"vote.resultsSubmissions":          "フォームの回答",
+	"vote.resultsViewTexts":            "テキスト回答を表示",
+	"vote.resultsToggleHint":           "クリックでテキスト回答の表示・非表示を切り替え",
+	"vote.resultsOptions":              "投票結果",
+	"vote.resultsVotes":                "票",
+	"vote.export":                      "CSV エクスポート",
+	"vote.resultsEmpty":                "まだ参加者がいません。リンクを共有しましょう！",
+
+	// 投票参加ページ
+	"vote.inlineTitle":                 "投票",
+	"vote.page.by":                     "の投票",
+	"vote.page.goVote":                 "投票する",
+	"vote.page.notStarted":             "未開始",
+	"vote.page.notStartedHint":         "この投票はまだ始まっていません。",
+	"vote.page.ended":                  "終了",
+	"vote.page.endedHint":              "この投票は終了しました。",
+	"vote.page.active":                 "進行中",
+	"vote.page.participated":           "参加済み",
+	"vote.page.loginRequired":          "この投票は登録ユーザーのみ参加できます。ログインしてください。",
+	"vote.page.anonymousHint":          "匿名での参加が可能で、あなたの身元は記録されません（同一端末で最大1回）。",
+	"vote.page.submit":                 "投票する",
+	"vote.page.alreadyVoted":           "この投票にはすでに参加済みです。ありがとうございます！",
+	"vote.page.resultsTitle":           "投票結果",
+	"vote.page.totalVotes":             "総参加",
+	"vote.page.avgRating":              "平均点",
+	"vote.page.avgRank":                "平均順位",
+	"vote.page.optionColumn":           "選択肢",
+	"vote.page.ratingLabel":            "評価",
+	"vote.page.ratingUnit":             "点",
+	"vote.page.rankHint":               "各選択肢に 1-N の順位を入力してください（小さいほど上位、重複不可）",
+	"vote.page.rankPlaceholder":        "順位",
+	"vote.page.multipleHint":           "複数選択可",
+	"vote.page.customOption":           "カスタム選択肢（任意）",
+	"vote.page.customPlaceholder":      "あなたの選択肢を入力",
+	"vote.page.customOther":            "その他",
+	"vote.page.customFieldPlaceholder": "カスタム選択肢を入力…",
+	"vote.page.customStats":            "カスタム選択肢",
+	"vote.page.formCount":              "回答受付数",
+	"vote.page.ownerManage":            "この投票を管理（結果は本人のみ閲覧可能）",
+
+	// 投票ごとの定量収集
+	"vote.formQuotaLimit":          "収集上限（件）",
+	"vote.formQuotaHint":           "0 は無制限。指定件数に達すると自動的に投票を終了します。",
+	"vote.flash.notFound":          "この投票は存在しないか、既に無効です",
+	"vote.flash.notPublished":      "この投票はまだ公開されていません",
+	"vote.flash.archived":          "この投票はアーカイブ済みのため参加できません",
+	"vote.flash.ended":             "この投票は終了しました",
+	"vote.flash.notStarted":        "この投票はまだ開始していません",
+	"vote.flash.success":           "投票が完了しました。ご参加ありがとうございます！",
+	"vote.err.noChoice":            "少なくとも 1 つの選択肢を選んでください",
+	"vote.err.tooManyChoices":      "選択できるのは最大 %d 個までです",
+	"vote.err.pickOne":             "選択肢を 1 つ選んでください",
+	"vote.err.invalidOption":       "無効な選択肢です",
+	"vote.err.optionDuplicate":     "選択肢は重複できません",
+	"vote.err.ratingRequired":      "1〜10 点の評価を入力してください",
+	"vote.err.rankRequired":        "すべての選択肢に 1〜%d の順位を入力してください",
+	"vote.err.rankDuplicate":       "順位が重複しています",
+	"vote.err.fieldRequired":       "「%s」を入力してください",
+	"vote.err.fieldCustomRequired": "「%s」の自由記入欄を入力してください",
+	"vote.err.fieldCustomTooLong":  "「%s」の自由記入は %d 字以内にしてください",
+	"vote.err.fieldInvalidOption":  "「%s」の選択肢が無効です",
+	"vote.err.fieldConfigError":    "「%s」の選択肢の設定に誤りがあります",
+	"vote.err.fieldRankIncomplete": "「%s」の順位をすべて入力してください",
+	"vote.err.fieldRankRange":      "「%s」の順位は 1〜%d の数字で入力してください",
+	"vote.err.fieldRankDuplicate":  "「%s」の順位が重複しています",
+	"vote.err.fieldTooLong":        "「%s」が文字数上限（最大 %d 字）を超えています",
+	"vote.err.fieldNotNumber":      "「%s」は数値で入力してください",
+	"vote.err.fieldRating":         "「%s」は 1〜10 点で評価してください",
+	"vote.err.unknownType":         "不明な投票タイプです",
+	"vote.err.customTooLong":       "自由記入オプションは %d 字以内にしてください",
+	"vote.err.blockWords":          "投稿内容に投票作成者が設定したブロックワードが含まれているため、送信できませんでした",
+	"vote.err.serialize":           "送信内容の保存に失敗しました",
+	"captcha.error":                "認証コードが正しくありません",
+	"captcha.errEmpty":             "認証コードを入力してください",
+	"captcha.errFormat":            "認証コードの形式が正しくありません。再読み込みしてお試しください",
+	"captcha.errAnswerFormat":      "認証コードの回答形式が正しくありません",
+	"captcha.errExpired":           "認証コードの有効期限が切れました。再読み込みしてお試しください",
+	"captcha.errService":           "認証コードサービスでエラーが発生しました。後ほどお試しください",
+	"captcha.errAnswerWrong":       "認証コードの回答が正しくありません",
+	"censor.unavailable":           "コンテンツ審査サービスが一時的に利用できません。後ほどお試しください",
+
+	// 機能管理：質問 / チャット / 投票 の ON・OFF、期間指定、定量収集
+	"admin.tabAccount":            "ユーザー設定",
+	"admin.featuresHint":          "「質問 / チャット / 投票」パネルで各機能の ON/OFF、公開期間、収集上限を管理します。上限に達すると対象機能は自動的に閉じられます。",
+	"admin.featuresEntry":         "設定",
+	"admin.featureHint.question":  "OFF にすると新しい質問を投稿できません。上限に達すると自動的に受付を停止します（非公開質問を含む）。",
+	"admin.featureHint.chat":      "OFF にすると新しいチャットを開始できません。既存の会話には影響しません。",
+	"admin.featureHint.vote":      "OFF にすると質問箱ページに投票が表示されず、回答もできなくなります。投票ごとの上限は編集ページで設定できます。",
+	"admin.featureEnabled":        "この機能を有効にする",
+	"admin.featureOpenAt":         "公開開始",
+	"admin.featureCloseAt":        "公開終了",
+	"admin.featureTimeHint":       "空欄は制限なし。開始前と終了後はその機能を利用できません。",
+	"admin.featureSchedule":       "定期公開（毎週）",
+	"admin.featureScheduleStart":  "毎日の開始",
+	"admin.featureScheduleEnd":    "毎日の終了",
+	"admin.featureScheduleHint":   "毎週の公開曜日と毎日の時間帯を設定すると、毎週繰り返し公開されます。すべて空欄で無効。曜日のみ（時間なし）は終日公開、時間のみ（曜日なし）は毎日その時間帯に公開。",
+	"admin.featureMode":           "収集モード",
+	"admin.featureModeAlways":     "常時開放",
+	"admin.featureModeWindow":     "期間限定",
+	"admin.featureModeRecurring":  "曜日スケジュール",
+	"admin.featureModeHint":       "常時開放：手動でオフにするまで開放し続けます。期間限定：一回限りの開始／終了時刻で開放します。曜日スケジュール：毎週の開放日と時間帯を繰り返し適用します。モードは保存時に排他となり、未選択モードの設定はクリアされます。",
+	"admin.featureQuotaLimit":     "収集上限（件）",
+	"admin.featureQuotaHint":      "0 は無制限。上限に達すると自動的に閉じられます。カウントをリセットすると次の回を開始できます。",
+	"admin.featureQuotaCount":     "収集済み",
+	"admin.featureQuotaUnlimited": "無制限",
+	"admin.featureQuotaResetAt":   "最終リセット：",
+	"admin.featureResetQuota":     "カウントをリセット",
+	"admin.featureSave":           "この機能を保存",
+
+	// 機能管理：状態とメッセージ
+	"feature.name.question":        "質問",
+	"feature.name.chat":            "チャット",
+	"feature.name.vote":            "投票",
+	"feature.statusOpen":           "受付中",
+	"feature.status.disabled":      "停止中",
+	"feature.status.not_started":   "未開始",
+	"feature.status.ended":         "終了",
+	"feature.status.quota_reached": "上限到達",
+	"feature.saved":                "機能設定を保存しました",
+	"feature.errTime":              "%s の日時形式が正しくありません。日時選択ツールを使用してください",
+	"feature.errTimeRange":         "%s の公開終了時刻は公開開始時刻より後にしてください",
+	"feature.errQuota":             "%s の収集上限は 0〜1000000 の整数で入力してください",
+	"feature.errInvalid":           "不明な機能です",
+	"feature.quotaReset":           "%s の収集カウントをリセットしました",
+	"feature.errScheduleHalf":      "%s の定期公開の開始時間と終了時間は両方入力してください",
+	"feature.errScheduleTime":      "%s の定期公開の時刻形式が正しくありません。時刻選択ツールを使用してください",
+	"feature.errScheduleRange":     "%s の定期公開の終了時刻は開始時刻より後にしてください",
+
+	// 機能が無効なときに訪問者へ表示するメッセージ
+	"feature.disabled.question":      "この質問箱の管理者は質問の受付を停止しています",
+	"feature.disabled.chat":          "この質問箱ではチャットを受け付けていません",
+	"feature.disabled.vote":          "この質問箱では投票を受け付けていません",
+	"feature.not_started.question":   "質問の受付はまだ開始していません",
+	"feature.not_started.chat":       "チャットの受付はまだ開始していません",
+	"feature.not_started.vote":       "投票の受付はまだ開始していません",
+	"feature.ended.question":         "質問の受付は終了しました",
+	"feature.ended.chat":             "チャットの受付は終了しました",
+	"feature.ended.vote":             "投票の受付は終了しました",
+	"feature.quota_reached.question": "質問の収集上限に達しました",
+	"feature.quota_reached.chat":     "チャットの収集上限に達しました",
+	"feature.quota_reached.vote":     "投票の収集上限に達しました",
+
+	// 認証：訪問者に表示されるメッセージ（P0）
+	"auth.errBadCredential":   "メールアドレスまたはパスワードが正しくありません",
+	"auth.errUserNotFound":    "ユーザーが存在しません",
+	"auth.errEmailFrequent":   "メールの送信頻度が高すぎます。しばらくしてからお試しください",
+	"auth.errEmailFailed":     "メールの送信に失敗しました。しばらくしてからお試しください",
+	"auth.errCodeExpired":     "認証コードの有効期限が切れました",
+	"auth.errPasswordChanged": "パスワードを変更しました",
+	"auth.errLoginRequired":   "ログインしてください",
+	"auth.errDuplicateEmail":  "このメールアドレスは既に登録されています",
+	"auth.errDuplicateDomain": "このカスタムドメインは既に使用されています",
+
+	// 質問箱ページ：訪問者に表示（P0）
+	"question.errWrongPassword":     "パスワードが正しくありません",
+	"question.errAskPasswordWrong":  "質問用パスワードが正しくありません",
+	"question.errLoginRequired":     "質問箱の所有者は登録ユーザーのみ質問できるように設定しています。先にログインしてください。",
+	"question.errSelfChat":          "自分自身とのチャットは開始できません",
+	"question.errBlockedChat":       "相手にブロックされているため、チャットを開始できません",
+	"question.errChatDailyLimit":    "本日の送信上限（%d件）に達しました。明日お試しください",
+	"question.errDuplicateSubmit":   "重複送信が検出されました。しばらくしてからお試しください",
+	"question.errImageTooLarge":     "画像ファイルのサイズは 5Mb 以下である必要があります",
+	"question.errUploadImageFailed": "画像のアップロードに失敗しました",
+	"question.errBlockWords":        "質問に所有者が設定したブロックワードが含まれているため、送信できませんでした",
+	"question.errAnsweredLocked":    "回答済みの質問は未読にできません",
+	"question.flash.chatSent":       "チャットリクエストを送信しました！以下のリンクから会話を確認できます：%s",
+	"question.flash.answered":       "回答を公開しました！",
+	"question.flash.operated":       "操作が完了しました",
+	"question.flash.markedRead":     "既読にしました",
+	"question.flash.markedUnread":   "未読にしました",
+
+	// 追加質問：訪問者/所有者に表示（P0）
+	"followup.errNoPermission": "権限がありません",
+	"followup.errNotAnswered":  "この質問にはまだ回答がありません。追加質問はできません",
+	"followup.errLimit":        "各質問の追加質問は最大 %d 回までで、上限に達しました",
+	"followup.errWaitReply":    "前の追加質問への返信を待ってから続けてください",
+	"followup.errNotFound":     "追加質問が存在しません",
+	"followup.flash.sent":      "追加質問を送信しました！",
+	"followup.flash.answered":  "回答を投稿しました！",
+
+	// 管理設定：所有者に表示（P1）
+	"admin.flash.profileUpdated":    "プロフィールを更新しました",
+	"admin.flash.chatUpdated":       "チャット設定を更新しました",
+	"admin.flash.pagePwdOff":        "ページパスワード認証を無効にしました",
+	"admin.flash.pagePwdUpdated":    "ページアクセスパスワードを更新しました",
+	"admin.flash.askPwdOff":         "質問パスワードを無効にしました",
+	"admin.flash.askPwdUpdated":     "質問パスワードを更新しました",
+	"admin.flash.tagsTooMany":       "タグは最大 5 個までです",
+	"admin.flash.tagsUpdated":       "タグを更新しました",
+	"admin.flash.tagTooLong":        "各タグは 5 文字以内である必要があります：%s",
+	"admin.flash.blockWordsTooMany": "ブロックワードは最大 10 個までです",
+	"admin.flash.blockWordTooLong":  "ブロックワードの長さは 10 文字以内である必要があります：%s",
+	"admin.flash.harassmentUpdated": "迷惑行為対策を更新しました",
+	"admin.flash.blockWordsUpdated": "ブロックワードを更新しました",
+	"admin.flash.deactivated":       "アカウントを停止しました。狼の質問箱をご利用いただきありがとうございます。またのお越しをお待ちしています 👋🏻",
+	"admin.export.errUser":          "エクスポート失敗：ユーザー情報の取得に失敗しました",
+	"admin.export.errQuestion":      "エクスポート失敗：質問情報の取得に失敗しました",
+
+	// 投票管理：所有者に表示（P1）
+	"vote.err.invalidID":                 "無効な投票 ID",
+	"vote.err.notExist":                  "投票が存在しません",
+	"vote.err.noPermission":              "この投票を操作する権限がありません",
+	"vote.err.type":                      "不明な投票タイプです",
+	"vote.err.titleRequired":             "投票のタイトルを入力してください",
+	"vote.err.titleTooLong":              "投票のタイトルは 100 文字以内である必要があります",
+	"vote.err.visibility":                "不明な表示設定です",
+	"vote.err.voterScope":                "不明な投票範囲設定です",
+	"vote.err.showResult":                "不明な結果表示設定です",
+	"vote.err.timeRange":                 "終了時刻は開始時刻より後にしてください",
+	"vote.err.quota":                     "収集上限は 0〜1000000 の整数で入力してください",
+	"vote.err.optionsTooFew":             "選択肢を最低 2 つ追加してください",
+	"vote.err.optionsFormat":             "選択肢データの形式が正しくありません",
+	"vote.err.optionTooLong":             "1 つの選択肢は %d 文字以内である必要があります",
+	"vote.err.maxChoicesExceed":          "最大選択数は選択肢の総数を超えられません",
+	"vote.err.fieldsTooFew":              "フォーム項目を最低 1 つ追加してください",
+	"vote.err.fieldsFormat":              "フォーム項目データの形式が正しくありません",
+	"vote.err.fieldsTooMany":             "フォーム項目は最大 50 個までです",
+	"vote.err.fieldType":                 "不明なフォーム項目タイプです",
+	"vote.err.fieldLabelMissing":         "%d 番目の項目にラベルがありません",
+	"vote.err.fieldLabelTooLong":         "%d 番目の項目のラベルは 100 文字以内である必要があります",
+	"vote.err.fieldLabelDuplicate":       "項目ラベル「%s」が重複しています。別のラベルを使用してください",
+	"vote.err.fieldMaxLength":            "%d 番目の項目の文字数上限は 0〜2000 の間である必要があります",
+	"vote.err.fieldReservedOption":       "%d 番目の項目（%s）の選択肢に予約値が含まれています。変更してください",
+	"vote.err.fieldOptionsTooFew":        "%d 番目の項目（%s）は選択肢を最低 1 つ入力してください",
+	"vote.err.fieldRankTooFew":           "%d 番目の項目（%s）の順位付けには最低 2 つの選択肢が必要です",
+	"vote.err.fieldSerialize":            "項目の選択肢のシリアライズに失敗しました",
+	"vote.err.editClosed":                "終了またはアーカイブされた投票は編集できません",
+	"vote.err.publishDraftOnly":          "草稿状態の投票のみ公開できます",
+	"vote.err.closePublishedOnly":        "進行中の投票のみ終了できます",
+	"vote.err.publishTitleRequired":      "公開前に投票のタイトルを入力してください",
+	"vote.err.publishFormFieldsRequired": "フォーム型投票には最低 1 つの項目が必要です",
+	"vote.err.publishOptionsRequired":    "選択型投票には最低 2 つの選択肢が必要です",
+	"vote.err.optionUpdateFailed":        "選択肢の更新に失敗しました。再試行してください",
+	"vote.err.fieldUpdateFailed":         "フォーム項目の更新に失敗しました。再試行してください",
+	"vote.flash.published":               "投票を公開しました！共有リンク：%s",
+	"vote.flash.updated":                 "投票情報を更新しました（進行中の投票はタイプと選択肢を変更できません）",
+	"vote.flash.draftSaved":              "下書きに保存しました",
+	"vote.flash.closed":                  "投票を終了しました",
+	"vote.flash.deleted":                 "投票を削除しました",
+	"vote.err.timeFormat":                "日時の形式が正しくありません。日時選択器を使用してください",
+	"vote.err.maxChoicesLimit":           "選択可能数は20を超えられません",
+	"vote.err.descriptionTooLong":        "投票の説明は5000文字を超えられません",
+	"profile.err.avatarTooLarge":         "アイコンファイルが大きすぎます。最大2MB",
+	"profile.err.backgroundTooLarge":     "背景画像が大きすぎます。最大2MB",
+	"profile.err.newPasswordTooShort":    "新しいパスワードは8文字以上である必要があります",
+	"profile.err.badOldPassword":         "古いパスワードが間違っています",
+	"admin.export.errCreateExcel":        "エクスポート失敗：Excelファイルの作成に失敗しました",
+	"admin.export.errWriteExcel":         "エクスポート失敗：Excelファイルの書き込みに失敗しました",
+
+	// プロフィール設定ページ UI リニューアル：カード区切り／アイコン・背景の切り取り／パスワード変更後の強制ログアウト
+	"profile.card.basic":             "基本情報",
+	"profile.card.avatarBg":          "アイコンと背景",
+	"profile.card.qr":                "QRコードのスタイル",
+	"profile.card.password":          "パスワード変更",
+	"profile.avatarCropHint":         "切り取り枠は 1:1（正方形）に固定されています",
+	"profile.backgroundCropHint":     "切り取り枠は 16:9 に固定されています",
+	"profile.cropTitle":              "画像を切り取る",
+	"profile.cropConfirm":            "切り取りを確定",
+	"profile.err.avatarRatio":        "アイコン画像は 1:1 の正方形である必要があります。切り取ってから再アップロードしてください",
+	"profile.err.backgroundRatio":    "背景画像は 16:9 の縦横比である必要があります。切り取ってから再アップロードしてください",
+	"profile.flash.passwordChanged":  "パスワードを変更しました。ログアウトしましたので、新しいパスワードで再度ログインしてください",
+	"profile.pwdNote":                "保存後、現在のセッションはすぐに無効になり、新しいパスワードで再ログインする必要があります",
+	"profile.pickAvatar":             "アイコンを変更",
+	"profile.pickBackground":         "背景を変更",
+	"profile.saveBasic":              "基本情報を保存",
+	"profile.saveMedia":              "アイコンと背景を保存",
+	"profile.savePassword":           "パスワードを更新",
+	"profile.saveQR":                 "QRコードのスタイルを保存",
+	"profile.saveSocial":             "SNSリンクを保存",
+	"profile.err.cropLibUnavailable": "画像切り取り機能の読み込みに失敗しました。ページを更新してもう一度お試しください",
+
+	// 認証コード JSON インターフェース：フロントエンドが消費（P2）
+	"captcha.json.badRequest": "リクエスト形式が正しくありません",
+	"captcha.json.idRequired": "認証コード ID を入力してください",
+	"captcha.json.genFailed":  "認証コードの生成に失敗しました",
+	"chat.errDeletedByOwner":  "このプライベート会話は相手によって削除されました。",
+	"chat.errBlockedView":     "あなたは相手にブロックされ、このチャットを表示できません",
+	"chat.errEmpty":           "メッセージを入力してください",
+	"chat.errTooLong":         "メッセージが長すぎます。%d文字以内でお願いします",
+	"chat.errConvDeletedSend": "この会話は削除されたため、メッセージを送信できません",
+	"chat.errBlockedSend":     "あなたは相手にブロックされ、メッセージを送信できません",
+	"chat.errBlockWords":      "メッセージにボックス所有者が設定したブロックワードが含まれているため、送信できませんでした",
+	"chat.errDailyLimit":      "本日の送信上限（%d件）に達しました。明日再度お試しください",
+	"chat.errLimitReached":    "会話が上限に達したため、新しいメッセージを送信できません",
+	"chat.errChatClosed":      "箱の所有者がプライベートチャットを無効にしたため、メッセージを送信できません",
+	"chat.errImageTooLarge":   "画像サイズは%dMBを超えることはできません",
+	"chat.errUploadFailed":    "画像のアップロードに失敗しました。後でもう一度お試しください",
+	"chat.errNoPermission":    "この操作を実行する権限がありません",
+	"chat.flash.sent":         "メッセージを送信しました",
+	"chat.flash.deleted":      "プライベート会話を削除しました",
+	"chat.flash.operated":     "操作が完了しました",
+	"image.errTooLarge":       "画像が大きすぎます。最大%d×%dピクセルまで対応しています。圧縮して再アップロードしてください",
+	"internal.errFlash":       "サーバー内部エラーが発生しました。後でもう一度お試しください。",
+	"internal.errServer":      "サーバー内部エラー",
+	"home.errStats":           "統計情報の取得に失敗しました",
+	"pixel.errPath":           "不正なリクエストパス",
+	"proxy.errNotFound":       "ページが見つかりません",
+	"proxy.errInternal":       "サービスゲートウェイ内部エラー",
+	"explore.errRandomUser":   "ランダムユーザーの取得に失敗しました",
+	// 表单校验
+	"form.answer.content":               "回答内容を入力してください",
+	"form.answer.contentTooLong":        "回答内容は%d文字以内にしてください",
+	"form.email.required":               "有効なメールアドレスを入力してください",
+	"form.followup.answer":              "フォローアップの回答を入力してください",
+	"form.followup.answerTooLong":       "フォローアップの回答は%d文字以内にしてください",
+	"form.followup.content":             "フォローアップ内容を入力してください",
+	"form.followup.contentTooLong":      "フォローアップ内容は%d文字以内にしてください",
+	"form.login.password":               "パスワードを入力してください",
+	"form.profile.backgroundimagealpha": "QRコードの背景の不透明度を入力してください",
+	"form.profile.colorHex":             "7文字の16進数カラーコード（#を含む）を入力してください",
+	"form.profile.dotscale":             "QRコードの点の大きさを入力してください",
+	"form.profile.intro":                "自己紹介は必須で、100文字以内である必要があります",
+	"form.profile.linkMax":              "プロフィールリンクは30文字以内である必要があります",
+	"form.profile.name":                 "ニックネームは必須で、20文字以内である必要があります",
+	"form.profile.newPassword":          "新しいパスワードは30文字以内である必要があります",
+	"form.profile.passwordMax":          "パスワードは30文字以内である必要があります",
+	"form.question.content":             "質問内容を入力してください",
+	"form.question.contentTooLong":      "質問内容は%d文字以内にしてください",
+	"form.question.receiveReplyEmail":   "返信を受け取るための有効なメールアドレスを入力してください",
+	"form.recaptcha":                    "CAPTCHA認証を完了してください",
+	"form.recover.newPassword":          "8〜30文字の新しいパスワードを設定してください",
+	"form.recover.repeatPassword":       "入力した2つの新しいパスワードが一致しません",
+	"form.register.domain":              "カスタムドメインは半角英数字とアンダースコアのみ使用でき、3〜20文字である必要があります",
+	"form.register.email":               "有効なメールアドレスを入力してください（100文字以内）",
+	"form.register.name":                "ニックネームは必須で、20文字以内である必要があります",
+	"form.register.password":            "8〜30文字のパスワードを設定してください",
+	"form.register.recaptcha":           "CAPTCHAを読み込めません。ページを再読み込みするか、ネットワークを変更してお試しください",
+	"form.register.repeatPassword":      "入力した2つのパスワードが一致しません",
+}
diff --git a/.workbuddy/backup/remove-vercount-20260906/dict_zh_cn.go b/.workbuddy/backup/remove-vercount-20260906/dict_zh_cn.go
new file mode 100644
index 0000000..41e82d0
--- /dev/null
+++ b/.workbuddy/backup/remove-vercount-20260906/dict_zh_cn.go
@@ -0,0 +1,842 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package i18n
+
+// zhCNDict 简体中文文案。
+var zhCNDict = map[string]string{
+	// 导航
+	"nav.explore":  "探索",
+	"nav.mine":     "我的",
+	"nav.register": "注册",
+	"nav.login":    "登录",
+	"nav.ask":      "提问",
+	"nav.settings": "设置",
+	"nav.lang":     "语言",
+
+	// 通用
+	"common.login":      "登录",
+	"common.forgot":     "忘记密码",
+	"common.submit":     "提交",
+	"common.cancel":     "取消",
+	"common.save":       "保存",
+	"common.close":      "关闭",
+	"common.delete":     "删除",
+	"common.moveUp":     "上移",
+	"common.moveDown":   "下移",
+	"common.share":      "分享",
+	"common.verifying":  "验证中...",
+	"common.submitting": "提交中...",
+	"common.uploading":  "上传中...",
+	"common.lang":       "语言",
+	"common.menu":       "菜单",
+
+	"common.pleaseWait": "请稍候...",
+	"common.backHome":   "返回首页",
+	"common.theme":      "切换深色/浅色模式",
+
+	// 站点
+	"site.title":           "狼的提问箱 | 匿名提问箱",
+	"site.description":     "狼的提问箱——一个无需注册、可匿名提问的匿名提问箱，安全地倾诉与回应。",
+	"site.keywords":        "匿名提问箱,提问箱,匿名提问,狼的提问箱,匿名问答,匿名提问网站",
+	"site.footer.visitor":  "您是本站第 %s 位访客",
+	"site.footer.pageview": "本页面已被访问 %s 次",
+	"site.footer.runtime":  "提问箱已成功存活",
+	"site.footer.admin":    "找站长",
+	"site.footer.notice":   "公告板",
+	"site.footer.chat":     "聊天室",
+	"site.footer.drive":    "盘",
+	"site.footer.status":   "监控板",
+	"site.footer.nav":      "导航页",
+	"site.maintenance":     "本站正在维护中，请稍后再来～",
+
+	// 认证
+	"auth.login.title":       "用户登录",
+	"auth.login.email":       "电子邮箱",
+	"auth.login.password":    "密码",
+	"auth.login.submit":      "登录",
+	"auth.login.forgot":      "忘记密码",
+	"auth.register.title":    "用户注册",
+	"auth.register.name":     "昵称",
+	"auth.register.email":    "电子邮箱",
+	"auth.register.password": "密码",
+	"auth.register.submit":   "注册",
+	"auth.forgot.title":      "忘记密码",
+	"auth.forgot.email":      "电子邮箱",
+	"auth.forgot.submit":     "发送重置邮件",
+	"auth.forgot.submitBtn":  "找回密码",
+	"auth.forgot.sent":       "邮件已发送至 %s，请查收。",
+	"auth.recover.title":     "重置密码",
+	"auth.recover.greeting":  "%s，您正在重置您的密码：",
+	"auth.recover.password":  "新密码",
+	"auth.recover.confirm":   "确认密码",
+	"auth.recover.submit":    "重置密码",
+
+	// 探索页
+	"explore.title":        "探索用户标签",
+	"explore.notice":       "此处展示已开启<span class=\"uk-text-bold\">“在首页展示我的标签”</span>的用户。该功能默认关闭，若希望自己的提问箱在这里被发现，请前往 <a href=\"/user/profile\" class=\"uk-text-bold\">个人设置</a> 手动开启。",
+	"explore.shuffle":      "换一批",
+	"explore.empty":        "暂时没有发现可展示的用户，快去开启吧～",
+	"explore.hotVotes":     "热门投票",
+	"explore.questionsTab": "提问",
+	"explore.votesTab":     "投票",
+	"explore.votesTitle":   "公开投票",
+	"explore.votesDesc":    "浏览正在进行的公开投票，选择你感兴趣的主题参与。",
+	"explore.randomVote":   "随机推荐",
+	"explore.allVotes":     "全部投票",
+	"explore.noVotes":      "暂时没有可参与的公开投票。",
+
+	// 提问页
+	"ask.scan":              "扫码向@%s提问",
+	"ask.anonymous":         "谁都可以以匿名的形式提问",
+	"ask.registerOnly":      "仅允许注册用户向TA提问",
+	"ask.nextOpenAt":        "下次开放时间：%s",
+	"ask.lastCloseAt":       "上次关闭时间：%s",
+	"weekday.0":             "周日",
+	"weekday.1":             "周一",
+	"weekday.2":             "周二",
+	"weekday.3":             "周三",
+	"weekday.4":             "周四",
+	"weekday.5":             "周五",
+	"weekday.6":             "周六",
+	"ask.pinned":            "已置顶",
+	"ask.share":             "分享提问箱",
+	"ask.placeholder":       "在此处撰写你的问题...",
+	"ask.chatPlaceholder":   "在此处撰写你的私聊消息...",
+	"ask.addImage":          "添加图片",
+	"ask.private":           "回复后不公开",
+	"ask.notify":            "接收通知",
+	"ask.emailPlaceholder":  "请输入你的邮箱地址",
+	"ask.submit":            "发送提问",
+	"ask.chat":              "发起私聊",
+	"ask.chatDisabled":      "该提问箱未开启私聊",
+	"ask.chatLimit":         "消息上限：%d条",
+	"ask.history":           "@%s 以前回答过的问题",
+	"ask.loginRequired":     "需要登录",
+	"ask.loginRequiredChat": "发起私聊需要登录账号",
+	"ask.goLogin":           "去登录",
+	"ask.needPassword":      "此提问箱需要密码",
+	"ask.needLogin":         "提问箱的主人设置了仅注册用户才能提问，你需要先登录才能向他提问。",
+	"ask.pleaseEmail":       "请填写接收通知的邮箱地址",
+	"ask.generating":        "正在生成分享图…",
+	"ask.genFailed":         "生成分享图失败，请稍后重试",
+	"ask.networkError":      "网络错误",
+	"ask.shareFilename":     "share.png",
+
+	// 问题条目
+	"qitem.answer":            "回答",
+	"qitem.delete":            "删除",
+	"qitem.private":           "设为私密",
+	"qitem.public":            "设为公开",
+	"qitem.asked":             "提问",
+	"qitem.pending":           "等待回答",
+	"qitem.answeredBy":        "@%s 于 %s 的回答",
+	"qitem.danger":            "危险！",
+	"qitem.deleteConfirm":     "你确定要删除这个提问吗？该操作不可恢复，请谨慎操作。",
+	"qitem.deleteConfirmBtn":  "确认删除",
+	"qitem.backToBox":         "返回%s的提问箱",
+	"qitem.answerTitle":       "回答问题",
+	"qitem.answerPlaceholder": "在此处撰写你的回答...",
+	"qitem.emailNotifyHint":   "提问人留下了自己的电子邮箱，在你第一次回复该问题后，提问人将会收到一封邮件通知。",
+	"qitem.submitAnswer":      "回答",
+	"qitem.updateAnswer":      "更新回答",
+	"qitem.askMore":           "再问点别的问题？",
+	"qitem.markRead":          "标记为已读",
+	"qitem.markUnread":        "标记为未读",
+	"qitem.readLocked":        "已回答，已锁定为已读",
+
+	// 个人设置页
+	"admin.profile":           "个人信息",
+	"admin.lang":              "界面语言",
+	"admin.langHint":          "选择访客访问你的提问箱时显示的语言（后台页面跟随此设置）",
+	"admin.email":             "电子邮箱",
+	"admin.name":              "昵称",
+	"admin.nameColor":         "昵称颜色",
+	"admin.oldPassword":       "旧密码",
+	"admin.newPassword":       "新密码",
+	"admin.notify":            "新提问通知",
+	"admin.personalize":       "个性化设置",
+	"admin.intro":             "提问箱介绍",
+	"admin.introColor":        "提问箱介绍颜色",
+	"admin.qrBgColor":         "二维码背景色（亮色部分）",
+	"admin.qrPdColor":         "二维码探测图形颜色（边角方形）",
+	"admin.qrFgColor":         "二维码前景色",
+	"admin.qrDotSize":         "二维码点大小 (←小 大→)",
+	"admin.qrBgAlpha":         "二维码背景透明度 (←不透明 很透明→)",
+	"admin.avatar":            "个人头像",
+	"admin.background":        "提问箱背景",
+	"admin.qrBackground":      "二维码背景图",
+	"admin.social":            "社交信息设置",
+	"admin.harassment":        "防骚扰设置",
+	"admin.askLimit":          "提问限制",
+	"admin.blockWords":        "屏蔽词设置（回车或逗号分隔，最多支持 10 个屏蔽词，每个屏蔽词最大长度为 10）",
+	"admin.chat":              "私聊设置",
+	"admin.chatMaxMessages":   "私聊消息条数上限",
+	"admin.chatDailyLimit":    "单用户每日私信条数上限",
+	"admin.tags":              "标签设置",
+	"admin.tagsHint":          "标签（最多5个，每个最多5字，回车或逗号分隔）",
+	"admin.tagsPlaceholder":   "例如：动漫,音乐,游戏",
+	"admin.tagInputHint":      "输入后按回车或逗号添加",
+	"admin.tagInputDuplicate": "已存在，已忽略",
+	"admin.pagePassword":      "页面访问密码",
+	"admin.pagePasswordHint":  "设置访问密码（留空则关闭）",
+	"admin.askPassword":       "提问密码",
+	"admin.askPasswordHint":   "设置提问密码（留空则关闭）",
+	"admin.saveProfile":       "保存修改",
+	"admin.updated":           "更新个人信息成功",
+	"admin.logout":            "退出登录",
+	"admin.export":            "导出数据",
+
+	// 后台设置（补充）
+	"admin.oldPasswordHint":         "修改密码使用，留空则不修改",
+	"admin.newPasswordHint":         "6-64 位，留空则不修改",
+	"admin.notifyEmail":             "邮件",
+	"admin.useCustomFg":             "启用自定义前景色（否则自动匹配）",
+	"admin.customFgHint":            "仅在启用时生效，否则颜色由系统自动生成",
+	"admin.avatarPlaceholder":       "上传个人头像（头像比例不为1:1就扁了你哦）",
+	"admin.backgroundPlaceholder":   "上传提问箱背景",
+	"admin.qrBackgroundPlaceholder": "上传二维码背景（颜色过深的背景会导致二维码无法识别）",
+	"admin.qrPreviewHint":           "选择图片后预览将即时更新",
+	"admin.preview":                 "实时预览",
+	"admin.themePreset":             "预设主题",
+	"admin.themeDefault":            "默认",
+	"admin.themeDark":               "暗夜",
+	"admin.themeOcean":              "海洋",
+	"admin.themeSunset":             "日落",
+	"admin.resetDefaults":           "🔄 恢复默认值",
+	"admin.previewHint":             "调整仅用于预览，最终效果点击「保存修改」后生效",
+	"admin.socialHint":              "勾选后填写主页地址（无需 https://），未勾选的项将不会在前台显示。",
+	"admin.enableAcfun":             "启用 AcFun",
+	"admin.enableBili":              "启用 Bilibili",
+	"admin.enableWeibo":             "启用 微博",
+	"admin.enableXiaohongshu":       "启用 小红书",
+	"admin.enableBlog":              "启用 个人博客",
+	"admin.registerOnly":            "仅允许注册用户向我提问",
+	"admin.updateHarassment":        "更新防骚扰设置",
+	"admin.globalBlockWords":        "全局屏蔽词",
+	"admin.globalBlockWordsHint":    "屏蔽词对提问、私聊（对方发给你的消息）与投票提交内容生效；三个设置页同步显示同一份设置，任意一处修改即时生效。",
+	"admin.updateBlockWords":        "保存屏蔽词",
+	"admin.allowChat":               "允许注册用户向我发起私聊",
+	"admin.dailyLimitHint":          "0 表示不限制",
+	"admin.updateChat":              "更新私聊设置",
+	"admin.showInHome":              "在首页展示我的标签（允许其他用户通过标签搜索到我）",
+	"admin.updateTags":              "更新标签",
+	"admin.updatePagePassword":      "更新页面密码",
+	"admin.pagePasswordPlaceholder": "输入页面访问密码",
+	"admin.updateAskPassword":       "更新提问密码",
+	"admin.askPasswordPlaceholder":  "输入提问密码",
+	"admin.account":                 "账号设置",
+	"admin.exportHint":              "您可以导出您在 %s 中的所有个人数据，包括你的基本信息、收到的问题以及回答。",
+	"admin.exportJSON":              "导出全部数据（JSON）",
+	"admin.exportJSONHint":          "包含提问、回答、追问与私聊记录，可完整备份或迁移。",
+	"admin.deactivate":              "停用我的账号",
+	"admin.deactivateHint":          "您随时可以选择停用您的账号。停用后，您的账号将无法登录，您的提问箱页面以及提问将无法访问，其他人也无法再给您发送新的提问。<b>该操作无法撤销！请谨慎操作！</b>",
+	"admin.socialRequired":          "请填写链接或取消勾选",
+
+	// 问题管理页
+	"qlist.title":              "我的提问",
+	"qlist.answered":           "已回答",
+	"qlist.pending":            "待回答",
+	"qlist.private":            "私密",
+	"qlist.empty":              "还没有提问，快把提问箱分享出去吧～",
+	"qlist.action":             "操作",
+	"qlist.answerNow":          "去回答",
+	"qlist.sort":               "排序",
+	"qlist.status":             "状态",
+	"qlist.type":               "类型",
+	"qlist.latest":             "最新",
+	"qlist.oldest":             "最早",
+	"qlist.all":                "全部",
+	"qlist.public":             "一般提问",
+	"qlist.privateQuestion":    "私密提问",
+	"qlist.received":           "我收到的提问",
+	"qlist.myChats":            "我发起的私聊",
+	"qlist.statsTotal":         "总提问数",
+	"qlist.statsAnswered":      "已回答",
+	"qlist.statsUnanswered":    "未回答",
+	"qlist.statsPrivate":       "私密提问",
+	"qlist.statsPinned":        "置顶",
+	"qlist.statsChats":         "私聊会话",
+	"qlist.searchPlaceholder":  "搜索问题或回答内容...",
+	"qlist.searchBtn":          "搜索",
+	"qlist.searchClear":        "清除搜索",
+	"qlist.questionsTab":       "提问",
+	"qlist.votesTab":           "投票",
+	"qlist.chatsTab":           "私聊",
+	"qlist.receivedChats":      "我收到的私聊",
+	"qlist.chatEmpty":          "还没有私聊，把提问箱分享出去让大家来私聊吧～",
+	"qlist.pinnedShort":        "置顶",
+	"qlist.privateShort":       "私密",
+	"qlist.chatStatsTotal":     "总私聊",
+	"qlist.chatStatsReceived":  "我收到的",
+	"qlist.chatStatsInitiated": "我发起的",
+	"qlist.chatStatsClosed":    "已关闭",
+	"qlist.unansweredShort":    "待答",
+	"qlist.readShort":          "已读",
+	"qlist.unreadShort":        "未读",
+	"qitem.markReadShort":      "标记",
+	"qlist.pinShort":           "置顶",
+	"qlist.unpinShort":         "取消置顶",
+	"qlist.myVotes":            "我创建的投票",
+	"qlist.loadMore":           "加载更多",
+	"qlist.newVote":            "新建投票",
+	"qlist.edit":               "编辑",
+	"qlist.untitledVote":       "未命名投票",
+	"qlist.blocked":            "已拉黑",
+	"qlist.unanswered":         "未回答",
+
+	// 站点 Logo 后缀（emoji 随机动物 + 后缀组成，如 🐺 的提问箱）
+	"site.logoSuffix": "的提问箱",
+	"site.stats":      "提问箱信息统计",
+
+	// 验证码弹窗
+	"captcha.title":        "人机验证",
+	"captcha.hint":         "请计算下方的算术题以验证你不是机器人",
+	"captcha.refresh":      "换一题",
+	"captcha.submit":       "验证并提交",
+	"captcha.loading":      "加载中...",
+	"captcha.loadFailed":   "加载失败",
+	"captcha.loadRetry":    "加载失败，请重试",
+	"captcha.inputAnswer":  "请输入答案",
+	"captcha.wrongAnswer":  "答案错误，请重新计算",
+	"captcha.verifyFailed": "验证失败，请重试",
+
+	// 注册页补充
+	"auth.register.domain.prefix":   "个性域名（你的问答箱网址将会是：%s + ",
+	"auth.register.domain.suffix":   " + 你在下面文本框中填写的内容）",
+	"auth.register.confirm":         "确认密码",
+	"auth.register.language":        "界面语言",
+	"auth.register.languageDefault": "跟随站点默认",
+	"auth.register.success":         "注册成功，欢迎来到 狼的提问箱！",
+
+	// 探索页补充
+	"explore.recommend":    "随机推荐",
+	"explore.search":       "搜索标签...",
+	"explore.sortLatest":   "最新加入",
+	"explore.sortOldest":   "最早加入",
+	"explore.noTags":       "无标签",
+	"explore.noRecommend":  "暂无推荐用户",
+	"explore.hotTags":      "热门标签",
+	"explore.hotQuestions": "热门问题",
+	"explore.noResult":     "暂无符合条件的用户。",
+	"explore.lazy":         "这个人很懒，什么都没写~",
+	"explore.prevPage":     "上一页",
+	"explore.nextPage":     "下一页",
+	"explore.loading":      "加载中...",
+	"explore.loadFailed":   "加载失败",
+
+	// 提问箱密码页
+	"password.title":  "此提问箱需要密码",
+	"password.desc":   "此提问箱已设置访问密码，请输入密码查看内容",
+	"password.input":  "请输入访问密码",
+	"password.enter":  "验证进入",
+	"password.submit": "确认",
+
+	// 问题不存在
+	"qitem.notFound": "问题不存在或已被删除",
+
+	// 聊天页
+	"chat.title":          "私聊",
+	"chat.input":          "输入消息...",
+	"chat.send":           "发送",
+	"chat.delete":         "删除对话",
+	"chat.block":          "拉黑对方",
+	"chat.unblock":        "取消拉黑",
+	"chat.empty":          "还没有消息，说点什么吧~",
+	"chat.withAsker":      "与提问者的私聊",
+	"chat.withUser":       "与 %s 的私聊",
+	"chat.closed":         "对话已关闭",
+	"chat.closedNoSend":   "对话已关闭，无法发送新消息",
+	"chat.remaining":      "消息剩余：%d 条（共 %d 条）",
+	"chat.me":             "我",
+	"chat.other":          "对方",
+	"chat.userBlocked":    "该用户已被拉黑",
+	"chat.addImage":       "添加图片（可选，最大5MB）",
+	"chat.confirm":        "确认",
+	"chat.confirmBlock":   "确定要拉黑该用户吗？他将无法再发送私信。",
+	"chat.confirmUnblock": "确定要取消屏蔽该用户吗？他将可以再次发送私信。",
+	"chat.deleteConfirm":  "确定要删除这条私聊对话吗？对方将无法再看到此对话，且操作不可恢复。",
+	"maintenance.title":   "NekoBox 维护中...",
+	"maintenance.desc":    "NekoBox 正在进行维护，服务暂时不可用。过一会再来吧~",
+
+	// 单题分享（v4）
+	"qitem.shareCard": "分享此提问",
+
+	// 追问（v4）
+	"followup.title":              "追问记录",
+	"followup.content":            "追问：",
+	"followup.answerPlaceholder":  "回答这条追问...",
+	"followup.answerBtn":          "回答追问",
+	"followup.waiting":            "等待回答中...",
+	"followup.askMore":            "继续追问",
+	"followup.remaining":          "还可追问 %d / %d 次",
+	"followup.contentPlaceholder": "补充你的问题...",
+	"followup.waitingReply":       "你的追加提问已发出，等待提问箱主人回复中...",
+	"followup.submit":             "提交追问",
+
+	// 置顶（v4）
+	"qlist.pinned":      "置顶中",
+	"qlist.pin":         "置顶",
+	"qlist.unpin":       "取消置顶",
+	"qlist.readStatus":  "阅读状态",
+	"qlist.read":        "已读",
+	"qlist.unread":      "未读",
+	"qlist.statsRead":   "已读",
+	"qlist.statsUnread": "未读",
+
+	// 提问成功页（v4）
+	"success.title":        "提问发送成功！",
+	"success.yourQuestion": "你的提问：",
+	"success.emailSent":    "已向你的邮箱发送了该提问的私密链接，也可以使用下方链接随时查看提问、接收回答与继续追问。",
+	"success.saveLink":     "<strong>请务必保存下面的私密链接！</strong>由于你没有留下邮箱，此链接（含口令 Token）是你查看提问、接收回答与继续追问的<strong>唯一凭证</strong>，丢失后将无法找回。",
+	"success.privateLink":  "你的提问私密链接（点击复制保存）",
+	"success.copy":         "复制",
+	"success.copied":       "已复制 ✓",
+	"success.copyFailed":   "复制失败",
+	"success.token":        "口令 Token：%s（提问人凭 Token 访问私密链接）",
+	"success.viewQuestion": "查看我的提问",
+	"success.backToBox":    "返回%s的提问箱",
+	"success.pageTitle":    "提问成功 - %s",
+
+	// 停用页
+	"deactivate.title":   "账号停用",
+	"deactivate.desc":    "停用后你的提问箱将无法访问，且所有数据将被删除，此操作不可恢复！",
+	"deactivate.confirm": "我确认要停用账号",
+	"deactivate.submit":  "停用账号",
+
+	// 匿名投票
+	"nav.votes": "投票",
+
+	"common.back": "返回",
+
+	"vote.listTitle":              "投票管理",
+	"vote.newTitle":               "新建投票",
+	"vote.editTitle":              "编辑投票",
+	"vote.resultsTitle":           "投票结果",
+	"vote.statsTotal":             "投票总数",
+	"vote.statsPublished":         "进行中",
+	"vote.createNew":              "新建投票",
+	"vote.typeSingle":             "单选",
+	"vote.typeMultiple":           "多选",
+	"vote.typeRating":             "评分",
+	"vote.typeRank":               "排序",
+	"vote.typeForm":               "表单收集",
+	"vote.statusNotStarted":       "未开始",
+	"vote.statusDraft":            "草稿",
+	"vote.statusPublished":        "进行中",
+	"vote.statusEnded":            "已结束",
+	"vote.statusArchived":         "已归档",
+	"vote.participants":           "参与",
+	"vote.remainLabel":            "剩余",
+	"vote.perpetual":              "无限期",
+	"vote.durationDay":            "天",
+	"vote.durationHour":           "小时",
+	"vote.durationMinute":         "分钟",
+	"vote.createdAt":              "创建于",
+	"vote.edit":                   "编辑",
+	"vote.results":                "结果",
+	"vote.preview":                "预览",
+	"vote.page.mustComplete":      "请完成",
+	"vote.page.rankHintRequired":  "排名 1-N（必填）",
+	"vote.page.rankHintOptional":  "排名 1-N（可选，可只排部分）",
+	"vote.page.previewHint":       "预览模式：这是发布前的页面样例，提交已禁用",
+	"vote.page.previewSubmitHint": "预览模式，发布后即可提交",
+	"vote.publish":                "发布",
+	"vote.close":                  "结束",
+	"vote.share":                  "复制链接",
+	"vote.copied":                 "已复制",
+	"vote.shareURL":               "投票分享链接",
+	"vote.confirmPublish":         "确定发布该投票吗？发布后即生成可分享链接。",
+	"vote.confirmClose":           "确定结束该投票吗？结束后参与者将无法再投票。",
+	"vote.confirmDelete":          "确定删除该投票吗？投票数据将一并删除，不可恢复！",
+	"vote.manageEntry":            "管理投票",
+
+	"vote.manageTitle": "管理投票",
+	"vote.manageDesc":  "创建与管理你的匿名投票", "vote.empty": "还没有投票，点击右上角\"新建投票\"开始吧～",
+	"vote.formLockedHint":              "该投票已发布，仅可修改基本信息；类型与选项已锁定（避免破坏已收集的投票数据）",
+	"vote.formBasic":                   "基本设置",
+	"vote.formTitle":                   "投票标题",
+	"vote.formTitlePlaceholder":        "例如：今天吃什么？",
+	"vote.formDescription":             "描述 / 说明",
+	"vote.formDescriptionPlaceholder":  "补充说明（可选）",
+	"vote.formType":                    "投票类型",
+	"vote.formVisibility":              "展示方式",
+	"vote.formVisibilityPublic":        "公开展示（探索页 + 提问箱页）",
+	"vote.formVisibilityLinkOnly":      "仅链接分享",
+	"vote.formVoterScope":              "投票范围",
+	"vote.formVoterScopeAnyone":        "任何人（含匿名）",
+	"vote.formVoterScopeRegistered":    "仅注册用户",
+	"vote.formShowResult":              "结果可见时机",
+	"vote.formShowResultAfterVote":     "投票后立即可见",
+	"vote.formShowResultAfterEnd":      "结束后可见",
+	"vote.formShowResultOwnerOnly":     "仅我可见",
+	"vote.formStartAt":                 "开始时间（留空立即开始）",
+	"vote.formEndAt":                   "结束时间（留空不限制）",
+	"vote.formMaxChoices":              "最多可选数量",
+	"vote.formMaxVotesPerFingerprint":  "每个投票每个设备限 1 次，使用同一浏览器重复提交将被拦截。",
+	"vote.formMaxVotesPerAccount":      "每个投票每个注册账号限 1 次，使用同一账号重复提交将被拦截。",
+	"vote.formAllowCustom":             "允许参与者补充自定义选项",
+	"vote.formRequireCaptcha":          "匿名投票需通过验证码",
+	"vote.formOptions":                 "投票选项",
+	"vote.formRatingHint":              "评分题无需配置选项（1-10 分）",
+	"vote.addOption":                   "添加选项",
+	"vote.optionPlaceholder":           "选项内容",
+	"vote.formFields":                  "表单字段",
+	"vote.addField":                    "添加字段",
+	"vote.field":                       "字段",
+	"vote.formFieldType":               "字段类型",
+	"vote.fieldTypeText":               "单行文本",
+	"vote.fieldTypeTextarea":           "多行文本",
+	"vote.fieldTypeSelect":             "下拉选择",
+	"vote.fieldTypeRadio":              "单选",
+	"vote.fieldTypeCheckbox":           "多选",
+	"vote.fieldTypeNumber":             "数字",
+	"vote.fieldTypeRank":               "排序",
+	"vote.page.selectPlaceholder":      "请选择",
+	"vote.page.avgNumber":              "平均",
+	"vote.page.fieldFilled":            "已填写",
+	"vote.fieldTypeRating":             "评分",
+	"vote.formFieldLabel":              "字段标签",
+	"vote.formFieldRequired":           "必填",
+	"vote.formFieldMaxLength":          "字数上限（0 不限制）",
+	"vote.formFieldOptions":            "选项",
+	"vote.formFieldOptionsHint":        "点击下方「添加选项」逐条添加，无需用逗号分隔",
+	"vote.fieldAllowCustom":            "允许补充自定义选项",
+	"vote.formFieldOptionsPlaceholder": "如：满意,一般,不满意",
+	"vote.createDraft":                 "保存草稿",
+	"vote.builderHintOptions":          "至少需要 2 个选项",
+	"vote.builderHintFields":           "请至少添加 1 个字段",
+	"vote.builderHintFieldOptions":     "选择题/排序题请填写选项（排序题至少 2 个）",
+	"vote.resultsAnswered":             "回答数",
+	"vote.page.rankedTimes":            "被排次数",
+	"vote.resultsTotal":                "总参与人数",
+	"vote.resultsSubmissions":          "表单回复",
+	"vote.resultsViewTexts":            "查看文本提交",
+	"vote.resultsToggleHint":           "点击展开或收起文本回复明细",
+	"vote.resultsOptions":              "投票结果",
+	"vote.resultsVotes":                "票",
+	"vote.export":                      "导出 CSV",
+	"vote.resultsEmpty":                "还没有人参与，快来分享吧～",
+
+	// 匿名投票参与页
+	"vote.inlineTitle":                 "投票",
+	"vote.page.by":                     "发起的投票",
+	"vote.page.goVote":                 "去投票",
+	"vote.page.notStarted":             "未开始",
+	"vote.page.notStartedHint":         "该投票尚未开始，敬请期待～",
+	"vote.page.ended":                  "已结束",
+	"vote.page.endedHint":              "该投票已结束",
+	"vote.page.active":                 "进行中",
+	"vote.page.participated":           "已参与",
+	"vote.page.loginRequired":          "该投票仅限注册用户参与，请先登录。",
+	"vote.page.anonymousHint":          "该投票允许匿名参与，你的身份不会被记录（同一设备最多可参与 1 次）。",
+	"vote.page.submit":                 "提交投票",
+	"vote.page.alreadyVoted":           "你已参与过该投票，感谢参与！",
+	"vote.page.resultsTitle":           "投票结果",
+	"vote.page.totalVotes":             "总参与",
+	"vote.page.avgRating":              "平均分",
+	"vote.page.avgRank":                "平均排名",
+	"vote.page.optionColumn":           "选项",
+	"vote.page.ratingLabel":            "请评分",
+	"vote.page.ratingUnit":             "分",
+	"vote.page.rankHint":               "请为每个选项填写 1-N 的排名（数字越小越靠前，不可重复）",
+	"vote.page.rankPlaceholder":        "排名",
+	"vote.page.multipleHint":           "可多选",
+	"vote.page.customOption":           "补充选项（可选）",
+	"vote.page.customPlaceholder":      "填写你心中的其他选项",
+	"vote.page.customOther":            "其他",
+	"vote.page.customFieldPlaceholder": "填写自定义选项…",
+	"vote.page.customStats":            "自定义补充选项",
+	"vote.page.formCount":              "已收到回复",
+	"vote.page.ownerManage":            "管理此投票（仅你可见结果）",
+
+	// 单份投票的定量收集
+	"vote.formQuotaLimit":          "收集上限（份）",
+	"vote.formQuotaHint":           "0 表示不限制；收集到指定份数后自动结束该投票。",
+	"vote.flash.notFound":          "投票不存在或已失效",
+	"vote.flash.notPublished":      "该投票尚未发布",
+	"vote.flash.archived":          "该投票已归档，无法参与",
+	"vote.flash.ended":             "该投票已结束",
+	"vote.flash.notStarted":        "该投票尚未开始",
+	"vote.flash.success":           "投票成功！感谢参与",
+	"vote.err.noChoice":            "请至少选择一个选项",
+	"vote.err.tooManyChoices":      "最多只能选择 %d 个选项",
+	"vote.err.pickOne":             "请选择一个选项",
+	"vote.err.invalidOption":       "存在无效的选项",
+	"vote.err.optionDuplicate":     "选项不能重复选择",
+	"vote.err.ratingRequired":      "请给出 1-10 分的评分",
+	"vote.err.rankRequired":        "请为每个选项填写 1-%d 的排名",
+	"vote.err.rankDuplicate":       "排名不能重复",
+	"vote.err.fieldRequired":       "请填写「%s」",
+	"vote.err.fieldCustomRequired": "请填写「%s」的自定义选项",
+	"vote.err.fieldCustomTooLong":  "「%s」的自定义选项不能超过 %d 字",
+	"vote.err.fieldInvalidOption":  "「%s」的选项无效",
+	"vote.err.fieldConfigError":    "「%s」选项配置错误",
+	"vote.err.fieldRankIncomplete": "请填写「%s」的完整排名",
+	"vote.err.fieldRankRange":      "「%s」排名必须是 1-%d 之间的数字",
+	"vote.err.fieldRankDuplicate":  "「%s」排名不能重复",
+	"vote.err.fieldTooLong":        "「%s」超出字数限制（最多 %d 字）",
+	"vote.err.fieldNotNumber":      "「%s」必须是数字",
+	"vote.err.fieldRating":         "「%s」请给出 1-10 分的评分",
+	"vote.err.unknownType":         "未知的投票类型",
+	"vote.err.customTooLong":       "自定义选项不能超过 %d 字",
+	"vote.err.blockWords":          "提交内容中包含了投票发起人设置的屏蔽词，无法提交",
+	"vote.err.serialize":           "提交内容序列化失败",
+	"captcha.error":                "验证码错误",
+	"captcha.errEmpty":             "验证码不能为空",
+	"captcha.errFormat":            "验证码格式错误，请刷新后重试",
+	"captcha.errAnswerFormat":      "验证码答案格式错误",
+	"captcha.errExpired":           "验证码已过期，请刷新后重试",
+	"captcha.errService":           "验证码服务异常，请稍后重试",
+	"captcha.errAnswerWrong":       "验证码答案错误",
+	"censor.unavailable":           "内容审核服务暂时不可用，请稍后再试",
+
+	// 功能管理：提问 / 私聊 / 投票 的开关、定时开关与定量收集
+	"admin.tabAccount":            "用户设置",
+	"admin.featuresHint":          "在「提问 / 私聊 / 投票」面板中管理各功能的开关、开放时段与收集上限；达到上限后对应功能自动关闭。",
+	"admin.featuresEntry":         "设置",
+	"admin.featureHint.question":  "关闭后访客无法提交新提问；达到收集上限后自动停止接收（含私密提问）。",
+	"admin.featureHint.chat":      "关闭后访客无法发起新的私聊；已有会话不受影响。",
+	"admin.featureHint.vote":      "关闭后提问箱页不再展示投票板块，访客也无法参与你的投票。单份投票可在编辑页单独设置收集上限。",
+	"admin.featureEnabled":        "开启该功能",
+	"admin.featureOpenAt":         "定时开放",
+	"admin.featureCloseAt":        "定时关闭",
+	"admin.featureTimeHint":       "留空表示不限制；开放时间之前、关闭时间之后该功能均不可用。",
+	"admin.featureSchedule":       "循环定时（每周循环）",
+	"admin.featureScheduleStart":  "每日开始",
+	"admin.featureScheduleEnd":    "每日结束",
+	"admin.featureScheduleHint":   "勾选每周固定开放日并设置每日时间段，按周循环生效；全部留空表示不启用。只填开放日（不填时间）表示该天全天开放；只填时间（不勾选任何日）表示每天该时段开放。",
+	"admin.featureMode":           "收集模式",
+	"admin.featureModeAlways":     "长期开放",
+	"admin.featureModeWindow":     "定时收集",
+	"admin.featureModeRecurring":  "循环定时",
+	"admin.featureModeHint":       "长期开放：不限时间，保持开放直到手动关闭；定时收集：一次性开放 / 关闭时间窗口；循环定时：每周固定开放日循环生效。三种模式互斥，保存时未选模式的设置将被清空。",
+	"admin.featureQuotaLimit":     "收集上限（条 / 份）",
+	"admin.featureQuotaHint":      "0 表示不限制；累计收集达到上限后自动关闭，重置计数后可开启下一轮。",
+	"admin.featureQuotaCount":     "已收集",
+	"admin.featureQuotaUnlimited": "不限制",
+	"admin.featureQuotaResetAt":   "上次重置：",
+	"admin.featureResetQuota":     "重置计数",
+	"admin.featureSave":           "保存该功能设置",
+
+	// 功能管理：状态与提示
+	"feature.name.question":        "提问",
+	"feature.name.chat":            "私聊",
+	"feature.name.vote":            "投票",
+	"feature.statusOpen":           "进行中",
+	"feature.status.disabled":      "已关闭",
+	"feature.status.not_started":   "未开始",
+	"feature.status.ended":         "已结束",
+	"feature.status.quota_reached": "已达上限",
+	"feature.saved":                "功能设置已保存",
+	"feature.errTime":              "%s 的时间格式不正确，请使用日期时间选择器",
+	"feature.errTimeRange":         "%s 的定时关闭时间必须晚于定时开放时间",
+	"feature.errQuota":             "%s 的收集上限需为 0 到 1000000 之间的整数",
+	"feature.errInvalid":           "未知的功能类型",
+	"feature.quotaReset":           "%s 的收集计数已重置",
+	"feature.errScheduleHalf":      "%s 的循环定时开始与结束时间必须同时填写",
+	"feature.errScheduleTime":      "%s 的循环定时时间格式不正确，请使用时间选择器",
+	"feature.errScheduleRange":     "%s 的循环定时结束时间必须晚于开始时间",
+
+	// 功能关闭时对访客的提示
+	"feature.disabled.question":      "提问箱主人已关闭提问功能",
+	"feature.disabled.chat":          "该提问箱未开启私聊功能",
+	"feature.disabled.vote":          "该提问箱已关闭投票功能",
+	"feature.not_started.question":   "提问功能尚未开放",
+	"feature.not_started.chat":       "私聊功能尚未开放",
+	"feature.not_started.vote":       "投票功能尚未开放",
+	"feature.ended.question":         "提问功能已结束收集",
+	"feature.ended.chat":             "私聊功能已结束",
+	"feature.ended.vote":             "投票功能已结束",
+	"feature.quota_reached.question": "提问功能已达到收集上限",
+	"feature.quota_reached.chat":     "私聊功能已达到收集上限",
+	"feature.quota_reached.vote":     "投票功能已达到收集上限",
+
+	// 认证：访客可见的提示（P0）
+	"auth.errBadCredential":   "邮箱或密码错误",
+	"auth.errUserNotFound":    "用户不存在",
+	"auth.errEmailFrequent":   "邮件发送太频繁，请稍后再试",
+	"auth.errEmailFailed":     "邮件发送失败，请稍后再试",
+	"auth.errCodeExpired":     "验证码已过期",
+	"auth.errPasswordChanged": "密码修改成功",
+	"auth.errLoginRequired":   "请先登录",
+	"auth.errDuplicateEmail":  "该邮箱已被注册",
+	"auth.errDuplicateDomain": "该个性域名已被使用",
+
+	// 提问箱页：访客可见（P0）
+	"question.errWrongPassword":     "密码错误",
+	"question.errAskPasswordWrong":  "提问密码错误",
+	"question.errLoginRequired":     "提问箱的主人设置了仅注册用户才能提问，请先登录。",
+	"question.errSelfChat":          "不能给自己发起私聊",
+	"question.errBlockedChat":       "你已被对方拉黑，无法发起私聊",
+	"question.errChatDailyLimit":    "你今日已达发送上限（%d条），请明天再试",
+	"question.errDuplicateSubmit":   "检测到重复提交，请稍后再试",
+	"question.errImageTooLarge":     "图片文件大小不能大于 5Mb",
+	"question.errUploadImageFailed": "上传图片失败",
+	"question.errBlockWords":        "提问内容中包含了提问箱主人设置的屏蔽词，发送失败",
+	"question.errAnsweredLocked":    "已回答的问题不能标记为未读",
+	"question.flash.chatSent":       "私聊请求已发送！你可以通过以下链接查看对话：%s",
+	"question.flash.answered":       "回答发布成功！",
+	"question.flash.operated":       "操作成功",
+	"question.flash.markedRead":     "已标记为已读",
+	"question.flash.markedUnread":   "已标记为未读",
+
+	// 追问：访客/箱主可见（P0）
+	"followup.errNoPermission": "无权操作",
+	"followup.errNotAnswered":  "问题尚未被回答，暂时不能追问",
+	"followup.errLimit":        "每条提问最多追问 %d 次，已达上限",
+	"followup.errWaitReply":    "请等待主人回复上一条追问后再继续追问",
+	"followup.errNotFound":     "追问不存在",
+	"followup.flash.sent":      "追问发送成功！",
+	"followup.flash.answered":  "回答成功！",
+
+	// 后台设置：箱主可见（P1）
+	"admin.flash.profileUpdated":    "更新个人信息成功",
+	"admin.flash.chatUpdated":       "私聊设置更新成功",
+	"admin.flash.pagePwdOff":        "已关闭页面密码访问",
+	"admin.flash.pagePwdUpdated":    "页面访问密码已更新",
+	"admin.flash.askPwdOff":         "已关闭提问密码",
+	"admin.flash.askPwdUpdated":     "提问密码已更新",
+	"admin.flash.tagsTooMany":       "标签不能超过 5 个",
+	"admin.flash.tagsUpdated":       "更新标签成功",
+	"admin.flash.tagTooLong":        "每个标签不能超过 5 个字符：%s",
+	"admin.flash.blockWordsTooMany": "屏蔽词不能超过 10 个",
+	"admin.flash.blockWordTooLong":  "屏蔽词长度不能超过 10 个字符：%s",
+	"admin.flash.harassmentUpdated": "更新防骚扰设置成功",
+	"admin.flash.blockWordsUpdated": "屏蔽词已更新",
+	"admin.flash.deactivated":       "您的账号已停用，感谢您使用 狼的提问箱。期待未来还能再见 👋🏻",
+	"admin.export.errUser":          "导出失败：获取用户信息失败",
+	"admin.export.errQuestion":      "导出失败：获取问题信息失败",
+
+	// 投票管理：箱主可见（P1）
+	"vote.err.invalidID":                 "无效的投票 ID",
+	"vote.err.notExist":                  "投票不存在",
+	"vote.err.noPermission":              "无权操作该投票",
+	"vote.err.type":                      "未知的投票类型",
+	"vote.err.titleRequired":             "请填写投票标题",
+	"vote.err.titleTooLong":              "投票标题不能超过 100 字",
+	"vote.err.visibility":                "未知的可见性设置",
+	"vote.err.voterScope":                "未知的投票范围设置",
+	"vote.err.showResult":                "未知的结果展示设置",
+	"vote.err.timeRange":                 "结束时间必须晚于开始时间",
+	"vote.err.quota":                     "收集上限需为 0 到 1000000 之间的整数",
+	"vote.err.optionsTooFew":             "请至少添加 2 个选项",
+	"vote.err.optionsFormat":             "选项数据格式错误",
+	"vote.err.optionTooLong":             "单个选项内容不能超过 %d 字",
+	"vote.err.maxChoicesExceed":          "最多可选数量不能超过选项总数",
+	"vote.err.fieldsTooFew":              "请至少添加 1 个表单字段",
+	"vote.err.fieldsFormat":              "表单字段数据格式错误",
+	"vote.err.fieldsTooMany":             "表单字段不能超过 50 个",
+	"vote.err.fieldType":                 "存在未知的表单字段类型",
+	"vote.err.fieldLabelMissing":         "第 %d 个字段缺少标签",
+	"vote.err.fieldLabelTooLong":         "第 %d 个字段的标签不能超过 100 字",
+	"vote.err.fieldLabelDuplicate":       "字段标签「%s」重复，请使用不同的标签",
+	"vote.err.fieldMaxLength":            "第 %d 个字段的字数上限需在 0-2000 之间",
+	"vote.err.fieldReservedOption":       "第 %d 个字段（%s）的选项内容包含保留值，请更换",
+	"vote.err.fieldOptionsTooFew":        "第 %d 个字段（%s）请至少填写 1 个选项",
+	"vote.err.fieldRankTooFew":           "第 %d 个字段（%s）排序题至少需要 2 个选项",
+	"vote.err.fieldSerialize":            "字段选项序列化失败",
+	"vote.err.editClosed":                "已结束或归档的投票不允许编辑",
+	"vote.err.publishDraftOnly":          "只有草稿状态的投票可以发布",
+	"vote.err.closePublishedOnly":        "只有进行中的投票可以结束",
+	"vote.err.publishTitleRequired":      "请先填写投票标题再发布",
+	"vote.err.publishFormFieldsRequired": "表单类型投票至少需要 1 个字段",
+	"vote.err.publishOptionsRequired":    "选项投票至少需要 2 个选项",
+	"vote.err.optionUpdateFailed":        "选项更新失败，请重试",
+	"vote.err.fieldUpdateFailed":         "表单字段更新失败，请重试",
+	"vote.flash.published":               "投票已发布！分享链接：%s",
+	"vote.flash.updated":                 "投票信息已更新（进行中的投票不可修改类型与选项）",
+	"vote.flash.draftSaved":              "已保存到草稿",
+	"vote.flash.closed":                  "投票已结束",
+	"vote.flash.deleted":                 "投票已删除",
+	"vote.err.timeFormat":                "时间格式不正确，请使用日期时间选择器",
+	"vote.err.maxChoicesLimit":           "最多可选数量不能超过 20",
+	"vote.err.descriptionTooLong":        "投票描述不能超过 5000 字",
+	"profile.err.avatarTooLarge":         "头像文件太大，最大支持 2MB",
+	"profile.err.backgroundTooLarge":     "背景图文件太大，最大支持 2MB",
+	"profile.err.newPasswordTooShort":    "新密码长度不能少于 8 位",
+	"profile.err.badOldPassword":         "旧密码输入错误",
+	"admin.export.errCreateExcel":        "导出失败：创建Excel文件失败",
+	"admin.export.errWriteExcel":         "导出失败：写入Excel文件失败",
+
+	// profile 设置页 UI 重构：卡片分区 / 头像背景裁剪 / 改密强制登出
+	"profile.card.basic":             "基础资料",
+	"profile.card.avatarBg":          "头像与背景",
+	"profile.card.qr":                "二维码样式",
+	"profile.card.password":          "修改密码",
+	"profile.avatarCropHint":         "裁剪框已锁定为 1:1 正方形",
+	"profile.backgroundCropHint":     "裁剪框已锁定为 16:9 宽屏",
+	"profile.cropTitle":              "裁剪图片",
+	"profile.cropConfirm":            "确认裁剪",
+	"profile.err.avatarRatio":        "头像图片必须为 1:1 正方形，请裁剪后再上传",
+	"profile.err.backgroundRatio":    "背景图片必须为 16:9 宽高比，请裁剪后再上传",
+	"profile.flash.passwordChanged":  "密码修改成功，已退出登录，请使用新密码重新登录",
+	"profile.pwdNote":                "保存后当前会话立即失效，需使用新密码重新登录",
+	"profile.pickAvatar":             "更换头像",
+	"profile.pickBackground":         "更换背景",
+	"profile.saveBasic":              "保存基础资料",
+	"profile.saveMedia":              "保存头像与背景",
+	"profile.savePassword":           "确认修改密码",
+	"profile.saveQR":                 "保存二维码样式",
+	"profile.saveSocial":             "保存社交链接",
+	"profile.err.cropLibUnavailable": "图片裁剪组件加载失败，请刷新页面后重试",
+
+	// 验证码 JSON 接口：前端消费（P2）
+	"captcha.json.badRequest": "请求格式错误",
+	"captcha.json.idRequired": "验证码 ID 不能为空",
+	"captcha.json.genFailed":  "生成验证码失败",
+	"chat.errDeletedByOwner":  "该私聊对话已被对方删除。",
+	"chat.errBlockedView":     "你已被对方拉黑，无法查看该私聊",
+	"chat.errEmpty":           "消息不能为空",
+	"chat.errTooLong":         "消息内容过长，请控制在 %d 字以内",
+	"chat.errConvDeletedSend": "该对话已被删除，无法发送消息",
+	"chat.errBlockedSend":     "你已被对方拉黑，无法发送私信",
+	"chat.errBlockWords":      "消息中包含了提问箱主人设置的屏蔽词，无法发送",
+	"chat.errDailyLimit":      "你今日已达发送上限（%d条），请明天再试",
+	"chat.errLimitReached":    "对话已达到上限，无法发送新消息",
+	"chat.errChatClosed":      "该箱主已关闭私聊功能，无法发送消息",
+	"chat.errImageTooLarge":   "图片大小不能超过 %dMB",
+	"chat.errUploadFailed":    "图片上传失败，请稍后重试",
+	"chat.errNoPermission":    "无权执行此操作",
+	"chat.flash.sent":         "消息发送成功",
+	"chat.flash.deleted":      "私聊对话已删除",
+	"chat.flash.operated":     "操作成功",
+	"image.errTooLarge":       "图片尺寸过大，最大支持 %d×%d 像素，请压缩后重新上传",
+	"internal.errFlash":       "服务内部错误，请稍后重试。",
+	"internal.errServer":      "服务器内部错误",
+	"home.errStats":           "获取统计信息失败",
+	"pixel.errPath":           "非法的请求路径",
+	"proxy.errNotFound":       "页面不存在",
+	"proxy.errInternal":       "服务网关内部错误",
+	"explore.errRandomUser":   "获取随机用户失败",
+	// 表单校验
+	"form.answer.content":               "回答内容不能为空",
+	"form.answer.contentTooLong":        "回答内容不能超过 %d 个字符",
+	"form.email.required":               "请填写有效的电子邮箱地址",
+	"form.followup.answer":              "追问回答不能为空",
+	"form.followup.answerTooLong":       "追问回答不能超过 %d 个字符",
+	"form.followup.content":             "追问内容不能为空",
+	"form.followup.contentTooLong":      "追问内容不能超过 %d 个字符",
+	"form.login.password":               "请输入密码",
+	"form.profile.backgroundimagealpha": "请填写二维码背景透明度",
+	"form.profile.colorHex":             "请填写 7 位十六进制颜色代码（含 #）",
+	"form.profile.dotscale":             "请填写二维码点大小",
+	"form.profile.intro":                "个人介绍不能为空，且不超过 100 个字符",
+	"form.profile.linkMax":              "主页链接长度不能超过 30 个字符",
+	"form.profile.name":                 "昵称不能为空，且不超过 20 个字符",
+	"form.profile.newPassword":          "新密码长度不能超过 30 个字符",
+	"form.profile.passwordMax":          "密码长度不能超过 30 个字符",
+	"form.question.content":             "问题内容不能为空",
+	"form.question.contentTooLong":      "问题内容不能超过 %d 个字符",
+	"form.question.receiveReplyEmail":   "请填写有效的电子邮箱地址以接收回复",
+	"form.recaptcha":                    "请完成人机验证",
+	"form.recover.newPassword":          "请设置 8 至 30 位的新密码",
+	"form.recover.repeatPassword":       "两次输入的新密码不一致",
+	"form.register.domain":              "个性域名只能包含字母、数字和下划线，长度为 3 至 20 位",
+	"form.register.email":               "请填写有效的电子邮箱地址（不超过 100 个字符）",
+	"form.register.name":                "昵称不能为空，且不超过 20 个字符",
+	"form.register.password":            "请设置 8 至 30 位的密码",
+	"form.register.recaptcha":           "无法加载人机验证，请刷新页面或切换网络后重试",
+	"form.register.repeatPassword":      "两次输入的密码不一致",
+}
diff --git a/.workbuddy/backup/remove-vercount-20260906/dict_zh_tw.go b/.workbuddy/backup/remove-vercount-20260906/dict_zh_tw.go
new file mode 100644
index 0000000..6f3acf4
--- /dev/null
+++ b/.workbuddy/backup/remove-vercount-20260906/dict_zh_tw.go
@@ -0,0 +1,842 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package i18n
+
+// zhTWDict 繁體中文文案。
+var zhTWDict = map[string]string{
+	// 導覽
+	"nav.explore":  "探索",
+	"nav.mine":     "我的",
+	"nav.register": "註冊",
+	"nav.login":    "登入",
+	"nav.ask":      "提問",
+	"nav.settings": "設定",
+	"nav.lang":     "語言",
+
+	// 通用
+	"common.login":      "登入",
+	"common.forgot":     "忘記密碼",
+	"common.submit":     "送出",
+	"common.cancel":     "取消",
+	"common.save":       "儲存",
+	"common.close":      "關閉",
+	"common.delete":     "刪除",
+	"common.moveUp":     "上移",
+	"common.moveDown":   "下移",
+	"common.share":      "分享",
+	"common.verifying":  "驗證中...",
+	"common.submitting": "提交中...",
+	"common.uploading":  "上傳中...",
+	"common.lang":       "語言",
+	"common.menu":       "選單",
+
+	"common.pleaseWait": "請稍候...",
+	"common.backHome":   "返回首頁",
+	"common.theme":      "切換深色/淺色模式",
+
+	// 站點
+	"site.title":           "狼的提問箱 | 匿名提問箱",
+	"site.description":     "狼的提問箱——一個無需註冊、可匿名提問的匿名提問箱，安全地傾訴與回應。",
+	"site.keywords":        "匿名提問箱,提問箱,匿名提問,狼的提問箱,匿名問答,匿名提問網站",
+	"site.footer.visitor":  "您是本站第 %s 位訪客",
+	"site.footer.pageview": "本頁面已被訪問 %s 次",
+	"site.footer.runtime":  "提問箱已成功存活",
+	"site.footer.admin":    "找站長",
+	"site.footer.notice":   "公告板",
+	"site.footer.chat":     "聊天室",
+	"site.footer.drive":    "盤",
+	"site.footer.status":   "監控板",
+	"site.footer.nav":      "導航頁",
+	"site.maintenance":     "本站正在維護中，請稍後再來～",
+
+	// 認證
+	"auth.login.title":       "使用者登入",
+	"auth.login.email":       "電子郵件",
+	"auth.login.password":    "密碼",
+	"auth.login.submit":      "登入",
+	"auth.login.forgot":      "忘記密碼",
+	"auth.register.title":    "使用者註冊",
+	"auth.register.name":     "暱稱",
+	"auth.register.email":    "電子郵件",
+	"auth.register.password": "密碼",
+	"auth.register.submit":   "註冊",
+	"auth.forgot.title":      "忘記密碼",
+	"auth.forgot.email":      "電子郵件",
+	"auth.forgot.submit":     "傳送重設郵件",
+	"auth.forgot.submitBtn":  "找回密碼",
+	"auth.forgot.sent":       "郵件已傳送至 %s，請查收。",
+	"auth.recover.title":     "重設密碼",
+	"auth.recover.greeting":  "%s，您正在重設您的密碼：",
+	"auth.recover.password":  "新密碼",
+	"auth.recover.confirm":   "確認密碼",
+	"auth.recover.submit":    "重設密碼",
+
+	// 探索頁
+	"explore.title":        "探索使用者標籤",
+	"explore.notice":       "此處展示已開啟<span class=\"uk-text-bold\">「在首頁展示我的標籤」</span>的使用者。該功能預設關閉，若希望自己的提問箱在這裡被發現，請前往 <a href=\"/user/profile\" class=\"uk-text-bold\">個人設定</a> 手動開啟。",
+	"explore.shuffle":      "換一批",
+	"explore.empty":        "暫時沒有可展示的使用者，快去開啟吧～",
+	"explore.hotVotes":     "熱門投票",
+	"explore.questionsTab": "提問",
+	"explore.votesTab":     "投票",
+	"explore.votesTitle":   "公開投票",
+	"explore.votesDesc":    "瀏覽進行中的公開投票，選擇你感興趣的主題參與。",
+	"explore.randomVote":   "隨機推薦",
+	"explore.allVotes":     "全部投票",
+	"explore.noVotes":      "暫時沒有可參與的公開投票。",
+
+	// 提問頁
+	"ask.scan":              "掃碼向@%s提問",
+	"ask.anonymous":         "誰都可以以匿名的方式提問",
+	"ask.registerOnly":      "僅允許註冊使用者向TA提問",
+	"ask.nextOpenAt":        "下次開放時間：%s",
+	"ask.lastCloseAt":       "上次關閉時間：%s",
+	"weekday.0":             "週日",
+	"weekday.1":             "週一",
+	"weekday.2":             "週二",
+	"weekday.3":             "週三",
+	"weekday.4":             "週四",
+	"weekday.5":             "週五",
+	"weekday.6":             "週六",
+	"ask.pinned":            "已置頂",
+	"ask.share":             "分享提問箱",
+	"ask.placeholder":       "在此處撰寫你的問題...",
+	"ask.chatPlaceholder":   "在此處撰寫你的私聊訊息...",
+	"ask.addImage":          "新增圖片",
+	"ask.private":           "回覆後不公開",
+	"ask.notify":            "接收通知",
+	"ask.emailPlaceholder":  "請輸入你的信箱地址",
+	"ask.submit":            "傳送提問",
+	"ask.chat":              "發起私聊",
+	"ask.chatDisabled":      "該提問箱未開啟私聊",
+	"ask.chatLimit":         "訊息上限：%d則",
+	"ask.history":           "@%s 以前回答過的問題",
+	"ask.loginRequired":     "需要登入",
+	"ask.loginRequiredChat": "發起私聊需要登入帳號",
+	"ask.goLogin":           "去登入",
+	"ask.needPassword":      "此提問箱需要密碼",
+	"ask.needLogin":         "提問箱的主人設定了僅註冊使用者才能提問，你需要先登入才能向他提問。",
+	"ask.pleaseEmail":       "請填寫接收通知的信箱地址",
+	"ask.generating":        "正在產生分享圖…",
+	"ask.genFailed":         "產生分享圖失敗，請稍後重試",
+	"ask.networkError":      "網路錯誤",
+	"ask.shareFilename":     "share.png",
+
+	// 問題條目
+	"qitem.answer":            "回答",
+	"qitem.delete":            "刪除",
+	"qitem.private":           "設為私密",
+	"qitem.public":            "設為公開",
+	"qitem.asked":             "提問",
+	"qitem.pending":           "等待回答",
+	"qitem.answeredBy":        "@%s 於 %s 的回答",
+	"qitem.danger":            "危險！",
+	"qitem.deleteConfirm":     "你確定要刪除這個提問嗎？該操作不可恢復，請謹慎操作。",
+	"qitem.deleteConfirmBtn":  "確認刪除",
+	"qitem.backToBox":         "返回%s的提問箱",
+	"qitem.answerTitle":       "回答問題",
+	"qitem.answerPlaceholder": "在此處撰寫你的回答...",
+	"qitem.emailNotifyHint":   "提問人留下了自己的電子郵箱，在你第一次回覆該問題後，提問人將會收到一封郵件通知。",
+	"qitem.submitAnswer":      "回答",
+	"qitem.updateAnswer":      "更新回答",
+	"qitem.askMore":           "再問點別的問題？",
+	"qitem.markRead":          "標記為已讀",
+	"qitem.markUnread":        "標記為未讀",
+	"qitem.readLocked":        "已回答，已鎖定為已讀",
+
+	// 個人設定頁
+	"admin.profile":           "個人資訊",
+	"admin.lang":              "介面語言",
+	"admin.langHint":          "選擇訪客訪問你的提問箱時顯示的語言（後台頁面跟隨此設定）",
+	"admin.email":             "電子郵件",
+	"admin.name":              "暱稱",
+	"admin.nameColor":         "暱稱顏色",
+	"admin.oldPassword":       "舊密碼",
+	"admin.newPassword":       "新密碼",
+	"admin.notify":            "新提問通知",
+	"admin.personalize":       "個人化設定",
+	"admin.intro":             "提問箱介紹",
+	"admin.introColor":        "提問箱介紹顏色",
+	"admin.qrBgColor":         "QR Code 背景色（亮色部分）",
+	"admin.qrPdColor":         "QR Code 探測圖形顏色（邊角方形）",
+	"admin.qrFgColor":         "QR Code 前景色",
+	"admin.qrDotSize":         "QR Code 點大小 (←小 大→)",
+	"admin.qrBgAlpha":         "QR Code 背景透明度 (←不透明 很透明→)",
+	"admin.avatar":            "個人頭像",
+	"admin.background":        "提問箱背景",
+	"admin.qrBackground":      "QR Code 背景圖",
+	"admin.social":            "社交資訊設定",
+	"admin.harassment":        "防騷擾設定",
+	"admin.askLimit":          "提問限制",
+	"admin.blockWords":        "屏蔽詞設定（Enter 或逗號分隔，最多支援 10 個屏蔽詞，每個屏蔽詞最大長度為 10）",
+	"admin.chat":              "私聊設定",
+	"admin.chatMaxMessages":   "私聊訊息條數上限",
+	"admin.chatDailyLimit":    "單一使用者每日私訊條數上限",
+	"admin.tags":              "標籤設定",
+	"admin.tagsHint":          "標籤（最多5個，每個最多5字，Enter 或逗號分隔）",
+	"admin.tagsPlaceholder":   "例如：動漫,音樂,遊戲",
+	"admin.tagInputHint":      "輸入後按 Enter 或逗號新增",
+	"admin.tagInputDuplicate": "已存在，已忽略",
+	"admin.pagePassword":      "頁面訪問密碼",
+	"admin.pagePasswordHint":  "設定訪問密碼（留空則關閉）",
+	"admin.askPassword":       "提問密碼",
+	"admin.askPasswordHint":   "設定提問密碼（留空則關閉）",
+	"admin.saveProfile":       "儲存修改",
+	"admin.updated":           "更新個人資訊成功",
+	"admin.logout":            "登出",
+	"admin.export":            "匯出資料",
+
+	// 後台設定（補充）
+	"admin.oldPasswordHint":         "修改密碼使用，留空則不修改",
+	"admin.newPasswordHint":         "6-64 位，留空則不修改",
+	"admin.notifyEmail":             "郵件",
+	"admin.useCustomFg":             "啟用自訂前景色（否則自動比對）",
+	"admin.customFgHint":            "僅在啟用時生效，否則顏色由系統自動產生",
+	"admin.avatarPlaceholder":       "上傳個人頭像（頭像比例不為1:1就扁了你哦）",
+	"admin.backgroundPlaceholder":   "上傳提問箱背景",
+	"admin.qrBackgroundPlaceholder": "上傳QR Code背景（顏色過深的背景會導致QR Code無法辨識）",
+	"admin.qrPreviewHint":           "選擇圖片後預覽將即時更新",
+	"admin.preview":                 "即時預覽",
+	"admin.themePreset":             "預設主題",
+	"admin.themeDefault":            "預設",
+	"admin.themeDark":               "暗夜",
+	"admin.themeOcean":              "海洋",
+	"admin.themeSunset":             "日落",
+	"admin.resetDefaults":           "🔄 恢復預設值",
+	"admin.previewHint":             "調整僅用於預覽，最終效果點擊「儲存修改」後生效",
+	"admin.socialHint":              "勾選後填寫主頁地址（無需 https://），未勾選的項目將不會在前台顯示。",
+	"admin.enableAcfun":             "啟用 AcFun",
+	"admin.enableBili":              "啟用 Bilibili",
+	"admin.enableWeibo":             "啟用 微博",
+	"admin.enableXiaohongshu":       "啟用 小紅書",
+	"admin.enableBlog":              "啟用 個人部落格",
+	"admin.registerOnly":            "僅允許註冊使用者向我提問",
+	"admin.updateHarassment":        "更新防騷擾設定",
+	"admin.globalBlockWords":        "全局屏蔽詞",
+	"admin.globalBlockWordsHint":    "屏蔽詞對提問、私聊（對方傳送給你的訊息）與投票提交內容生效；三個設定頁同步顯示同一份設定，任意一處修改即時生效。",
+	"admin.updateBlockWords":        "儲存屏蔽詞",
+	"admin.allowChat":               "允許註冊使用者向我發起私聊",
+	"admin.dailyLimitHint":          "0 表示不限制",
+	"admin.updateChat":              "更新私聊設定",
+	"admin.showInHome":              "在首頁展示我的標籤（允許其他使用者透過標籤搜尋到我）",
+	"admin.updateTags":              "更新標籤",
+	"admin.updatePagePassword":      "更新頁面密碼",
+	"admin.pagePasswordPlaceholder": "輸入頁面訪問密碼",
+	"admin.updateAskPassword":       "更新提問密碼",
+	"admin.askPasswordPlaceholder":  "輸入提問密碼",
+	"admin.account":                 "帳號設定",
+	"admin.exportHint":              "您可以匯出您在 %s 中的所有個人資料，包括你的基本資訊、收到的問題以及回答。",
+	"admin.exportJSON":              "導出全部資料（JSON）",
+	"admin.exportJSONHint":          "包含提問、回答、追問與私聊記錄，可完整備份或遷移。",
+	"admin.deactivate":              "停用我的帳號",
+	"admin.deactivateHint":          "您隨時可以選擇停用您的帳號。停用後，您的帳號將無法登入，您的提問箱頁面以及提問將無法訪問，其他人也無法再給您發送新的提問。<b>該操作無法撤銷！請謹慎操作！</b>",
+	"admin.socialRequired":          "請填寫連結或取消勾選",
+
+	// 問題管理頁
+	"qlist.title":              "我的提問",
+	"qlist.answered":           "已回答",
+	"qlist.pending":            "待回答",
+	"qlist.private":            "私密",
+	"qlist.empty":              "還沒有提問，快把提問箱分享出去吧～",
+	"qlist.action":             "操作",
+	"qlist.answerNow":          "去回答",
+	"qlist.sort":               "排序",
+	"qlist.status":             "狀態",
+	"qlist.type":               "類型",
+	"qlist.latest":             "最新",
+	"qlist.oldest":             "最早",
+	"qlist.all":                "全部",
+	"qlist.public":             "一般提問",
+	"qlist.privateQuestion":    "私密提問",
+	"qlist.received":           "我收到的提問",
+	"qlist.myChats":            "我發起的私聊",
+	"qlist.statsTotal":         "總提問數",
+	"qlist.statsAnswered":      "已回答",
+	"qlist.statsUnanswered":    "未回答",
+	"qlist.statsPrivate":       "私密提問",
+	"qlist.statsPinned":        "置頂",
+	"qlist.statsChats":         "私聊會話",
+	"qlist.searchPlaceholder":  "搜尋問題或回答內容...",
+	"qlist.searchBtn":          "搜尋",
+	"qlist.searchClear":        "清除搜尋",
+	"qlist.questionsTab":       "提問",
+	"qlist.votesTab":           "投票",
+	"qlist.chatsTab":           "私聊",
+	"qlist.receivedChats":      "我收到的私聊",
+	"qlist.chatEmpty":          "還沒有私聊，把提問箱分享出去讓大家來私聊吧～",
+	"qlist.pinnedShort":        "置頂",
+	"qlist.privateShort":       "私密",
+	"qlist.chatStatsTotal":     "總私聊",
+	"qlist.chatStatsReceived":  "我收到的",
+	"qlist.chatStatsInitiated": "我發起的",
+	"qlist.chatStatsClosed":    "已關閉",
+	"qlist.unansweredShort":    "待答",
+	"qlist.readShort":          "已讀",
+	"qlist.unreadShort":        "未讀",
+	"qitem.markReadShort":      "標記",
+	"qlist.pinShort":           "置頂",
+	"qlist.unpinShort":         "取消置頂",
+	"qlist.myVotes":            "我建立的投票",
+	"qlist.loadMore":           "載入更多",
+	"qlist.newVote":            "新建投票",
+	"qlist.edit":               "編輯",
+	"qlist.untitledVote":       "未命名投票",
+	"qlist.blocked":            "已拉黑",
+	"qlist.unanswered":         "未回答",
+
+	// 站點 Logo 後綴
+	"site.logoSuffix": "的提問箱",
+	"site.stats":      "提問箱資訊統計",
+
+	// 驗證碼彈窗
+	"captcha.title":        "人機驗證",
+	"captcha.hint":         "請計算下方的算術題以驗證你不是機器人",
+	"captcha.refresh":      "換一題",
+	"captcha.submit":       "驗證並送出",
+	"captcha.loading":      "載入中...",
+	"captcha.loadFailed":   "載入失敗",
+	"captcha.loadRetry":    "載入失敗，請重試",
+	"captcha.inputAnswer":  "請輸入答案",
+	"captcha.wrongAnswer":  "答案錯誤，請重新計算",
+	"captcha.verifyFailed": "驗證失敗，請重試",
+
+	// 註冊頁補充
+	"auth.register.domain.prefix":   "個性網域（你的問答箱網址將會是：%s + ",
+	"auth.register.domain.suffix":   " + 你在下面文字框中填寫的內容）",
+	"auth.register.confirm":         "確認密碼",
+	"auth.register.language":        "介面語言",
+	"auth.register.languageDefault": "跟隨站點預設",
+	"auth.register.success":         "註冊成功，歡迎來到 狼的提問箱！",
+
+	// 探索頁補充
+	"explore.recommend":    "隨機推薦",
+	"explore.search":       "搜尋標籤...",
+	"explore.sortLatest":   "最新加入",
+	"explore.sortOldest":   "最早加入",
+	"explore.noTags":       "無標籤",
+	"explore.noRecommend":  "暫無推薦用戶",
+	"explore.hotTags":      "熱門標籤",
+	"explore.hotQuestions": "熱門問題",
+	"explore.noResult":     "暫無符合條件的用戶。",
+	"explore.lazy":         "這個人很懶，什麼都沒寫~",
+	"explore.prevPage":     "上一頁",
+	"explore.nextPage":     "下一頁",
+	"explore.loading":      "載入中...",
+	"explore.loadFailed":   "載入失敗",
+
+	// 提問箱密碼頁
+	"password.title":  "此提問箱需要密碼",
+	"password.desc":   "此提問箱已設定存取密碼，請輸入密碼查看內容",
+	"password.input":  "請輸入存取密碼",
+	"password.enter":  "驗證進入",
+	"password.submit": "確認",
+
+	// 問題不存在
+	"qitem.notFound": "問題不存在或已被刪除",
+
+	// 聊天頁
+	"chat.title":          "私聊",
+	"chat.input":          "輸入訊息...",
+	"chat.send":           "傳送",
+	"chat.delete":         "刪除對話",
+	"chat.block":          "封鎖對方",
+	"chat.unblock":        "取消封鎖",
+	"chat.empty":          "還沒有訊息，說點什麼吧~",
+	"chat.withAsker":      "與提問者的私聊",
+	"chat.withUser":       "與 %s 的私聊",
+	"chat.closed":         "對話已關閉",
+	"chat.closedNoSend":   "對話已關閉，無法發送新訊息",
+	"chat.remaining":      "訊息剩餘：%d 條（共 %d 條）",
+	"chat.me":             "我",
+	"chat.other":          "對方",
+	"chat.userBlocked":    "該使用者已被拉黑",
+	"chat.addImage":       "新增圖片（可選，最大5MB）",
+	"chat.confirm":        "確認",
+	"chat.confirmBlock":   "確定要拉黑該使用者嗎？他將無法再發送私訊。",
+	"chat.confirmUnblock": "確定要取消封鎖該使用者嗎？他將可以再次發送私訊。",
+	"chat.deleteConfirm":  "確定要刪除這條私聊對話嗎？對方將無法再看到此對話，且操作不可恢復。",
+	"maintenance.title":   "NekoBox 維護中...",
+	"maintenance.desc":    "NekoBox 正在進行維護，服務暫時不可用。過一會再來吧~",
+
+	// 單題分享（v4）
+	"qitem.shareCard": "分享此提問",
+
+	// 追問（v4）
+	"followup.title":              "追問記錄",
+	"followup.content":            "追問：",
+	"followup.answerPlaceholder":  "回答這條追問...",
+	"followup.answerBtn":          "回答追問",
+	"followup.waiting":            "等待回答中...",
+	"followup.askMore":            "繼續追問",
+	"followup.remaining":          "還可追問 %d / %d 次",
+	"followup.contentPlaceholder": "補充你的問題...",
+	"followup.waitingReply":       "你的追加提問已發出，等待提問箱主人回覆中...",
+	"followup.submit":             "提交追問",
+
+	// 置頂（v4）
+	"qlist.pinned":      "置頂中",
+	"qlist.pin":         "置頂",
+	"qlist.unpin":       "取消置頂",
+	"qlist.readStatus":  "閱讀狀態",
+	"qlist.read":        "已讀",
+	"qlist.unread":      "未讀",
+	"qlist.statsRead":   "已讀",
+	"qlist.statsUnread": "未讀",
+
+	// 提問成功頁（v4）
+	"success.title":        "提問發送成功！",
+	"success.yourQuestion": "你的提問：",
+	"success.emailSent":    "已向你的信箱發送了該提問的私密連結，也可以使用下方連結隨時查看提問、接收回答與繼續追問。",
+	"success.saveLink":     "<strong>請務必保存下面的私密連結！</strong>由於你沒有留下信箱，此連結（含口令 Token）是你查看提問、接收回答與繼續追問的<strong>唯一憑證</strong>，遺失後將無法找回。",
+	"success.privateLink":  "你的提問私密連結（點擊複製保存）",
+	"success.copy":         "複製",
+	"success.copied":       "已複製 ✓",
+	"success.copyFailed":   "複製失敗",
+	"success.token":        "口令 Token：%s（提問人憑 Token 存取私密連結）",
+	"success.viewQuestion": "查看我的提問",
+	"success.backToBox":    "返回%s的提問箱",
+	"success.pageTitle":    "提問成功 - %s",
+
+	// 停用頁
+	"deactivate.title":   "帳號停用",
+	"deactivate.desc":    "停用後你的提問箱將無法存取，且所有資料將被刪除，此操作不可恢復！",
+	"deactivate.confirm": "我確認要停用帳號",
+	"deactivate.submit":  "停用帳號",
+
+	// 匿名投票
+	"nav.votes": "投票",
+
+	"common.back": "返回",
+
+	"vote.listTitle":              "投票管理",
+	"vote.newTitle":               "新建投票",
+	"vote.editTitle":              "編輯投票",
+	"vote.resultsTitle":           "投票結果",
+	"vote.statsTotal":             "投票總數",
+	"vote.statsPublished":         "進行中",
+	"vote.createNew":              "新建投票",
+	"vote.typeSingle":             "單選",
+	"vote.typeMultiple":           "多選",
+	"vote.typeRating":             "評分",
+	"vote.typeRank":               "排序",
+	"vote.typeForm":               "表單收集",
+	"vote.statusNotStarted":       "未開始",
+	"vote.statusDraft":            "草稿",
+	"vote.statusPublished":        "進行中",
+	"vote.statusEnded":            "已結束",
+	"vote.statusArchived":         "已歸檔",
+	"vote.participants":           "參與",
+	"vote.remainLabel":            "剩餘",
+	"vote.perpetual":              "無限期",
+	"vote.durationDay":            "天",
+	"vote.durationHour":           "小時",
+	"vote.durationMinute":         "分鐘",
+	"vote.createdAt":              "建立於",
+	"vote.edit":                   "編輯",
+	"vote.results":                "結果",
+	"vote.preview":                "預覽",
+	"vote.page.mustComplete":      "請完成",
+	"vote.page.rankHintRequired":  "排名 1-N（必填）",
+	"vote.page.rankHintOptional":  "排名 1-N（可選，可只排部分）",
+	"vote.page.previewHint":       "預覽模式：這是發布前的頁面範例，提交已停用",
+	"vote.page.previewSubmitHint": "預覽模式，發布後即可提交",
+	"vote.publish":                "發布",
+	"vote.close":                  "結束",
+	"vote.share":                  "複製連結",
+	"vote.copied":                 "已複製",
+	"vote.shareURL":               "投票分享連結",
+	"vote.confirmPublish":         "確定發布該投票嗎？發布後即產生可分享連結。",
+	"vote.confirmClose":           "確定結束該投票嗎？結束後參與者將無法再投票。",
+	"vote.confirmDelete":          "確定刪除該投票嗎？投票資料將一併刪除，不可復原！",
+	"vote.manageEntry":            "管理投票",
+
+	"vote.manageTitle": "管理投票",
+	"vote.manageDesc":  "建立與管理你的匿名投票", "vote.empty": "還沒有投票，點擊右上角\"新建投票\"開始吧～",
+	"vote.formLockedHint":              "該投票已發布，僅可修改基本資訊；類型與選項已鎖定（避免破壞已收集的投票資料）",
+	"vote.formBasic":                   "基本設定",
+	"vote.formTitle":                   "投票標題",
+	"vote.formTitlePlaceholder":        "例如：今天吃什麼？",
+	"vote.formDescription":             "描述 / 說明",
+	"vote.formDescriptionPlaceholder":  "補充說明（可選）",
+	"vote.formType":                    "投票類型",
+	"vote.formVisibility":              "展示方式",
+	"vote.formVisibilityPublic":        "公開展示（探索頁 + 提問箱頁）",
+	"vote.formVisibilityLinkOnly":      "僅連結分享",
+	"vote.formVoterScope":              "投票範圍",
+	"vote.formVoterScopeAnyone":        "任何人（含匿名）",
+	"vote.formVoterScopeRegistered":    "僅註冊用戶",
+	"vote.formShowResult":              "結果可見時機",
+	"vote.formShowResultAfterVote":     "投票後立即可見",
+	"vote.formShowResultAfterEnd":      "結束後可見",
+	"vote.formShowResultOwnerOnly":     "僅我可見",
+	"vote.formStartAt":                 "開始時間（留空立即開始）",
+	"vote.formEndAt":                   "結束時間（留空不限制）",
+	"vote.formMaxChoices":              "最多可選數量",
+	"vote.formMaxVotesPerFingerprint":  "每個投票每個裝置限 1 次，使用同一瀏覽器重複提交將被攔截。",
+	"vote.formMaxVotesPerAccount":      "每個投票每個註冊帳號限 1 次，使用同一帳號重複提交將被攔截。",
+	"vote.formAllowCustom":             "允許參與者補充自訂選項",
+	"vote.formRequireCaptcha":          "匿名投票需通過驗證碼",
+	"vote.formOptions":                 "投票選項",
+	"vote.formRatingHint":              "評分題無需設定選項（1-10 分）",
+	"vote.addOption":                   "新增選項",
+	"vote.optionPlaceholder":           "選項內容",
+	"vote.formFields":                  "表單欄位",
+	"vote.addField":                    "新增欄位",
+	"vote.field":                       "欄位",
+	"vote.formFieldType":               "欄位類型",
+	"vote.fieldTypeText":               "單行文字",
+	"vote.fieldTypeTextarea":           "多行文字",
+	"vote.fieldTypeSelect":             "下拉選擇",
+	"vote.fieldTypeRadio":              "單選",
+	"vote.fieldTypeCheckbox":           "多選",
+	"vote.fieldTypeNumber":             "數字",
+	"vote.fieldTypeRank":               "排序",
+	"vote.page.selectPlaceholder":      "請選擇",
+	"vote.page.avgNumber":              "平均",
+	"vote.page.fieldFilled":            "已填寫",
+	"vote.fieldTypeRating":             "評分",
+	"vote.formFieldLabel":              "欄位標籤",
+	"vote.formFieldRequired":           "必填",
+	"vote.formFieldMaxLength":          "字數上限（0 不限制）",
+	"vote.formFieldOptions":            "選項",
+	"vote.formFieldOptionsHint":        "點擊下方「新增選項」逐條新增，不需用逗號分隔",
+	"vote.fieldAllowCustom":            "允許補充自訂選項",
+	"vote.formFieldOptionsPlaceholder": "如：滿意,一般,不滿意",
+	"vote.createDraft":                 "儲存草稿",
+	"vote.builderHintOptions":          "至少需要 2 個選項",
+	"vote.builderHintFields":           "請至少新增 1 個欄位",
+	"vote.builderHintFieldOptions":     "選擇題/排序題請填寫選項（排序題至少 2 個）",
+	"vote.resultsAnswered":             "回答數",
+	"vote.page.rankedTimes":            "被排次數",
+	"vote.resultsTotal":                "總參與人數",
+	"vote.resultsSubmissions":          "表單回覆",
+	"vote.resultsViewTexts":            "查看文字提交",
+	"vote.resultsToggleHint":           "點擊展開或收起文字回覆明細",
+	"vote.resultsOptions":              "投票結果",
+	"vote.resultsVotes":                "票",
+	"vote.export":                      "匯出 CSV",
+	"vote.resultsEmpty":                "還沒有人參與，快來分享吧～",
+
+	// 匿名投票參與頁
+	"vote.inlineTitle":                 "投票",
+	"vote.page.by":                     "發起的投票",
+	"vote.page.goVote":                 "去投票",
+	"vote.page.notStarted":             "未開始",
+	"vote.page.notStartedHint":         "該投票尚未開始，敬請期待～",
+	"vote.page.ended":                  "已結束",
+	"vote.page.endedHint":              "該投票已結束",
+	"vote.page.active":                 "進行中",
+	"vote.page.participated":           "已參與",
+	"vote.page.loginRequired":          "該投票僅限註冊用戶參與，請先登入。",
+	"vote.page.anonymousHint":          "該投票允許匿名參與，你的身分不會被記錄（同一裝置最多可參與 1 次）。",
+	"vote.page.submit":                 "提交投票",
+	"vote.page.alreadyVoted":           "你已參與過該投票，感謝參與！",
+	"vote.page.resultsTitle":           "投票結果",
+	"vote.page.totalVotes":             "總參與",
+	"vote.page.avgRating":              "平均分",
+	"vote.page.avgRank":                "平均排名",
+	"vote.page.optionColumn":           "選項",
+	"vote.page.ratingLabel":            "請評分",
+	"vote.page.ratingUnit":             "分",
+	"vote.page.rankHint":               "請為每個選項填寫 1-N 的排名（數字越小越靠前，不可重複）",
+	"vote.page.rankPlaceholder":        "排名",
+	"vote.page.multipleHint":           "可多選",
+	"vote.page.customOption":           "補充選項（可選）",
+	"vote.page.customPlaceholder":      "填寫你心中的其他選項",
+	"vote.page.customOther":            "其他",
+	"vote.page.customFieldPlaceholder": "填寫自訂選項…",
+	"vote.page.customStats":            "自訂補充選項",
+	"vote.page.formCount":              "已收到回覆",
+	"vote.page.ownerManage":            "管理此投票（僅你可見結果）",
+
+	// 單份投票的定量收集
+	"vote.formQuotaLimit":          "收集上限（份）",
+	"vote.formQuotaHint":           "0 表示不限制；收集到指定份數後自動結束該投票。",
+	"vote.flash.notFound":          "該投票不存在或已失效",
+	"vote.flash.notPublished":      "該投票尚未發布",
+	"vote.flash.archived":          "該投票已歸檔，無法參與",
+	"vote.flash.ended":             "該投票已結束",
+	"vote.flash.notStarted":        "該投票尚未開始",
+	"vote.flash.success":           "投票成功！感謝參與",
+	"vote.err.noChoice":            "請至少選擇一個選項",
+	"vote.err.tooManyChoices":      "最多只能選擇 %d 個選項",
+	"vote.err.pickOne":             "請選擇一個選項",
+	"vote.err.invalidOption":       "存在無效的選項",
+	"vote.err.optionDuplicate":     "選項不能重複選擇",
+	"vote.err.ratingRequired":      "請給出 1-10 分的評分",
+	"vote.err.rankRequired":        "請為每個選項填寫 1-%d 的排名",
+	"vote.err.rankDuplicate":       "排名不能重複",
+	"vote.err.fieldRequired":       "請填寫「%s」",
+	"vote.err.fieldCustomRequired": "請填寫「%s」的自訂選項",
+	"vote.err.fieldCustomTooLong":  "「%s」的自訂選項不能超過 %d 字",
+	"vote.err.fieldInvalidOption":  "「%s」的選項無效",
+	"vote.err.fieldConfigError":    "「%s」選項配置錯誤",
+	"vote.err.fieldRankIncomplete": "請填寫「%s」的完整排名",
+	"vote.err.fieldRankRange":      "「%s」排名必須是 1-%d 之間的數字",
+	"vote.err.fieldRankDuplicate":  "「%s」排名不能重複",
+	"vote.err.fieldTooLong":        "「%s」超出字數限制（最多 %d 字）",
+	"vote.err.fieldNotNumber":      "「%s」必須是數字",
+	"vote.err.fieldRating":         "「%s」請給出 1-10 分的評分",
+	"vote.err.unknownType":         "未知的投票類型",
+	"vote.err.customTooLong":       "自訂選項不能超過 %d 字",
+	"vote.err.blockWords":          "提交內容中包含了投票發起人設定的屏蔽詞，無法提交",
+	"vote.err.serialize":           "提交內容序列化失敗",
+	"captcha.error":                "驗證碼錯誤",
+	"captcha.errEmpty":             "驗證碼不能為空",
+	"captcha.errFormat":            "驗證碼格式錯誤，請重新整理後重試",
+	"captcha.errAnswerFormat":      "驗證碼答案格式錯誤",
+	"captcha.errExpired":           "驗證碼已過期，請重新整理後重試",
+	"captcha.errService":           "驗證碼服務異常，請稍後再試",
+	"captcha.errAnswerWrong":       "驗證碼答案錯誤",
+	"censor.unavailable":           "內容審核服務暫時不可用，請稍後再試",
+
+	// 功能管理：提問 / 私聊 / 投票 的開關、定時開關與定量收集
+	"admin.tabAccount":            "用戶設定",
+	"admin.featuresHint":          "在「提問 / 私聊 / 投票」面板中管理各功能的開關、開放時段與收集上限；達到上限後對應功能自動關閉。",
+	"admin.featuresEntry":         "設定",
+	"admin.featureHint.question":  "關閉後訪客無法提交新提問；達到收集上限後自動停止接收（含私密提問）。",
+	"admin.featureHint.chat":      "關閉後訪客無法發起新的私聊；已有會話不受影響。",
+	"admin.featureHint.vote":      "關閉後提問箱頁不再展示投票板塊，訪客也無法參與你的投票。單份投票可在編輯頁單獨設定收集上限。",
+	"admin.featureEnabled":        "啟用該功能",
+	"admin.featureOpenAt":         "定時開放",
+	"admin.featureCloseAt":        "定時關閉",
+	"admin.featureTimeHint":       "留空表示不限制；開放時間之前、關閉時間之後該功能均不可用。",
+	"admin.featureSchedule":       "循環定時（每週循環）",
+	"admin.featureScheduleStart":  "每日開始",
+	"admin.featureScheduleEnd":    "每日結束",
+	"admin.featureScheduleHint":   "勾選每週固定開放日並設定每日時間段，按週循環生效；全部留空表示不啟用。只填開放日（不填時間）表示該天全天開放；只填時間（不勾選任何日）表示每天該時段開放。",
+	"admin.featureMode":           "收集模式",
+	"admin.featureModeAlways":     "長期開放",
+	"admin.featureModeWindow":     "定時收集",
+	"admin.featureModeRecurring":  "循環定時",
+	"admin.featureModeHint":       "長期開放：不限時間，保持開放直到手動關閉；定時收集：一次性開放 / 關閉時間視窗；循環定時：每週固定開放日循環生效。三種模式互斥，儲存時未選模式的設定將被清空。",
+	"admin.featureQuotaLimit":     "收集上限（條 / 份）",
+	"admin.featureQuotaHint":      "0 表示不限制；累計收集達到上限後自動關閉，重設計數後可開啟下一輪。",
+	"admin.featureQuotaCount":     "已收集",
+	"admin.featureQuotaUnlimited": "不限制",
+	"admin.featureQuotaResetAt":   "上次重設：",
+	"admin.featureResetQuota":     "重設計數",
+	"admin.featureSave":           "儲存該功能設定",
+
+	// 功能管理：狀態與提示
+	"feature.name.question":        "提問",
+	"feature.name.chat":            "私聊",
+	"feature.name.vote":            "投票",
+	"feature.statusOpen":           "進行中",
+	"feature.status.disabled":      "已關閉",
+	"feature.status.not_started":   "未開始",
+	"feature.status.ended":         "已結束",
+	"feature.status.quota_reached": "已達上限",
+	"feature.saved":                "功能設定已儲存",
+	"feature.errTime":              "%s 的時間格式不正確，請使用日期時間選擇器",
+	"feature.errTimeRange":         "%s 的定時關閉時間必須晚於定時開放時間",
+	"feature.errQuota":             "%s 的收集上限需為 0 到 1000000 之間的整數",
+	"feature.errInvalid":           "未知的功能類型",
+	"feature.quotaReset":           "%s 的收集計數已重設",
+	"feature.errScheduleHalf":      "%s 的循環定時開始與結束時間必須同時填寫",
+	"feature.errScheduleTime":      "%s 的循環定時時間格式不正確，請使用時間選擇器",
+	"feature.errScheduleRange":     "%s 的循環定時結束時間必須晚於開始時間",
+
+	// 功能關閉時對訪客的提示
+	"feature.disabled.question":      "提問箱主人已關閉提問功能",
+	"feature.disabled.chat":          "該提問箱未開啟私聊功能",
+	"feature.disabled.vote":          "該提問箱已關閉投票功能",
+	"feature.not_started.question":   "提問功能尚未開放",
+	"feature.not_started.chat":       "私聊功能尚未開放",
+	"feature.not_started.vote":       "投票功能尚未開放",
+	"feature.ended.question":         "提問功能已結束收集",
+	"feature.ended.chat":             "私聊功能已結束",
+	"feature.ended.vote":             "投票功能已結束",
+	"feature.quota_reached.question": "提問功能已達到收集上限",
+	"feature.quota_reached.chat":     "私聊功能已達到收集上限",
+	"feature.quota_reached.vote":     "投票功能已達到收集上限",
+
+	// 認證：訪客可見的提示（P0）
+	"auth.errBadCredential":   "郵箱或密碼錯誤",
+	"auth.errUserNotFound":    "使用者不存在",
+	"auth.errEmailFrequent":   "郵件發送太頻繁，請稍後再試",
+	"auth.errEmailFailed":     "郵件發送失敗，請稍後再試",
+	"auth.errCodeExpired":     "驗證碼已過期",
+	"auth.errPasswordChanged": "密碼修改成功",
+	"auth.errLoginRequired":   "請先登入",
+	"auth.errDuplicateEmail":  "該郵箱已被註冊",
+	"auth.errDuplicateDomain": "該個性網域已被使用",
+
+	// 提問箱頁：訪客可見（P0）
+	"question.errWrongPassword":     "密碼錯誤",
+	"question.errAskPasswordWrong":  "提問密碼錯誤",
+	"question.errLoginRequired":     "提問箱的主人設定了僅註冊使用者才能提問，請先登入。",
+	"question.errSelfChat":          "不能給自己發起私聊",
+	"question.errBlockedChat":       "你已被對方封鎖，無法發起私聊",
+	"question.errChatDailyLimit":    "你今日已達發送上限（%d則），請明天再試",
+	"question.errDuplicateSubmit":   "偵測到重複提交，請稍後再試",
+	"question.errImageTooLarge":     "圖片檔案大小不能大於 5Mb",
+	"question.errUploadImageFailed": "上傳圖片失敗",
+	"question.errBlockWords":        "提問內容包含了提問箱主人設定的屏蔽詞，發送失敗",
+	"question.errAnsweredLocked":    "已回答的問題不能標記為未讀",
+	"question.flash.chatSent":       "私聊請求已發送！你可以透過以下連結查看對話：%s",
+	"question.flash.answered":       "回答發布成功！",
+	"question.flash.operated":       "操作成功",
+	"question.flash.markedRead":     "已標記為已讀",
+	"question.flash.markedUnread":   "已標記為未讀",
+
+	// 追問：訪客/箱主可見（P0）
+	"followup.errNoPermission": "無權操作",
+	"followup.errNotAnswered":  "問題尚未被回答，暫時不能追問",
+	"followup.errLimit":        "每條提問最多追問 %d 次，已達上限",
+	"followup.errWaitReply":    "請等待主人回覆上一條追問後再繼續追問",
+	"followup.errNotFound":     "追問不存在",
+	"followup.flash.sent":      "追問發送成功！",
+	"followup.flash.answered":  "回答成功！",
+
+	// 後台設定：箱主可見（P1）
+	"admin.flash.profileUpdated":    "更新個人資訊成功",
+	"admin.flash.chatUpdated":       "私聊設定更新成功",
+	"admin.flash.pagePwdOff":        "已關閉頁面密碼存取",
+	"admin.flash.pagePwdUpdated":    "頁面存取密碼已更新",
+	"admin.flash.askPwdOff":         "已關閉提問密碼",
+	"admin.flash.askPwdUpdated":     "提問密碼已更新",
+	"admin.flash.tagsTooMany":       "標籤不能超過 5 個",
+	"admin.flash.tagsUpdated":       "更新標籤成功",
+	"admin.flash.tagTooLong":        "每個標籤不能超過 5 個字元：%s",
+	"admin.flash.blockWordsTooMany": "屏蔽詞不能超過 10 個",
+	"admin.flash.blockWordTooLong":  "屏蔽詞長度不能超過 10 個字元：%s",
+	"admin.flash.harassmentUpdated": "更新防騷擾設定成功",
+	"admin.flash.blockWordsUpdated": "屏蔽詞已更新",
+	"admin.flash.deactivated":       "您的帳號已停用，感謝您使用 狼的提問箱。期待未來還能再見 👋🏻",
+	"admin.export.errUser":          "匯出失敗：獲取使用者資訊失敗",
+	"admin.export.errQuestion":      "匯出失敗：獲取問題資訊失敗",
+
+	// 投票管理：箱主可見（P1）
+	"vote.err.invalidID":                 "無效的投票 ID",
+	"vote.err.notExist":                  "投票不存在",
+	"vote.err.noPermission":              "無權操作該投票",
+	"vote.err.type":                      "未知的投票類型",
+	"vote.err.titleRequired":             "請填寫投票標題",
+	"vote.err.titleTooLong":              "投票標題不能超過 100 字",
+	"vote.err.visibility":                "未知的可見性設定",
+	"vote.err.voterScope":                "未知的投票範圍設定",
+	"vote.err.showResult":                "未知的結果展示設定",
+	"vote.err.timeRange":                 "結束時間必須晚於開始時間",
+	"vote.err.quota":                     "收集上限需為 0 到 1000000 之間的整數",
+	"vote.err.optionsTooFew":             "請至少新增 2 個選項",
+	"vote.err.optionsFormat":             "選項資料格式錯誤",
+	"vote.err.optionTooLong":             "單個選項內容不能超過 %d 字",
+	"vote.err.maxChoicesExceed":          "最多可選數量不能超過選項總數",
+	"vote.err.fieldsTooFew":              "請至少新增 1 個表單欄位",
+	"vote.err.fieldsFormat":              "表單欄位資料格式錯誤",
+	"vote.err.fieldsTooMany":             "表單欄位不能超過 50 個",
+	"vote.err.fieldType":                 "存在未知的表單欄位類型",
+	"vote.err.fieldLabelMissing":         "第 %d 個欄位缺少標籤",
+	"vote.err.fieldLabelTooLong":         "第 %d 個欄位的標籤不能超過 100 字",
+	"vote.err.fieldLabelDuplicate":       "欄位標籤「%s」重複，請使用不同的標籤",
+	"vote.err.fieldMaxLength":            "第 %d 個欄位的字數上限需在 0-2000 之間",
+	"vote.err.fieldReservedOption":       "第 %d 個欄位（%s）的選項內容包含保留值，請更換",
+	"vote.err.fieldOptionsTooFew":        "第 %d 個欄位（%s）請至少填寫 1 個選項",
+	"vote.err.fieldRankTooFew":           "第 %d 個欄位（%s）排序題至少需要 2 個選項",
+	"vote.err.fieldSerialize":            "欄位選項序列化失敗",
+	"vote.err.editClosed":                "已結束或歸檔的投票不允許編輯",
+	"vote.err.publishDraftOnly":          "只有草稿狀態的投票可以發布",
+	"vote.err.closePublishedOnly":        "只有進行中的投票可以結束",
+	"vote.err.publishTitleRequired":      "請先填寫投票標題再發布",
+	"vote.err.publishFormFieldsRequired": "表單類型投票至少需要 1 個欄位",
+	"vote.err.publishOptionsRequired":    "選項投票至少需要 2 個選項",
+	"vote.err.optionUpdateFailed":        "選項更新失敗，請重試",
+	"vote.err.fieldUpdateFailed":         "表單欄位更新失敗，請重試",
+	"vote.flash.published":               "投票已發布！分享連結：%s",
+	"vote.flash.updated":                 "投票資訊已更新（進行中的投票不可修改類型與選項）",
+	"vote.flash.draftSaved":              "已儲存到草稿",
+	"vote.flash.closed":                  "投票已結束",
+	"vote.flash.deleted":                 "投票已刪除",
+	"vote.err.timeFormat":                "時間格式不正確，請使用日期時間選擇器",
+	"vote.err.maxChoicesLimit":           "最多可選數量不能超過 20",
+	"vote.err.descriptionTooLong":        "投票描述不能超過 5000 字",
+	"profile.err.avatarTooLarge":         "頭像檔案太大，最大支援 2MB",
+	"profile.err.backgroundTooLarge":     "背景圖檔案太大，最大支援 2MB",
+	"profile.err.newPasswordTooShort":    "新密碼長度不能少於 8 位",
+	"profile.err.badOldPassword":         "舊密碼輸入錯誤",
+	"admin.export.errCreateExcel":        "匯出失敗：建立Excel檔案失敗",
+	"admin.export.errWriteExcel":         "匯出失敗：寫入Excel檔案失敗",
+
+	// profile 設定頁 UI 重構：卡片分區 / 頭像背景裁切 / 改密強制登出
+	"profile.card.basic":             "基本資料",
+	"profile.card.avatarBg":          "頭像與背景",
+	"profile.card.qr":                "二維碼樣式",
+	"profile.card.password":          "修改密碼",
+	"profile.avatarCropHint":         "裁切框已鎖定為 1:1 正方形",
+	"profile.backgroundCropHint":     "裁切框已鎖定為 16:9 寬螢幕",
+	"profile.cropTitle":              "裁切圖片",
+	"profile.cropConfirm":            "確認裁切",
+	"profile.err.avatarRatio":        "頭像圖片必須為 1:1 正方形，請裁切後再上傳",
+	"profile.err.backgroundRatio":    "背景圖片必須為 16:9 寬高比，請裁切後再上傳",
+	"profile.flash.passwordChanged":  "密碼修改成功，已登出，請使用新密碼重新登入",
+	"profile.pwdNote":                "儲存後目前工作階段立即失效，需使用新密碼重新登入",
+	"profile.pickAvatar":             "更換頭像",
+	"profile.pickBackground":         "更換背景",
+	"profile.saveBasic":              "儲存基本資料",
+	"profile.saveMedia":              "儲存頭像與背景",
+	"profile.savePassword":           "確認修改密碼",
+	"profile.saveQR":                 "儲存 QR Code 樣式",
+	"profile.saveSocial":             "儲存社交連結",
+	"profile.err.cropLibUnavailable": "圖片裁切元件載入失敗，請重新整理頁面後重試",
+
+	// 驗證碼 JSON 介面：前端消費（P2）
+	"captcha.json.badRequest": "請求格式錯誤",
+	"captcha.json.idRequired": "驗證碼 ID 不能為空",
+	"captcha.json.genFailed":  "生成驗證碼失敗",
+	"chat.errDeletedByOwner":  "該私聊對話已被對方刪除。",
+	"chat.errBlockedView":     "你已被對方拉黑，無法查看該私聊",
+	"chat.errEmpty":           "消息不能為空",
+	"chat.errTooLong":         "消息內容過長，請控制在 %d 字以內",
+	"chat.errConvDeletedSend": "該對話已被刪除，無法發送消息",
+	"chat.errBlockedSend":     "你已被對方拉黑，無法發送私信",
+	"chat.errBlockWords":      "訊息中包含了提問箱主人設定的屏蔽詞，無法傳送",
+	"chat.errDailyLimit":      "你今日已達發送上限（%d條），請明天再試",
+	"chat.errLimitReached":    "對話已達到上限，無法發送新消息",
+	"chat.errChatClosed":      "該箱主已關閉私聊功能，無法發送消息",
+	"chat.errImageTooLarge":   "圖片大小不能超過 %dMB",
+	"chat.errUploadFailed":    "圖片上傳失敗，請稍後重試",
+	"chat.errNoPermission":    "無權執行此操作",
+	"chat.flash.sent":         "消息發送成功",
+	"chat.flash.deleted":      "私聊對話已刪除",
+	"chat.flash.operated":     "操作成功",
+	"image.errTooLarge":       "圖片尺寸過大，最大支援 %d×%d 像素，請壓縮後重新上傳",
+	"internal.errFlash":       "服務內部錯誤，請稍後重試。",
+	"internal.errServer":      "伺服器內部錯誤",
+	"home.errStats":           "獲取統計資訊失敗",
+	"pixel.errPath":           "非法的請求路徑",
+	"proxy.errNotFound":       "頁面不存在",
+	"proxy.errInternal":       "服務網關內部錯誤",
+	"explore.errRandomUser":   "獲取隨機用戶失敗",
+	// 表单校验
+	"form.answer.content":               "回答內容不能為空",
+	"form.answer.contentTooLong":        "回答內容不能超過 %d 個字元",
+	"form.email.required":               "請填寫有效的電子郵件地址",
+	"form.followup.answer":              "追問回答不能為空",
+	"form.followup.answerTooLong":       "追問回答不能超過 %d 個字元",
+	"form.followup.content":             "追問內容不能為空",
+	"form.followup.contentTooLong":      "追問內容不能超過 %d 個字元",
+	"form.login.password":               "請輸入密碼",
+	"form.profile.backgroundimagealpha": "請填寫 QR Code 背景透明度",
+	"form.profile.colorHex":             "請填寫 7 位十六進制顏色代碼（含 #）",
+	"form.profile.dotscale":             "請填寫 QR Code 點大小",
+	"form.profile.intro":                "個人介紹不能為空，且不超過 100 個字元",
+	"form.profile.linkMax":              "主頁連結長度不能超過 30 個字元",
+	"form.profile.name":                 "暱稱不能為空，且不超過 20 個字元",
+	"form.profile.newPassword":          "新密碼長度不能超過 30 個字元",
+	"form.profile.passwordMax":          "密碼長度不能超過 30 個字元",
+	"form.question.content":             "問題內容不能為空",
+	"form.question.contentTooLong":      "問題內容不能超過 %d 個字元",
+	"form.question.receiveReplyEmail":   "請填寫有效的電子郵件地址以接收回覆",
+	"form.recaptcha":                    "請完成人機驗證",
+	"form.recover.newPassword":          "請設定 8 至 30 位的新密碼",
+	"form.recover.repeatPassword":       "兩次輸入的新密碼不一致",
+	"form.register.domain":              "個性網域只能包含字母、數字與底線，長度為 3 至 20 位",
+	"form.register.email":               "請填寫有效的電子郵件地址（不超過 100 個字元）",
+	"form.register.name":                "暱稱不能為空，且不超過 20 個字元",
+	"form.register.password":            "請設定 8 至 30 位的密碼",
+	"form.register.recaptcha":           "無法人機驗證，請重新整理頁面或更換網路後重試",
+	"form.register.repeatPassword":      "兩次輸入的密碼不一致",
+}
diff --git a/.workbuddy/backup/remove-vercount-20260906/footer.html b/.workbuddy/backup/remove-vercount-20260906/footer.html
new file mode 100644
index 0000000..0536a82
--- /dev/null
+++ b/.workbuddy/backup/remove-vercount-20260906/footer.html
@@ -0,0 +1,79 @@
+<p class="{{ if .IsPixel }}uk-container{{end}} uk-text-right uk-text-muted uk-text-small">
+    {{t .LangCode "site.footer.visitor" `<span id="busuanzi_value_site_uv"><span class="tb-spinner"></span></span>` | safe}} | {{t .LangCode "site.footer.pageview" `<span id="busuanzi_value_page_pv"><span class="tb-spinner"></span></span>` | safe}}
+  <br>Powered by NekoBox | {{ ICP }}<br>{{t .LangCode "site.footer.runtime"}}：<span id="box_runtime"></span>
+  <br>
+  <!--<a href="/pixel">画板</a> | -->
+  <a href="https://box.tama.guru/_/tamakyi" target="_blank">{{t .LangCode "site.footer.admin"}}</a>
+  | <a href="https://blog.tama.guru" target="_blank">{{t .LangCode "site.footer.notice"}}</a>
+  | <a href="https://chat.tama.guru" target="_blank">{{t .LangCode "site.footer.chat"}}</a>
+  | <a href="https://share.tama.guru" target="_blank">{{t .LangCode "site.footer.drive"}}</a>
+  | <a href="https://status.tama.guru" target="_blank">{{t .LangCode "site.footer.status"}}</a>
+  | <a href="https://tama.guru" target="_blank">{{t .LangCode "site.footer.nav"}}</a>
+</p>
+<br>
+</div>
+
+<script>
+  // 提交反馈（P0）：点击任意表单的提交按钮后，立即把触发按钮变成「转圈 + 本地化文字」，
+  // 并禁用表单内全部按钮，物理阻止在上传/网络慢时的重复点击与重复提交。
+  // 浏览器前进/后退（bfcache）回到本页时自动复位，避免停留在禁用或转圈状态。
+  // 纯内联反馈，不使用全屏遮罩。
+  var SUBMIT_I18N = {
+    submitting: '{{t .LangCode "common.submitting"}}',
+    uploading:  '{{t .LangCode "common.uploading"}}'
+  };
+
+  function tbResetSubmitButtons() {
+    document.querySelectorAll('button[data-tb-submitting]').forEach(function(b) {
+      b.disabled = false;
+      b.removeAttribute('data-tb-submitting');
+      var orig = b.getAttribute('data-tb-restore');
+      if (orig !== null) {
+        b.innerHTML = orig;
+        b.removeAttribute('data-tb-restore');
+      }
+    });
+  }
+
+  document.addEventListener('submit', function(e) {
+    var form = e.target;
+    if (!form || form.tagName !== 'FORM') return;
+
+    // 页面级提交反馈必须尊重前置校验：投票编辑页等 onsubmit 返回 false 时，
+    // submit 事件仍可能继续到达此监听器；此时绝不能切换到“提交中”状态。
+    if (e.defaultPrevented || form.getAttribute('data-tb-skip-submit-feedback') === '1') {
+      form.removeAttribute('data-tb-skip-submit-feedback');
+      return;
+    }
+
+    // 下载 / 新窗口类表单（target="_blank"，如导出）：当前页不发生导航，也没有 bfcache
+    // 复位机会，进入“提交中”状态后按钮会永远卡在转圈 + 禁用。这类表单直接跳过提交反馈。
+    if (form.getAttribute('target') === '_blank') return;
+
+    // 触发提交的按钮（programmatic submit 时 e.submitter 为 null，回退到首个 submit 按钮）
+    var trigger = e.submitter || form.querySelector('button[type="submit"]');
+
+    // 表单含已选中的文件 → 提示“上传中”，否则“提交中”
+    var hasFile = false;
+    form.querySelectorAll('input[type="file"]').forEach(function(f) {
+      if (f.files && f.files.length > 0) hasFile = true;
+    });
+    var label = hasFile ? SUBMIT_I18N.uploading : SUBMIT_I18N.submitting;
+
+    if (trigger && trigger.tagName === 'BUTTON') {
+      trigger.setAttribute('data-tb-restore', trigger.innerHTML);
+      trigger.innerHTML = '<span uk-spinner="ratio: 0.6"></span> ' + label;
+    }
+
+    // 禁用表单内所有按钮，防止重复提交
+    form.querySelectorAll('button').forEach(function(b) {
+      b.disabled = true;
+      b.setAttribute('data-tb-submitting', '1');
+    });
+  });
+
+  // bfcache 还原时复位按钮
+  window.addEventListener('pageshow', tbResetSubmitButtons);
+</script>
+</body>
+</html>
diff --git a/.workbuddy/backup/remove-vercount-20260906/header.html b/.workbuddy/backup/remove-vercount-20260906/header.html
new file mode 100644
index 0000000..6518b98
--- /dev/null
+++ b/.workbuddy/backup/remove-vercount-20260906/header.html
@@ -0,0 +1,1044 @@
+<!DOCTYPE html>
+<html lang="{{.LangCode}}">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width">
+  <title>{{ .Title }}</title>
+  <meta name="description" content="{{ if .MetaDescription }}{{ .MetaDescription }}{{ else }}{{ t .LangCode "site.description" }}{{ end }}">
+  <meta name="keywords" content="{{ t .LangCode "site.keywords" }}">
+  <!-- 预连接：UIkit 走公共 CDN（cdnjs.snrat.com），其余自托管库仍在本站 R2，均需预连接 -->
+  <link rel="preconnect" href="https://r2.337845818.best" crossorigin>
+  <link rel="preconnect" href="https://cdnjs.snrat.com" crossorigin>
+  <link rel="dns-prefetch" href="https://cn.vercount.one">
+  <!-- UIkit 3.3.3 切到公共 CDN（cdnjs.snrat.com，国内实测全量下载 ~0.25s，原 R2 自建 ~1.4-2.0s） -->
+  <link rel="stylesheet" href="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/css/uikit.min.css"/>
+  <!-- Waline 评论区样式：非阻塞加载，不阻塞首屏渲染 -->
+  <link rel="stylesheet" href="https://r2.337845818.best/tamabox/cdn/waline/client/v2/waline-no-commits.css" media="print" onload="this.media='all'"/>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/js/uikit.min.js"></script>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/js/uikit-icons.min.js"></script>
+  <!-- UIkit 补丁：复刻原自建版 "modify-black-font"（官方版与自建版仅 3 处颜色差异——把有色容器内默认白字/白标题改为黑字）。
+       模板当前只用到 .uk-light 容器（用户背景封面，question/list.html、question-not-found.html；
+       其中 h3/p 已由 #usernamecolor/#introcolor 内联 style 覆盖），故只需补该容器的 3 处投影即可保持渲染一致。
+       若日后新增 .uk-card-primary/.uk-card-secondary/.uk-section-primary/.uk-tile-*/.uk-overlay-primary 等容器且需黑字，须同步扩展。 -->
+  <style>
+      .uk-light { color: rgba(0,0,0,.7); }
+      .uk-light .uk-h1, .uk-light .uk-h2, .uk-light .uk-h3, .uk-light .uk-h4, .uk-light .uk-h5, .uk-light .uk-h6,
+      .uk-light .uk-heading-2xlarge, .uk-light .uk-heading-large, .uk-light .uk-heading-medium, .uk-light .uk-heading-small, .uk-light .uk-heading-xlarge,
+      .uk-light h1, .uk-light h2, .uk-light h3, .uk-light h4, .uk-light h5, .uk-light h6 { color: #000; }
+      .uk-light .uk-table th { color: rgba(0,0,0,.7); }
+  </style>
+  <!-- dayjs/alpinejs/vconsole/waline.js 已迁 cdnjs.snrat.com（sha256 与官方一致，国内实测快 2-7x） -->
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/dayjs/1.10.8/dayjs.min.js"></script>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/alpinejs/3.9.0/cdn.min.js"></script>
+  {{ if .VConsole }}
+  <script src="https://cdnjs.snrat.com/ajax/libs/vConsole/3.12.1/vconsole.min.js" type="application/javascript"></script>
+  <script>new window.VConsole()</script>
+  {{ end }}
+  <!-- jQuery 已改为按需加载：仅 easy.qrcode 二维码页（list/question-not-found/profile）自行引入 -->
+  <script defer src="https://r2.337845818.best/tamabox/cdn/time.box.js"></script>
+  <!--<script src="https://r2.337845818.best/tamabox/cdn/busuanzi.pure.mini.js"/></script>-->
+  <script defer src="https://cn.vercount.one/js"></script>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/waline/2.15.8/waline.js"></script>
+  {{ if eq .CaptchaType "math" }}
+  <!-- 算数验证码：弹窗模式，不影响原布局 -->
+  <style>
+      .captcha-equation-box {
+          display: inline-flex;
+          align-items: center;
+          background: #f0f2f5;
+          border: 1px solid #dcdcdc;
+          border-radius: 8px;
+          padding: 8px 8px 8px 16px;
+          gap: 6px;
+          transition: border-color 0.2s;
+      }
+      .captcha-equation-box:focus-within {
+          border-color: #1e87f0;
+          box-shadow: 0 0 0 3px rgba(30,135,240,0.12);
+      }
+      .math-captcha-modal-question {
+          font-size: 1.4rem;
+          font-family: "Courier New", monospace;
+          font-weight: 700;
+          color: #333;
+          letter-spacing: 1px;
+          white-space: nowrap;
+      }
+      #captcha-modal-answer {
+          width: 80px;
+          padding: 6px 10px;
+          text-align: center;
+          font-size: 1.2rem;
+          font-family: "Courier New", monospace;
+          font-weight: 600;
+          border: 1px solid #ccc;
+          border-radius: 5px;
+          outline: none;
+          transition: border-color 0.15s, box-shadow 0.15s;
+          background: #fff;
+      }
+      #captcha-modal-answer:focus {
+          border-color: #1e87f0;
+          box-shadow: 0 0 0 2px rgba(30,135,240,0.2);
+      }
+      /* 隐藏数字输入框的上下箭头 */
+      #captcha-modal-answer::-webkit-inner-spin-button,
+      #captcha-modal-answer::-webkit-outer-spin-button {
+          -webkit-appearance: none;
+          margin: 0;
+      }
+      #captcha-modal-answer {
+          -moz-appearance: textfield;
+      }
+  </style>
+  {{ else if .RecaptchaTurnstileStyle }}
+  <script src="https://challenges.cloudflare.com/turnstile/v0/api.js?compat=recaptcha" async defer></script>
+  <script>
+      document.addEventListener('DOMContentLoaded', function () {
+          document.querySelectorAll('.g-recaptcha').forEach(item => {
+              item.disabled = true;
+          });
+      });
+
+      function onSubmit() {
+          document.querySelectorAll('.g-recaptcha').forEach(item => {
+              item.disabled = false;
+          })
+      }</script>
+  {{ else }}
+  <script src="{{.RecaptchaDomain}}/recaptcha/api.js" async defer></script>
+  <script>function onSubmit() {document.getElementById('form').submit();}</script>
+  {{ end }}
+  {{ if ne SentryDSN "" }}
+  <script
+          src="https://browser.sentry-cdn.com/7.37.2/bundle.tracing.replay.min.js"
+          integrity="sha384-o0mU2P+zsvXua0Y6f/J55PKWZt3sZCv3qDqJe6J5lZklyIQkpgjBVqNnPWYWqGhf"
+          crossorigin="anonymous"
+  ></script>
+  <script>
+      Sentry.init({
+          dsn: "{{ SentryDSN }}",
+          integrations: [new Sentry.BrowserTracing(), new Sentry.Replay()],
+          tracesSampleRate: 1.0,
+          replaysSessionSampleRate: 0.1,
+          replaysOnErrorSampleRate: 1.0,
+      });
+  </script>
+  {{ end }}
+  <style>
+      .grecaptcha-badge {visibility: hidden;}
+      .icon-container {
+         display: flex;
+         justify-content: center;
+         width: 100%;
+  }
+      .icon {
+         margin-left: 10px;
+         width: 20px; /* 设置图标的宽度 */
+         height: auto; /* 保持图标的高度自动调整 */
+      }
+      .emoji-placeholder {
+         display: inline-block;
+         animation: jump 0.5s ease-in-out;
+      }
+
+      @keyframes jump {
+         0%, 100% { transform: translateY(0); }
+         50% { transform: translateY(-5px); }
+      }
+     /* 防止 UIkit Dropbar 初始闪烁 */
+     .uk-dropbar {
+       opacity: 0;
+       visibility: hidden;
+       transition: opacity 0.2s ease, visibility 0.2s ease;
+     }
+     
+     .uk-dropbar.uk-open {
+       opacity: 1;
+       visibility: visible;
+     }
+     
+     a.uk-button.uk-button-link {
+       text-transform: none;
+     }
+
+     /* 移动端优化：缩小字体和间距，避免右侧空白 */
+     @media (max-width: 640px) {
+         .uk-logo {
+             font-size: 1rem;
+         }
+         .uk-navbar-nav a {
+             font-size: 0.78rem;
+             padding: 0 4px;
+         }
+         .emoji-placeholder {
+             font-size: 1rem;
+         }
+         /* 移动端用户名限宽省略，避免长英文用户名撑爆顶栏 */
+         .tb-nav-username {
+             max-width: 64px;
+             overflow: hidden;
+             text-overflow: ellipsis;
+             white-space: nowrap;
+             display: inline-block;
+             vertical-align: middle;
+         }
+     }
+  </style>
+
+  <!-- 深色模式：html[data-theme="dark"] 时覆盖 UIkit 3.3.3 编译主题的关键颜色 -->
+  <style>
+      html[data-theme="dark"] {
+          --tb-bg: #1a1d23;
+          --tb-surface: #242830;
+          --tb-surface-2: #2d323c;
+          --tb-border: #3a404c;
+          --tb-text: #d8dce4;
+          --tb-text-muted: #8b93a1;
+          --tb-primary: #5c8dff;
+      }
+      /* 根元素与 body 一起覆盖，确保整个视口（含内容不足一屏时的空白区）都是深色背景 */
+      html[data-theme="dark"],
+      html[data-theme="dark"] body {
+          background-color: var(--tb-bg) !important;
+          color: var(--tb-text) !important;
+      }
+      /* 通用表面容器 */
+      html[data-theme="dark"] .uk-card,
+      html[data-theme="dark"] .uk-card-default,
+      html[data-theme="dark"] .uk-card-secondary,
+      html[data-theme="dark"] .uk-dropbar,
+      html[data-theme="dark"] .uk-navbar-dropdown,
+      html[data-theme="dark"] .uk-modal-dialog,
+      html[data-theme="dark"] .uk-dropdown,
+      html[data-theme="dark"] .uk-offcanvas-bar,
+      html[data-theme="dark"] .uk-section,
+      html[data-theme="dark"] .uk-tile,
+      html[data-theme="dark"] .uk-panel,
+      html[data-theme="dark"] .uk-background-default,
+      html[data-theme="dark"] .uk-search-default .uk-search-input {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-navbar-container {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-navbar-nav > li > a,
+      html[data-theme="dark"] .uk-card a,
+      html[data-theme="dark"] .uk-link,
+      html[data-theme="dark"] a.uk-button-link,
+      html[data-theme="dark"] .uk-navbar-dropdown-nav > li > a,
+      html[data-theme="dark"] .uk-dropdown-nav > li > a,
+      html[data-theme="dark"] .uk-list a {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-navbar-nav > li > a:hover,
+      html[data-theme="dark"] .uk-card a:hover,
+      html[data-theme="dark"] .uk-navbar-dropdown-nav > li > a:hover,
+      html[data-theme="dark"] .uk-dropdown-nav > li > a:hover {
+          color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .uk-input,
+      html[data-theme="dark"] .uk-textarea,
+      html[data-theme="dark"] .uk-select {
+          background-color: var(--tb-surface-2) !important;
+          color: var(--tb-text) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] .uk-input:focus,
+      html[data-theme="dark"] .uk-textarea:focus,
+      html[data-theme="dark"] .uk-select:focus {
+          border-color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .uk-text-muted,
+      html[data-theme="dark"] .uk-text-meta,
+      html[data-theme="dark"] .uk-text-secondary,
+      html[data-theme="dark"] .uk-text-muted a,
+      html[data-theme="dark"] .uk-text-small.uk-text-muted {
+          color: var(--tb-text-muted) !important;
+      }
+      html[data-theme="dark"] .uk-divider-icon::after,
+      html[data-theme="dark"] hr,
+      html[data-theme="dark"] .uk-table th,
+      html[data-theme="dark"] .uk-table td,
+      html[data-theme="dark"] .uk-list-divider > li:nth-child(n+2) {
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] .uk-button-default {
+          background-color: var(--tb-surface-2) !important;
+          color: var(--tb-text) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] .uk-modal-title,
+      html[data-theme="dark"] h1, html[data-theme="dark"] h2, html[data-theme="dark"] h3,
+      html[data-theme="dark"] h4, html[data-theme="dark"] h5, html[data-theme="dark"] h6,
+      html[data-theme="dark"] .uk-card-title {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-alert-warning,
+      html[data-theme="dark"] .uk-alert-danger,
+      html[data-theme="dark"] .uk-alert-success,
+      html[data-theme="dark"] .uk-alert-primary {
+          background-color: var(--tb-surface-2) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .uk-modal-dialog {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .captcha-equation-box {
+          background-color: var(--tb-surface-2) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .math-captcha-modal-question {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-answer {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-answer::placeholder {
+          color: var(--tb-text-muted) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .uk-text-meta,
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-refresh {
+          color: var(--tb-text-muted) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-refresh:hover {
+          color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .uk-label {
+          color: #fff !important;
+      }
+      /* 自定义组件（探索页推荐卡片等）深色覆盖 */
+      html[data-theme="dark"] .recommend-card,
+      html[data-theme="dark"] .recommend-card:hover {
+          background-color: var(--tb-surface-2) !important;
+      }
+      html[data-theme="dark"] .explore-name a {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .explore-name a:hover {
+          color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .explore-intro {
+          color: var(--tb-text-muted) !important;
+      }
+      /* 切换按钮图标切换 */
+      #theme-toggle .tb-icon-dark, #theme-toggle-mobile .tb-icon-dark { display: none; }
+      html[data-theme="dark"] #theme-toggle .tb-icon-light,
+      html[data-theme="dark"] #theme-toggle-mobile .tb-icon-light { display: none; }
+      html[data-theme="dark"] #theme-toggle .tb-icon-dark,
+      html[data-theme="dark"] #theme-toggle-mobile .tb-icon-dark { display: inline; }
+  </style>
+
+  <!-- 顶栏自适应：导航全部直接显示，窄屏时分级缩小字号/间距，保证英文/日文等长文字不溢出 -->
+  <style>
+      .uk-navbar-nav a {
+          font-size: 0.95rem;
+          padding: 0 10px;
+      }
+      /* 未登录移动端占位：桌面端隐藏，仅 ≤640px 显示（见下方 media 查询）。
+         桌面端布局与改动前完全一致，不受影响。 */
+      .tb-mobile-balancer { display: none; }
+      /* 桌面端保持 UIkit 原生居中三列布局（无需额外 CSS） */
+      .tb-navbar .uk-logo {
+          white-space: nowrap;
+      }
+      @media (max-width: 1200px) {
+          .uk-navbar-nav a {
+              font-size: 0.88rem;
+              padding: 0 8px;
+          }
+      }
+      @media (max-width: 1000px) {
+          .uk-navbar-nav a {
+              font-size: 0.82rem;
+              padding: 0 6px;
+          }
+          .uk-logo {
+              font-size: 1.1rem;
+          }
+          /* 登录用户名限宽，过长省略号截断 */
+          .tb-nav-username {
+              max-width: 110px;
+              overflow: hidden;
+              text-overflow: ellipsis;
+              white-space: nowrap;
+              display: inline-block;
+              vertical-align: middle;
+          }
+      }
+      @media (max-width: 800px) {
+          .uk-navbar-nav a {
+              font-size: 0.78rem;
+              padding: 0 4px;
+          }
+          .uk-logo {
+              font-size: 1rem;
+          }
+          .tb-nav-username {
+              max-width: 80px;
+          }
+      }
+      /* 手机端（≤640px）：沿用 UIkit 桌面端 navbar 的原生三列定位。
+         不再重写 .uk-navbar-center / center-left / center-right 的定位，
+         避免 logo 被挤到下一行；底部语言与深色模式按钮仍由下方独立栏承载。 */
+      @media (max-width: 640px) {
+          .tb-navbar {
+              position: relative;
+              min-height: 56px;
+              overflow: visible;
+          }
+          .tb-navbar > .uk-navbar-center {
+              position: relative !important;
+              top: auto !important;
+              left: auto !important;
+              right: auto !important;
+              bottom: auto !important;
+              transform: none !important;
+              display: flex !important;
+              align-items: center;
+              justify-content: center;
+              width: 100%;
+              min-height: 56px;
+              white-space: nowrap;
+              flex-wrap: nowrap;
+          }
+          .tb-navbar .uk-navbar-center-left,
+          .tb-navbar .uk-navbar-center-right {
+              position: static !important;
+              top: auto !important;
+              left: auto !important;
+              right: auto !important;
+              bottom: auto !important;
+              transform: none !important;
+              display: flex !important;
+              align-items: center;
+              flex: 0 0 auto;
+              white-space: nowrap;
+          }
+          .tb-navbar .uk-navbar-center-left > div,
+          .tb-navbar .uk-navbar-center-right > div {
+              display: flex;
+              align-items: center;
+              white-space: nowrap;
+          }
+          .tb-navbar .uk-navbar-nav {
+              display: flex;
+              flex-wrap: nowrap;
+              flex: 0 0 auto;
+          }
+          .tb-navbar .uk-navbar-nav > li > a,
+          .tb-navbar .uk-logo {
+              white-space: nowrap;
+          }
+          /* 未登录：移动端显示与「我的」等宽的隐藏占位，使左栏「探索+占位」与
+             右栏「注册/登录」两项等宽，logo 真正居中，左右视觉平衡 */
+          .tb-mobile-balancer { display: block; }
+      }
+  </style>
+
+  <!-- 标签样式的按钮（管理页置顶等）：
+       尺寸完全继承 .uk-label（font-size/padding/line-height/text-transform 等），
+       仅覆盖 button 元素特有的默认样式（边框/字体族/光标等），保证与相邻 span 标签完全一致。 -->
+  <style>
+      .tb-label-btn {
+          border: none !important;
+          cursor: pointer;
+          font-family: inherit;
+          margin: 0;
+          vertical-align: middle;
+          outline: none;
+          background-image: none;
+          box-sizing: border-box;
+          -webkit-appearance: none;
+          appearance: none;
+      }
+      .tb-label-btn:hover {
+          opacity: 0.85;
+      }
+      /* 公开页置顶小图标：仅一个图钉，不占行高、不影响原布局 */
+      .tb-pin-flag {
+          font-size: 0.9em;
+          margin-right: 4px;
+          vertical-align: -1px;
+          cursor: default;
+      }
+  </style>
+
+  <!-- 页脚统计加载动画：替代 fontawesome 的 fa-spinner（纯 CSS，不引字体库） -->
+  <style>
+      .tb-spinner {
+          display: inline-block;
+          width: 0.9em;
+          height: 0.9em;
+          border: 2px solid rgba(128, 128, 128, 0.25);
+          border-top-color: #666;
+          border-radius: 50%;
+          vertical-align: -2px;
+          animation: tb-spin 0.8s linear infinite;
+      }
+      html[data-theme="dark"] .tb-spinner {
+          border-color: rgba(255, 255, 255, 0.2);
+          border-top-color: #bbb;
+      }
+      @keyframes tb-spin {
+          to { transform: rotate(360deg); }
+      }
+  </style>
+
+  <!-- Markdown 渲染排版（问题/回答/追问正文，左对齐以保留排版格式） -->
+  <style>
+      /* 纯文本列表：保留换行与连续空格（pre-wrap），不渲染 Markdown 大字号/彩色 */
+      .tb-preline {
+          white-space: pre-wrap;
+      }
+      /* 纯文本列表：超过 5 行截断并显示省略号（不足 5 行则完整显示） */
+      .tb-clamp-5 {
+          display: -webkit-box;
+          -webkit-box-orient: vertical;
+          -webkit-line-clamp: 5;
+          overflow: hidden;
+      }
+      .md-body {
+          line-height: 1.7;
+          text-align: left;
+          word-break: break-word;
+      }
+      .md-body p { margin: 0.5em 0; }
+      .md-body h1, .md-body h2, .md-body h3,
+      .md-body h4, .md-body h5, .md-body h6 {
+          margin: 0.8em 0 0.4em;
+          font-weight: 600;
+          line-height: 1.4;
+      }
+      .md-body ul, .md-body ol { padding-left: 1.6em; margin: 0.5em 0; }
+      .md-body li { margin: 0.2em 0; }
+      .md-body blockquote {
+          border-left: 3px solid #d3d1c7;
+          margin: 0.6em 0;
+          padding: 0.2em 1em;
+          color: #5f5e5a;
+      }
+      .md-body pre {
+          background: #f5f5f5;
+          padding: 0.8em 1em;
+          border-radius: 6px;
+          overflow-x: auto;
+          margin: 0.6em 0;
+      }
+      .md-body code {
+          background: #f0f0f0;
+          padding: 0.1em 0.35em;
+          border-radius: 4px;
+          font-size: 0.9em;
+      }
+      .md-body pre code { background: none; padding: 0; }
+      .md-body img { max-width: 100%; height: auto; }
+      .md-body table { border-collapse: collapse; margin: 0.6em 0; }
+      .md-body th, .md-body td {
+          border: 1px solid #ddd;
+          padding: 0.4em 0.8em;
+      }
+      .md-body hr { margin: 1em 0; }
+      html[data-theme="dark"] .md-body blockquote {
+          border-color: #3a404c;
+          color: #8b93a1;
+      }
+      html[data-theme="dark"] .md-body pre,
+      html[data-theme="dark"] .md-body code { background: #2d323c; }
+      html[data-theme="dark"] .md-body th,
+      html[data-theme="dark"] .md-body td { border-color: #3a404c; }
+  </style>
+
+  <!-- 投票结果占比条：UIkit 3 已无 .uk-progressbar 类（那是 UIkit 2 的），
+       模板用 <div class="uk-progress"><div class="uk-progressbar"> 结构，需补一套填充样式，
+       否则内层填充无高度/背景，所有占比条都只剩外层灰色轨道，看起来一模一样。 -->
+  <style>
+      .uk-progress {
+          -webkit-appearance: none;
+          -moz-appearance: none;
+          appearance: none;
+          height: 10px;
+          margin: 0;
+          border: none;
+          border-radius: 6px;
+          background-color: #e5e5e5;
+          overflow: hidden;
+          box-shadow: none;
+      }
+      .uk-progressbar {
+          display: block;
+          height: 100%;
+          background-color: #1e87f0;
+          border-radius: 6px 0 0 6px;
+          transition: width 0.3s ease;
+      }
+      html[data-theme="dark"] .uk-progress {
+          background-color: var(--tb-border);
+      }
+      html[data-theme="dark"] .uk-progressbar {
+          background-color: var(--tb-primary);
+      }
+  </style>
+
+  <!-- 移动端底部操作栏：固定底栏承载语言切换与深色模式，桌面端隐藏 -->
+  <style>
+      #tb-mobile-utils {
+          display: none;
+      }
+      @media (max-width: 640px) {
+          /* 顶栏不再容纳语言/深色按钮，恢复原有导航空间 */
+          .tb-nav-utils {
+              display: none !important;
+          }
+          /* 手机端隐藏登录用户名（左边仅保留"探索"），保证 logo 居中、
+             两侧各不超过 2 个短按钮，避免用户名宽度挤压布局 */
+          .tb-nav-username {
+              display: none !important;
+          }
+          /* 固定底部操作栏 */
+          #tb-mobile-utils {
+              display: flex;
+              position: fixed;
+              left: 0;
+              right: 0;
+              bottom: 0;
+              z-index: 1000;
+              justify-content: center;
+              align-items: center;
+              gap: 10px;
+              padding: 8px 12px calc(8px + env(safe-area-inset-bottom));
+              background: rgba(255, 255, 255, 0.92);
+              -webkit-backdrop-filter: blur(8px);
+              backdrop-filter: blur(8px);
+              box-shadow: 0 -2px 12px rgba(0, 0, 0, 0.08);
+          }
+          #tb-mobile-utils .uk-select {
+              width: 110px;
+          }
+          html[data-theme="dark"] #tb-mobile-utils {
+              background: rgba(36, 40, 48, 0.92);
+              box-shadow: 0 -2px 12px rgba(0, 0, 0, 0.4);
+          }
+          /* 给页面底部预留空间，避免页脚内容被固定底栏遮挡 */
+          body {
+              padding-bottom: 56px;
+          }
+      }
+  </style>
+
+<!-- Commit 6d0a3ad -->
+  <meta property="og:site_name" content="{{ t .LangCode "site.title" }}" />
+  <meta property="og:type" content="website" />
+  <meta property="og:title" content="{{ if .IsUserPage }}{{ .PageUser.Name }} - {{ t .LangCode "site.title" }}{{ else }}{{ t .LangCode "site.title" }}{{ end }}" />
+  <meta property="og:url" content="{{ .ExternalURL }}{{ .CurrentURI }}" />
+  <meta property="og:description" content="{{ if .IsUserPage }}{{ .PageUser.Name }} - {{ t .LangCode "site.description" }}{{ else }}{{ t .LangCode "site.description" }}{{ end }}" />
+  {{ if .NoIndex }}<meta name="robots" content="noindex">{{ end }}
+  {{ if .IsUserPage }}
+   <meta property="og:image" content="{{ .PageUser.Avatar }}?og-image=1" />
+   <meta property="og:image:alt" content="{{ .PageUser.Name }}" />
+   <meta itemprop="image" content="{{ .PageUser.Avatar }}?og-image=1"/>
+   <meta name="msapplication-TileImage" content="{{ .PageUser.Avatar }}"/>
+   <link rel="shortcut icon" href="{{ .PageUser.Avatar }}?og-image=1"/>
+   <link rel="apple-touch-icon" href="{{ .PageUser.Avatar }}?og-image=1"/>
+   <link rel="icon" sizes="192x192" href="{{ .PageUser.Avatar }}?og-image=1">
+   <meta name="twitter:image:src" content="{{ .PageUser.Avatar }}?og-image=1" />
+   {{ else }}
+  <meta itemprop="image" content="https://r2.337845818.best/tamabox/tamabox_low.png"/>
+  <meta name="msapplication-TileImage" content="https://r2.337845818.best/tamabox/tamabox_low.png"/>
+  <link rel="shortcut icon" href="https://r2.337845818.best/tamabox/tamabox_low.png" />
+  <link rel="apple-touch-icon" href="https://r2.337845818.best/tamabox/tamabox_low.png"/>
+  <link rel="icon" sizes="192x192" href="https://r2.337845818.best/tamabox/tamabox_low.png">
+  <meta name="twitter:image:src" content="https://r2.337845818.best/tamabox/tamabox_low.png" />
+   {{ end }}
+
+<!-- Google and Bing -->
+  <meta name="google-site-verification" content="fEPwRRJfiGsgwc5SINBQwZhPK8F0cwRaOvRx0YRurI4" />
+  <meta name="msvalidate.01" content="2F185E8E63C93635F50B3574F3B31E42" />
+  <script defer src="https://mami.tama.guru/tamami.js" data-website-id="c42ebe8b-9281-4da0-83a4-8f18b3e710fe"></script>
+</head>
+<body>
+<script>
+// 二维码降级渲染（P0-②）：easy.qrcode 的 logo（用户头像）/ 背景图加载失败或极慢时，
+// 库内部仅 console.error 且无降级 → 二维码区域会永久空白。
+// 策略：未知状态的远程图先不画（基础码立即可扫）→ 后台探针（Image 预载）→
+//       判定完成后再重绘带 logo/背景的升级版；失败则保持基础码，绝不空白。
+// 同会话记忆：探针结果按 URL 记忆（good/bad），编辑页拖动滑块高频重绘时零等待、不闪降级。
+// 使用：window.tbRenderQR(el, function(){ return options; })  // options 含完整 logo/backgroundImage
+window.tbRenderQR = function (el, getOptions) {
+  if (!el || typeof QRCode === 'undefined') return;
+  var opts = getOptions();
+  function remoteOf(o, key) {
+    var v = o[key];
+    return (typeof v === 'string' && v.indexOf('http') === 0) ? v : '';
+  }
+  var good = window._tbQrGood || (window._tbQrGood = {}); // URL -> true（可 CORS 加载）
+  var bad = window._tbQrBad || (window._tbQrBad = {});    // URL -> true（加载失败）
+  // 每层状态：''=无需, 1=已知可用, 0=已知失败, null=未知需探针
+  function layerState(url) { return !url ? '' : (good[url] ? 1 : (bad[url] ? 0 : null)); }
+  var layers = [
+    { url: remoteOf(opts, 'logo'), st: null, present: function (o, on) {
+        if (on) { /* 保留 */ } else { o.logo = undefined; o.logoWidth = undefined; o.logoHeight = undefined; o.logoBackgroundTransparent = undefined; }
+      } },
+    { url: remoteOf(opts, 'backgroundImage'), st: null, present: function (o, on) {
+        if (on) { /* 保留 */ } else { o.backgroundImage = undefined; o.backgroundImageAlpha = undefined; }
+      } }
+  ];
+  var needProbe = false;
+  for (var i = 0; i < layers.length; i++) {
+    layers[i].st = layerState(layers[i].url);
+    if (layers[i].st === null) needProbe = true;
+  }
+  function paint(states) {
+    var o = {};
+    for (var k in opts) o[k] = opts[k];
+    for (var j = 0; j < layers.length; j++) layers[j].present(o, states[j] === 1);
+    el.innerHTML = '';
+    new QRCode(el, o);
+  }
+  // 已知可用层立即带上；未知层先省略 → 立即绘制（logo 记忆命中时不会闪降级）
+  var initStates = [];
+  for (var n = 0; n < layers.length; n++) initStates.push(layers[n].st === 1 ? 1 : 0);
+  paint(initStates);
+  if (!needProbe) return;
+  // 后台探针未知层；全部判定后若有变化再重绘一次升级版
+  var pending = 0, cross = opts.crossOrigin || 'anonymous';
+  layers.forEach(function (L) {
+    if (L.st !== null) return;
+    pending++;
+    var im = new Image();
+    im.onload = function () { good[L.url] = true; L.st = 1; onDone(); };
+    im.onerror = function () { bad[L.url] = true; L.st = 0; onDone(); };
+    if (cross) im.crossOrigin = cross;
+    im.src = L.url;
+  });
+  function onDone() {
+    if (--pending > 0) return;
+    var finalStates = [];
+    for (var m = 0; m < layers.length; m++) finalStates.push(layers[m].st === 1 ? 1 : 0);
+    var changed = false;
+    for (var q = 0; q < finalStates.length; q++) if (finalStates[q] !== initStates[q]) changed = true;
+    if (changed) paint(finalStates);
+  }
+  // 超时保险：个别挂起连接永不回调时，3s 后按当前已知状态收尾（基础码早已可扫）
+  setTimeout(function () { if (pending > 0) { pending = 0; onDone(); } }, 3000);
+};
+</script>
+<nav class="uk-navbar-container uk-margin tb-navbar" uk-navbar>
+  <div class="uk-navbar-center">
+    <div class="uk-navbar-center-left">
+      <div>
+        <ul class="uk-navbar-nav">
+          <!-- 探索链接，始终显示 -->
+          <li><a href="/explore">{{t .LangCode "nav.explore"}}</a></li>
+          {{ if .IsLogged }}
+          <!-- 我的：进入自己的提问箱主页（与右侧「提问/设置」形成左右均衡） -->
+          <li><a href="/_/{{ .LoggedUser.Domain }}">{{t .LangCode "nav.mine"}}</a></li>
+          {{ else }}
+          <!-- 移动端占位：未登录时左栏仅「探索」一项，与右栏「注册/登录」两项不等宽，
+               导致 logo 整体被拉向左（偏左）。移动端(≤640px)显示一个与「我的」等宽的隐藏占位，
+               使左右视觉平衡；桌面端由 .tb-mobile-balancer 隐藏，保持原布局完全不变。 -->
+          <li class="tb-mobile-balancer" aria-hidden="true"><a tabindex="-1" style="visibility:hidden">{{t .LangCode "nav.mine"}}</a></li>
+          {{ end }}
+        </ul>
+      </div>
+    </div>
+
+    <a class="uk-navbar-item uk-logo" href="/"><span class="emoji-placeholder" aria-label="random animal">🐺</span>{{t .LangCode "site.logoSuffix"}}</a>
+
+    <div class="uk-navbar-center-right">
+      <div>
+        {{ if .IsLogged }}
+        <ul class="uk-navbar-nav">
+          <li><a href="/user/questions">{{t .LangCode "nav.ask"}}</a></li>
+        </ul>
+        <ul class="uk-navbar-nav">
+          <li><a href="/user/profile">{{t .LangCode "nav.settings"}}</a></li>
+        </ul>
+        {{ else}}
+        <ul class="uk-navbar-nav">
+          <li><a href="/register">{{t .LangCode "nav.register"}}</a></li>
+        </ul>
+        <ul class="uk-navbar-nav">
+          <li><a href="/login">{{t .LangCode "nav.login"}}</a></li>
+        </ul>
+        {{ end }}
+        {{ if not .IsUserPage }}
+        <!-- 语言切换（紧凑图标，点击展开；移动端隐藏，见底部操作栏） -->
+        <ul class="uk-navbar-nav tb-nav-utils">
+          <li>
+            <a href="#" aria-label="{{t .LangCode "common.lang"}}" title="{{t .LangCode "common.lang"}}">🌐</a>
+            <div class="uk-navbar-dropdown" uk-drop="mode: click; pos: bottom-right">
+              <ul class="uk-nav uk-navbar-dropdown-nav">
+                {{ range .SupportedLangs }}
+                <li class="{{ if eq .Code $.LangCode }}uk-active{{ end }}">
+                  <a href="/i18n/{{ .Code }}?to={{ urlquery $.CurrentURI }}">{{ .Name }}</a>
+                </li>
+                {{ end }}
+              </ul>
+            </div>
+          </li>
+        </ul>
+        {{ end }}
+        <!-- 深色模式切换（紧凑图标；移动端隐藏，见底部操作栏） -->
+        <ul class="uk-navbar-nav tb-nav-utils">
+          <li>
+            <a href="#" id="theme-toggle" title="{{t .LangCode "common.theme"}}" aria-label="{{t .LangCode "common.theme"}}">
+              <span class="tb-icon-light">🌙</span><span class="tb-icon-dark">☀️</span>
+            </a>
+          </li>
+        </ul>
+      </div>
+    </div>
+  </div>
+</nav>
+
+<script>
+document.addEventListener("DOMContentLoaded", function() {
+    const emojis = ["🐺","🐗","🐻","🐨","🐼","🐹","🐭","🐰","🦊","🐮","🐷","🐽","🐸","🐒","🦍","🐔","🐧","🐦","🐤","🐦‍⬛","🦅","🦉","🦇","🐴","🦄","🐝","🦎","🦖","🦕","🐙","🦑","🦐","🦞","🦀","🐡","🐠","🐟","🐬","🐳","🐋","🦈","🐊","🐅","🐆","🦓","🦍","🦧","🐘","🦛","🦏","🐪","🐫","🦒","🦘","🐃","🐂","🐄","🐎","🐖","🐏","🐑","🦙","🐐","🦌","🐕","🐩","🦮","🐕‍🦺","🐈","🐋","🐳","🐬","🐉","🐲"];
+    const placeholder = document.querySelector('.emoji-placeholder');
+    if (placeholder) {
+        placeholder.textContent = emojis[Math.floor(Math.random() * emojis.length)];
+    }
+});
+</script>
+
+<!-- 移动端固定底部操作栏：语言切换 + 深色模式（桌面端隐藏） -->
+<div id="tb-mobile-utils">
+  {{ if not .IsUserPage }}
+  <select id="mobile-lang-select" class="uk-select uk-form-small" aria-label="{{t .LangCode "common.lang"}}">
+    {{ range .SupportedLangs }}
+    <option value="{{ .Code }}" {{ if eq .Code $.LangCode }}selected{{ end }}>{{ .Name }}</option>
+    {{ end }}
+  </select>
+  {{ end }}
+  <button type="button" id="theme-toggle-mobile" class="uk-button uk-button-default uk-button-small"
+          title="{{t .LangCode "common.theme"}}" aria-label="{{t .LangCode "common.theme"}}">
+    <span class="tb-icon-light">🌙</span><span class="tb-icon-dark">☀️</span>
+  </button>
+</div>
+
+<script>
+(function() {
+    // 深色模式：读取 cookie 应用主题，按钮切换并持久化
+    var THEME_COOKIE = 'theme';
+    function getTheme() {
+        var m = document.cookie.match(/(?:^|;\s*)theme=([^;]*)/);
+        return m ? m[1] : '';
+    }
+    function applyTheme(theme) {
+        if (theme === 'dark') {
+            document.documentElement.setAttribute('data-theme', 'dark');
+        } else {
+            document.documentElement.removeAttribute('data-theme');
+        }
+    }
+    function toggleTheme() {
+        var next = getTheme() === 'dark' ? 'light' : 'dark';
+        applyTheme(next);
+        var expires = new Date(Date.now() + 365 * 24 * 3600 * 1000).toUTCString();
+        document.cookie = THEME_COOKIE + '=' + next + '; path=/; max-age=' + (365 * 24 * 3600) + '; SameSite=Lax';
+    }
+    // 首屏前应用，避免闪烁
+    applyTheme(getTheme());
+    document.addEventListener('DOMContentLoaded', function() {
+        // 桌面顶栏按钮与移动端底部按钮都绑定
+        var buttons = document.querySelectorAll('#theme-toggle, #theme-toggle-mobile');
+        buttons.forEach(function(btn) {
+            btn.addEventListener('click', function(e) {
+                e.preventDefault();
+                toggleTheme();
+            });
+        });
+
+        // 移动端底部语言切换：onchange 跳转到 /i18n/{code}，保留当前页面位置
+        var langSel = document.getElementById('mobile-lang-select');
+        if (langSel) {
+            langSel.addEventListener('change', function() {
+                if (!this.value) return;
+                var to = window.location.pathname + window.location.search;
+                window.location.href = '/i18n/' + encodeURIComponent(this.value) + '?to=' + encodeURIComponent(to);
+            });
+        }
+    });
+})();
+</script>
+
+{{ if .IsPixel }}
+<div>
+{{ else }}
+<div class="uk-container uk-container-xsmall">
+{{ end }}
+
+{{ if eq .CaptchaType "math" }}
+<!-- 算数验证码弹窗 --><div id="math-captcha-modal" uk-modal>
+  <div class="uk-modal-dialog uk-modal-body uk-text-center">
+    <h3 class="uk-modal-title">{{t .LangCode "captcha.title"}}</h3>
+    <p class="uk-text-meta">{{t .LangCode "captcha.hint"}}</p>
+    <div class="captcha-equation-box">
+      <span id="captcha-modal-question" class="math-captcha-modal-question">{{t .LangCode "captcha.loading"}}</span>
+      <input type="number" id="captcha-modal-answer" placeholder="?" autocomplete="off" inputmode="numeric">
+    </div>
+    <div style="margin-top:6px;">
+      <button type="button" class="uk-button uk-button-text uk-text-small" id="captcha-modal-refresh">{{t .LangCode "captcha.refresh"}}</button>
+    </div>
+    <div id="captcha-modal-error" class="uk-text-danger uk-text-small" style="display:none;min-height:20px;"></div>
+    <div class="uk-margin-small-top">
+      <button type="button" class="uk-button uk-button-primary" id="captcha-modal-submit">{{t .LangCode "captcha.submit"}}</button>
+      <button type="button" class="uk-button uk-button-default uk-modal-close">{{t .LangCode "common.cancel"}}</button>
+    </div>
+  </div>
+</div>
+
+<script>
+var CAPTCHA_I18N = {
+  loading: "{{t .LangCode "captcha.loading"}}",
+  loadFailed: "{{t .LangCode "captcha.loadFailed"}}",
+  loadRetry: "{{t .LangCode "captcha.loadRetry"}}",
+  inputAnswer: "{{t .LangCode "captcha.inputAnswer"}}",
+  wrongAnswer: "{{t .LangCode "captcha.wrongAnswer"}}",
+  verifyFailed: "{{t .LangCode "captcha.verifyFailed"}}",
+  needPassword: "{{t .LangCode "ask.needPassword"}}",
+  needEmail: "{{t .LangCode "ask.pleaseEmail"}}"
+};
+</script>
+
+<script>
+(function() {
+  var captchaId = '';
+  var pendingForm = null;
+  var pendingNeedPassword = false;
+  var verifying = false;
+
+  function fetchCaptcha() {
+    var qEl = document.getElementById('captcha-modal-question');
+    var errEl = document.getElementById('captcha-modal-error');
+    var ansEl = document.getElementById('captcha-modal-answer');
+    qEl.textContent = CAPTCHA_I18N.loading;
+    fetch('/api/captcha/generate')
+      .then(function(r) { return r.json(); })
+      .then(function(data) {
+        if (data.code === 0 && data.data) {
+          captchaId = data.data.id;
+          qEl.textContent = data.data.question;
+          if (errEl) errEl.style.display = 'none';
+          if (ansEl) { ansEl.value = ''; ansEl.focus(); }
+        } else {
+          qEl.textContent = CAPTCHA_I18N.loadFailed;
+        }
+      })
+      .catch(function() {
+        qEl.textContent = CAPTCHA_I18N.loadRetry;
+      });
+  }
+
+  function getCSRFToken() {
+    var input = document.querySelector('input[name="_csrf"]');
+    return input ? input.value : '';
+  }
+
+  function doSubmit(form) {
+    // 将 captcha 答案填入隐藏字段
+    var ans = document.getElementById('captcha-modal-answer').value.trim();
+    var hidden = form.querySelector('[name="g-recaptcha-response"]');
+    if (hidden) hidden.value = captchaId + ':' + (ans || '0');
+
+    UIkit.modal('#math-captcha-modal').hide();
+
+    // 处理 AskPassword（提问箱密码）
+    if (pendingNeedPassword) {
+      UIkit.modal.prompt(CAPTCHA_I18N.needPassword, '', 'password')
+        .then(function(password) {
+          if (password) {
+            var pwInput = document.getElementById('ask_password_input');
+            if (pwInput) pwInput.value = password;
+            form.submit();
+          }
+        });
+    } else {
+      form.submit();
+    }
+  }
+
+  // 验证按钮
+  document.getElementById('captcha-modal-submit').addEventListener('click', function() {
+    if (verifying) return;
+    var ans = document.getElementById('captcha-modal-answer').value.trim();
+    if (!ans) {
+      var errEl = document.getElementById('captcha-modal-error');
+      errEl.textContent = CAPTCHA_I18N.inputAnswer;
+      errEl.style.display = 'block';
+      return;
+    }
+    verifying = true;
+    fetch('/api/captcha/verify', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'X-CSRF-Token': getCSRFToken()
+      },
+      body: JSON.stringify({ id: captchaId, answer: parseInt(ans, 10) })
+    })
+    .then(function(r) { return r.json(); })
+    .then(function(data) {
+      verifying = false;
+      if (data.correct) {
+        if (pendingForm) doSubmit(pendingForm);
+      } else {
+        var errEl = document.getElementById('captcha-modal-error');
+        errEl.textContent = CAPTCHA_I18N.wrongAnswer;
+        errEl.style.display = 'block';
+        fetchCaptcha(); // 自动刷新题目
+      }
+    })
+    .catch(function() {
+      verifying = false;
+      var errEl = document.getElementById('captcha-modal-error');
+      errEl.textContent = CAPTCHA_I18N.verifyFailed;
+      errEl.style.display = 'block';
+      fetchCaptcha();
+    });
+  });
+
+  // 回车提交
+  document.getElementById('captcha-modal-answer').addEventListener('keydown', function(e) {
+    if (e.key === 'Enter') {
+      e.preventDefault();
+      document.getElementById('captcha-modal-submit').click();
+    }
+  });
+
+  // 刷新按钮
+  document.getElementById('captcha-modal-refresh').addEventListener('click', fetchCaptcha);
+
+  // 拦截所有带 class="math-captcha-trigger" 的按钮
+  document.addEventListener('click', function(e) {
+    var btn = e.target.closest('.math-captcha-trigger');
+    if (!btn) return;
+    e.preventDefault();
+
+    var form = btn.closest('form');
+    if (!form) return;
+    pendingForm = form;
+
+    // 检查是否需要提问密码
+    pendingNeedPassword = !!(form.querySelector('#ask_password_input'));
+
+    // 邮箱校验（提问页面）
+    var notifyCb = document.getElementById('notify-checkbox');
+    var emailInput = document.getElementById('email-input');
+    if (notifyCb && notifyCb.checked && emailInput && emailInput.value.trim() === '') {
+      UIkit.modal.alert(CAPTCHA_I18N.needEmail);
+      return;
+    }
+
+    fetchCaptcha();
+    UIkit.modal('#math-captcha-modal').show();
+  });
+})();
+</script>
+{{ end }}
\ No newline at end of file
diff --git a/.workbuddy/backup/remove-vercount-20260906/i18n_test.go b/.workbuddy/backup/remove-vercount-20260906/i18n_test.go
new file mode 100644
index 0000000..e16347b
--- /dev/null
+++ b/.workbuddy/backup/remove-vercount-20260906/i18n_test.go
@@ -0,0 +1,76 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package i18n
+
+import (
+	"testing"
+)
+
+// TestDictionaryComplete 校验四种语言的字典 key 完全一致，防止漏翻译。
+func TestDictionaryComplete(t *testing.T) {
+	ref := dictionary[LangZhCN]
+	langs := []string{LangZhTW, LangEn, LangJa}
+
+	for _, lang := range langs {
+		dict := dictionary[lang]
+		if len(dict) != len(ref) {
+			t.Errorf("%s: 词条数量 %d != 简体中文 %d", lang, len(dict), len(ref))
+		}
+		for key := range ref {
+			if _, ok := dict[key]; !ok {
+				t.Errorf("%s: 缺少词条 %q", lang, key)
+			}
+		}
+		for key := range dict {
+			if _, ok := ref[key]; !ok {
+				t.Errorf("%s: 多出简体中文没有的词条 %q", lang, key)
+			}
+		}
+	}
+}
+
+func TestResolve(t *testing.T) {
+	cases := map[string]string{
+		"":        LangZhCN,
+		"zh-cn":   LangZhCN,
+		"zh":      LangZhCN,
+		"zh-TW":   LangZhTW,
+		"zh-Hant": LangZhTW,
+		"en":      LangEn,
+		"en-US":   LangEn,
+		"ja":      LangJa,
+		"ja-JP":   LangJa,
+		"fr":      LangZhCN, // 未知回退
+		"  En  ":  LangEn,   // 自动去除首尾空白
+		"zh_cn":   LangZhCN,
+		"zh_tw":   LangZhTW,
+		"zh_hk":   LangZhTW, // 香港繁体（下划线变体）
+	}
+	for in, want := range cases {
+		if got := Resolve(in); got != want {
+			t.Errorf("Resolve(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestT(t *testing.T) {
+	if got := T(LangZhCN, "nav.explore"); got != "探索" {
+		t.Errorf("zh-CN nav.explore = %q", got)
+	}
+	if got := T(LangEn, "nav.explore"); got != "Explore" {
+		t.Errorf("en nav.explore = %q", got)
+	}
+	if got := T(LangJa, "nav.explore"); got != "探索" {
+		t.Errorf("ja nav.explore = %q", got)
+	}
+	// 参数填充
+	if got := T(LangEn, "site.footer.visitor", "42"); got != "You are visitor #42" {
+		t.Errorf("en site.footer.visitor with arg = %q", got)
+	}
+	// 未知 key 回退返回 key 本身
+	if got := T(LangEn, "no.such.key"); got != "no.such.key" {
+		t.Errorf("unknown key = %q", got)
+	}
+}
diff --git a/.workbuddy/backup/remove-vercount-20260906/tamabox.changelogs.json b/.workbuddy/backup/remove-vercount-20260906/tamabox.changelogs.json
new file mode 100644
index 0000000..e089503
--- /dev/null
+++ b/.workbuddy/backup/remove-vercount-20260906/tamabox.changelogs.json
@@ -0,0 +1,35 @@
+{
+  "page": 1,
+  "perPage": 3,
+  "totalItems": 3,
+  "totalPages": 1,
+  "items": [
+    {
+      "collectionId": "tamabox",
+      "collectionName": "tamabox-changelogs",
+      "content": "新增：用户私信功能上线，可在「我的」页查看匿名来信。<br>\n修复：移动端问题列表间距过窄的问题。<br>\n优化：首页加载速度提升约 30%。",
+      "created": "2024-03-04 21:45:55.000Z",
+      "id": "none",
+      "published_at": "2024-03-04 21:45:55.000Z",
+      "updated": "2024-03-04 21:45:55.000Z"
+    },
+    {
+      "collectionId": "tamabox",
+      "collectionName": "tamabox-changelogs",
+      "content": "修复：部分旧浏览器下时间显示异常。<br>\n新增：修改记录页（本页），将完整更新历史从首页挪出，保持首页简洁。",
+      "created": "2024-02-29 00:00:55.000Z",
+      "id": "none",
+      "published_at": "2024-02-29 00:00:55.000Z",
+      "updated": "2024-02-29 00:00:55.000Z"
+    },
+    {
+      "collectionId": "tamabox",
+      "collectionName": "tamabox-changelogs",
+      "content": "项目初始化：匿名提问 / 回答的基础流程跑通。",
+      "created": "2023-06-03 13:11:55.000Z",
+      "id": "none",
+      "published_at": "2023-06-03 13:11:55.000Z",
+      "updated": "2023-06-03 13:11:55.000Z"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/.workbuddy/backup/tamami-load-inject-20260906/header.html b/.workbuddy/backup/tamami-load-inject-20260906/header.html
new file mode 100644
index 0000000..7659d79
--- /dev/null
+++ b/.workbuddy/backup/tamami-load-inject-20260906/header.html
@@ -0,0 +1,1020 @@
+<!DOCTYPE html>
+<html lang="{{.LangCode}}">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width">
+  <title>{{ .Title }}</title>
+  <meta name="description" content="{{ if .MetaDescription }}{{ .MetaDescription }}{{ else }}{{ t .LangCode "site.description" }}{{ end }}">
+  <meta name="keywords" content="{{ t .LangCode "site.keywords" }}">
+  <!-- 预连接：UIkit 走公共 CDN（cdnjs.snrat.com），其余自托管库仍在本站 R2，均需预连接 -->
+  <link rel="preconnect" href="https://r2.337845818.best" crossorigin>
+  <link rel="preconnect" href="https://cdnjs.snrat.com" crossorigin>
+  <!-- UIkit 3.3.3 切到公共 CDN（cdnjs.snrat.com，国内实测全量下载 ~0.25s，原 R2 自建 ~1.4-2.0s） -->
+  <link rel="stylesheet" href="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/css/uikit.min.css"/>
+  <!-- Waline 评论区样式：非阻塞加载，不阻塞首屏渲染 -->
+  <link rel="stylesheet" href="https://r2.337845818.best/tamabox/cdn/waline/client/v2/waline-no-commits.css" media="print" onload="this.media='all'"/>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/js/uikit.min.js"></script>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/js/uikit-icons.min.js"></script>
+  <!-- UIkit 补丁：复刻原自建版 "modify-black-font"（官方版与自建版仅 3 处颜色差异——把有色容器内默认白字/白标题改为黑字）。
+       模板当前只用到 .uk-light 容器（用户背景封面，question/list.html、question-not-found.html；
+       其中 h3/p 已由 #usernamecolor/#introcolor 内联 style 覆盖），故只需补该容器的 3 处投影即可保持渲染一致。
+       若日后新增 .uk-card-primary/.uk-card-secondary/.uk-section-primary/.uk-tile-*/.uk-overlay-primary 等容器且需黑字，须同步扩展。 -->
+  <style>
+      .uk-light { color: rgba(0,0,0,.7); }
+      .uk-light .uk-h1, .uk-light .uk-h2, .uk-light .uk-h3, .uk-light .uk-h4, .uk-light .uk-h5, .uk-light .uk-h6,
+      .uk-light .uk-heading-2xlarge, .uk-light .uk-heading-large, .uk-light .uk-heading-medium, .uk-light .uk-heading-small, .uk-light .uk-heading-xlarge,
+      .uk-light h1, .uk-light h2, .uk-light h3, .uk-light h4, .uk-light h5, .uk-light h6 { color: #000; }
+      .uk-light .uk-table th { color: rgba(0,0,0,.7); }
+  </style>
+  <!-- dayjs/alpinejs/vconsole/waline.js 已迁 cdnjs.snrat.com（sha256 与官方一致，国内实测快 2-7x） -->
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/dayjs/1.10.8/dayjs.min.js"></script>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/alpinejs/3.9.0/cdn.min.js"></script>
+  {{ if .VConsole }}
+  <script src="https://cdnjs.snrat.com/ajax/libs/vConsole/3.12.1/vconsole.min.js" type="application/javascript"></script>
+  <script>new window.VConsole()</script>
+  {{ end }}
+  <!-- jQuery 已改为按需加载：仅 easy.qrcode 二维码页（list/question-not-found/profile）自行引入 -->
+  <script defer src="https://r2.337845818.best/tamabox/cdn/time.box.js"></script>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/waline/2.15.8/waline.js"></script>
+  {{ if eq .CaptchaType "math" }}
+  <!-- 算数验证码：弹窗模式，不影响原布局 -->
+  <style>
+      .captcha-equation-box {
+          display: inline-flex;
+          align-items: center;
+          background: #f0f2f5;
+          border: 1px solid #dcdcdc;
+          border-radius: 8px;
+          padding: 8px 8px 8px 16px;
+          gap: 6px;
+          transition: border-color 0.2s;
+      }
+      .captcha-equation-box:focus-within {
+          border-color: #1e87f0;
+          box-shadow: 0 0 0 3px rgba(30,135,240,0.12);
+      }
+      .math-captcha-modal-question {
+          font-size: 1.4rem;
+          font-family: "Courier New", monospace;
+          font-weight: 700;
+          color: #333;
+          letter-spacing: 1px;
+          white-space: nowrap;
+      }
+      #captcha-modal-answer {
+          width: 80px;
+          padding: 6px 10px;
+          text-align: center;
+          font-size: 1.2rem;
+          font-family: "Courier New", monospace;
+          font-weight: 600;
+          border: 1px solid #ccc;
+          border-radius: 5px;
+          outline: none;
+          transition: border-color 0.15s, box-shadow 0.15s;
+          background: #fff;
+      }
+      #captcha-modal-answer:focus {
+          border-color: #1e87f0;
+          box-shadow: 0 0 0 2px rgba(30,135,240,0.2);
+      }
+      /* 隐藏数字输入框的上下箭头 */
+      #captcha-modal-answer::-webkit-inner-spin-button,
+      #captcha-modal-answer::-webkit-outer-spin-button {
+          -webkit-appearance: none;
+          margin: 0;
+      }
+      #captcha-modal-answer {
+          -moz-appearance: textfield;
+      }
+  </style>
+  {{ else if .RecaptchaTurnstileStyle }}
+  <script src="https://challenges.cloudflare.com/turnstile/v0/api.js?compat=recaptcha" async defer></script>
+  <script>
+      document.addEventListener('DOMContentLoaded', function () {
+          document.querySelectorAll('.g-recaptcha').forEach(item => {
+              item.disabled = true;
+          });
+      });
+
+      function onSubmit() {
+          document.querySelectorAll('.g-recaptcha').forEach(item => {
+              item.disabled = false;
+          })
+      }</script>
+  {{ else }}
+  <script src="{{.RecaptchaDomain}}/recaptcha/api.js" async defer></script>
+  <script>function onSubmit() {document.getElementById('form').submit();}</script>
+  {{ end }}
+  {{ if ne SentryDSN "" }}
+  <script
+          src="https://browser.sentry-cdn.com/7.37.2/bundle.tracing.replay.min.js"
+          integrity="sha384-o0mU2P+zsvXua0Y6f/J55PKWZt3sZCv3qDqJe6J5lZklyIQkpgjBVqNnPWYWqGhf"
+          crossorigin="anonymous"
+  ></script>
+  <script>
+      Sentry.init({
+          dsn: "{{ SentryDSN }}",
+          integrations: [new Sentry.BrowserTracing(), new Sentry.Replay()],
+          tracesSampleRate: 1.0,
+          replaysSessionSampleRate: 0.1,
+          replaysOnErrorSampleRate: 1.0,
+      });
+  </script>
+  {{ end }}
+  <style>
+      .grecaptcha-badge {visibility: hidden;}
+      .icon-container {
+         display: flex;
+         justify-content: center;
+         width: 100%;
+  }
+      .icon {
+         margin-left: 10px;
+         width: 20px; /* 设置图标的宽度 */
+         height: auto; /* 保持图标的高度自动调整 */
+      }
+      .emoji-placeholder {
+         display: inline-block;
+         animation: jump 0.5s ease-in-out;
+      }
+
+      @keyframes jump {
+         0%, 100% { transform: translateY(0); }
+         50% { transform: translateY(-5px); }
+      }
+     /* 防止 UIkit Dropbar 初始闪烁 */
+     .uk-dropbar {
+       opacity: 0;
+       visibility: hidden;
+       transition: opacity 0.2s ease, visibility 0.2s ease;
+     }
+     
+     .uk-dropbar.uk-open {
+       opacity: 1;
+       visibility: visible;
+     }
+     
+     a.uk-button.uk-button-link {
+       text-transform: none;
+     }
+
+     /* 移动端优化：缩小字体和间距，避免右侧空白 */
+     @media (max-width: 640px) {
+         .uk-logo {
+             font-size: 1rem;
+         }
+         .uk-navbar-nav a {
+             font-size: 0.78rem;
+             padding: 0 4px;
+         }
+         .emoji-placeholder {
+             font-size: 1rem;
+         }
+         /* 移动端用户名限宽省略，避免长英文用户名撑爆顶栏 */
+         .tb-nav-username {
+             max-width: 64px;
+             overflow: hidden;
+             text-overflow: ellipsis;
+             white-space: nowrap;
+             display: inline-block;
+             vertical-align: middle;
+         }
+     }
+  </style>
+
+  <!-- 深色模式：html[data-theme="dark"] 时覆盖 UIkit 3.3.3 编译主题的关键颜色 -->
+  <style>
+      html[data-theme="dark"] {
+          --tb-bg: #1a1d23;
+          --tb-surface: #242830;
+          --tb-surface-2: #2d323c;
+          --tb-border: #3a404c;
+          --tb-text: #d8dce4;
+          --tb-text-muted: #8b93a1;
+          --tb-primary: #5c8dff;
+      }
+      /* 根元素与 body 一起覆盖，确保整个视口（含内容不足一屏时的空白区）都是深色背景 */
+      html[data-theme="dark"],
+      html[data-theme="dark"] body {
+          background-color: var(--tb-bg) !important;
+          color: var(--tb-text) !important;
+      }
+      /* 通用表面容器 */
+      html[data-theme="dark"] .uk-card,
+      html[data-theme="dark"] .uk-card-default,
+      html[data-theme="dark"] .uk-card-secondary,
+      html[data-theme="dark"] .uk-dropbar,
+      html[data-theme="dark"] .uk-navbar-dropdown,
+      html[data-theme="dark"] .uk-modal-dialog,
+      html[data-theme="dark"] .uk-dropdown,
+      html[data-theme="dark"] .uk-offcanvas-bar,
+      html[data-theme="dark"] .uk-section,
+      html[data-theme="dark"] .uk-tile,
+      html[data-theme="dark"] .uk-panel,
+      html[data-theme="dark"] .uk-background-default,
+      html[data-theme="dark"] .uk-search-default .uk-search-input {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-navbar-container {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-navbar-nav > li > a,
+      html[data-theme="dark"] .uk-card a,
+      html[data-theme="dark"] .uk-link,
+      html[data-theme="dark"] a.uk-button-link,
+      html[data-theme="dark"] .uk-navbar-dropdown-nav > li > a,
+      html[data-theme="dark"] .uk-dropdown-nav > li > a,
+      html[data-theme="dark"] .uk-list a {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-navbar-nav > li > a:hover,
+      html[data-theme="dark"] .uk-card a:hover,
+      html[data-theme="dark"] .uk-navbar-dropdown-nav > li > a:hover,
+      html[data-theme="dark"] .uk-dropdown-nav > li > a:hover {
+          color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .uk-input,
+      html[data-theme="dark"] .uk-textarea,
+      html[data-theme="dark"] .uk-select {
+          background-color: var(--tb-surface-2) !important;
+          color: var(--tb-text) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] .uk-input:focus,
+      html[data-theme="dark"] .uk-textarea:focus,
+      html[data-theme="dark"] .uk-select:focus {
+          border-color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .uk-text-muted,
+      html[data-theme="dark"] .uk-text-meta,
+      html[data-theme="dark"] .uk-text-secondary,
+      html[data-theme="dark"] .uk-text-muted a,
+      html[data-theme="dark"] .uk-text-small.uk-text-muted {
+          color: var(--tb-text-muted) !important;
+      }
+      html[data-theme="dark"] .uk-divider-icon::after,
+      html[data-theme="dark"] hr,
+      html[data-theme="dark"] .uk-table th,
+      html[data-theme="dark"] .uk-table td,
+      html[data-theme="dark"] .uk-list-divider > li:nth-child(n+2) {
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] .uk-button-default {
+          background-color: var(--tb-surface-2) !important;
+          color: var(--tb-text) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] .uk-modal-title,
+      html[data-theme="dark"] h1, html[data-theme="dark"] h2, html[data-theme="dark"] h3,
+      html[data-theme="dark"] h4, html[data-theme="dark"] h5, html[data-theme="dark"] h6,
+      html[data-theme="dark"] .uk-card-title {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-alert-warning,
+      html[data-theme="dark"] .uk-alert-danger,
+      html[data-theme="dark"] .uk-alert-success,
+      html[data-theme="dark"] .uk-alert-primary {
+          background-color: var(--tb-surface-2) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .uk-modal-dialog {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .captcha-equation-box {
+          background-color: var(--tb-surface-2) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .math-captcha-modal-question {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-answer {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-answer::placeholder {
+          color: var(--tb-text-muted) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .uk-text-meta,
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-refresh {
+          color: var(--tb-text-muted) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-refresh:hover {
+          color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .uk-label {
+          color: #fff !important;
+      }
+      /* 自定义组件（探索页推荐卡片等）深色覆盖 */
+      html[data-theme="dark"] .recommend-card,
+      html[data-theme="dark"] .recommend-card:hover {
+          background-color: var(--tb-surface-2) !important;
+      }
+      html[data-theme="dark"] .explore-name a {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .explore-name a:hover {
+          color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .explore-intro {
+          color: var(--tb-text-muted) !important;
+      }
+      /* 切换按钮图标切换 */
+      #theme-toggle .tb-icon-dark, #theme-toggle-mobile .tb-icon-dark { display: none; }
+      html[data-theme="dark"] #theme-toggle .tb-icon-light,
+      html[data-theme="dark"] #theme-toggle-mobile .tb-icon-light { display: none; }
+      html[data-theme="dark"] #theme-toggle .tb-icon-dark,
+      html[data-theme="dark"] #theme-toggle-mobile .tb-icon-dark { display: inline; }
+  </style>
+
+  <!-- 顶栏自适应：导航全部直接显示，窄屏时分级缩小字号/间距，保证英文/日文等长文字不溢出 -->
+  <style>
+      .uk-navbar-nav a {
+          font-size: 0.95rem;
+          padding: 0 10px;
+      }
+      /* 未登录移动端占位：桌面端隐藏，仅 ≤640px 显示（见下方 media 查询）。
+         桌面端布局与改动前完全一致，不受影响。 */
+      .tb-mobile-balancer { display: none; }
+      /* 桌面端保持 UIkit 原生居中三列布局（无需额外 CSS） */
+      .tb-navbar .uk-logo {
+          white-space: nowrap;
+      }
+      @media (max-width: 1200px) {
+          .uk-navbar-nav a {
+              font-size: 0.88rem;
+              padding: 0 8px;
+          }
+      }
+      @media (max-width: 1000px) {
+          .uk-navbar-nav a {
+              font-size: 0.82rem;
+              padding: 0 6px;
+          }
+          .uk-logo {
+              font-size: 1.1rem;
+          }
+          /* 登录用户名限宽，过长省略号截断 */
+          .tb-nav-username {
+              max-width: 110px;
+              overflow: hidden;
+              text-overflow: ellipsis;
+              white-space: nowrap;
+              display: inline-block;
+              vertical-align: middle;
+          }
+      }
+      @media (max-width: 800px) {
+          .uk-navbar-nav a {
+              font-size: 0.78rem;
+              padding: 0 4px;
+          }
+          .uk-logo {
+              font-size: 1rem;
+          }
+          .tb-nav-username {
+              max-width: 80px;
+          }
+      }
+      /* 手机端（≤640px）：沿用 UIkit 桌面端 navbar 的原生三列定位。
+         不再重写 .uk-navbar-center / center-left / center-right 的定位，
+         避免 logo 被挤到下一行；底部语言与深色模式按钮仍由下方独立栏承载。 */
+      @media (max-width: 640px) {
+          .tb-navbar {
+              position: relative;
+              min-height: 56px;
+              overflow: visible;
+          }
+          .tb-navbar > .uk-navbar-center {
+              position: relative !important;
+              top: auto !important;
+              left: auto !important;
+              right: auto !important;
+              bottom: auto !important;
+              transform: none !important;
+              display: flex !important;
+              align-items: center;
+              justify-content: center;
+              width: 100%;
+              min-height: 56px;
+              white-space: nowrap;
+              flex-wrap: nowrap;
+          }
+          .tb-navbar .uk-navbar-center-left,
+          .tb-navbar .uk-navbar-center-right {
+              position: static !important;
+              top: auto !important;
+              left: auto !important;
+              right: auto !important;
+              bottom: auto !important;
+              transform: none !important;
+              display: flex !important;
+              align-items: center;
+              flex: 0 0 auto;
+              white-space: nowrap;
+          }
+          .tb-navbar .uk-navbar-center-left > div,
+          .tb-navbar .uk-navbar-center-right > div {
+              display: flex;
+              align-items: center;
+              white-space: nowrap;
+          }
+          .tb-navbar .uk-navbar-nav {
+              display: flex;
+              flex-wrap: nowrap;
+              flex: 0 0 auto;
+          }
+          .tb-navbar .uk-navbar-nav > li > a,
+          .tb-navbar .uk-logo {
+              white-space: nowrap;
+          }
+          /* 未登录：移动端显示与「我的」等宽的隐藏占位，使左栏「探索+占位」与
+             右栏「注册/登录」两项等宽，logo 真正居中，左右视觉平衡 */
+          .tb-mobile-balancer { display: block; }
+      }
+  </style>
+
+  <!-- 标签样式的按钮（管理页置顶等）：
+       尺寸完全继承 .uk-label（font-size/padding/line-height/text-transform 等），
+       仅覆盖 button 元素特有的默认样式（边框/字体族/光标等），保证与相邻 span 标签完全一致。 -->
+  <style>
+      .tb-label-btn {
+          border: none !important;
+          cursor: pointer;
+          font-family: inherit;
+          margin: 0;
+          vertical-align: middle;
+          outline: none;
+          background-image: none;
+          box-sizing: border-box;
+          -webkit-appearance: none;
+          appearance: none;
+      }
+      .tb-label-btn:hover {
+          opacity: 0.85;
+      }
+      /* 公开页置顶小图标：仅一个图钉，不占行高、不影响原布局 */
+      .tb-pin-flag {
+          font-size: 0.9em;
+          margin-right: 4px;
+          vertical-align: -1px;
+          cursor: default;
+      }
+  </style>
+
+  <!-- Markdown 渲染排版（问题/回答/追问正文，左对齐以保留排版格式） -->
+  <style>
+      /* 纯文本列表：保留换行与连续空格（pre-wrap），不渲染 Markdown 大字号/彩色 */
+      .tb-preline {
+          white-space: pre-wrap;
+      }
+      /* 纯文本列表：超过 5 行截断并显示省略号（不足 5 行则完整显示） */
+      .tb-clamp-5 {
+          display: -webkit-box;
+          -webkit-box-orient: vertical;
+          -webkit-line-clamp: 5;
+          overflow: hidden;
+      }
+      .md-body {
+          line-height: 1.7;
+          text-align: left;
+          word-break: break-word;
+      }
+      .md-body p { margin: 0.5em 0; }
+      .md-body h1, .md-body h2, .md-body h3,
+      .md-body h4, .md-body h5, .md-body h6 {
+          margin: 0.8em 0 0.4em;
+          font-weight: 600;
+          line-height: 1.4;
+      }
+      .md-body ul, .md-body ol { padding-left: 1.6em; margin: 0.5em 0; }
+      .md-body li { margin: 0.2em 0; }
+      .md-body blockquote {
+          border-left: 3px solid #d3d1c7;
+          margin: 0.6em 0;
+          padding: 0.2em 1em;
+          color: #5f5e5a;
+      }
+      .md-body pre {
+          background: #f5f5f5;
+          padding: 0.8em 1em;
+          border-radius: 6px;
+          overflow-x: auto;
+          margin: 0.6em 0;
+      }
+      .md-body code {
+          background: #f0f0f0;
+          padding: 0.1em 0.35em;
+          border-radius: 4px;
+          font-size: 0.9em;
+      }
+      .md-body pre code { background: none; padding: 0; }
+      .md-body img { max-width: 100%; height: auto; }
+      .md-body table { border-collapse: collapse; margin: 0.6em 0; }
+      .md-body th, .md-body td {
+          border: 1px solid #ddd;
+          padding: 0.4em 0.8em;
+      }
+      .md-body hr { margin: 1em 0; }
+      html[data-theme="dark"] .md-body blockquote {
+          border-color: #3a404c;
+          color: #8b93a1;
+      }
+      html[data-theme="dark"] .md-body pre,
+      html[data-theme="dark"] .md-body code { background: #2d323c; }
+      html[data-theme="dark"] .md-body th,
+      html[data-theme="dark"] .md-body td { border-color: #3a404c; }
+  </style>
+
+  <!-- 投票结果占比条：UIkit 3 已无 .uk-progressbar 类（那是 UIkit 2 的），
+       模板用 <div class="uk-progress"><div class="uk-progressbar"> 结构，需补一套填充样式，
+       否则内层填充无高度/背景，所有占比条都只剩外层灰色轨道，看起来一模一样。 -->
+  <style>
+      .uk-progress {
+          -webkit-appearance: none;
+          -moz-appearance: none;
+          appearance: none;
+          height: 10px;
+          margin: 0;
+          border: none;
+          border-radius: 6px;
+          background-color: #e5e5e5;
+          overflow: hidden;
+          box-shadow: none;
+      }
+      .uk-progressbar {
+          display: block;
+          height: 100%;
+          background-color: #1e87f0;
+          border-radius: 6px 0 0 6px;
+          transition: width 0.3s ease;
+      }
+      html[data-theme="dark"] .uk-progress {
+          background-color: var(--tb-border);
+      }
+      html[data-theme="dark"] .uk-progressbar {
+          background-color: var(--tb-primary);
+      }
+  </style>
+
+  <!-- 移动端底部操作栏：固定底栏承载语言切换与深色模式，桌面端隐藏 -->
+  <style>
+      #tb-mobile-utils {
+          display: none;
+      }
+      @media (max-width: 640px) {
+          /* 顶栏不再容纳语言/深色按钮，恢复原有导航空间 */
+          .tb-nav-utils {
+              display: none !important;
+          }
+          /* 手机端隐藏登录用户名（左边仅保留"探索"），保证 logo 居中、
+             两侧各不超过 2 个短按钮，避免用户名宽度挤压布局 */
+          .tb-nav-username {
+              display: none !important;
+          }
+          /* 固定底部操作栏 */
+          #tb-mobile-utils {
+              display: flex;
+              position: fixed;
+              left: 0;
+              right: 0;
+              bottom: 0;
+              z-index: 1000;
+              justify-content: center;
+              align-items: center;
+              gap: 10px;
+              padding: 8px 12px calc(8px + env(safe-area-inset-bottom));
+              background: rgba(255, 255, 255, 0.92);
+              -webkit-backdrop-filter: blur(8px);
+              backdrop-filter: blur(8px);
+              box-shadow: 0 -2px 12px rgba(0, 0, 0, 0.08);
+          }
+          #tb-mobile-utils .uk-select {
+              width: 110px;
+          }
+          html[data-theme="dark"] #tb-mobile-utils {
+              background: rgba(36, 40, 48, 0.92);
+              box-shadow: 0 -2px 12px rgba(0, 0, 0, 0.4);
+          }
+          /* 给页面底部预留空间，避免页脚内容被固定底栏遮挡 */
+          body {
+              padding-bottom: 56px;
+          }
+      }
+  </style>
+
+<!-- Commit 6d0a3ad -->
+  <meta property="og:site_name" content="{{ t .LangCode "site.title" }}" />
+  <meta property="og:type" content="website" />
+  <meta property="og:title" content="{{ if .IsUserPage }}{{ .PageUser.Name }} - {{ t .LangCode "site.title" }}{{ else }}{{ t .LangCode "site.title" }}{{ end }}" />
+  <meta property="og:url" content="{{ .ExternalURL }}{{ .CurrentURI }}" />
+  <meta property="og:description" content="{{ if .IsUserPage }}{{ .PageUser.Name }} - {{ t .LangCode "site.description" }}{{ else }}{{ t .LangCode "site.description" }}{{ end }}" />
+  {{ if .NoIndex }}<meta name="robots" content="noindex">{{ end }}
+  {{ if .IsUserPage }}
+   <meta property="og:image" content="{{ .PageUser.Avatar }}?og-image=1" />
+   <meta property="og:image:alt" content="{{ .PageUser.Name }}" />
+   <meta itemprop="image" content="{{ .PageUser.Avatar }}?og-image=1"/>
+   <meta name="msapplication-TileImage" content="{{ .PageUser.Avatar }}"/>
+   <link rel="shortcut icon" href="{{ .PageUser.Avatar }}?og-image=1"/>
+   <link rel="apple-touch-icon" href="{{ .PageUser.Avatar }}?og-image=1"/>
+   <link rel="icon" sizes="192x192" href="{{ .PageUser.Avatar }}?og-image=1">
+   <meta name="twitter:image:src" content="{{ .PageUser.Avatar }}?og-image=1" />
+   {{ else }}
+  <meta itemprop="image" content="https://r2.337845818.best/tamabox/tamabox_low.png"/>
+  <meta name="msapplication-TileImage" content="https://r2.337845818.best/tamabox/tamabox_low.png"/>
+  <link rel="shortcut icon" href="https://r2.337845818.best/tamabox/tamabox_low.png" />
+  <link rel="apple-touch-icon" href="https://r2.337845818.best/tamabox/tamabox_low.png"/>
+  <link rel="icon" sizes="192x192" href="https://r2.337845818.best/tamabox/tamabox_low.png">
+  <meta name="twitter:image:src" content="https://r2.337845818.best/tamabox/tamabox_low.png" />
+   {{ end }}
+
+<!-- Google and Bing -->
+  <meta name="google-site-verification" content="fEPwRRJfiGsgwc5SINBQwZhPK8F0cwRaOvRx0YRurI4" />
+  <meta name="msvalidate.01" content="2F185E8E63C93635F50B3574F3B31E42" />
+  <script defer src="https://mami.tama.guru/tamami.js" data-website-id="c42ebe8b-9281-4da0-83a4-8f18b3e710fe"></script>
+</head>
+<body>
+<script>
+// 二维码降级渲染（P0-②）：easy.qrcode 的 logo（用户头像）/ 背景图加载失败或极慢时，
+// 库内部仅 console.error 且无降级 → 二维码区域会永久空白。
+// 策略：未知状态的远程图先不画（基础码立即可扫）→ 后台探针（Image 预载）→
+//       判定完成后再重绘带 logo/背景的升级版；失败则保持基础码，绝不空白。
+// 同会话记忆：探针结果按 URL 记忆（good/bad），编辑页拖动滑块高频重绘时零等待、不闪降级。
+// 使用：window.tbRenderQR(el, function(){ return options; })  // options 含完整 logo/backgroundImage
+window.tbRenderQR = function (el, getOptions) {
+  if (!el || typeof QRCode === 'undefined') return;
+  var opts = getOptions();
+  function remoteOf(o, key) {
+    var v = o[key];
+    return (typeof v === 'string' && v.indexOf('http') === 0) ? v : '';
+  }
+  var good = window._tbQrGood || (window._tbQrGood = {}); // URL -> true（可 CORS 加载）
+  var bad = window._tbQrBad || (window._tbQrBad = {});    // URL -> true（加载失败）
+  // 每层状态：''=无需, 1=已知可用, 0=已知失败, null=未知需探针
+  function layerState(url) { return !url ? '' : (good[url] ? 1 : (bad[url] ? 0 : null)); }
+  var layers = [
+    { url: remoteOf(opts, 'logo'), st: null, present: function (o, on) {
+        if (on) { /* 保留 */ } else { o.logo = undefined; o.logoWidth = undefined; o.logoHeight = undefined; o.logoBackgroundTransparent = undefined; }
+      } },
+    { url: remoteOf(opts, 'backgroundImage'), st: null, present: function (o, on) {
+        if (on) { /* 保留 */ } else { o.backgroundImage = undefined; o.backgroundImageAlpha = undefined; }
+      } }
+  ];
+  var needProbe = false;
+  for (var i = 0; i < layers.length; i++) {
+    layers[i].st = layerState(layers[i].url);
+    if (layers[i].st === null) needProbe = true;
+  }
+  function paint(states) {
+    var o = {};
+    for (var k in opts) o[k] = opts[k];
+    for (var j = 0; j < layers.length; j++) layers[j].present(o, states[j] === 1);
+    el.innerHTML = '';
+    new QRCode(el, o);
+  }
+  // 已知可用层立即带上；未知层先省略 → 立即绘制（logo 记忆命中时不会闪降级）
+  var initStates = [];
+  for (var n = 0; n < layers.length; n++) initStates.push(layers[n].st === 1 ? 1 : 0);
+  paint(initStates);
+  if (!needProbe) return;
+  // 后台探针未知层；全部判定后若有变化再重绘一次升级版
+  var pending = 0, cross = opts.crossOrigin || 'anonymous';
+  layers.forEach(function (L) {
+    if (L.st !== null) return;
+    pending++;
+    var im = new Image();
+    im.onload = function () { good[L.url] = true; L.st = 1; onDone(); };
+    im.onerror = function () { bad[L.url] = true; L.st = 0; onDone(); };
+    if (cross) im.crossOrigin = cross;
+    im.src = L.url;
+  });
+  function onDone() {
+    if (--pending > 0) return;
+    var finalStates = [];
+    for (var m = 0; m < layers.length; m++) finalStates.push(layers[m].st === 1 ? 1 : 0);
+    var changed = false;
+    for (var q = 0; q < finalStates.length; q++) if (finalStates[q] !== initStates[q]) changed = true;
+    if (changed) paint(finalStates);
+  }
+  // 超时保险：个别挂起连接永不回调时，3s 后按当前已知状态收尾（基础码早已可扫）
+  setTimeout(function () { if (pending > 0) { pending = 0; onDone(); } }, 3000);
+};
+</script>
+<nav class="uk-navbar-container uk-margin tb-navbar" uk-navbar>
+  <div class="uk-navbar-center">
+    <div class="uk-navbar-center-left">
+      <div>
+        <ul class="uk-navbar-nav">
+          <!-- 探索链接，始终显示 -->
+          <li><a href="/explore">{{t .LangCode "nav.explore"}}</a></li>
+          {{ if .IsLogged }}
+          <!-- 我的：进入自己的提问箱主页（与右侧「提问/设置」形成左右均衡） -->
+          <li><a href="/_/{{ .LoggedUser.Domain }}">{{t .LangCode "nav.mine"}}</a></li>
+          {{ else }}
+          <!-- 移动端占位：未登录时左栏仅「探索」一项，与右栏「注册/登录」两项不等宽，
+               导致 logo 整体被拉向左（偏左）。移动端(≤640px)显示一个与「我的」等宽的隐藏占位，
+               使左右视觉平衡；桌面端由 .tb-mobile-balancer 隐藏，保持原布局完全不变。 -->
+          <li class="tb-mobile-balancer" aria-hidden="true"><a tabindex="-1" style="visibility:hidden">{{t .LangCode "nav.mine"}}</a></li>
+          {{ end }}
+        </ul>
+      </div>
+    </div>
+
+    <a class="uk-navbar-item uk-logo" href="/"><span class="emoji-placeholder" aria-label="random animal">🐺</span>{{t .LangCode "site.logoSuffix"}}</a>
+
+    <div class="uk-navbar-center-right">
+      <div>
+        {{ if .IsLogged }}
+        <ul class="uk-navbar-nav">
+          <li><a href="/user/questions">{{t .LangCode "nav.ask"}}</a></li>
+        </ul>
+        <ul class="uk-navbar-nav">
+          <li><a href="/user/profile">{{t .LangCode "nav.settings"}}</a></li>
+        </ul>
+        {{ else}}
+        <ul class="uk-navbar-nav">
+          <li><a href="/register">{{t .LangCode "nav.register"}}</a></li>
+        </ul>
+        <ul class="uk-navbar-nav">
+          <li><a href="/login">{{t .LangCode "nav.login"}}</a></li>
+        </ul>
+        {{ end }}
+        {{ if not .IsUserPage }}
+        <!-- 语言切换（紧凑图标，点击展开；移动端隐藏，见底部操作栏） -->
+        <ul class="uk-navbar-nav tb-nav-utils">
+          <li>
+            <a href="#" aria-label="{{t .LangCode "common.lang"}}" title="{{t .LangCode "common.lang"}}">🌐</a>
+            <div class="uk-navbar-dropdown" uk-drop="mode: click; pos: bottom-right">
+              <ul class="uk-nav uk-navbar-dropdown-nav">
+                {{ range .SupportedLangs }}
+                <li class="{{ if eq .Code $.LangCode }}uk-active{{ end }}">
+                  <a href="/i18n/{{ .Code }}?to={{ urlquery $.CurrentURI }}">{{ .Name }}</a>
+                </li>
+                {{ end }}
+              </ul>
+            </div>
+          </li>
+        </ul>
+        {{ end }}
+        <!-- 深色模式切换（紧凑图标；移动端隐藏，见底部操作栏） -->
+        <ul class="uk-navbar-nav tb-nav-utils">
+          <li>
+            <a href="#" id="theme-toggle" title="{{t .LangCode "common.theme"}}" aria-label="{{t .LangCode "common.theme"}}">
+              <span class="tb-icon-light">🌙</span><span class="tb-icon-dark">☀️</span>
+            </a>
+          </li>
+        </ul>
+      </div>
+    </div>
+  </div>
+</nav>
+
+<script>
+document.addEventListener("DOMContentLoaded", function() {
+    const emojis = ["🐺","🐗","🐻","🐨","🐼","🐹","🐭","🐰","🦊","🐮","🐷","🐽","🐸","🐒","🦍","🐔","🐧","🐦","🐤","🐦‍⬛","🦅","🦉","🦇","🐴","🦄","🐝","🦎","🦖","🦕","🐙","🦑","🦐","🦞","🦀","🐡","🐠","🐟","🐬","🐳","🐋","🦈","🐊","🐅","🐆","🦓","🦍","🦧","🐘","🦛","🦏","🐪","🐫","🦒","🦘","🐃","🐂","🐄","🐎","🐖","🐏","🐑","🦙","🐐","🦌","🐕","🐩","🦮","🐕‍🦺","🐈","🐋","🐳","🐬","🐉","🐲"];
+    const placeholder = document.querySelector('.emoji-placeholder');
+    if (placeholder) {
+        placeholder.textContent = emojis[Math.floor(Math.random() * emojis.length)];
+    }
+});
+</script>
+
+<!-- 移动端固定底部操作栏：语言切换 + 深色模式（桌面端隐藏） -->
+<div id="tb-mobile-utils">
+  {{ if not .IsUserPage }}
+  <select id="mobile-lang-select" class="uk-select uk-form-small" aria-label="{{t .LangCode "common.lang"}}">
+    {{ range .SupportedLangs }}
+    <option value="{{ .Code }}" {{ if eq .Code $.LangCode }}selected{{ end }}>{{ .Name }}</option>
+    {{ end }}
+  </select>
+  {{ end }}
+  <button type="button" id="theme-toggle-mobile" class="uk-button uk-button-default uk-button-small"
+          title="{{t .LangCode "common.theme"}}" aria-label="{{t .LangCode "common.theme"}}">
+    <span class="tb-icon-light">🌙</span><span class="tb-icon-dark">☀️</span>
+  </button>
+</div>
+
+<script>
+(function() {
+    // 深色模式：读取 cookie 应用主题，按钮切换并持久化
+    var THEME_COOKIE = 'theme';
+    function getTheme() {
+        var m = document.cookie.match(/(?:^|;\s*)theme=([^;]*)/);
+        return m ? m[1] : '';
+    }
+    function applyTheme(theme) {
+        if (theme === 'dark') {
+            document.documentElement.setAttribute('data-theme', 'dark');
+        } else {
+            document.documentElement.removeAttribute('data-theme');
+        }
+    }
+    function toggleTheme() {
+        var next = getTheme() === 'dark' ? 'light' : 'dark';
+        applyTheme(next);
+        var expires = new Date(Date.now() + 365 * 24 * 3600 * 1000).toUTCString();
+        document.cookie = THEME_COOKIE + '=' + next + '; path=/; max-age=' + (365 * 24 * 3600) + '; SameSite=Lax';
+    }
+    // 首屏前应用，避免闪烁
+    applyTheme(getTheme());
+    document.addEventListener('DOMContentLoaded', function() {
+        // 桌面顶栏按钮与移动端底部按钮都绑定
+        var buttons = document.querySelectorAll('#theme-toggle, #theme-toggle-mobile');
+        buttons.forEach(function(btn) {
+            btn.addEventListener('click', function(e) {
+                e.preventDefault();
+                toggleTheme();
+            });
+        });
+
+        // 移动端底部语言切换：onchange 跳转到 /i18n/{code}，保留当前页面位置
+        var langSel = document.getElementById('mobile-lang-select');
+        if (langSel) {
+            langSel.addEventListener('change', function() {
+                if (!this.value) return;
+                var to = window.location.pathname + window.location.search;
+                window.location.href = '/i18n/' + encodeURIComponent(this.value) + '?to=' + encodeURIComponent(to);
+            });
+        }
+    });
+})();
+</script>
+
+{{ if .IsPixel }}
+<div>
+{{ else }}
+<div class="uk-container uk-container-xsmall">
+{{ end }}
+
+{{ if eq .CaptchaType "math" }}
+<!-- 算数验证码弹窗 --><div id="math-captcha-modal" uk-modal>
+  <div class="uk-modal-dialog uk-modal-body uk-text-center">
+    <h3 class="uk-modal-title">{{t .LangCode "captcha.title"}}</h3>
+    <p class="uk-text-meta">{{t .LangCode "captcha.hint"}}</p>
+    <div class="captcha-equation-box">
+      <span id="captcha-modal-question" class="math-captcha-modal-question">{{t .LangCode "captcha.loading"}}</span>
+      <input type="number" id="captcha-modal-answer" placeholder="?" autocomplete="off" inputmode="numeric">
+    </div>
+    <div style="margin-top:6px;">
+      <button type="button" class="uk-button uk-button-text uk-text-small" id="captcha-modal-refresh">{{t .LangCode "captcha.refresh"}}</button>
+    </div>
+    <div id="captcha-modal-error" class="uk-text-danger uk-text-small" style="display:none;min-height:20px;"></div>
+    <div class="uk-margin-small-top">
+      <button type="button" class="uk-button uk-button-primary" id="captcha-modal-submit">{{t .LangCode "captcha.submit"}}</button>
+      <button type="button" class="uk-button uk-button-default uk-modal-close">{{t .LangCode "common.cancel"}}</button>
+    </div>
+  </div>
+</div>
+
+<script>
+var CAPTCHA_I18N = {
+  loading: "{{t .LangCode "captcha.loading"}}",
+  loadFailed: "{{t .LangCode "captcha.loadFailed"}}",
+  loadRetry: "{{t .LangCode "captcha.loadRetry"}}",
+  inputAnswer: "{{t .LangCode "captcha.inputAnswer"}}",
+  wrongAnswer: "{{t .LangCode "captcha.wrongAnswer"}}",
+  verifyFailed: "{{t .LangCode "captcha.verifyFailed"}}",
+  needPassword: "{{t .LangCode "ask.needPassword"}}",
+  needEmail: "{{t .LangCode "ask.pleaseEmail"}}"
+};
+</script>
+
+<script>
+(function() {
+  var captchaId = '';
+  var pendingForm = null;
+  var pendingNeedPassword = false;
+  var verifying = false;
+
+  function fetchCaptcha() {
+    var qEl = document.getElementById('captcha-modal-question');
+    var errEl = document.getElementById('captcha-modal-error');
+    var ansEl = document.getElementById('captcha-modal-answer');
+    qEl.textContent = CAPTCHA_I18N.loading;
+    fetch('/api/captcha/generate')
+      .then(function(r) { return r.json(); })
+      .then(function(data) {
+        if (data.code === 0 && data.data) {
+          captchaId = data.data.id;
+          qEl.textContent = data.data.question;
+          if (errEl) errEl.style.display = 'none';
+          if (ansEl) { ansEl.value = ''; ansEl.focus(); }
+        } else {
+          qEl.textContent = CAPTCHA_I18N.loadFailed;
+        }
+      })
+      .catch(function() {
+        qEl.textContent = CAPTCHA_I18N.loadRetry;
+      });
+  }
+
+  function getCSRFToken() {
+    var input = document.querySelector('input[name="_csrf"]');
+    return input ? input.value : '';
+  }
+
+  function doSubmit(form) {
+    // 将 captcha 答案填入隐藏字段
+    var ans = document.getElementById('captcha-modal-answer').value.trim();
+    var hidden = form.querySelector('[name="g-recaptcha-response"]');
+    if (hidden) hidden.value = captchaId + ':' + (ans || '0');
+
+    UIkit.modal('#math-captcha-modal').hide();
+
+    // 处理 AskPassword（提问箱密码）
+    if (pendingNeedPassword) {
+      UIkit.modal.prompt(CAPTCHA_I18N.needPassword, '', 'password')
+        .then(function(password) {
+          if (password) {
+            var pwInput = document.getElementById('ask_password_input');
+            if (pwInput) pwInput.value = password;
+            form.submit();
+          }
+        });
+    } else {
+      form.submit();
+    }
+  }
+
+  // 验证按钮
+  document.getElementById('captcha-modal-submit').addEventListener('click', function() {
+    if (verifying) return;
+    var ans = document.getElementById('captcha-modal-answer').value.trim();
+    if (!ans) {
+      var errEl = document.getElementById('captcha-modal-error');
+      errEl.textContent = CAPTCHA_I18N.inputAnswer;
+      errEl.style.display = 'block';
+      return;
+    }
+    verifying = true;
+    fetch('/api/captcha/verify', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'X-CSRF-Token': getCSRFToken()
+      },
+      body: JSON.stringify({ id: captchaId, answer: parseInt(ans, 10) })
+    })
+    .then(function(r) { return r.json(); })
+    .then(function(data) {
+      verifying = false;
+      if (data.correct) {
+        if (pendingForm) doSubmit(pendingForm);
+      } else {
+        var errEl = document.getElementById('captcha-modal-error');
+        errEl.textContent = CAPTCHA_I18N.wrongAnswer;
+        errEl.style.display = 'block';
+        fetchCaptcha(); // 自动刷新题目
+      }
+    })
+    .catch(function() {
+      verifying = false;
+      var errEl = document.getElementById('captcha-modal-error');
+      errEl.textContent = CAPTCHA_I18N.verifyFailed;
+      errEl.style.display = 'block';
+      fetchCaptcha();
+    });
+  });
+
+  // 回车提交
+  document.getElementById('captcha-modal-answer').addEventListener('keydown', function(e) {
+    if (e.key === 'Enter') {
+      e.preventDefault();
+      document.getElementById('captcha-modal-submit').click();
+    }
+  });
+
+  // 刷新按钮
+  document.getElementById('captcha-modal-refresh').addEventListener('click', fetchCaptcha);
+
+  // 拦截所有带 class="math-captcha-trigger" 的按钮
+  document.addEventListener('click', function(e) {
+    var btn = e.target.closest('.math-captcha-trigger');
+    if (!btn) return;
+    e.preventDefault();
+
+    var form = btn.closest('form');
+    if (!form) return;
+    pendingForm = form;
+
+    // 检查是否需要提问密码
+    pendingNeedPassword = !!(form.querySelector('#ask_password_input'));
+
+    // 邮箱校验（提问页面）
+    var notifyCb = document.getElementById('notify-checkbox');
+    var emailInput = document.getElementById('email-input');
+    if (notifyCb && notifyCb.checked && emailInput && emailInput.value.trim() === '') {
+      UIkit.modal.alert(CAPTCHA_I18N.needEmail);
+      return;
+    }
+
+    fetchCaptcha();
+    UIkit.modal('#math-captcha-modal').show();
+  });
+})();
+</script>
+{{ end }}
\ No newline at end of file
diff --git a/.workbuddy/backup/timebox-inline-20260906/footer.html b/.workbuddy/backup/timebox-inline-20260906/footer.html
new file mode 100644
index 0000000..0564317
--- /dev/null
+++ b/.workbuddy/backup/timebox-inline-20260906/footer.html
@@ -0,0 +1,78 @@
+<p class="{{ if .IsPixel }}uk-container{{end}} uk-text-right uk-text-muted uk-text-small">
+  <br>Powered by NekoBox | {{ ICP }}<br>{{t .LangCode "site.footer.runtime"}}：<span id="box_runtime"></span>
+  <br>
+  <!--<a href="/pixel">画板</a> | -->
+  <a href="https://box.tama.guru/_/tamakyi" target="_blank">{{t .LangCode "site.footer.admin"}}</a>
+  | <a href="https://blog.tama.guru" target="_blank">{{t .LangCode "site.footer.notice"}}</a>
+  | <a href="https://chat.tama.guru" target="_blank">{{t .LangCode "site.footer.chat"}}</a>
+  | <a href="https://share.tama.guru" target="_blank">{{t .LangCode "site.footer.drive"}}</a>
+  | <a href="https://status.tama.guru" target="_blank">{{t .LangCode "site.footer.status"}}</a>
+  | <a href="https://tama.guru" target="_blank">{{t .LangCode "site.footer.nav"}}</a>
+</p>
+<br>
+</div>
+
+<script>
+  // 提交反馈（P0）：点击任意表单的提交按钮后，立即把触发按钮变成「转圈 + 本地化文字」，
+  // 并禁用表单内全部按钮，物理阻止在上传/网络慢时的重复点击与重复提交。
+  // 浏览器前进/后退（bfcache）回到本页时自动复位，避免停留在禁用或转圈状态。
+  // 纯内联反馈，不使用全屏遮罩。
+  var SUBMIT_I18N = {
+    submitting: '{{t .LangCode "common.submitting"}}',
+    uploading:  '{{t .LangCode "common.uploading"}}'
+  };
+
+  function tbResetSubmitButtons() {
+    document.querySelectorAll('button[data-tb-submitting]').forEach(function(b) {
+      b.disabled = false;
+      b.removeAttribute('data-tb-submitting');
+      var orig = b.getAttribute('data-tb-restore');
+      if (orig !== null) {
+        b.innerHTML = orig;
+        b.removeAttribute('data-tb-restore');
+      }
+    });
+  }
+
+  document.addEventListener('submit', function(e) {
+    var form = e.target;
+    if (!form || form.tagName !== 'FORM') return;
+
+    // 页面级提交反馈必须尊重前置校验：投票编辑页等 onsubmit 返回 false 时，
+    // submit 事件仍可能继续到达此监听器；此时绝不能切换到“提交中”状态。
+    if (e.defaultPrevented || form.getAttribute('data-tb-skip-submit-feedback') === '1') {
+      form.removeAttribute('data-tb-skip-submit-feedback');
+      return;
+    }
+
+    // 下载 / 新窗口类表单（target="_blank"，如导出）：当前页不发生导航，也没有 bfcache
+    // 复位机会，进入“提交中”状态后按钮会永远卡在转圈 + 禁用。这类表单直接跳过提交反馈。
+    if (form.getAttribute('target') === '_blank') return;
+
+    // 触发提交的按钮（programmatic submit 时 e.submitter 为 null，回退到首个 submit 按钮）
+    var trigger = e.submitter || form.querySelector('button[type="submit"]');
+
+    // 表单含已选中的文件 → 提示“上传中”，否则“提交中”
+    var hasFile = false;
+    form.querySelectorAll('input[type="file"]').forEach(function(f) {
+      if (f.files && f.files.length > 0) hasFile = true;
+    });
+    var label = hasFile ? SUBMIT_I18N.uploading : SUBMIT_I18N.submitting;
+
+    if (trigger && trigger.tagName === 'BUTTON') {
+      trigger.setAttribute('data-tb-restore', trigger.innerHTML);
+      trigger.innerHTML = '<span uk-spinner="ratio: 0.6"></span> ' + label;
+    }
+
+    // 禁用表单内所有按钮，防止重复提交
+    form.querySelectorAll('button').forEach(function(b) {
+      b.disabled = true;
+      b.setAttribute('data-tb-submitting', '1');
+    });
+  });
+
+  // bfcache 还原时复位按钮
+  window.addEventListener('pageshow', tbResetSubmitButtons);
+</script>
+</body>
+</html>
diff --git a/.workbuddy/backup/timebox-inline-20260906/header.html b/.workbuddy/backup/timebox-inline-20260906/header.html
new file mode 100644
index 0000000..ad7f165
--- /dev/null
+++ b/.workbuddy/backup/timebox-inline-20260906/header.html
@@ -0,0 +1,1029 @@
+<!DOCTYPE html>
+<html lang="{{.LangCode}}">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width">
+  <title>{{ .Title }}</title>
+  <meta name="description" content="{{ if .MetaDescription }}{{ .MetaDescription }}{{ else }}{{ t .LangCode "site.description" }}{{ end }}">
+  <meta name="keywords" content="{{ t .LangCode "site.keywords" }}">
+  <!-- 预连接：UIkit 走公共 CDN（cdnjs.snrat.com），其余自托管库仍在本站 R2，均需预连接 -->
+  <link rel="preconnect" href="https://r2.337845818.best" crossorigin>
+  <link rel="preconnect" href="https://cdnjs.snrat.com" crossorigin>
+  <!-- UIkit 3.3.3 切到公共 CDN（cdnjs.snrat.com，国内实测全量下载 ~0.25s，原 R2 自建 ~1.4-2.0s） -->
+  <link rel="stylesheet" href="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/css/uikit.min.css"/>
+  <!-- Waline 评论区样式：非阻塞加载，不阻塞首屏渲染 -->
+  <link rel="stylesheet" href="https://r2.337845818.best/tamabox/cdn/waline/client/v2/waline-no-commits.css" media="print" onload="this.media='all'"/>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/js/uikit.min.js"></script>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/js/uikit-icons.min.js"></script>
+  <!-- UIkit 补丁：复刻原自建版 "modify-black-font"（官方版与自建版仅 3 处颜色差异——把有色容器内默认白字/白标题改为黑字）。
+       模板当前只用到 .uk-light 容器（用户背景封面，question/list.html、question-not-found.html；
+       其中 h3/p 已由 #usernamecolor/#introcolor 内联 style 覆盖），故只需补该容器的 3 处投影即可保持渲染一致。
+       若日后新增 .uk-card-primary/.uk-card-secondary/.uk-section-primary/.uk-tile-*/.uk-overlay-primary 等容器且需黑字，须同步扩展。 -->
+  <style>
+      .uk-light { color: rgba(0,0,0,.7); }
+      .uk-light .uk-h1, .uk-light .uk-h2, .uk-light .uk-h3, .uk-light .uk-h4, .uk-light .uk-h5, .uk-light .uk-h6,
+      .uk-light .uk-heading-2xlarge, .uk-light .uk-heading-large, .uk-light .uk-heading-medium, .uk-light .uk-heading-small, .uk-light .uk-heading-xlarge,
+      .uk-light h1, .uk-light h2, .uk-light h3, .uk-light h4, .uk-light h5, .uk-light h6 { color: #000; }
+      .uk-light .uk-table th { color: rgba(0,0,0,.7); }
+  </style>
+  <!-- dayjs/alpinejs/vconsole/waline.js 已迁 cdnjs.snrat.com（sha256 与官方一致，国内实测快 2-7x） -->
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/dayjs/1.10.8/dayjs.min.js"></script>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/alpinejs/3.9.0/cdn.min.js"></script>
+  {{ if .VConsole }}
+  <script src="https://cdnjs.snrat.com/ajax/libs/vConsole/3.12.1/vconsole.min.js" type="application/javascript"></script>
+  <script>new window.VConsole()</script>
+  {{ end }}
+  <!-- jQuery 已改为按需加载：仅 easy.qrcode 二维码页（list/question-not-found/profile）自行引入 -->
+  <script defer src="https://r2.337845818.best/tamabox/cdn/time.box.js"></script>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/waline/2.15.8/waline.js"></script>
+  {{ if eq .CaptchaType "math" }}
+  <!-- 算数验证码：弹窗模式，不影响原布局 -->
+  <style>
+      .captcha-equation-box {
+          display: inline-flex;
+          align-items: center;
+          background: #f0f2f5;
+          border: 1px solid #dcdcdc;
+          border-radius: 8px;
+          padding: 8px 8px 8px 16px;
+          gap: 6px;
+          transition: border-color 0.2s;
+      }
+      .captcha-equation-box:focus-within {
+          border-color: #1e87f0;
+          box-shadow: 0 0 0 3px rgba(30,135,240,0.12);
+      }
+      .math-captcha-modal-question {
+          font-size: 1.4rem;
+          font-family: "Courier New", monospace;
+          font-weight: 700;
+          color: #333;
+          letter-spacing: 1px;
+          white-space: nowrap;
+      }
+      #captcha-modal-answer {
+          width: 80px;
+          padding: 6px 10px;
+          text-align: center;
+          font-size: 1.2rem;
+          font-family: "Courier New", monospace;
+          font-weight: 600;
+          border: 1px solid #ccc;
+          border-radius: 5px;
+          outline: none;
+          transition: border-color 0.15s, box-shadow 0.15s;
+          background: #fff;
+      }
+      #captcha-modal-answer:focus {
+          border-color: #1e87f0;
+          box-shadow: 0 0 0 2px rgba(30,135,240,0.2);
+      }
+      /* 隐藏数字输入框的上下箭头 */
+      #captcha-modal-answer::-webkit-inner-spin-button,
+      #captcha-modal-answer::-webkit-outer-spin-button {
+          -webkit-appearance: none;
+          margin: 0;
+      }
+      #captcha-modal-answer {
+          -moz-appearance: textfield;
+      }
+  </style>
+  {{ else if .RecaptchaTurnstileStyle }}
+  <script src="https://challenges.cloudflare.com/turnstile/v0/api.js?compat=recaptcha" async defer></script>
+  <script>
+      document.addEventListener('DOMContentLoaded', function () {
+          document.querySelectorAll('.g-recaptcha').forEach(item => {
+              item.disabled = true;
+          });
+      });
+
+      function onSubmit() {
+          document.querySelectorAll('.g-recaptcha').forEach(item => {
+              item.disabled = false;
+          })
+      }</script>
+  {{ else }}
+  <script src="{{.RecaptchaDomain}}/recaptcha/api.js" async defer></script>
+  <script>function onSubmit() {document.getElementById('form').submit();}</script>
+  {{ end }}
+  {{ if ne SentryDSN "" }}
+  <script
+          src="https://browser.sentry-cdn.com/7.37.2/bundle.tracing.replay.min.js"
+          integrity="sha384-o0mU2P+zsvXua0Y6f/J55PKWZt3sZCv3qDqJe6J5lZklyIQkpgjBVqNnPWYWqGhf"
+          crossorigin="anonymous"
+  ></script>
+  <script>
+      Sentry.init({
+          dsn: "{{ SentryDSN }}",
+          integrations: [new Sentry.BrowserTracing(), new Sentry.Replay()],
+          tracesSampleRate: 1.0,
+          replaysSessionSampleRate: 0.1,
+          replaysOnErrorSampleRate: 1.0,
+      });
+  </script>
+  {{ end }}
+  <style>
+      .grecaptcha-badge {visibility: hidden;}
+      .icon-container {
+         display: flex;
+         justify-content: center;
+         width: 100%;
+  }
+      .icon {
+         margin-left: 10px;
+         width: 20px; /* 设置图标的宽度 */
+         height: auto; /* 保持图标的高度自动调整 */
+      }
+      .emoji-placeholder {
+         display: inline-block;
+         animation: jump 0.5s ease-in-out;
+      }
+
+      @keyframes jump {
+         0%, 100% { transform: translateY(0); }
+         50% { transform: translateY(-5px); }
+      }
+     /* 防止 UIkit Dropbar 初始闪烁 */
+     .uk-dropbar {
+       opacity: 0;
+       visibility: hidden;
+       transition: opacity 0.2s ease, visibility 0.2s ease;
+     }
+     
+     .uk-dropbar.uk-open {
+       opacity: 1;
+       visibility: visible;
+     }
+     
+     a.uk-button.uk-button-link {
+       text-transform: none;
+     }
+
+     /* 移动端优化：缩小字体和间距，避免右侧空白 */
+     @media (max-width: 640px) {
+         .uk-logo {
+             font-size: 1rem;
+         }
+         .uk-navbar-nav a {
+             font-size: 0.78rem;
+             padding: 0 4px;
+         }
+         .emoji-placeholder {
+             font-size: 1rem;
+         }
+         /* 移动端用户名限宽省略，避免长英文用户名撑爆顶栏 */
+         .tb-nav-username {
+             max-width: 64px;
+             overflow: hidden;
+             text-overflow: ellipsis;
+             white-space: nowrap;
+             display: inline-block;
+             vertical-align: middle;
+         }
+     }
+  </style>
+
+  <!-- 深色模式：html[data-theme="dark"] 时覆盖 UIkit 3.3.3 编译主题的关键颜色 -->
+  <style>
+      html[data-theme="dark"] {
+          --tb-bg: #1a1d23;
+          --tb-surface: #242830;
+          --tb-surface-2: #2d323c;
+          --tb-border: #3a404c;
+          --tb-text: #d8dce4;
+          --tb-text-muted: #8b93a1;
+          --tb-primary: #5c8dff;
+      }
+      /* 根元素与 body 一起覆盖，确保整个视口（含内容不足一屏时的空白区）都是深色背景 */
+      html[data-theme="dark"],
+      html[data-theme="dark"] body {
+          background-color: var(--tb-bg) !important;
+          color: var(--tb-text) !important;
+      }
+      /* 通用表面容器 */
+      html[data-theme="dark"] .uk-card,
+      html[data-theme="dark"] .uk-card-default,
+      html[data-theme="dark"] .uk-card-secondary,
+      html[data-theme="dark"] .uk-dropbar,
+      html[data-theme="dark"] .uk-navbar-dropdown,
+      html[data-theme="dark"] .uk-modal-dialog,
+      html[data-theme="dark"] .uk-dropdown,
+      html[data-theme="dark"] .uk-offcanvas-bar,
+      html[data-theme="dark"] .uk-section,
+      html[data-theme="dark"] .uk-tile,
+      html[data-theme="dark"] .uk-panel,
+      html[data-theme="dark"] .uk-background-default,
+      html[data-theme="dark"] .uk-search-default .uk-search-input {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-navbar-container {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-navbar-nav > li > a,
+      html[data-theme="dark"] .uk-card a,
+      html[data-theme="dark"] .uk-link,
+      html[data-theme="dark"] a.uk-button-link,
+      html[data-theme="dark"] .uk-navbar-dropdown-nav > li > a,
+      html[data-theme="dark"] .uk-dropdown-nav > li > a,
+      html[data-theme="dark"] .uk-list a {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-navbar-nav > li > a:hover,
+      html[data-theme="dark"] .uk-card a:hover,
+      html[data-theme="dark"] .uk-navbar-dropdown-nav > li > a:hover,
+      html[data-theme="dark"] .uk-dropdown-nav > li > a:hover {
+          color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .uk-input,
+      html[data-theme="dark"] .uk-textarea,
+      html[data-theme="dark"] .uk-select {
+          background-color: var(--tb-surface-2) !important;
+          color: var(--tb-text) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] .uk-input:focus,
+      html[data-theme="dark"] .uk-textarea:focus,
+      html[data-theme="dark"] .uk-select:focus {
+          border-color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .uk-text-muted,
+      html[data-theme="dark"] .uk-text-meta,
+      html[data-theme="dark"] .uk-text-secondary,
+      html[data-theme="dark"] .uk-text-muted a,
+      html[data-theme="dark"] .uk-text-small.uk-text-muted {
+          color: var(--tb-text-muted) !important;
+      }
+      html[data-theme="dark"] .uk-divider-icon::after,
+      html[data-theme="dark"] hr,
+      html[data-theme="dark"] .uk-table th,
+      html[data-theme="dark"] .uk-table td,
+      html[data-theme="dark"] .uk-list-divider > li:nth-child(n+2) {
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] .uk-button-default {
+          background-color: var(--tb-surface-2) !important;
+          color: var(--tb-text) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] .uk-modal-title,
+      html[data-theme="dark"] h1, html[data-theme="dark"] h2, html[data-theme="dark"] h3,
+      html[data-theme="dark"] h4, html[data-theme="dark"] h5, html[data-theme="dark"] h6,
+      html[data-theme="dark"] .uk-card-title {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-alert-warning,
+      html[data-theme="dark"] .uk-alert-danger,
+      html[data-theme="dark"] .uk-alert-success,
+      html[data-theme="dark"] .uk-alert-primary {
+          background-color: var(--tb-surface-2) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .uk-modal-dialog {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .captcha-equation-box {
+          background-color: var(--tb-surface-2) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .math-captcha-modal-question {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-answer {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-answer::placeholder {
+          color: var(--tb-text-muted) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .uk-text-meta,
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-refresh {
+          color: var(--tb-text-muted) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-refresh:hover {
+          color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .uk-label {
+          color: #fff !important;
+      }
+      /* 自定义组件（探索页推荐卡片等）深色覆盖 */
+      html[data-theme="dark"] .recommend-card,
+      html[data-theme="dark"] .recommend-card:hover {
+          background-color: var(--tb-surface-2) !important;
+      }
+      html[data-theme="dark"] .explore-name a {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .explore-name a:hover {
+          color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .explore-intro {
+          color: var(--tb-text-muted) !important;
+      }
+      /* 切换按钮图标切换 */
+      #theme-toggle .tb-icon-dark, #theme-toggle-mobile .tb-icon-dark { display: none; }
+      html[data-theme="dark"] #theme-toggle .tb-icon-light,
+      html[data-theme="dark"] #theme-toggle-mobile .tb-icon-light { display: none; }
+      html[data-theme="dark"] #theme-toggle .tb-icon-dark,
+      html[data-theme="dark"] #theme-toggle-mobile .tb-icon-dark { display: inline; }
+  </style>
+
+  <!-- 顶栏自适应：导航全部直接显示，窄屏时分级缩小字号/间距，保证英文/日文等长文字不溢出 -->
+  <style>
+      .uk-navbar-nav a {
+          font-size: 0.95rem;
+          padding: 0 10px;
+      }
+      /* 未登录移动端占位：桌面端隐藏，仅 ≤640px 显示（见下方 media 查询）。
+         桌面端布局与改动前完全一致，不受影响。 */
+      .tb-mobile-balancer { display: none; }
+      /* 桌面端保持 UIkit 原生居中三列布局（无需额外 CSS） */
+      .tb-navbar .uk-logo {
+          white-space: nowrap;
+      }
+      @media (max-width: 1200px) {
+          .uk-navbar-nav a {
+              font-size: 0.88rem;
+              padding: 0 8px;
+          }
+      }
+      @media (max-width: 1000px) {
+          .uk-navbar-nav a {
+              font-size: 0.82rem;
+              padding: 0 6px;
+          }
+          .uk-logo {
+              font-size: 1.1rem;
+          }
+          /* 登录用户名限宽，过长省略号截断 */
+          .tb-nav-username {
+              max-width: 110px;
+              overflow: hidden;
+              text-overflow: ellipsis;
+              white-space: nowrap;
+              display: inline-block;
+              vertical-align: middle;
+          }
+      }
+      @media (max-width: 800px) {
+          .uk-navbar-nav a {
+              font-size: 0.78rem;
+              padding: 0 4px;
+          }
+          .uk-logo {
+              font-size: 1rem;
+          }
+          .tb-nav-username {
+              max-width: 80px;
+          }
+      }
+      /* 手机端（≤640px）：沿用 UIkit 桌面端 navbar 的原生三列定位。
+         不再重写 .uk-navbar-center / center-left / center-right 的定位，
+         避免 logo 被挤到下一行；底部语言与深色模式按钮仍由下方独立栏承载。 */
+      @media (max-width: 640px) {
+          .tb-navbar {
+              position: relative;
+              min-height: 56px;
+              overflow: visible;
+          }
+          .tb-navbar > .uk-navbar-center {
+              position: relative !important;
+              top: auto !important;
+              left: auto !important;
+              right: auto !important;
+              bottom: auto !important;
+              transform: none !important;
+              display: flex !important;
+              align-items: center;
+              justify-content: center;
+              width: 100%;
+              min-height: 56px;
+              white-space: nowrap;
+              flex-wrap: nowrap;
+          }
+          .tb-navbar .uk-navbar-center-left,
+          .tb-navbar .uk-navbar-center-right {
+              position: static !important;
+              top: auto !important;
+              left: auto !important;
+              right: auto !important;
+              bottom: auto !important;
+              transform: none !important;
+              display: flex !important;
+              align-items: center;
+              flex: 0 0 auto;
+              white-space: nowrap;
+          }
+          .tb-navbar .uk-navbar-center-left > div,
+          .tb-navbar .uk-navbar-center-right > div {
+              display: flex;
+              align-items: center;
+              white-space: nowrap;
+          }
+          .tb-navbar .uk-navbar-nav {
+              display: flex;
+              flex-wrap: nowrap;
+              flex: 0 0 auto;
+          }
+          .tb-navbar .uk-navbar-nav > li > a,
+          .tb-navbar .uk-logo {
+              white-space: nowrap;
+          }
+          /* 未登录：移动端显示与「我的」等宽的隐藏占位，使左栏「探索+占位」与
+             右栏「注册/登录」两项等宽，logo 真正居中，左右视觉平衡 */
+          .tb-mobile-balancer { display: block; }
+      }
+  </style>
+
+  <!-- 标签样式的按钮（管理页置顶等）：
+       尺寸完全继承 .uk-label（font-size/padding/line-height/text-transform 等），
+       仅覆盖 button 元素特有的默认样式（边框/字体族/光标等），保证与相邻 span 标签完全一致。 -->
+  <style>
+      .tb-label-btn {
+          border: none !important;
+          cursor: pointer;
+          font-family: inherit;
+          margin: 0;
+          vertical-align: middle;
+          outline: none;
+          background-image: none;
+          box-sizing: border-box;
+          -webkit-appearance: none;
+          appearance: none;
+      }
+      .tb-label-btn:hover {
+          opacity: 0.85;
+      }
+      /* 公开页置顶小图标：仅一个图钉，不占行高、不影响原布局 */
+      .tb-pin-flag {
+          font-size: 0.9em;
+          margin-right: 4px;
+          vertical-align: -1px;
+          cursor: default;
+      }
+  </style>
+
+  <!-- Markdown 渲染排版（问题/回答/追问正文，左对齐以保留排版格式） -->
+  <style>
+      /* 纯文本列表：保留换行与连续空格（pre-wrap），不渲染 Markdown 大字号/彩色 */
+      .tb-preline {
+          white-space: pre-wrap;
+      }
+      /* 纯文本列表：超过 5 行截断并显示省略号（不足 5 行则完整显示） */
+      .tb-clamp-5 {
+          display: -webkit-box;
+          -webkit-box-orient: vertical;
+          -webkit-line-clamp: 5;
+          overflow: hidden;
+      }
+      .md-body {
+          line-height: 1.7;
+          text-align: left;
+          word-break: break-word;
+      }
+      .md-body p { margin: 0.5em 0; }
+      .md-body h1, .md-body h2, .md-body h3,
+      .md-body h4, .md-body h5, .md-body h6 {
+          margin: 0.8em 0 0.4em;
+          font-weight: 600;
+          line-height: 1.4;
+      }
+      .md-body ul, .md-body ol { padding-left: 1.6em; margin: 0.5em 0; }
+      .md-body li { margin: 0.2em 0; }
+      .md-body blockquote {
+          border-left: 3px solid #d3d1c7;
+          margin: 0.6em 0;
+          padding: 0.2em 1em;
+          color: #5f5e5a;
+      }
+      .md-body pre {
+          background: #f5f5f5;
+          padding: 0.8em 1em;
+          border-radius: 6px;
+          overflow-x: auto;
+          margin: 0.6em 0;
+      }
+      .md-body code {
+          background: #f0f0f0;
+          padding: 0.1em 0.35em;
+          border-radius: 4px;
+          font-size: 0.9em;
+      }
+      .md-body pre code { background: none; padding: 0; }
+      .md-body img { max-width: 100%; height: auto; }
+      .md-body table { border-collapse: collapse; margin: 0.6em 0; }
+      .md-body th, .md-body td {
+          border: 1px solid #ddd;
+          padding: 0.4em 0.8em;
+      }
+      .md-body hr { margin: 1em 0; }
+      html[data-theme="dark"] .md-body blockquote {
+          border-color: #3a404c;
+          color: #8b93a1;
+      }
+      html[data-theme="dark"] .md-body pre,
+      html[data-theme="dark"] .md-body code { background: #2d323c; }
+      html[data-theme="dark"] .md-body th,
+      html[data-theme="dark"] .md-body td { border-color: #3a404c; }
+  </style>
+
+  <!-- 投票结果占比条：UIkit 3 已无 .uk-progressbar 类（那是 UIkit 2 的），
+       模板用 <div class="uk-progress"><div class="uk-progressbar"> 结构，需补一套填充样式，
+       否则内层填充无高度/背景，所有占比条都只剩外层灰色轨道，看起来一模一样。 -->
+  <style>
+      .uk-progress {
+          -webkit-appearance: none;
+          -moz-appearance: none;
+          appearance: none;
+          height: 10px;
+          margin: 0;
+          border: none;
+          border-radius: 6px;
+          background-color: #e5e5e5;
+          overflow: hidden;
+          box-shadow: none;
+      }
+      .uk-progressbar {
+          display: block;
+          height: 100%;
+          background-color: #1e87f0;
+          border-radius: 6px 0 0 6px;
+          transition: width 0.3s ease;
+      }
+      html[data-theme="dark"] .uk-progress {
+          background-color: var(--tb-border);
+      }
+      html[data-theme="dark"] .uk-progressbar {
+          background-color: var(--tb-primary);
+      }
+  </style>
+
+  <!-- 移动端底部操作栏：固定底栏承载语言切换与深色模式，桌面端隐藏 -->
+  <style>
+      #tb-mobile-utils {
+          display: none;
+      }
+      @media (max-width: 640px) {
+          /* 顶栏不再容纳语言/深色按钮，恢复原有导航空间 */
+          .tb-nav-utils {
+              display: none !important;
+          }
+          /* 手机端隐藏登录用户名（左边仅保留"探索"），保证 logo 居中、
+             两侧各不超过 2 个短按钮，避免用户名宽度挤压布局 */
+          .tb-nav-username {
+              display: none !important;
+          }
+          /* 固定底部操作栏 */
+          #tb-mobile-utils {
+              display: flex;
+              position: fixed;
+              left: 0;
+              right: 0;
+              bottom: 0;
+              z-index: 1000;
+              justify-content: center;
+              align-items: center;
+              gap: 10px;
+              padding: 8px 12px calc(8px + env(safe-area-inset-bottom));
+              background: rgba(255, 255, 255, 0.92);
+              -webkit-backdrop-filter: blur(8px);
+              backdrop-filter: blur(8px);
+              box-shadow: 0 -2px 12px rgba(0, 0, 0, 0.08);
+          }
+          #tb-mobile-utils .uk-select {
+              width: 110px;
+          }
+          html[data-theme="dark"] #tb-mobile-utils {
+              background: rgba(36, 40, 48, 0.92);
+              box-shadow: 0 -2px 12px rgba(0, 0, 0, 0.4);
+          }
+          /* 给页面底部预留空间，避免页脚内容被固定底栏遮挡 */
+          body {
+              padding-bottom: 56px;
+          }
+      }
+  </style>
+
+<!-- Commit 6d0a3ad -->
+  <meta property="og:site_name" content="{{ t .LangCode "site.title" }}" />
+  <meta property="og:type" content="website" />
+  <meta property="og:title" content="{{ if .IsUserPage }}{{ .PageUser.Name }} - {{ t .LangCode "site.title" }}{{ else }}{{ t .LangCode "site.title" }}{{ end }}" />
+  <meta property="og:url" content="{{ .ExternalURL }}{{ .CurrentURI }}" />
+  <meta property="og:description" content="{{ if .IsUserPage }}{{ .PageUser.Name }} - {{ t .LangCode "site.description" }}{{ else }}{{ t .LangCode "site.description" }}{{ end }}" />
+  {{ if .NoIndex }}<meta name="robots" content="noindex">{{ end }}
+  {{ if .IsUserPage }}
+   <meta property="og:image" content="{{ .PageUser.Avatar }}?og-image=1" />
+   <meta property="og:image:alt" content="{{ .PageUser.Name }}" />
+   <meta itemprop="image" content="{{ .PageUser.Avatar }}?og-image=1"/>
+   <meta name="msapplication-TileImage" content="{{ .PageUser.Avatar }}"/>
+   <link rel="shortcut icon" href="{{ .PageUser.Avatar }}?og-image=1"/>
+   <link rel="apple-touch-icon" href="{{ .PageUser.Avatar }}?og-image=1"/>
+   <link rel="icon" sizes="192x192" href="{{ .PageUser.Avatar }}?og-image=1">
+   <meta name="twitter:image:src" content="{{ .PageUser.Avatar }}?og-image=1" />
+   {{ else }}
+  <meta itemprop="image" content="https://r2.337845818.best/tamabox/tamabox_low.png"/>
+  <meta name="msapplication-TileImage" content="https://r2.337845818.best/tamabox/tamabox_low.png"/>
+  <link rel="shortcut icon" href="https://r2.337845818.best/tamabox/tamabox_low.png" />
+  <link rel="apple-touch-icon" href="https://r2.337845818.best/tamabox/tamabox_low.png"/>
+  <link rel="icon" sizes="192x192" href="https://r2.337845818.best/tamabox/tamabox_low.png">
+  <meta name="twitter:image:src" content="https://r2.337845818.best/tamabox/tamabox_low.png" />
+   {{ end }}
+
+<!-- Google and Bing -->
+  <meta name="google-site-verification" content="fEPwRRJfiGsgwc5SINBQwZhPK8F0cwRaOvRx0YRurI4" />
+  <meta name="msvalidate.01" content="2F185E8E63C93635F50B3574F3B31E42" />
+  <!-- 站点统计（umami）：非关键资源，window load 后再动态注入，避免 mami.tama.guru
+       （Vercel 托管、无国内节点）在高峰/冷访问时阻塞 DOMContentLoaded 与 load -->
+  <script>
+      window.addEventListener("load", function () {
+          var s = document.createElement("script");
+          s.src = "https://mami.tama.guru/tamami.js";
+          s.setAttribute("data-website-id", "c42ebe8b-9281-4da0-83a4-8f18b3e710fe");
+          document.body.appendChild(s);
+      });
+  </script>
+</head>
+<body>
+<script>
+// 二维码降级渲染（P0-②）：easy.qrcode 的 logo（用户头像）/ 背景图加载失败或极慢时，
+// 库内部仅 console.error 且无降级 → 二维码区域会永久空白。
+// 策略：未知状态的远程图先不画（基础码立即可扫）→ 后台探针（Image 预载）→
+//       判定完成后再重绘带 logo/背景的升级版；失败则保持基础码，绝不空白。
+// 同会话记忆：探针结果按 URL 记忆（good/bad），编辑页拖动滑块高频重绘时零等待、不闪降级。
+// 使用：window.tbRenderQR(el, function(){ return options; })  // options 含完整 logo/backgroundImage
+window.tbRenderQR = function (el, getOptions) {
+  if (!el || typeof QRCode === 'undefined') return;
+  var opts = getOptions();
+  function remoteOf(o, key) {
+    var v = o[key];
+    return (typeof v === 'string' && v.indexOf('http') === 0) ? v : '';
+  }
+  var good = window._tbQrGood || (window._tbQrGood = {}); // URL -> true（可 CORS 加载）
+  var bad = window._tbQrBad || (window._tbQrBad = {});    // URL -> true（加载失败）
+  // 每层状态：''=无需, 1=已知可用, 0=已知失败, null=未知需探针
+  function layerState(url) { return !url ? '' : (good[url] ? 1 : (bad[url] ? 0 : null)); }
+  var layers = [
+    { url: remoteOf(opts, 'logo'), st: null, present: function (o, on) {
+        if (on) { /* 保留 */ } else { o.logo = undefined; o.logoWidth = undefined; o.logoHeight = undefined; o.logoBackgroundTransparent = undefined; }
+      } },
+    { url: remoteOf(opts, 'backgroundImage'), st: null, present: function (o, on) {
+        if (on) { /* 保留 */ } else { o.backgroundImage = undefined; o.backgroundImageAlpha = undefined; }
+      } }
+  ];
+  var needProbe = false;
+  for (var i = 0; i < layers.length; i++) {
+    layers[i].st = layerState(layers[i].url);
+    if (layers[i].st === null) needProbe = true;
+  }
+  function paint(states) {
+    var o = {};
+    for (var k in opts) o[k] = opts[k];
+    for (var j = 0; j < layers.length; j++) layers[j].present(o, states[j] === 1);
+    el.innerHTML = '';
+    new QRCode(el, o);
+  }
+  // 已知可用层立即带上；未知层先省略 → 立即绘制（logo 记忆命中时不会闪降级）
+  var initStates = [];
+  for (var n = 0; n < layers.length; n++) initStates.push(layers[n].st === 1 ? 1 : 0);
+  paint(initStates);
+  if (!needProbe) return;
+  // 后台探针未知层；全部判定后若有变化再重绘一次升级版
+  var pending = 0, cross = opts.crossOrigin || 'anonymous';
+  layers.forEach(function (L) {
+    if (L.st !== null) return;
+    pending++;
+    var im = new Image();
+    im.onload = function () { good[L.url] = true; L.st = 1; onDone(); };
+    im.onerror = function () { bad[L.url] = true; L.st = 0; onDone(); };
+    if (cross) im.crossOrigin = cross;
+    im.src = L.url;
+  });
+  function onDone() {
+    if (--pending > 0) return;
+    var finalStates = [];
+    for (var m = 0; m < layers.length; m++) finalStates.push(layers[m].st === 1 ? 1 : 0);
+    var changed = false;
+    for (var q = 0; q < finalStates.length; q++) if (finalStates[q] !== initStates[q]) changed = true;
+    if (changed) paint(finalStates);
+  }
+  // 超时保险：个别挂起连接永不回调时，3s 后按当前已知状态收尾（基础码早已可扫）
+  setTimeout(function () { if (pending > 0) { pending = 0; onDone(); } }, 3000);
+};
+</script>
+<nav class="uk-navbar-container uk-margin tb-navbar" uk-navbar>
+  <div class="uk-navbar-center">
+    <div class="uk-navbar-center-left">
+      <div>
+        <ul class="uk-navbar-nav">
+          <!-- 探索链接，始终显示 -->
+          <li><a href="/explore">{{t .LangCode "nav.explore"}}</a></li>
+          {{ if .IsLogged }}
+          <!-- 我的：进入自己的提问箱主页（与右侧「提问/设置」形成左右均衡） -->
+          <li><a href="/_/{{ .LoggedUser.Domain }}">{{t .LangCode "nav.mine"}}</a></li>
+          {{ else }}
+          <!-- 移动端占位：未登录时左栏仅「探索」一项，与右栏「注册/登录」两项不等宽，
+               导致 logo 整体被拉向左（偏左）。移动端(≤640px)显示一个与「我的」等宽的隐藏占位，
+               使左右视觉平衡；桌面端由 .tb-mobile-balancer 隐藏，保持原布局完全不变。 -->
+          <li class="tb-mobile-balancer" aria-hidden="true"><a tabindex="-1" style="visibility:hidden">{{t .LangCode "nav.mine"}}</a></li>
+          {{ end }}
+        </ul>
+      </div>
+    </div>
+
+    <a class="uk-navbar-item uk-logo" href="/"><span class="emoji-placeholder" aria-label="random animal">🐺</span>{{t .LangCode "site.logoSuffix"}}</a>
+
+    <div class="uk-navbar-center-right">
+      <div>
+        {{ if .IsLogged }}
+        <ul class="uk-navbar-nav">
+          <li><a href="/user/questions">{{t .LangCode "nav.ask"}}</a></li>
+        </ul>
+        <ul class="uk-navbar-nav">
+          <li><a href="/user/profile">{{t .LangCode "nav.settings"}}</a></li>
+        </ul>
+        {{ else}}
+        <ul class="uk-navbar-nav">
+          <li><a href="/register">{{t .LangCode "nav.register"}}</a></li>
+        </ul>
+        <ul class="uk-navbar-nav">
+          <li><a href="/login">{{t .LangCode "nav.login"}}</a></li>
+        </ul>
+        {{ end }}
+        {{ if not .IsUserPage }}
+        <!-- 语言切换（紧凑图标，点击展开；移动端隐藏，见底部操作栏） -->
+        <ul class="uk-navbar-nav tb-nav-utils">
+          <li>
+            <a href="#" aria-label="{{t .LangCode "common.lang"}}" title="{{t .LangCode "common.lang"}}">🌐</a>
+            <div class="uk-navbar-dropdown" uk-drop="mode: click; pos: bottom-right">
+              <ul class="uk-nav uk-navbar-dropdown-nav">
+                {{ range .SupportedLangs }}
+                <li class="{{ if eq .Code $.LangCode }}uk-active{{ end }}">
+                  <a href="/i18n/{{ .Code }}?to={{ urlquery $.CurrentURI }}">{{ .Name }}</a>
+                </li>
+                {{ end }}
+              </ul>
+            </div>
+          </li>
+        </ul>
+        {{ end }}
+        <!-- 深色模式切换（紧凑图标；移动端隐藏，见底部操作栏） -->
+        <ul class="uk-navbar-nav tb-nav-utils">
+          <li>
+            <a href="#" id="theme-toggle" title="{{t .LangCode "common.theme"}}" aria-label="{{t .LangCode "common.theme"}}">
+              <span class="tb-icon-light">🌙</span><span class="tb-icon-dark">☀️</span>
+            </a>
+          </li>
+        </ul>
+      </div>
+    </div>
+  </div>
+</nav>
+
+<script>
+document.addEventListener("DOMContentLoaded", function() {
+    const emojis = ["🐺","🐗","🐻","🐨","🐼","🐹","🐭","🐰","🦊","🐮","🐷","🐽","🐸","🐒","🦍","🐔","🐧","🐦","🐤","🐦‍⬛","🦅","🦉","🦇","🐴","🦄","🐝","🦎","🦖","🦕","🐙","🦑","🦐","🦞","🦀","🐡","🐠","🐟","🐬","🐳","🐋","🦈","🐊","🐅","🐆","🦓","🦍","🦧","🐘","🦛","🦏","🐪","🐫","🦒","🦘","🐃","🐂","🐄","🐎","🐖","🐏","🐑","🦙","🐐","🦌","🐕","🐩","🦮","🐕‍🦺","🐈","🐋","🐳","🐬","🐉","🐲"];
+    const placeholder = document.querySelector('.emoji-placeholder');
+    if (placeholder) {
+        placeholder.textContent = emojis[Math.floor(Math.random() * emojis.length)];
+    }
+});
+</script>
+
+<!-- 移动端固定底部操作栏：语言切换 + 深色模式（桌面端隐藏） -->
+<div id="tb-mobile-utils">
+  {{ if not .IsUserPage }}
+  <select id="mobile-lang-select" class="uk-select uk-form-small" aria-label="{{t .LangCode "common.lang"}}">
+    {{ range .SupportedLangs }}
+    <option value="{{ .Code }}" {{ if eq .Code $.LangCode }}selected{{ end }}>{{ .Name }}</option>
+    {{ end }}
+  </select>
+  {{ end }}
+  <button type="button" id="theme-toggle-mobile" class="uk-button uk-button-default uk-button-small"
+          title="{{t .LangCode "common.theme"}}" aria-label="{{t .LangCode "common.theme"}}">
+    <span class="tb-icon-light">🌙</span><span class="tb-icon-dark">☀️</span>
+  </button>
+</div>
+
+<script>
+(function() {
+    // 深色模式：读取 cookie 应用主题，按钮切换并持久化
+    var THEME_COOKIE = 'theme';
+    function getTheme() {
+        var m = document.cookie.match(/(?:^|;\s*)theme=([^;]*)/);
+        return m ? m[1] : '';
+    }
+    function applyTheme(theme) {
+        if (theme === 'dark') {
+            document.documentElement.setAttribute('data-theme', 'dark');
+        } else {
+            document.documentElement.removeAttribute('data-theme');
+        }
+    }
+    function toggleTheme() {
+        var next = getTheme() === 'dark' ? 'light' : 'dark';
+        applyTheme(next);
+        var expires = new Date(Date.now() + 365 * 24 * 3600 * 1000).toUTCString();
+        document.cookie = THEME_COOKIE + '=' + next + '; path=/; max-age=' + (365 * 24 * 3600) + '; SameSite=Lax';
+    }
+    // 首屏前应用，避免闪烁
+    applyTheme(getTheme());
+    document.addEventListener('DOMContentLoaded', function() {
+        // 桌面顶栏按钮与移动端底部按钮都绑定
+        var buttons = document.querySelectorAll('#theme-toggle, #theme-toggle-mobile');
+        buttons.forEach(function(btn) {
+            btn.addEventListener('click', function(e) {
+                e.preventDefault();
+                toggleTheme();
+            });
+        });
+
+        // 移动端底部语言切换：onchange 跳转到 /i18n/{code}，保留当前页面位置
+        var langSel = document.getElementById('mobile-lang-select');
+        if (langSel) {
+            langSel.addEventListener('change', function() {
+                if (!this.value) return;
+                var to = window.location.pathname + window.location.search;
+                window.location.href = '/i18n/' + encodeURIComponent(this.value) + '?to=' + encodeURIComponent(to);
+            });
+        }
+    });
+})();
+</script>
+
+{{ if .IsPixel }}
+<div>
+{{ else }}
+<div class="uk-container uk-container-xsmall">
+{{ end }}
+
+{{ if eq .CaptchaType "math" }}
+<!-- 算数验证码弹窗 --><div id="math-captcha-modal" uk-modal>
+  <div class="uk-modal-dialog uk-modal-body uk-text-center">
+    <h3 class="uk-modal-title">{{t .LangCode "captcha.title"}}</h3>
+    <p class="uk-text-meta">{{t .LangCode "captcha.hint"}}</p>
+    <div class="captcha-equation-box">
+      <span id="captcha-modal-question" class="math-captcha-modal-question">{{t .LangCode "captcha.loading"}}</span>
+      <input type="number" id="captcha-modal-answer" placeholder="?" autocomplete="off" inputmode="numeric">
+    </div>
+    <div style="margin-top:6px;">
+      <button type="button" class="uk-button uk-button-text uk-text-small" id="captcha-modal-refresh">{{t .LangCode "captcha.refresh"}}</button>
+    </div>
+    <div id="captcha-modal-error" class="uk-text-danger uk-text-small" style="display:none;min-height:20px;"></div>
+    <div class="uk-margin-small-top">
+      <button type="button" class="uk-button uk-button-primary" id="captcha-modal-submit">{{t .LangCode "captcha.submit"}}</button>
+      <button type="button" class="uk-button uk-button-default uk-modal-close">{{t .LangCode "common.cancel"}}</button>
+    </div>
+  </div>
+</div>
+
+<script>
+var CAPTCHA_I18N = {
+  loading: "{{t .LangCode "captcha.loading"}}",
+  loadFailed: "{{t .LangCode "captcha.loadFailed"}}",
+  loadRetry: "{{t .LangCode "captcha.loadRetry"}}",
+  inputAnswer: "{{t .LangCode "captcha.inputAnswer"}}",
+  wrongAnswer: "{{t .LangCode "captcha.wrongAnswer"}}",
+  verifyFailed: "{{t .LangCode "captcha.verifyFailed"}}",
+  needPassword: "{{t .LangCode "ask.needPassword"}}",
+  needEmail: "{{t .LangCode "ask.pleaseEmail"}}"
+};
+</script>
+
+<script>
+(function() {
+  var captchaId = '';
+  var pendingForm = null;
+  var pendingNeedPassword = false;
+  var verifying = false;
+
+  function fetchCaptcha() {
+    var qEl = document.getElementById('captcha-modal-question');
+    var errEl = document.getElementById('captcha-modal-error');
+    var ansEl = document.getElementById('captcha-modal-answer');
+    qEl.textContent = CAPTCHA_I18N.loading;
+    fetch('/api/captcha/generate')
+      .then(function(r) { return r.json(); })
+      .then(function(data) {
+        if (data.code === 0 && data.data) {
+          captchaId = data.data.id;
+          qEl.textContent = data.data.question;
+          if (errEl) errEl.style.display = 'none';
+          if (ansEl) { ansEl.value = ''; ansEl.focus(); }
+        } else {
+          qEl.textContent = CAPTCHA_I18N.loadFailed;
+        }
+      })
+      .catch(function() {
+        qEl.textContent = CAPTCHA_I18N.loadRetry;
+      });
+  }
+
+  function getCSRFToken() {
+    var input = document.querySelector('input[name="_csrf"]');
+    return input ? input.value : '';
+  }
+
+  function doSubmit(form) {
+    // 将 captcha 答案填入隐藏字段
+    var ans = document.getElementById('captcha-modal-answer').value.trim();
+    var hidden = form.querySelector('[name="g-recaptcha-response"]');
+    if (hidden) hidden.value = captchaId + ':' + (ans || '0');
+
+    UIkit.modal('#math-captcha-modal').hide();
+
+    // 处理 AskPassword（提问箱密码）
+    if (pendingNeedPassword) {
+      UIkit.modal.prompt(CAPTCHA_I18N.needPassword, '', 'password')
+        .then(function(password) {
+          if (password) {
+            var pwInput = document.getElementById('ask_password_input');
+            if (pwInput) pwInput.value = password;
+            form.submit();
+          }
+        });
+    } else {
+      form.submit();
+    }
+  }
+
+  // 验证按钮
+  document.getElementById('captcha-modal-submit').addEventListener('click', function() {
+    if (verifying) return;
+    var ans = document.getElementById('captcha-modal-answer').value.trim();
+    if (!ans) {
+      var errEl = document.getElementById('captcha-modal-error');
+      errEl.textContent = CAPTCHA_I18N.inputAnswer;
+      errEl.style.display = 'block';
+      return;
+    }
+    verifying = true;
+    fetch('/api/captcha/verify', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'X-CSRF-Token': getCSRFToken()
+      },
+      body: JSON.stringify({ id: captchaId, answer: parseInt(ans, 10) })
+    })
+    .then(function(r) { return r.json(); })
+    .then(function(data) {
+      verifying = false;
+      if (data.correct) {
+        if (pendingForm) doSubmit(pendingForm);
+      } else {
+        var errEl = document.getElementById('captcha-modal-error');
+        errEl.textContent = CAPTCHA_I18N.wrongAnswer;
+        errEl.style.display = 'block';
+        fetchCaptcha(); // 自动刷新题目
+      }
+    })
+    .catch(function() {
+      verifying = false;
+      var errEl = document.getElementById('captcha-modal-error');
+      errEl.textContent = CAPTCHA_I18N.verifyFailed;
+      errEl.style.display = 'block';
+      fetchCaptcha();
+    });
+  });
+
+  // 回车提交
+  document.getElementById('captcha-modal-answer').addEventListener('keydown', function(e) {
+    if (e.key === 'Enter') {
+      e.preventDefault();
+      document.getElementById('captcha-modal-submit').click();
+    }
+  });
+
+  // 刷新按钮
+  document.getElementById('captcha-modal-refresh').addEventListener('click', fetchCaptcha);
+
+  // 拦截所有带 class="math-captcha-trigger" 的按钮
+  document.addEventListener('click', function(e) {
+    var btn = e.target.closest('.math-captcha-trigger');
+    if (!btn) return;
+    e.preventDefault();
+
+    var form = btn.closest('form');
+    if (!form) return;
+    pendingForm = form;
+
+    // 检查是否需要提问密码
+    pendingNeedPassword = !!(form.querySelector('#ask_password_input'));
+
+    // 邮箱校验（提问页面）
+    var notifyCb = document.getElementById('notify-checkbox');
+    var emailInput = document.getElementById('email-input');
+    if (notifyCb && notifyCb.checked && emailInput && emailInput.value.trim() === '') {
+      UIkit.modal.alert(CAPTCHA_I18N.needEmail);
+      return;
+    }
+
+    fetchCaptcha();
+    UIkit.modal('#math-captcha-modal').show();
+  });
+})();
+</script>
+{{ end }}
\ No newline at end of file
diff --git a/.workbuddy/backup/wp-fragments-20260906/autoban.go b/.workbuddy/backup/wp-fragments-20260906/autoban.go
new file mode 100644
index 0000000..f2186aa
--- /dev/null
+++ b/.workbuddy/backup/wp-fragments-20260906/autoban.go
@@ -0,0 +1,277 @@
+// Package autoban 提供 fail2ban 风格的自动临时封禁：检测批量扫描/探测特征后
+// 临时封禁来源 IP，并可回调发送告警。纯标准库实现，便于独立测试与复用。
+package autoban
+
+import (
+	"strings"
+	"sync"
+	"time"
+)
+
+// 探测事件类型
+const (
+	KindNone      = 0 // 无探测特征
+	KindSensitive = 1 // 命中敏感路径
+	KindNotFound  = 2 // 404 响应（未命中敏感路径）
+)
+
+// 默认阈值/窗口（Options 未配置或为 0 时兜底）。
+const (
+	DefaultWindowSeconds      = 60
+	DefaultDurationMinutes    = 15
+	DefaultThresholdSensitive = 10
+	DefaultThreshold404       = 20
+	pathSampleMax             = 6
+)
+
+// Options 自动封禁配置。
+type Options struct {
+	Enabled bool
+	// TrackNotFound 是否把 KindNotFound（未注册路径的 404）计入封禁统计。
+	// 默认 false：正常业务路径一律放行，仅敏感扫描特征路径参与计数封禁，
+	// 避免共享出口下正常访问被 404 探测连坐误伤（详见 conf.Security.BanTrackNotFound）。
+	TrackNotFound      bool
+	ThresholdSensitive int                                                        // 窗口内敏感路径命中次数
+	Threshold404       int                                                        // 窗口内 404 次数
+	Window             time.Duration                                              // 统计窗口
+	Duration           time.Duration                                              // 封禁时长
+	AlertEmail         string                                                     // 告警收件人（留空不发送）
+	SendAlert          func(ip string, paths []string, durationMinutes int) error // 告警发送函数（nil 则不发送）
+}
+
+// sensitivePaths 常见后台/配置/漏洞探测路径特征（忽略大小写，前缀匹配）。
+var sensitivePaths = []string{
+	"/admin", "/wp-admin", "/wp-login.php", "/wp-content", "/wordpress",
+	"/administrator", "/manager", "/cpanel", "/plesk",
+	"/.env", "/.git", "/.aws", "/.ssh", "/.svn", "/.hg", "/.htaccess",
+	"/config", "/configuration", "/backup", "/database", "/db",
+	"/actuator", "/swagger", "/api-docs", "/openapi", "/v2/api-docs",
+	"/phpmyadmin", "/pma", "/mysql", "/server-status", "/server-info",
+	"/shell", "/webshell", "/cmd", "/eval", "/hack", "/shell.php",
+	"/login.php", "/admin.php", "/index.php", "/console", "/vendor",
+}
+
+type probeEvent struct {
+	at   time.Time
+	kind int
+}
+
+type probeStat struct {
+	events    []probeEvent
+	sensitive int
+	notFound  int
+	paths     []string // 命中路径样本（告警用）
+}
+
+// Banner 自动封禁器。方法并发安全。
+type Banner struct {
+	mu sync.Mutex
+
+	probes  map[string]*probeStat
+	banned  map[string]time.Time
+	alerted map[string]bool
+
+	thresholdSensitive int
+	threshold404       int
+	trackNotFound      bool
+	window             time.Duration
+	duration           time.Duration
+	alertEmail         string
+	sendAlert          func(ip string, paths []string, durationMinutes int) error
+	enabled            bool
+}
+
+// New 按配置创建封禁器并注册全局清理。
+func New(opts Options) *Banner {
+	window := opts.Window
+	if window <= 0 {
+		window = DefaultWindowSeconds * time.Second
+	}
+	duration := opts.Duration
+	if duration <= 0 {
+		duration = DefaultDurationMinutes * time.Minute
+	}
+	sensitive := opts.ThresholdSensitive
+	if sensitive <= 0 {
+		sensitive = DefaultThresholdSensitive
+	}
+	notFound := opts.Threshold404
+	if notFound <= 0 {
+		notFound = DefaultThreshold404
+	}
+	b := &Banner{
+		probes:             make(map[string]*probeStat),
+		banned:             make(map[string]time.Time),
+		alerted:            make(map[string]bool),
+		thresholdSensitive: sensitive,
+		threshold404:       notFound,
+		trackNotFound:      opts.TrackNotFound,
+		window:             window,
+		duration:           duration,
+		alertEmail:         strings.TrimSpace(opts.AlertEmail),
+		sendAlert:          opts.SendAlert,
+		enabled:            opts.Enabled,
+	}
+	register(b)
+	return b
+}
+
+// Record 记录一次探测事件，达到阈值时封禁 IP 并触发一次告警。
+func (b *Banner) Record(ip, path string, kind int) {
+	if !b.enabled || ip == "" || kind == KindNone {
+		return
+	}
+	// 404 计数默认关闭（正常业务路径一律放行，仅敏感扫描特征参与封禁）：
+	// 只有显式开启 TrackNotFound 时才把未注册路径的 404 计入统计。
+	if kind == KindNotFound && !b.trackNotFound {
+		return
+	}
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	now := time.Now()
+	cutoff := now.Add(-b.window)
+
+	st := b.probes[ip]
+	if st == nil {
+		st = &probeStat{}
+		b.probes[ip] = st
+	}
+
+	// 滚动清理过期事件并重算计数
+	valid := st.events[:0]
+	sensitive, notFound := 0, 0
+	for _, e := range st.events {
+		if e.at.After(cutoff) {
+			valid = append(valid, e)
+			if e.kind == KindSensitive {
+				sensitive++
+			} else if e.kind == KindNotFound {
+				notFound++
+			}
+		}
+	}
+	valid = append(valid, probeEvent{at: now, kind: kind})
+	if kind == KindSensitive {
+		sensitive++
+	} else {
+		notFound++
+	}
+	st.events = valid
+	st.sensitive = sensitive
+	st.notFound = notFound
+	if len(st.paths) < pathSampleMax && path != "" {
+		st.paths = append(st.paths, path)
+	}
+
+	if sensitive < b.thresholdSensitive && notFound < b.threshold404 {
+		return
+	}
+
+	// 已达阈值：封禁（已在封禁中则跳过）
+	if until, ok := b.banned[ip]; ok && until.After(now) {
+		return
+	}
+	until := now.Add(b.duration)
+	b.banned[ip] = until
+
+	// 告警（每 IP 仅一次）
+	if b.alertEmail != "" && b.sendAlert != nil && !b.alerted[ip] {
+		b.alerted[ip] = true
+		sample := append([]string{}, st.paths...)
+		dur := int(b.duration.Minutes())
+		go func() {
+			_ = b.sendAlert(ip, sample, dur)
+		}()
+	}
+}
+
+// IsBanned 判断 IP 是否处于封禁期；到期自动解除。
+func (b *Banner) IsBanned(ip string) bool {
+	if !b.enabled || ip == "" {
+		return false
+	}
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if until, ok := b.banned[ip]; ok {
+		if until.After(time.Now()) {
+			return true
+		}
+		delete(b.banned, ip)
+	}
+	return false
+}
+
+// IsSensitivePath 判断路径是否命中敏感探测特征（忽略大小写，完整段前缀匹配）。
+func IsSensitivePath(p string) bool {
+	lower := strings.ToLower(p)
+	for _, s := range sensitivePaths {
+		if lower == s || strings.HasPrefix(lower, s+"/") {
+			return true
+		}
+	}
+	return false
+}
+
+// ---------- 全局注册与清理 ----------
+
+var (
+	bannersMu   sync.Mutex
+	banners     = make(map[*Banner]struct{})
+	bannersOnce sync.Once
+)
+
+func register(b *Banner) {
+	bannersMu.Lock()
+	banners[b] = struct{}{}
+	bannersMu.Unlock()
+
+	bannersOnce.Do(func() {
+		go func() {
+			for {
+				time.Sleep(2 * time.Minute)
+				bannersMu.Lock()
+				for b := range banners {
+					b.cleanup()
+				}
+				bannersMu.Unlock()
+			}
+		}()
+	})
+}
+
+// cleanup 定期清理过期探测记录与已到期封禁（防止内存膨胀）。
+func (b *Banner) cleanup() {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	now := time.Now()
+	cutoff := now.Add(-b.window)
+
+	for ip, st := range b.probes {
+		if len(st.events) == 0 || st.events[len(st.events)-1].at.Before(cutoff) {
+			delete(b.probes, ip)
+			continue
+		}
+		valid := st.events[:0]
+		sensitive, notFound := 0, 0
+		for _, e := range st.events {
+			if e.at.After(cutoff) {
+				valid = append(valid, e)
+				if e.kind == KindSensitive {
+					sensitive++
+				} else if e.kind == KindNotFound {
+					notFound++
+				}
+			}
+		}
+		st.events = valid
+		st.sensitive = sensitive
+		st.notFound = notFound
+	}
+	for ip, until := range b.banned {
+		if !until.After(now) {
+			delete(b.banned, ip)
+		}
+	}
+}
diff --git a/.workbuddy/backup/wp-fragments-20260906/autoban_test.go b/.workbuddy/backup/wp-fragments-20260906/autoban_test.go
new file mode 100644
index 0000000..57ee69b
--- /dev/null
+++ b/.workbuddy/backup/wp-fragments-20260906/autoban_test.go
@@ -0,0 +1,143 @@
+package autoban
+
+import (
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func newTestBanner(thresholdSensitive, threshold404 int, window, duration time.Duration, alertEmail string, alertCalls *int64) *Banner {
+	return New(Options{
+		Enabled:            true,
+		TrackNotFound:      true, // 测试 helper 显式开启 404 跟踪，覆盖两种计数的既有用例
+		ThresholdSensitive: thresholdSensitive,
+		Threshold404:       threshold404,
+		Window:             window,
+		Duration:           duration,
+		AlertEmail:         alertEmail,
+		SendAlert: func(ip string, paths []string, dur int) error {
+			if alertCalls != nil {
+				atomic.AddInt64(alertCalls, 1)
+			}
+			return nil
+		},
+	})
+}
+
+func TestSensitiveThreshold(t *testing.T) {
+	b := newTestBanner(2, 5, time.Minute, time.Minute, "", nil)
+	b.Record("1.2.3.4", "/admin", KindSensitive)
+	if b.IsBanned("1.2.3.4") {
+		t.Fatal("should not be banned before reaching threshold")
+	}
+	b.Record("1.2.3.4", "/.env", KindSensitive)
+	if !b.IsBanned("1.2.3.4") {
+		t.Fatal("expected ban after reaching sensitive threshold")
+	}
+}
+
+func TestNotFoundThreshold(t *testing.T) {
+	b := newTestBanner(10, 3, time.Minute, time.Minute, "", nil)
+	for i := 0; i < 3; i++ {
+		b.Record("5.6.7.8", "/random-"+string(rune('a'+i)), KindNotFound)
+	}
+	if !b.IsBanned("5.6.7.8") {
+		t.Fatal("expected ban after reaching 404 threshold")
+	}
+}
+
+func TestNotFoundTrackDisabledByDefault(t *testing.T) {
+	// 默认（TrackNotFound=false）下 404 不参与统计：正常业务路径一律放行，
+	// 仅敏感扫描路径仍计数封禁——防止共享出口下正常访问被 404 探测连坐误伤。
+	b := New(Options{Enabled: true, ThresholdSensitive: 1, Threshold404: 1, Window: time.Minute, Duration: time.Minute})
+	for i := 0; i < 5; i++ {
+		b.Record("7.7.7.7", "/random-"+string(rune('a'+i)), KindNotFound)
+	}
+	if b.IsBanned("7.7.7.7") {
+		t.Fatal("404 events must not accumulate when TrackNotFound is false")
+	}
+	b.Record("7.7.7.7", "/.env", KindSensitive)
+	if !b.IsBanned("7.7.7.7") {
+		t.Fatal("sensitive events must still ban even when 404 tracking is off")
+	}
+}
+
+func TestWindowExpiry(t *testing.T) {
+	b := newTestBanner(2, 5, 50*time.Millisecond, time.Minute, "", nil)
+	b.Record("1.1.1.1", "/admin", KindSensitive)
+	time.Sleep(80 * time.Millisecond) // 事件滑出窗口
+	b.Record("1.1.1.1", "/.env", KindSensitive)
+	if b.IsBanned("1.1.1.1") {
+		t.Fatal("events outside the window must not accumulate")
+	}
+}
+
+func TestDurationExpiry(t *testing.T) {
+	b := newTestBanner(1, 5, time.Minute, 60*time.Millisecond, "", nil)
+	b.Record("2.2.2.2", "/admin", KindSensitive)
+	if !b.IsBanned("2.2.2.2") {
+		t.Fatal("expected ban")
+	}
+	time.Sleep(100 * time.Millisecond) // 封禁到期
+	if b.IsBanned("2.2.2.2") {
+		t.Fatal("ban should expire after duration")
+	}
+}
+
+func TestAlertOncePerIP(t *testing.T) {
+	var calls int64
+	b := newTestBanner(1, 5, time.Minute, time.Minute, "admin@example.com", &calls)
+	b.Record("9.9.9.9", "/wp-admin", KindSensitive)
+	b.Record("9.9.9.9", "/.git", KindSensitive) // 已在封禁中，不应重复告警
+	b.Record("9.9.9.9", "/config", KindSensitive)
+
+	// sendAlert 异步调用，轮询等待最多 500ms
+	deadline := time.Now().Add(500 * time.Millisecond)
+	for atomic.LoadInt64(&calls) == 0 && time.Now().Before(deadline) {
+		time.Sleep(10 * time.Millisecond)
+	}
+	if got := atomic.LoadInt64(&calls); got != 1 {
+		t.Fatalf("expected exactly 1 alert, got %d", got)
+	}
+}
+
+func TestDisabled(t *testing.T) {
+	b := New(Options{Enabled: false})
+	b.Record("3.3.3.3", "/admin", KindSensitive)
+	if b.IsBanned("3.3.3.3") {
+		t.Fatal("disabled auto-ban must not ban")
+	}
+}
+
+func TestDefaults(t *testing.T) {
+	b := New(Options{Enabled: true}) // 全部走默认值
+	if b.thresholdSensitive != DefaultThresholdSensitive || b.threshold404 != DefaultThreshold404 {
+		t.Fatalf("default thresholds wrong: %d/%d", b.thresholdSensitive, b.threshold404)
+	}
+	if b.window != DefaultWindowSeconds*time.Second || b.duration != DefaultDurationMinutes*time.Minute {
+		t.Fatalf("default window/duration wrong: %v/%v", b.window, b.duration)
+	}
+	if b.trackNotFound {
+		t.Fatal("404 tracking must be disabled by default")
+	}
+}
+
+func TestIsSensitivePath(t *testing.T) {
+	cases := []struct {
+		path string
+		want bool
+	}{
+		{"/admin", true},
+		{"/admin/panel", true},
+		{"/WP-ADMIN", true},
+		{"/.env", true},
+		{"/user/questions", false},
+		{"/vote/abc123", false},
+		{"/administratorx", false}, // 前缀必须完整段匹配，避免误伤
+	}
+	for _, c := range cases {
+		if got := IsSensitivePath(c.path); got != c.want {
+			t.Errorf("IsSensitivePath(%q) = %v, want %v", c.path, got, c.want)
+		}
+	}
+}
diff --git a/.workbuddy/memory/2026-09-04.md b/.workbuddy/memory/2026-09-04.md
new file mode 100644
index 0000000..e975282
--- /dev/null
+++ b/.workbuddy/memory/2026-09-04.md
@@ -0,0 +1,99 @@
+# 2026-09-04
+
+- 调研并输出 /user/profile 页面（account 面板）UI 优化评审与改造方案（等待用户批准后实施）。
+- 关键结论：
+  - 密码强制登出：`users.password_version` + 会话 `pwd_ver` 机制已存在（internal/context/auth.go authenticatedUser），改密后旧会话下次请求即失效；但 UpdateProfile 改密后仍重定向 /user/profile，被 Toggle 以「请先登录」错误文案弹回 /login，成功 flash 被吞。改造方向：改密成功 → Session.Flush() + success flash（复用 auth.errPasswordChanged）→ 直接跳 /login。
+  - 头像/背景裁剪：项目无任何 crop 库；第三方库全部自托管于 R2（r2.337845818.best/tamabox/cdn）。候选方案：Cropper.js 内嵌 static/（需扩 static/fs.go embed 规则）。当前 avatarPlaceholder 文案自嘲"非1:1会扁"但无强制。
+  - 复用点：profile-tabs 面板、Pickr 颜色选择、easy.qrcode 预览、UIkit modal/accordion、imagecheck 像素校验、storage.UploadPictureToS3（自动转 WebP、宽>1920 缩放）。
+  - i18n 四语言字典 key 全等校验（i18n_test.go TestDictionaryComplete），新增词条须同步 4 个 dict 文件。
+
+## 下午：profile account 面板改造已实施（用户已批准方案）
+
+- 决策：Cropper.js 走自有 R2 CDN（`lib/cropperjs/1.6.2/`，用户自行上传）；改密立即登出跳登录页；卡片分区+折叠（中等重构）；前后端双比例校验。
+- 改动清单：
+  - `route/user/profile.go`：avatar→storage.UploadAvatarToS3、background→storage.UploadBackgroundToS3（新增），改密成功（passwordChanged 标志）→ Session.Flush + flash(profile.flash.passwordChanged) → /login；比例不符 flash 提示（profile.err.avatarRatio / backgroundRatio）。
+  - `internal/imagecheck/imagecheck.go`：新增 ErrBadAspectRatio + CheckAspectRatio + DefaultAspectTolerance(0.01)；`imagecheck_test.go` 新增 4 个用例。
+  - `internal/storage/s3.go`：抽 uploadPictureToS3 内部分管线（aspect 可选），UploadAvatarToS3=1:1、UploadBackgroundToS3=16:9，魔数后、像素总量前校验；原有 UploadPictureToS3 兼容签名（其他调用方不变）。
+  - `internal/i18n/dict_*.go`（4 语）：新增 15 词条（card.* 4、cropHint 2、cropTitle/cropConfirm、pwdNote、pickAvatar/pickBackground、err.avatarRatio/backgroundRatio/cropLibUnavailable、flash.passwordChanged）。
+  - `templates/user/profile.html`：account 面板重构为 8 张卡片（基础资料/头像与背景[预览+裁剪]/二维码样式折叠/社交折叠/修改密码[随主表单]/标签/页面密码/账号操作）；头像 96px 圆、背景 16:9 预览；Cropper 弹窗+写回 file input 逻辑；accordion 展开时重绘二维码预览；新增 .tb-pcard 等样式与暗色适配、移动端单列。
+- 验证：go build ./...（用 dev/webpstub overlay 方式，Windows 无 libwebp）通过；go test internal/i18n + internal/imagecheck 通过；dev/checktpl 全模板语法 OK；HTML 标签开闭平衡校验通过。
+- 待办：R2 上传 cropper.min.{js,css} 到 r2.337845818.best/tamabox/cdn/lib/cropperjs/1.6.2/ 后即可端到端生效；未做浏览器实测（需本地 DB/Redis）。
+
+## 晚间：修复部署环境 `UIkit is not defined`（Rocket Loader 时序）
+
+- 现象：VM234:42 Uncaught ReferenceError: UIkit is not defined；更换头像/背景按钮点击无效果。
+- 根因：裁剪脚本（templates/user/profile.html 末尾）IIFE 解析期即执行 `var modalObj = UIkit.modal(modalEl)`；UIkit 在 base/header.html 是 defer 加载，Cloudflare Rocket Loader 把该内联脚本激活在 UIkit 执行前 → 抛错中断整个脚本 → `[data-pick-image]` 监听（其后）从未绑定。
+- 修复（templates/user/profile.html，4 处）：
+  1. `modalObj` 改为 null 懒创建（startCrop 内、依赖就绪后 `UIkit.modal(modalEl)`）；
+  2. 新增 `notify()`：UIkit 可用→UIkit.modal.alert，否则回退原生 window.alert；
+  3. 新增 `whenReady(cb)`：轮询等待 window.UIkit && window.Cropper，超时 3s → notify(MSG_NO_CROPPER)；文件大小校验前置（不依赖库）；
+  4. 脚本标签加 `data-cfasync="false"`，按钮监听尽早同步绑定。
+- 经验：模板内联脚本**禁止在解析期触碰 defer/外部库全局对象**（UIkit/Pickr 等），一律在用户事件回调内或依赖就绪后使用——Rocket Loader 会打乱执行序；全站内联脚本仅裁剪脚本踩中此坑。
+- 验证：node --check 通过（模板占位符替换后）；R2 上 cropper 文件此前 curl 仍不可达（HTTP 000），用户需先上传，否则选图后 3s 提示「裁剪组件暂不可用」——需提醒用户。
+
+## 晚间（二）：图像保存 UX + 同行居中 + console 噪音排查
+
+- 用户反馈：图像上传/裁剪已可用；但「保存修改」按钮在「修改密码」卡片里，改图后要去那里点击才生效，不直观；且头像修改显示在左上角别扭。
+- 改动（templates/user/profile.html）：
+  1. 头像与背景卡片内新增本地保存按钮（type=submit，label 新 i18n key `profile.saveMedia`，随主表单提交，裁剪写回的文件域一并上传）；CSS `.tb-media-save`（居中条）。
+  2. `.tb-media-row` 改 `justify-content:center`、子项 `flex:0 1 auto` + column 居中、`tb-frame-bg` 固定 320px（max-width:100%）；移动端 ≤640 子项 `flex-basis:100%` 上下堆叠居中、背景图全宽、保存按钮全宽。
+  3. 4 语字典新增 `profile.saveMedia`（zh-CN 保存头像与背景 / zh-TW 儲存頭像與背景 / en Save avatar & background / ja アイコンと背景を保存）。
+- console 噪音排查结论：`inspector.js` AbortError/Request timeout/responseType arraybuffer 报错**非项目代码**（全仓库 grep 无 inspector/fetch 包装）；是浏览器 XHR 监控类扩展包装 fetch/XHR + Rocket Loader 激进异步调度（arraybuffer 脚本请求被中止）造成的误报。建议无痕窗口验证 + 或 Cloudflare 关闭 Rocket Loader。
+- 验证：gofmt -w 4 个 dict；go test ./internal/i18n/ 通过；go run ./dev/checktpl 全模板语法 OK。
+
+## 晚间（三）：二维码/社交默认展开 + 头像背景组件等宽 + 每卡片独立保存按钮
+
+- 用户要求：①二维码、社交两块默认展开；②更换头像/更换背景组件大小一致（原头像 96 圆 vs 背景 320 宽预览悬殊）；③为 account 面板每块加独立保存按钮（仿头像背景卡样式）。
+- 改动（templates/user/profile.html）：
+  1. 卡片3/4 的 uk-accordion `<li>` 加 `uk-open` 默认展开（仍可折叠，multiple:true）。
+  2. `.tb-media-item` 固定等宽列 320px（flex:0 0 320 + max-width:100%），头像预览 96→120px、背景帧 width:100%（列内满宽 16:9）；`.tb-media-actions .uk-button` min-width:150px 令两个更换按钮同宽。移动端：头像 80→96px、item 全宽堆叠、按钮全宽。
+  3. 保存按钮：基础资料(profile.saveBasic)/头像背景(已有 saveMedia)/二维码(profile.saveQR)/社交(profile.saveSocial)/改密(原 admin.saveProfile 改 profile.savePassword「确认修改密码」)——均为同表单 type=submit（提交整表），复用居中类 `.tb-card-save`（与 .tb-media-save 同规则）。
+  4. 二维码预览：默认展开后从其它 tab（?tab=question 等）切回 account 面板时不会再触发 accordion 'shown' → showPanel 里 account 时调 `window.__tbRefreshAccountPreview`（IIFE 内暴露的 debouncedUpdatePreview）重绘。
+- i18n 4 语新增 saveBasic/savePassword/saveQR/saveSocial；admin.saveProfile key 保留未删（四语仍在，仅模板不再引用）。
+- 验证：go test ./internal/i18n/ 通过；go run ./dev/checktpl OK。
+
+## 晚间（四）：头像/背景框等高 + 按钮统一居中 + 页面纵向压缩
+
+- 用户反馈：①头像框偏小，希望与背景框显示高度一致；②按钮有的居中有的居左，要求统一并压缩空间。
+- 改动（templates/user/profile.html，纯 CSS/结构）：
+  1. 预览框等高：头像 120→150px 圆；背景框 267×150（16:9，与头像等高）；媒体列 320→280 等宽；行间隙 20/40→14/32；移动端头像 96→120px。
+  2. 按钮统一居中：账号操作卡片（登出/导出/停用）`text-align:center` + 行距 12→9px；卡片6 标签、卡片7 页面密码按钮 `div.uk-margin`→`div.tb-card-save`；提问面板 updateHarassment/updateAskPassword、私聊面板 updateChat 三个按钮同改居中。
+  3. 压缩：`.tb-pcard` padding 16/16/10→13/14/8、margin-bottom 16→12、标题 margin 12→10；新增 `.profile-panel .uk-margin { margin-bottom: 12px }`（全面板字段间距 20→12）。
+- 范围说明：global-blockwords / feature-control-form 两个 partial 模板（三面板共用）内按钮未改（避免影响其它页面），如需统一再单独处理。
+- 验证：go run ./dev/checktpl OK。
+
+## 晚间（五）：账号操作按钮分组同行 + partial 内按钮居中
+
+- 用户要求：①导出数据/导出全部数据按钮同一行；②退出登录/停用我的账号同一行；③屏蔽词设置、计数设置也居中。
+- 改动：
+  1. `templates/user/profile.html`：账号操作卡重构为 `.tb-account-pair`（flex 居中，两按钮同行）：导出组（默认按钮×2，target=_blank 表单）+ 说明行 `.tb-account-note`；登出组（danger 按钮+停用链接）+ 说明行。旧的 `.tb-account-action` 行式堆叠 CSS 删除，暗色规则改 `.tb-account-note`。
+  2. `.feat-quota-line` 加 text-align:center；`.feat-actions` 加 justify-content:center（保存/重置计数按钮居中）——覆盖 feature-control-form（提问/私聊/投票共用）。
+  3. `templates/user/global-blockwords.html`：提交按钮行 `.uk-margin` → `.tb-card-save`（居中）；该 partial 仅 profile.html 引用，无外溢。
+  4. 说明文字合并保留：exportHint+exportJSONHint 合并一行小字，deactivateHint（含 <b>）保留在其按钮组下方（deactivate 确认页另有完整警告文案）。
+- 验证：go run ./dev/checktpl OK。
+
+## 晚间（六）：修复导出按钮点击后永久「提交中」转圈
+
+- 现象：导出数据/导出全部数据（target=_blank 下载表单）文件能下，但按钮永久转圈禁用。
+- 根因：`templates/base/footer.html` 全局 submit 反馈（P0 防重复提交）把触发按钮置「转圈+提交中」并禁用；复位仅靠整页导航/bfcache pageshow。`target="_blank"` 下载表单当前页不导航 → 无复位机会 → 永久卡死。
+- 修复（双保险）：
+  1. `templates/user/profile.html`：两个导出 form 加 `data-tb-skip-submit-feedback="1"`（footer 既有跳过通道，每次 submit 读到即跳并移除）。
+  2. `templates/base/footer.html`：submit 监听里对 `form.getAttribute('target')==='_blank'` 一律 return 跳过反馈——防御未来任何下载/新窗口表单踩同一坑（全站现存 target=_blank 表单仅 profile 这两处，行为从“卡死 bug”变“无反馈”=纯修复）。
+- 经验：全站提交反馈的复位依赖导航，凡不触发本页导航的提交（target=_blank / 下载 / iframe）都必须显式跳过。
+- 验证：go run ./dev/checktpl OK。
+
+## 晚间（七）：私聊面板 chat 专属功能聚合单卡
+
+- 用户要求：`?tab=chat` 面板里「私聊块」（功能开关/收集窗口 feature-control-form）与「私聊设置」（update-chat-settings 消息上限）聚合为一张卡；全局屏蔽词为三面板共享、保持独立。
+- 改动（templates/user/profile.html）：
+  1. chat 面板改两段结构：私聊专属 = `<section class="tb-pcard chat-zone">` 内含 FeatureChat partial + `<hr>` + update-chat-settings 表单（原外层 `div.uk-margin` 移除）；全局屏蔽词维持原 `hr` + partial 独立区。
+  2. CSS `.chat-zone`：内部 `.feat-card` 去边框透明（padding:0; border:0; background:transparent），避免卡中卡；`hr` margin 14px；内部 `legend`（admin.chat）从 uk-legend 大标题降级为 1.05rem 小节标题。
+- 提问/投票面板未动（结构同前）。
+- 验证：go run ./dev/checktpl OK。
+
+## 晚间（八）：功能控制卡按钮尺寸统一为常规按钮
+
+- 用户要求：「保存该功能设置」按钮样式/大小改成与「更新私聊设置」一致；「重置计数」同调。
+- 改动（templates/user/feature-control-form.html，三面板共享 partial）：feat-actions 内两按钮去掉 `uk-button-small` —— 保存改 `uk-button uk-button-primary`、重置改 `uk-button uk-button-default`（常规尺寸，与全站其它表单主按钮一致）。提问/私聊/投票同步生效。
+- 验证：go run ./dev/checktpl OK。
+
diff --git a/.workbuddy/memory/2026-09-05.md b/.workbuddy/memory/2026-09-05.md
new file mode 100644
index 0000000..d2ad474
--- /dev/null
+++ b/.workbuddy/memory/2026-09-05.md
@@ -0,0 +1,167 @@
+# 2026-09-05 工作日志
+
+## 提问箱公开主页「加载更多」翻页失效（内容重复）排查
+
+- 用户报告：提问列表加载完后「加载更多」按钮仍在，点击后加载相同内容。示例链接 `https://box.tama.guru/_/aoi/3105?t=Kmd0mu`（item 页底部嵌有该箱「历史提问」列表 + history-template 加载更多）。
+- 代码链路：`templates/question/history-template.html`(Alpine fetch) → `route/question/page.go ListAPI`(`/api/v1/user/{domain}/questions`) → `internal/db/questions.go GetByUserID`(PinFirst 复合键集游标 `isPinned.CreatedAtUnixNano.ID`)。
+- 线上实测（box.tama.guru, aoi 箱共 38 条已答公开问题）：
+  - 首页 20 条 id 3109→3089；`next_cursor=0.1788566476678885000.3089`。
+  - 携带任意真实 next_cursor 再次请求 → 仍返回首页同样 20 条（has_more 恒 true）→ 内容重复、无法翻页（已稳定复现）。
+  - 部分异常游标返回空集/6 条等与源码 keyset 预期不符的怪异结果 → 指向线上二进制或 DB 环境与工作区源码假设不一致（时区/列精度/部署版本），单凭源码无法闭合解释。
+- 前端模板与工作区 0904 版逐字符一致（x-on:click.debounce、payload.next_cursor、注释），说明线上模板=新版；但服务端行为异常。
+- 历史：outputs/re-audit-2026-09-01.md P0-2 曾记录同款症状（前端回传旧格式游标→parsePinCursor 失败→永远第一页），当时修复为服务端下发 next_cursor；但线上当前仍复现，说明修复未生效或有残余缺陷。
+- 后续建议：生产库执行 keyset SQL 直查对照 + SHOW CREATE TABLE 确认列精度；代码侧做健壮化（游标未前进/解析失败 → 返回空 + has_more=false；前端按已见 id 集合防重）。
+
+## 落地修复（用户选定：防重复兜底）
+
+1. `internal/db/questions.go`：
+   - `GetByUserID`：携带游标但 PinFirst 复合游标/纯 id 游标解析失败时，由「忽略游标静默回退首页」改为直接 `return []*Question{}, nil`（空列表 → 上层 has_more=false → 按钮收敛）。
+   - `getBy`（GetByAskUserID 旧路径）：同步改为解析失败返回空。
+2. `templates/question/history-template.html`：
+   - SSR range 项与 JS append 项均加 `data-qid`；点击时先扫描 `#question-list [data-qid]` 收集已见 id，过滤重复项；无新增条目时 `more=false`（按钮隐藏/显示无更多）。
+   - 注释说明重复加载 bug 的历史形态。
+3. 验证：`go build ./internal/db/...`、`go vet ./internal/db/` 通过；模板测试 `TestTemplatesParse/TestTemplateCrossReferences/TestRenderPublicQuestionList/TestRenderPublicQuestionItem` 全 PASS。全量 `go build ./...` 因第三方 `chai2010/webp`（CGO，本地缺 C 库）预存失败，与本次改动无关。
+4. 待办（未做）：生产侧核对部署二进制是否含 9/1 P0-2 修复、DB 列精度/时区一致性诊断；线上复现的 keyset 怪异行为（同 nano 不同 id 返回不同页等）仍未完全由源码闭合解释。
+- 为用户产出 PG 根因诊断脚本 outputs/pg-cursor-pagination-diagnose.sql：PART A 环境/表结构/集合核对（含 created_at 列精度、索引、answered_public_all 应=38 与线上 API 对齐）；PART B 用 DO+临时表纯 SQL 复刻 ListAPI 复合键集翻页循环，逐页打印 ids、带死循环/重复页检测；PART C UnixNano 指纹核对（1788566476678885000 类）用于区分部署版本旧 vs DB 环境问题。ListAPI 等价条件已核对: FilterAnswered(True)+PrivateStatus=1+PinFirst+page_size=20+1 探测。待用户执行回贴结果判读。
+- 生产库真实结构确认（用户探查）: schema=nekobox（search_path 默认 public 导致首版脚本找不到表）；nekobox.questions: id numeric(seq nekobox.questions_id_seq), created_at/updated_at/deleted_at = timestamp(6) WITHOUT TIME ZONE, user_id bigint, answer text, is_private/is_pinned/is_read boolean NOT NULL；nekobox.users 含 domain。线上库与源码(GORM timestamptz 假设)不一致 -> 无时区列+Go UTC 解释=线上 keyset 错位头号嫌疑。产出 v2 脚本 outputs/pg-cursor-diagnose-v2-nekobox.sql：SET search_path=nekobox; PART A 结构/集合核对(应38)+DB墙钟vs线上Z文本目视(差8h即偏移实锤); PART B DO+临时表纯墙钟 keyset 复现(锚点 timestamp 变量避免时区换算, 重复页/死循环检测); PART C nano 指纹反推命中检测(match_3089)+Z文本墙钟命中。待用户执行回贴。
+- 【根因闭合】v2 脚本线上结果: aoi_user_id=329, answered_public_all=38(与线上API一致), 无置顶行(pinned=0)。DB 墙钟==线上 JSON Z 文本（无时区偏移，会话 Asia/Shanghai 不影响无时区列直比）。PART B 纯墙钟 keyset 翻页: 第1页20条(3109..3089)=线上首页, 第2页18条(3088,2883..2411), 无重复无跳行 -> **DB 层完全自洽**。PART C: nano=1788566476678885000 反推墙钟 00:01:16.678885 精确命中 3089 (match_3089=t), Z 文本命中 3109/3089 -> 服务端 encode 正确、无时区/精度错位。结论: DB/SQL 层彻底排除，线上"游标被无视返回首页"只能用【线上部署二进制与 0904 源码不一致(解析路径差异)】解释。修复=部署含防重兜底的最新源码; 部署后需 curl 复测翻页收敛。
+- 【真根因确认+已修复】部署 0904 后线上仍复现 -> 读 parsePinCursor 源码定位: `time.Unix(0, nano)` 返回 Local 时区，进程 TZ=Asia/Shanghai 时墙钟 +8h(00:01->08:01)。生产 questions.created_at 是 timestamp WITHOUT time zone，驱动按 time.Location 墙钟直发无时区列 -> `created_at < '08:01'` 对库内全部 00:xx 行恒真 -> keyset 退化为全量 -> 永远返回首页 has_more=true -> 无限循环。本地实验 tz_proof.go 证明 08:01 vs 00:01 偏移。已修复 internal/db/questions.go parsePinCursor: time.Unix(0,nano) -> time.Unix(0,nano).UTC()（含时区约定注释）。build/vet PASS。其余 UnixNano 用途(随机/文件名)无 keyset 风险。待用户重新部署后 curl 验收翻页收敛(38条唯一)。
+- 【修复验收通过】用户重新部署后线上验证：第1页20条(新增20) has_more=true -> 第2页18条(新增18) has_more=false -> 总计38条唯一，完全收敛 ✓。非法游标(abc)/旧纯id游标(3089)均返回 {"data":[],"has_more":false} -> 解析失败收敛兜底同时生效。根因(parsePinCursor 时区偏移)与今日两处防重兜底均已上线。问题闭环。
+- 用户拟将生产库克隆到本地实验环境做 timestamptz 迁移测试。本地已建独立 PG 测试实例: 127.0.0.1:5433, user=postgres, trust 认证, data 目录 $HOME/AppData/Local/Temp/tamabox-pg-clone-test/data (PostgreSQL 18 at C:/OtherFiles/PostgreSQL/18)。等待用户 pg_dump 生产库(Fc, --schema=nekobox) 后导入跑迁移验证(epoch 快照/转换/验收/翻页复现)。注意本地另有用户自己的 5432 实例(scram 认证, 无密码勿扰)。
+- 【timestamptz 迁移已在克隆库验证通过】用户 dump(nekobox_clone_20260905.dump, 资料库 drive 节点 6oAmSRkxq7DVFAnqRt8QEv) 下载后导入本地 5433 测试实例 nekobox_clone。结果: 16 表, aoi=38 与线上一致。实际无时区时间列仅 4 表 12 列: questions/users/censor_logs/upload_images(其余表本为 timestamptz)。Asia/Shanghai 会话下迁移 ALTER TYPE timestamptz USING AT TIME ZONE 'UTC': 1.7s 完成, epoch 前后差异 0 行, 残余 without=0; 关键行指纹 3109=1788569378648502000/3089=1788566476678885000/2411=1781735419615754000 与线上一致; keyset 翻页带 +00 参数精确翻出线上第2页同款 18 条; 索引完整; 回滚路径双向验证无损。产出 outputs/timestamptz-migration-online.sql(PART0 核对/1 快照/2 迁移/3 验收4项/4 注释回滚)。克隆测试实例与 dump 暂存本地 Temp, 待用户线上执行确认后清理。
+- 【线上 timestamptz 迁移执行成功】用户线上跑 timestamptz-migration-online.sql: PART0=4表12列, PART1快照12列, PART2迁移DO完成, PART3验收全绿: 3.1 epoch差异0行, 3.2 remain_without=0, 3.3 指纹 2411=1781735419615754000/3089=1788566476678885000/3109=1788569378648502000 与克隆库/线上游标一致, 3.4 keyset第2页18条(3088,2883..2411)同款。但端到端验收受阻: box.tama.guru 持续 HTTP 521(源站不可达, 页面+API均打不开, 观察约2.5min) -> 疑似用户正在重启/部署应用或服务宕机, 待服务恢复后重跑翻页验收脚本(38条唯一收敛)确认整体闭环; 本地5433克隆实例与dump暂留待最终验收后清理。
+- 【端到端验收通过·最终闭环】服务启动后重跑线上翻页: 第1页20条 has_more=true -> 第2页18条 has_more=false -> 38条唯一收敛 ✓。注意: 迁移后 JSON created_at 文本从 "...Z"(UTC) 变为 "...+08:00"(session TZ=Asia/Shanghai) —— 绝对时刻一致。前端消费核对: history-template SSR {{Date .CreatedAt}} 迁移前显示 UTC 墙钟(少8h) 而 JS dayjs() 追加项本地化 -> 首屏与追加时间曾不一致(隐藏显示bug), 迁移后 SSR 读 timestamptz 转会话时区 -> 两者一致且显示上海本地时间(对用户更正确); item.html/list.html 同理顺带修正。无需改代码, 属显示语义修正观察项。遗留: 用户清理 diag_test 报依赖错误 -> 解答用 DROP SCHEMA diag_test CASCADE (schema 内仅 snap_before/snap_after 两张自建快照表)。本地 5433 克隆实例+dump 待清理。
+- 【发现迁移基准错误+已产修复脚本】用户反馈: 真实本地时间 00:01 的提问页面显示 08:01 -> 存量墙钟实为"上海本地时间"(驱动按进程本地墙钟写无时区列, 读出按UTC标记, 文本一致造成 v2 诊断"对称"假象), 先前迁移用 AT TIME ZONE 'UTC' 把上海墙钟误标 UTC -> 存量绝对时刻整体 +8h。克隆库验证反向修正(USING c AT TIME ZONE 'UTC' AT TIME ZONE 'Asia/Shanghai', 净-8h): 3089 08:01->00:01:16+08 (epoch 1788566476678885000->1788537676678885000), 3109->00:49:38+08, 2411->06-17 22:30+08; keyset 第2页仍18条。产出 outputs/timestamptz-migration-fix-8h.sql (PART0 聚焦4表12列/1快照/2修正/3验收含3.1显示+epoch/3.2翻页/3.3计数/3.4残余/4注释回滚=反向AT TIME ZONE 'Asia/Shanghai' AT TIME ZONE 'UTC')。克隆库全流程演练通过。待用户线上执行贴回 + 我重跑 API 验收(next_cursor nano 应从 0.1788566476678885000 变 0.1788537676678885000)。
+- 【线上反向修正验收通过】用户线上执行 timestamptz-migration-fix-8h.sql(PART2 修正完成, 后续输出被 psql 分页截断不影响), 我直接 API 验证: next_cursor nano 1788566476678885000->1788537676678885000 ✓, created_at 文本回到本地墙钟 00:49:38.648502+08:00 / 末条 00:01:16.678885+08:00 ✓, 翻页 38 唯一收敛 ✓。存量时间语义修正为"上海墙钟"。注意: 该脚本不可重跑(会再-8h)。遗留: 用户如需补看验收可跑只读 SQL; diag_test 清理可用 DROP SCHEMA diag_test CASCADE; 本地 5433 克隆实例+dump 待清理(询问用户后执行)。
+- 【留档完成】事故复盘文档 outputs/TamaBox-v4-keyset-pagination-timezone-incident-2026-09-05.md：完整记录两层缺陷(①parsePinCursor time.Unix Local +8h 致 keyset 失效②timestamptz 迁移基准误用 UTC 致存量+8h 已反向修正)、时间线、4文件代码改动、SQL 脚本产物清单(标注 v1/v2 已淘汰、online.sql 基准错误勿复用、fix-8h.sql 不可重跑)、经验教训预防清单(无时区列+带时区代码混用是土壤/迁移前须用现实锚点确认数据语义/文本一致≠语义正确)、遗留建议(页面抽查/可选 UTC 输出/清理克隆实例与dump/生产 DROP SCHEMA diag_test CASCADE)。
+
+## UIkit CSS 迁移公共 CDN（速度优化落地）
+
+- 背景：生产速度测试发现 R2 自托管 `uikit/3.3.3/css/modify-black-font/uikit.min.css`（263432B）加载 ~1100ms 是大头。
+- Diff 结论：自建版与官方 uikit@3.3.3（263444B，sha256 6630e078...）**仅 3 处颜色差异**——把有色容器(.uk-light/.uk-card-primary/.uk-card-secondary/.uk-overlay-primary/.uk-section-*/.uk-tile-*/.uk-offcanvas-bar)内默认白字/白标题改黑：容器文字与 table th `rgba(255,255,255,.7)→rgba(0,0,0,.7)`，h1-h6/.uk-h*/.uk-heading-* `#fff→#000`。
+- 模板实际仅用 `.uk-light`（用户背景封面，question/list.html、question-not-found.html；内部 h3/p 由 #usernamecolor/#introcolor 内联 JS 覆盖，优先级最高），其余有色容器全仓无 class 使用 → 补丁可只投影 .uk-light（477B 代替 9KB）。
+- 测速（本地国内网络，全量 263KB 3 次）：cdnjs.snrat.com ~0.25s（热）最快 > jsdelivr ~0.47s > unpkg ~1.3s > cdnjs.cloudflare ~1.0-1.4s > R2 自建 1.4-2.0s。check-host.net 全球 12 节点：snrat 与 jsdelivr 均 12/12 = 200 OK（snrat 根路径 301 不影响带资源路径请求）。snrat 缓存头 max-age=31104000（360 天）。
+- 落地修改（仅 templates/base/header.html）：
+  1. css link → `https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/css/uikit.min.css`
+  2. js（uikit.min.js/uikit-icons.min.js）→ `https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/js/...`（CDNJS 路径与 cdnjs 官方同构，已验证文件存在 Content-Type 正确）
+  3. link 后新增补丁 `<style>`（.uk-light 黑字 3 条规则 + 扩展警告注释）
+  4. 头部 preconnect 增加 `https://cdnjs.snrat.com`（注释同步更新，原"全部归拢 R2"说法过时）
+- 验证：go test ./templates（TestTemplatesParse/TestTemplateCrossReferences/TestRenderPublicQuestionList 等）全 PASS；CSS 括号配对/规则数 3 条自检通过。
+- 未做（用户排除）：Rocket Loader（cloudflare-static/rocket-loader.min.js 1100ms）需在 Cloudflare 后台关闭 Speed→Rocket Loader。
+- 注意：原 R2 路径 `.../expire-1-y/uikit/3.3.3/css/modify-black-font/uikit.min.css` 仍保留可访问（回滚用）。若日后引入 .uk-card-primary 等容器需黑字，须扩展补丁（参考此节差异清单）。
+
+## UIkit 迁移生产/测试环境验收（对比通过）
+
+- 部署后对比（真实浏览器 computed style 实测，agent-browser eval，注意本会话模型不可读图、勿再用"看截图"断言）：
+  - 生产 box.tama.guru/_/tamakyi（旧代码）：uikitSheet=r2 modify-black-font；.uk-light 容器色 rgba(0,0,0,.7)；navbar_bg rgb(248,248,248)；username 内联色 rgb(0,123,255)（小狼账号自设蓝）、intro rgb(205,76,108)（自设粉）。
+  - 测试 box-dev-api.337845818.best/_/admin6（新部署）：uikitSheet=cdnjs.snrat.com 官方；.uk-light 容器色 rgba(0,0,0,.7)（补丁生效=modify-black-font 等价）；navbar_bg rgb(248,248,248) 一致；username/intro 内联色 rgb(0,0,0)（admin6 账号默认黑，非 CSS 差异）。
+  - 结论：UIkit 相关 computed style 两环境逐值一致 → 迁移无回归。用户名/简介颜色差异仅来自各账号服务端颜色字段。
+- 环境坑记录：agent-browser 冷启动需 `agent-browser install`（Chrome 152 下载 193MB，卡住原因=缺浏览器）；open+eval 组合命令易超时被 auto-background，应 open 与 eval 分两条命令执行；本环境 curl 落盘/-o /dev/null 偶报 error 23 但不影响数据（可改 stdout+管道）。Chrome 位置 C:\Users\Tamakyi Gekka\.agent-browser\browsers\chrome-152.0.7977.82。
+
+## uikit R2 vs snrat 国内外测速（5 次全量下载中位，2026-09-05）
+
+- 国内本机：OLD-css 0.864s→NEW 0.200s（4.3x）；OLD-js 0.796→NEW 0.163（4.9x）；OLD-icons 0.824→NEW 0.177（4.7x）。三资源合计 2.48s→0.54s，净省 ~1.9s。
+- 国外 check-host.net 多节点（两轮）：CSS p50 R2 240-358ms vs snrat 233-420ms ≈ 打平（R2 偶发长尾 max 3.3-4.8s，snrat 平稳 ≤896ms）；JS p50 R2 372ms vs snrat 647ms，R2 快 ~40%。
+- 结论：snrat 国内完胜；海外 R2(Cloudflare 全球边缘)略优/打平。站点访客以国内为主 → 切 snrat 净收益大。若未来在意海外可 geo 双源（国内 snrat / 海外 R2），当前不做（过度设计）。
+- 测速脚本已归档 dev/bench-cdn.sh（cn=国内 5 次全量取中位 / global=check-host.net 海外 p50/p90），cn 模式冒烟通过（复测数据与基线一致）。
+
+## 部署架构澄清（用户补充 + 实测确认）
+
+- 用户架构：正式 box.tama.guru 与测试 box-dev-api.337845818.best 均经 Cloudflare Tunnel 开放；box.tama.guru 是国内走腾讯 EdgeOne 的双入口。
+- 实测（国内本机/出口视角）：box.tama.guru → 43.174.247.43 Server: TencentEdgeOne（HTML 无 rocket-loader 注入，干净）；box-dev-api.337845818.best & r2.337845818.best → 172.67.144.141 Server: cloudflare CF-RAY AMS（HTML 含 rocket-loader）；cdnjs.snrat.com → 101.227.21.24（国内节点）。
+- 推论：Rocket Loader 只在 Cloudflare 边缘对走 CF 的请求注入 → 仅影响海外路径与测试域名；国内 EdgeOne 路径 HTML 干净（EdgeOne 回源直连源站不经 CF HTML 重写）。本机出口连 CF 落在 AMS（阿姆斯特丹）→ 本机测 R2 慢不代表真实国内用户（其可能经 CF 亚洲/香港节点），但 snrat 国内节点快是实打实。
+- 待用户确认：① 之前 1100ms rocket-loader 截图是否来自海外/测试域名或未接 EdgeOne 前 ② r2.337845818.best 是否也接 EdgeOne（未接 → 静态资源国内仍可能慢，是后续优化重点）③ CF 侧 Rocket Loader zone 开关位置。
+- 【用户澄清+盘点完成】①截图=PageSpeed(海外探测)，非国内 ②r2.337845818.best 未接 EdgeOne ③DNS 分流架构：dnspod 按境内/境外解析 box.tama.guru，境内 EdgeOne/境外 Cloudflare。据此修正认知：国内不受 Rocket Loader 影响；国内真实瓶颈=R2 的 CF 国际链路。全量盘点 r2 静态资源（outputs/r2-assets-cdn-audit-2026-09-05.md）：sha256 校验 6 个 JS 库（jquery/dayjs/alpine/cropperjs/vConsole/waline.js）=纯官方原版；实测 R2 每资源 0.72-1.10s vs snrat 0.15-0.42s（2-7.4×）；关键认知=公共 CDN(cdnjs.cloudflare/jsdelivr 0.6-1.8s)≠快，要选 snrat 国内节点。waline-no-commits.css 为刻意定制（39 条 .wl-card display:none 隐藏评论列表，与官方选择器全同）不可直换官方。easy.qrcode=remake 定制、neko-pixel 0.0.21 npm 查无、time.box.js/图片图标=专属 → 无公共源。建议：方案 A(R2 接 EdgeOne 根治定制文件)+方案 B(A 组 5 库迁 snrat) 组合，待用户批准。
+- 【重大认知修正 + 方案落地】itdog 大陆多节点测速（用户截图）：box.tama.guru（EO新加坡,43.174.247.43）大陆均值 3.2-3.6s、三网骨干峰值 9-11s（四川电信 11.1s）；box-dev-api（纯 CF，172.67.144.141/147.52/80.1）大陆均值 5.7-6.5s、峰值 12s。**反向分布**：港澳台/新疆/内陆部分省份反而 300-500ms。结论：① CF 与 EO 单走大陆都慢 3-12s，CF tunnel 不是备案前解药，删 DNS 分流的方案被证伪 ② R2 大陆实测 ~250ms 正常，静态资源非瓶颈 ③ 真正瓶颈=大陆→境外源站(EO新加坡/CF边缘)动态页链路。Rocket Loader 用户已手动关闭，HTTP/3 已开启。后端审计初步：box-dev-api 的 /favicon.ico→302 首页、robots.txt 1.1-2.4s(本机 AMS 视角)、cf-cache-status: BYPASS → 静态未缓存且每次回源，存疑点待大陆视角复核。根本解决路径只剩备案+大陆 CDN（腾讯云/阿里云，或 CF 中国伙伴京东云/世纪互联），备案前可做项=静态库迁 snrat。方案 B 已落地：jquery3.7.1/dayjs1.10.8/alpine3.9.0/cropper1.6.2(js+css 用 min 版)/vConsole3.12.1/waline2.15.8 共 7 文件全部 sha256 校验一致后 R2→cdnjs.snrat.com（4 文件：header/list/question-not-found/profile），备份在 .workbuddy/backup/cdn-migration-20260905/，go test templates 通过。R2 保留：easy.qrcode remake/waline-no-commits.css/time.box.js/pickr(1.10.1 snrat 404 未收录)/neko-pixel 0.0.21/logo/社交图标。
+- 【snrat 部署验收通过】用户部署 box-dev-api 后用浏览器实测 admin6 主页：HTML 全部 snrat 引用已生效（uikit/css/js/icons、dayjs/alpinejs、waline.js/jquery/min），无 Rocket Loader 注入。document.readyState=complete，UIkit/Dayjs/jQuery/Waline 全局对象全部存在，UIkit 组件（navbar、tab、表单、按钮）渲染完整、.uk-light 补丁正确生效、定制文件（waline-no-commits/easy.qrcode remake/time.box.js/社交图标）继续走 R2 无回归。截图已存 outputs/admin6-snrat-check.png。验收小波折：open+eval 组合命令易卡顿（已分步解决），首次 eval 在 defer 脚本未执行完时探测 typeof UIkit=false 属时序问题，等 3s 后 UIkit=true。
+- 【生产部署验收通过】box.tama.guru 主页/用户页 HTML 引用全部确认（uikit/dayjs/alpinejs/jquery/waline.js → cdnjs.snrat.com，旧 R2 库残留=0，定制文件 waline-no-commits/time.box.js/tamabox_low.png 继续 R2 200 可达）。浏览器实测 /_/tamakyi：UIkit/dayjs/jQuery/Waline 全局对象全部就位（UIkit=function）、navbar rgb(248,248,248)、.uk-light rgba(0,0,0,.7) 补丁生效、用户名 rgb(0,123,255) 账号自设色、28 UIkit 按钮，无回归。截图 outputs/prod-tamakyi-snrat-check.png。⚠️ 踩坑记录：agent-browser 探测 defer JS 库有显著时序窗口——本机(AMS 出口)拉 snrat 国内节点 133KB uikit.min.js 需数秒，过早 eval typeof UIkit=false 属假阴性；且 CDN 无 Timing-Allow-Origin 时 resource timing 全 0 属正常。正确姿势：open 后 sleep≥8 再 eval，或先 fetch 触发等待；判断库是否成功以全局对象(typeof)为准，勿信 resource timing。
+- 【后端审计补完】澄清两个疑点+确认一个真问题：① /favicon.ico、/robots.txt、/ 的 302 是 curl -sSI(HEAD) 假象——flamego f.Get 路由对 HEAD 不匹配返回 302，GET 全部 200，浏览器无影响，撤稿之前"favicon 302"结论。② 真问题：route.go 的 favicon/robots/sitemap/llms/llms-full 5 个 embed handler 只设 Content-Type 无 Cache-Control → CF cf-cache-status: BYPASS、EdgeOne Age:0 每次回源 tunnel。全项目仅 share.go:501 share-card 设了 public max-age=300；/static/* 由 flamego.Static CacheControl 统一 86400。③ 动态页 HTML 无缓存头是预期(个性化)，edge 每次回源属免备案架构使然。待批修复：5 个 handler 各加 Cache-Control: public, max-age=86400（约 5 行，纯增益）。源站不在本机(无 cloudflared/tamabox 进程)，localhost 直测不可行。
+- 【修复落地】route.go 5 个 embed 静态 handler（/favicon.ico /robots.txt /sitemap.xml /llms.txt /llms-full.txt）各加 Cache-Control: public, max-age=86400。验证：gofmt 干净 + go build -overlay 编译通过 + go test ./internal/route/ 通过。⚠️ 环境坑记录：Windows 本机全量 go build/go test 会因 chai2010/webp@v1.4.0(cgo 依赖 libwebp) 报 undefined webpGetInfo 等——需用 dev/webpstub 机制：dev/overlay.json 已失效(指向旧仓库路径 TamaBox-v4-time)，正确姿势=自建 overlay 把 internal/storage/s3.go 替换为 stub(s3.go 导出符号仅 MaxUploadBytes/UploadAvatarToS3/UploadBackgroundToS3/UploadPictureToS3/ConvertStaticImageToWebP + oss.go 引用的私有 isSupportedImage)，本次 stub 存 %TEMP%/s3_stub_tamabox.go、overlay 存 %TEMP%/ov-tamabox.json，命令：go build/test -overlay=...。部署链：Dockerfile CGO_ENABLED=0 + go build ./cmd/（生产无碍）。
+- 【测试环境缓存修复验收】box-dev-api 5 路径(favicon/robots/sitemap/llms/llms-full)响应均已带 Cache-Control: public, max-age=86400（HTTP 200）。⚠️ CF 缓存机制要点：无 cookie 首访 → session 中间件 Set-Cookie(flamego_session) → cf-cache-status: BYPASS 永不缓存；带有效 cookie 请求 → 不 Set-Cookie → MISS→HIT(Age 递增) 正常缓存。真实浏览器=先访问 HTML 已种 cookie→后续 favicon 等请求均带 cookie→缓存命中；无 cookie 场景仅 curl 首访/搜索引擎爬虫(低频,可接受)。测试环境通过，用户将部署生产。若日后想让爬虫也命中缓存：把静态路由挪到 session 中间件之前或让 session 跳过静态路径（本次未做）。
+- 【答疑】/.well-known/pki-validation/fileauth.txt 删除后仍被爬：① 线上实测两环境均 302→/（Go http.Redirect 标准输出），文件内容确已删除生效；② 请求持续=全网证书/安全扫描器将 .well-known/pki-validation 与 acme-challenge 同列标准探测目标，按字典批量扫所有域名，与文件是否存在无关；③ 302 来源=route.go:396 f.NotFound handler（先 ab.Record 404 计数再 ctx.Redirect("/")，注释说明 flamego NotFound 先写 404 再 302）；④ 噪音放大：探测 302→扫描器跟随→再请求 / 首页，日志翻倍且 CDN 不缓存 302（EO-Cache-Status: MISS/DYNAMIC）每次回源。治理可选：CDN 规则边缘拦 .well-known/*(推荐,零回源)/f.NotFound 对探测路径直接 404 不 302/autoban 敏感路径加速封禁。等待用户选方向。
+- 【架构澄清+瓶颈定位实验设计】用户澄清架构：海外=CF+tunnel+优选网络；国内=EdgeOne 直连源站 IP（回源不走 tunnel）。质疑"大陆→境外源站"归因。回应要点：大陆用户连的是 EO 节点非源站（此前表述简写失准），但 EO 国际站无大陆 PoP（43.174.247.43=新加坡），"境外段"=大陆→EO 新加坡节点（itdog 3-11s 证据即此段）。分离实验：生产 robots.txt 已确认 EO HIT 缓存（MISS→HIT Age 2/3，证明 cache-control 5 行修复已部署生产生效）→ 用户 itdog 对比 robots.txt(HIT 零回源) vs /_/tamakyi(每次回源)，差异=EO→源站回源段+源站处理；若 robots 也 3s+ 则瓶颈纯在大陆→EO 段与回源方式无关。需用户补测+告知源站位置（决定回源段性质：源站大陆则 EO 新加坡→大陆回源也属国际链路）。
+- 【链路分解实测完成】用户确认服务器在境外。三组实测：① 本机 curl(AMS 出口)：robots.txt(EO HIT 零回源) 0.6-2.2s 波动 vs 动态页 /_/tamakyi ttfb 0.87-1.46s——EO HIT 也波动大，非回源差异；② check-host.net 全球 25 节点：robots.txt(EO HIT) p50=1258ms min505(us2) vs 动态页(回源) p50=1217ms min735(jp1)——**两者几乎相同**→ 证明 EO→境外源站回源段快(服务器境外)，动态页不比零回源静态慢；③ agent-browser 页面级(AMS)：TTFB 348ms、HTML download 555ms、load_total 1.1s、最慢资源 log beacon 1944ms。结论：动态页慢的根因=用户→EO 新加坡节点段（大陆 itdog 3-11s 因国际出口拥塞；连欧美节点也 0.5-2.7s 因 EO 国际站无大陆 PoP 且节点网络质量差），与回源方式(tunnel/优选/直连IP)无关。对照：snrat(国内 cdnjs 镜像) 全球 p50 仅 257ms ≪ EO p50 1258ms，EO 国际站全球表现差。根治=备案+大陆 CDN。
+- 【HTML 压缩评估】生产 /_/tamakyi：原文 61,125B（内联 style 11 块 19,972B + 内联 script 10 块 14,048B + 外链 9js/2css + 空白 4KB）。gzip 已在源站开启（internal/route/gzip.go GzipHandler 挂 http.Server 最外层，处理 204/304/嗅探/Flusher，不主动 flush 单块输出；EO 透传带 Vary），gzip-9 后仅 14,966B(24%)。无显式 Flush 调用点 → 无多次 RTT 问题。结论：压缩已最优；555ms download 主因是高 RTT 非体积；内联 CSS 20KB 是设计（高 RTT 下内联优于外链+缓存），不建议外链化；剩余微优化(minify 内联块/去空白)收益 <1KB gzip，无意义。真正优化=降 RTT(大陆 CDN)。
+- 【EO 优选调研】结论：①有，社区"EO 优选 IP"玩法与 CF 优选同原理：EO 官方 CNAME 把大陆调度到新加坡(43.174.247.43 AS139341 ACE)慢，社区做法=DNS 改 A 记录直指香港等优质 EO 边缘 IP(43.174.150.x 香港同 AS)。数据源 wetest.vip(page/edgeone/address_v4 需登录，15min 更新)/cf2dns 面板/archlinuxcn forum 教程。②实测：xhh 教程香港 IP 43.174.150.199/119 已失效(000，时效性强需活源+月度更新)；EO 大陆可达节点列表(EdgeOne-ips-Checker available_eofreecn_ips 167 个大陆 IP)接口 2026-07-31 停服 8-31 下线，实测全 000 → B 类已死。③EO 官方内建"自研协议优化/回源链路探测"(类 Argo)但无法解决无大陆 PoP；优选只能把边缘从新加坡换香港(大陆 3-11s→预计 50-200ms，待 itdog 验证)。④落地=dnspod 境内线路解析值改 A 记录指向活香港 EO IP(多 IP+TTL60-300s+月度更新)，境外保持 CF。风险：灰色玩法/证书 SNI 需实测/EO 不承诺。结论已回复用户，未动手改 DNS。
+
+## EO 优选方案 B 免费实测（用户排除付费 wetest.vip 后执行）
+- 【用户确认】方案 B=自扫或公开 CNAME 均可，不限香港，周边区域比新加坡好即可。
+- 【免费公开源全灭实测】wetest.vip 需会员(公开页0 IP)；*.v1/v4.eo.fastlydns.cn、eo.072103.xyz、eo.088086.xyz 全部 NXD；蓝点网/雾创岛 43.174.150.x 香港 IP 证书已退回 *.cdn.myqcloud.com(CDN 通用池) 全失效。博客佐证(2026-02):"EO 现在不能使用优选节点,非适用节点返回 418"。
+- 【方法论修正】TLS 握手成功≠可用(腾讯 CDN 泛播池也握手)；正确判据=schannel 证书校验过(CN=box.tama.guru)+HTTP 200+Server: TencentEdgeOne。
+- 【扫描事实】43.174/43.175 全 /16 抽样(3072)+官方段/HK/JP 细扫(56 /24≈14000 IP)：能服务 box.tama.guru 的 EO 池 9 段全新加坡(192-195/218/240-241/246-247)；EO 泛播确实同步全球——HK(43.175.115/119/43.174.126 共8 IP)、东京(43.175.16/17/18/113 共6)、大阪 107.217、AMS/DXB 零星可服务。
+- 【南宁电信视角(真实大陆)】官方新加坡 TCP 180ms/TTFB 0.8-1.0s 反而最优；香港候选 351-377ms/TTFB 1.3-1.8s、东京 276-299ms/TTFB 1.1-4.0s(不稳) 均更慢 → 官方 CNAME 即 EO 对大陆优化调度,自扫候选跨境路由绕。单点结论≠全国,华南可能反转,已列 15 个候选 IP 待用户 itdog 多节点验证(报告 outputs/eo-free-probe-2026-09-05.md)。
+- 【工具沉淀】dev/eo-probe-ips.py(TLS快速预筛)、dev/eo-probe-v2.py(schannel 严格判定,可复用任意域名)、dev/eo-scan-all.py(TCP+openssl 两段式大范围扫描)。
+- 【下一步】用户 itdog 验证候选 vs 新加坡；若均不优→方案 B 到此为止(免费优选时代窗口 2025中-2026初已关),剩余=备案+大陆CDN 或维持现状。
+
+## 头像+二维码加载慢诊断（个人主页 /_/tamakyi，南宁电信实测）
+- 【根因1 P0】R2( r2.337845818.best ) 图片对象全部无 Cache-Control（仅 ETag+Last-Modified，cf-cache-status: DYNAMIC）；头像 Last-Modified=当天→启发式缓存≈0→每次页面加载重下头像。304 也 1.05s（RTT 省不掉）。上传代码 s3.go PutObjectInput 从未设 CacheControl（已确认）。
+- 【根因2 P0】R2 纯 CF 国际链路：南宁实测每资源 0.78-1.4s（头像 0.9-1.05s/背景 297KB 1.39s/logo js 0.96s/1.6KB time.box.js 也 0.9s=RTT 主导）；snrat 大陆镜像 0.3-0.5s 作对照。
+- 【根因3 P1】easy.qrcode.min.js(52KB,R2) logo 分支：头像 onload 才绘制，onerror 仅 console.error 无降级→头像挂/失败=二维码永久空白。
+- 【根因4 P1】头像缓存键分裂：header.html icon/favicon 用 ?og-image=1(646-648)，list.html+页面头像+QR logo 用 ?v=2 → 一页下载 2 份。
+- 【根因5 P1】背景 box_background.png 303KB 未压缩 PNG（2024-08 上传未变）。
+- 【根因6 P2】defer 统计脚本拖 DOMContentLoaded：vercount 1.24s(波动2.7s)/mami 波动3.7s → 二维码初始化(DCL)被拖。
+- 【修复方向】P0① s3.go 加 CacheControl public,max-age=31536000,immutable(图片 key 随机不可变安全)；P0② easy.qrcode onerror 降级无 logo 绘制+超时；P1③ 统一头像 query 键(og-image=1 无 Go 处理疑似遗留)；P1④ 背景转 WebP≤60KB；P1⑤ 统计脚本 async；P2⑥⑦⑧(R2 前接 EO 回源=治本)。
+- 报告 outputs/avatar-qrcode-slow-2026-09-05.md；抓包快照 outputs/tb-page-snapshot.html；库源码已存 dev/easy.qrcode.min.js、dev/time.box.js。
+
+## P0 批落地：s3.go immutable 缓存头 + 二维码降级渲染（用户批准后执行）
+- 【用户授权】"先备份当前源码，然后尝试吧"→ 执行诊断报告的 P0-① 与 P0-②。
+- 【备份】.workbuddy/backup/p0-avatar-qrcode-20260905/（s3.go + header.html + list.html + question-not-found.html + profile.html，含修改前版本；header.html 修改前版本用脚本从当前版精确移除新增块生成，已与 cdn-migration 基线比对仅差上午 10 行 CDN 迁移改动，验证一致）。
+- 【改动1 s3.go】uploadPictureToS3 的 PutObjectInput 增加 CacheControl: public, max-age=31536000, immutable（key=picture/日期/随机hex 内容不可变，安全）。SDK v1.47.5 PutObjectInput.CacheControl 字段验证存在；gofmt 通过。
+- 【改动2 header.html】<body> 后新增全局 window.tbRenderQR(el, getOptions)：核心修复 easy.qrcode logo/背景图加载失败仅 console.error 无降级导致二维码永久空白。策略=已知可用层立即绘制（logo 记忆命中零等待一次成型）→ 未知层先省略画基础码（立即可扫）→ Image 探针判定后重绘升级版；失败记忆 _tbQrGood/_tbQrBad 按 URL 同会话缓存；3s 超时兜底；迟到 onload 仍能补 logo。实测 8 个行为用例全过（node stub QRCode/Image）。
+- 【改动3 三个调用点】list.html(公开主页)/question-not-found.html：new QRCode→tbRenderQR；profile.html updatePreview 同改（debounce 高频重绘场景靠 URL 记忆避免闪烁）。背景图分支（库内无 onerror 同风险）一并纳入降级。
+- 【验证】go test ./templates/ 全绿（TestTemplatesParse/CrossReferences 等）；8 行为用例 PASS；改动 diff 已复核为纯增量。
+- 【部署注意】缓存头只对新上传对象生效；历史对象需手动（可用 CF 批量 purge 或 R2 重新上传）；模板改动无后端逻辑变化。待用户部署后浏览器验证：二次访问头像应 0ms 级、头像坏链时二维码仍可扫。
+
+## CORS/画布污染核查（P0-② 二维码降级改动安全性）
+- 【结论】当前部署不会引发 CORS 失败或 canvas 污染。三个前提实测：① R2 已配 CORS 白名单，box.tama.guru 与 box-dev-api.337845818.best 均返回 ACAO（localhost:3000/example.com/裸域 无 ACAO）；② list/profile options 显式 crossOrigin:'anonymous'（注释注明"直连 R2 跨域图须 CORS 模式"），tbRenderQR 默认同值，与库内 new Image 的 CORS 模式一致，探针与库绘制走同一缓存键；③ easy.qrcode 内部 makeImage 后调 this._elCanvas.toDataURL("image/png")（catch 后 console.error + 提示 "Configured crossOrigin:'anonymous'"）——库开发者已内置该诊断。
+- 【污染免疫原理】canvas 污染只发生在"no-cors 隐式加载成功但无 ACAO"的中间态；tbRenderQR 探针失败(onerror)→ 根本不 drawImage → 无污染；成功 → 响应必带 ACAO → 干净。不存在绘制了却污染的路径。
+- 【边界提醒】R2 CORS 白名单只有 2 个源；新增页面域名/本地开发需先加白名单，否则 anonymous 探针 onerror → 降级基础码（可扫但永不带 logo，不报错）。favicon/og-image/meta 均非 canvas 上下文，无需 CORS 无污染风险（header.html 640-653 直指 R2）。
+
+## P0 批测试环境验证（agent-browser 实测 box-dev-api.337845818.best/_/admin6）
+- 【静态部署检查】HTML 含 tbRenderQR 2 次（helper 定义+1 调用）/ crossOrigin:'anonymous' 1 次 / logoBackgroundTransparent 2 次 / new QRCode(document.getElementById 为 0（已替换）→ 三处调用点全部到位。
+- 【正常路径】#boxqrimg canvas 200x200、toDataURL 成功（base64 长 28578 无污染）、中心 20x20 像素全为非白非黑"other"且色相分布为深色照片调（4,4,3 棕色系 96 像素、7,6,1 等）→ 头像 logo 已绘制升级版。
+- 【降级路径】临时 div 用坏头像 URL（不存在 picture path）调 tbRenderQR：立即态 canvas 已生成（len 4226 紧凑基础码、exportable true）；3s 后状态保持（childCount 1、exportable true）；_tbQrBad 写入坏 URL；_tbQrGood 同时记录真实页面头像 9af3e38?v=2 与背景图 25e2d84 → 双向印证降级免疫污染。
+- 【加载中排查】页面 2 个 uk-spinner："正在生成分享图…"（分享卡区正常态）+ captcha modal 内的"加载中..."（rect 全 0 不可见）；"加载更多 加载中..."按钮 display:none → 均非主诉"全屏加载中"覆盖层。用户主诉已消除。
+- 【截图】outputs/tb-dev-test-qr.png 全页、tb-dev-test-qr-crop.png 头部裁切：头像、用户名、提问按钮、二维码均已显示，无加载中残留。
+- 【代理坑提醒】agent-browser open <url> 因测试站境外+defer 脚本多会卡 load 等待；可靠做法：先 agent-browser open (about:blank 启动 daemon) → 再 open <url> 导航 → 然后 sleep ≥10s 让 defer 脚本就绪再 eval。
+- 【结论】P0 批（s3.go immutable 缓存头 + 二维码降级）测试环境验证全部通过，可部署生产。
+
+## P0 批正式环境验证（agent-browser 实测 box.tama.guru/_/tamakyi）
+- 【静态部署】HTML 60.1KB；tbRenderQR 2 次/调用点 1 处替换/crossOrigin 'anonymous' 1 次/logoBackgroundTransparent 2 次/new QRCode(document.getElementById 0；头像引用 r2.337845818.best/.../2e571390...（2026/09/05 新传）→ 与测试环境一致部署完整。
+- 【正常路径】#boxqrimg canvas 200x200 exportable len 31726；中心 20x20 像素全为深色照片调（7,7,7 灰+蓝黑系）→ 头像 logo 已绘制。
+- 【降级路径】坏 URL 测试：立即态 len 4226 基础码、3s 后保持 stillCanvas exportable len 4226 不空白；badMem=1、goodMem 含 2 个真实 URL（头像 2026/09/05 新头像 + 背景图 2024/09/22）→ 双向印证探针与降级免疫污染均正常。
+- 【加载中残留】visibleLoading=[]（精确定位 rect>0 且文本含"加载中"的可见元素）；之前的 uk-spinner/captcha/loadmore 在生产页同样不可见。
+- 【截图】outputs/tb-prod-test-qr.png：头像、二维码码眼完整、无加载中遮挡 → 与测试环境一致通过。
+- 【坑补充】第一次 `agent-browser open | open URL` 链式启动 3+ 分钟无输出卡死（即使之前测试环境用同样命令成功），最终拆成单条独立命令即恢复。原因可能是 Chromium 冷启动资源紧张或 chain 顺序导致首条 stdin 未及时关闭。经验：永远单条命令、第一条单独跑。
+- 【结论】P0 批正式环境全部通过；图片缓存头对老对象（2024/09/22 背景图）暂不生效，新上传对象生效，需要时间自然过渡。
+
+## autoban 误伤诊断（用户 app.ini: window=10s, sensitive=10, 404=20, duration=15min, trust_proxy=true）
+- 【机制】全站仅 2 个计数入口：中间件敏感路径 defer Record（autoban.go:39）+ f.NotFound 404 Record（route.go:403）。业务路由/模板 77 URL × 39 敏感词零碰撞 → 正常页面不误计。
+- 【误伤根因】正常用户 10s 内凑不出 10 敏感/20 404 → 误伤必是"他人探测记到自己键上"：P0-A IP 键折叠（EO 未透传 EO-Client-IP 时全大陆回退到 43.174.247.x 新加坡边缘共享键；CF tunnel 异常时回退 127.0.0.1）；P0-B CGNAT 共享出口连坐（国内 NAT444 常态，管理员自伤主因）；P1-C IPv6 /64 聚合连坐；P1-D 双 CDN 未删对端权威头可被伪造头定向嫁祸。
+- 【止血配置】window 60s + sensitive 30 + 404 100 + security_alert_email 开（先看封禁 IP 判断折叠）。治本=EO 开回源 IP 透传 + 源站防火墙锁 CDN 网段 + 双 CDN 删对端头。
+- 【代码增强候选】登录 session 豁免计数、封禁 logrus 日志、UA 二次确认。报告 outputs/autoban-false-positive-2026-09-05.md。
+
+## autoban 策略修正实施：ban_track_notfound（用户选定"配置开关版"）
+- 【背景】生产新误伤案例 106.7.154.160（真实国内电信 IP，非 CDN 边缘）：样本 /_/Liarcs×4 + /×2 全是计数事件；但 domain/题目不存在走 302（Pager/Questioner 均 ctx.Redirect）不计数 → 能进 f.NotFound 的多为非 GET 探测或未注册路径；告警 paths 仅 6 条且受 2min cleanup 影响可跨窗口累积 ≠ 触发原因；触发=10s 内 ≥20 次 f.NotFound 或 ≥10 敏感。疑似共享出口(CGNAT)连坐或目标性探测。
+- 【评估结论】敏感通道 35 项扫描特征与业务路由全表零重叠→零误伤；404 通道是唯一误伤源但价值低（主流字典必碰敏感项；/_/{domain} 枚举靠 200/302 区分本来就抓不到）→ 砍 404 计数收益>损失。
+- 【改动 5 文件，备份 .workbuddy/backup/autoban-track-notfound-20260905/】
+  1. internal/conf/static.go：Security 加 BanTrackNotFound bool `ini:"ban_track_notfound"`（默认 false）
+  2. internal/security/autoban/autoban.go：Options.TrackNotFound、Banner.trackNotFound、New 赋值；Record 对 KindNotFound && !trackNotFound 直接 return
+  3. internal/route/route.go：Options 传 TrackNotFound: conf.Security.BanTrackNotFound；f.NotFound 注释同步
+  4. internal/security/autoban/autoban_test.go：newTestBanner 默认 TrackNotFound:true；新增 TestNotFoundTrackDisabledByDefault；TestDefaults 断言 trackNotFound==false
+  5. conf/app.sample.ini：security 段加 ban_track_notfound = false + 注释（真实 app.ini 在各部署环境，需用户同步补键或留空=默认关）
+- 【验证】gofmt 干净；go vet OK；go test 三包全绿（route/conf/autoban，带 -overlay=tb_overlay.json 规避 cgo webp）；新用例 PASS。
+- 【部署提醒】测试/生产 app.ini 无需强制加键（缺省 false 即关闭 404 计数）；若想恢复 404 计数置 true。conf/app.ini 不在本地副本（conf/ 仅 app.sample.ini）。
+
+## ban_track_notfound 测试环境实测（box-dev-api，出口=本机南宁电信）
+- 【正常路径】/ + /_/admin3..admin9 全 200 无 403；不存在 domain ×8 → 302 不封（业务 302 通道确认）；admin6 页 SSR title「admin6 - 狼的提问箱」正常。
+- 【404 洪水】未注册路径 ×30 → 全 302(location:/) 不封（TrackNotFound=false 预期，但受 enable_auto_ban 前提约束）。
+- 【敏感×37 异常】/.env /admin /wp-login.php 等共 37 个敏感路径（默认阈值 10 的 3.7 倍）→ 全 302 无 403。302 均为服务端 f.NotFound Redirect（location:/ + securityHeaders + CF NEL），确认到达应用层 → 疑似测试环境 enable_auto_ban=false（或阈值极高/实例未跑新二进制），需用户核对 app.ini + 日志后才能定论。若 enable=false，本测无法验证 TrackNotFound 语义，建议测试环境 enable_auto_ban=true 后重测。
+- 【教训】agent-browser open 境外站再次卡死（>3.5min），TaskStop 清理；渲染验证降级 curl 抽查 HTML 即可。
+
+## ban_track_notfound 测试环境复测通过（22:17-22:35，出口 222.218.124.37）
+- 【上轮误判根因】串行 curl 每个请求间隔 1-2s（南宁→CF→源 RTT），13 个敏感请求跨 18s > 10s 窗口 → 永不达阈值；日志时间戳证实。非配置问题。
+- 【复测方法】xargs -P 25 并发打，窗口内密集命中。
+- 【结果】① 正常路径 / + admin3-9 全 200；② 纯 404 并发 x25 → 全 302 无 403（TrackNotFound=false 生效）；③ 敏感路径并发 x25 → 前~10 个 302 后 15 个全 403（阈值10触发封禁）；④ 封禁后 / 与 /_/admin6 也 403（IsBanned 全局生效）。
+- 【副作用】本机出口 IP 222.218.124.37 被测试环境临时封禁 15min（约至 22:35 自动解除）；测试环境日志可见该批 403 + 若有 security_alert_email 会收到告警（含样本路径）。
+- 【结论】修复语义完整闭环：正常业务放行、纯404豁免、敏感扫描封禁。部署生产即可。
diff --git a/.workbuddy/memory/2026-09-06.md b/.workbuddy/memory/2026-09-06.md
new file mode 100644
index 0000000..6ab9442
--- /dev/null
+++ b/.workbuddy/memory/2026-09-06.md
@@ -0,0 +1,136 @@
+# 2026-09-06
+
+## 移除 vercount 第三方页脚统计（用户确认"不用就去掉"）
+- 【诊断】cn.vercount.one 实际 = Vercel 托管 + CF 前置（104.21.1.96），cf-cache-status DYNAMIC 每次回源跨洋；南宁实测 js ttfb ~1.9s（DNS 0.72s 高）；脚本内部 DOMContentLoaded 后才 fetch events.vercount.one（ttfb ~3s，才是页脚 spinner 真瓶颈）；且慢 defer 会推迟 DOMContentLoaded ~1.4s。页脚仅展示 site_uv/page_pv 两徽标（busuanzi 兼容命名）。
+- 【决策】第三方装饰统计非必须 → 用户选彻底移除（非动态注入方案）。备份 .workbuddy/backup/remove-vercount-20260906/。
+- 【改动 7 文件】
+  1. templates/base/header.html：删 dns-prefetch cn.vercount.one；删 busuanzi 注释行与 <script defer vercount>；删专用 .tb-spinner CSS 块（含 dark 覆盖）
+  2. templates/base/footer.html：删整行 visitor/pageview 统计（busuanzi_value_site_uv/page_pv）
+  3-6. internal/i18n/dict_{zh_cn,zh_tw,en,ja}.go：删 site.footer.visitor/pageview 两个 key
+  7. internal/i18n/i18n_test.go：visitor 参数填充断言改指 auth.recover.greeting（保 %s 覆盖）
+- 【验证】残留 grep 全空；gofmt clean；go test ./internal/i18n/ + ./templates/ 全绿。
+- 【未动】static/tamabox.changelogs.json 为 2024 停更归档；根 CHANGELOG.md 是否追加条目待用户确认。
+
+## umami 数据展示放弃 + tamami.js 加载优化（方案A load 注入）
+- 【umami 取数可行性】mami.tama.guru = Vercel 托管 Next.js（CNAME vercel-dns-017.com）；umami v2 API 全需登录（/api/websites 401、login 空体 zod 400）；新版 umami 无 Share 功能 → 用户放弃 umami 数据恢复页脚统计，footer 维持无统计徽标（vercount 移除后现状）。
+- 【mami 慢根因】Vercel 无国内节点，白天/冷访问 1-2s+；tamami.js 4.6KB 缓存头好（public max-age=86400, Age=303024 靠 CDN 兜底）凌晨命中 0.3s；用户体感慢主因=umami 后台（Next.js 动态回源）+ 白天边缘波动。defer 在 head 会推迟 DOMContentLoaded（同 vercount 问题）。
+- 【R2 方案排除】实测 R2 直链 0.80-1.56s 比 Vercel 缓存命中 0.28-0.35s 更慢（凌晨南宁），印证 UIkit 当初迁 cdnjs.snrat.com 的原因。
+- 【脚本能力确认】tamami.js 内部：host = data-host-url 优先否则脚本同源，拼 /api/send 上报 → 静态搬迁可行但无快托管点故弃。
+- 【改动】templates/base/header.html（备份 .workbuddy/backup/tamami-load-inject-20260906/）：638 行 <script defer tamami.js> → window load 后 createElement 注入 + setAttribute data-website-id。效果：mami 再慢不阻塞页面关键事件；PV 统计损失≈0（load 后立即上报当前页）。
+- 【验证】go test ./templates/ 通过。
+- 【未做】mami 接入 EdgeOne（方案C）未实施——用户暂选 A；上报 /api/send 跨洋延迟/丢失为 Vercel 托管固有限制。
+
+## 全站外部资源加载体检（南宁凌晨实测 2 次取快值）
+- 【健康】snrat 全家(uikit css/js/icons/dayjs/alpine/waline) 0.14-0.32s；www.recaptcha.net 0.17s；cf-turnstile 0.61s；bytecdntp 0.065s（注释未启用）；cdn.github.red 0.15s；sentry-cdn 0.32s（仅 SentryDSN 非空才加载）。
+- 【🔴唯一慢域=R2】time.box.js 0.7-1.7s（header 全站 defer 1.6KB，纯装饰 runtime 倒计时，硬编码 2023-06-01 起算，无外部依赖）；neko-pixel umd 0.87s(pixel页)；waline R2 源/home.html bytecdntp 均注释残留未启用（实际 waline 走 snrat）。图片类(头像/social icons)同 R2 慢但异步非阻塞，缓存头已 immutable。
+- 【发现】header 的 vConsole 有 .VConsole 开关；sentry script 无 defer/async 且 tracesSampleRate=1.0——若生产 SentryDSN 启用则同步阻塞+高采样开销（需用户确认是否启用）。
+- 【未决】time.box.js 优化方案待用户选（内联 footer / load 注入 / 不动）；SentryDSN 生产是否配置待确认。
+
+## time.box.js 内联到 footer（用户选"内联"，备份 .workbuddy/backup/timebox-inline-20260906/）
+- 【背景】加载体检确认 R2 是全站唯一慢域（0.71-1.68s），公共路径只剩 time.box.js（header 全站 defer 1.6KB 存活倒计时，无外部依赖）拖慢 DOMContentLoaded。
+- 【改动】① header.html 删 <script defer r2 cdn/time.box.js>；② footer.html box_runtime 后内联紧凑版 IIFE：功能等价 + 修 2 个原版 bug（先赋值后判空会抛错；DOMContentLoaded 后首个 1s 才显示）。
+- 【验证】time.box.js 引用清零（仅注释提及）；go test ./templates/ 通过。
+- 【待确认】SentryDSN 生产是否配置（若启用 sentry bundle 250KB 同步阻塞 + tracesSampleRate=1.0）；R2 旧对象 time.box.js 可留作兼容不动。
+
+## 测试环境部署验证通过（box-dev-api，01:19-01:21）
+- 【tamami load 注入】主页+admin6：旧 defer src=mami.tama.guru 标签残留 0；addEventListener("load") 注入监听器 1；内联代码含 createElement+data-website-id 与源码一致。
+- 【time.box.js 内联】主页+admin6：time.box.js 外链 0；id="box_runtime" 元素 1；footer 内联脚本（Date.UTC(2023 + setInterval(tick)）就位。
+- 【说明】未做浏览器 JS 行为验证（box-dev 境外站 agent-browser 有卡死史）；SSR HTML 结构与源码逐字一致 + 标准 API 逻辑，判定部署生效。文案「存活」未出现因 curl 无语言 cookie 回退 en。
+
+## EO(生产 box.tama.guru) vs CF(测试 box-dev) 速度实测对比（南宁，凌晨 01:36，http1.1）
+- 【归属】prod: Server TencentEdgeOne IP 43.174.246/247.43（EO 新加坡）；dev: Server cloudflare 104.21.47.52/172.67.144.141，但 CF-RAY 后缀 AMS（阿姆斯特丹）与实测 conn ~0.24s 矛盾（疑 Ray 字段不准/边缘非 AMS）。
+- 【数据】①动态首页 8 轮 TTFB：prod 0.86-1.69s 均~1.22 vs dev 1.06-1.81s 均~1.49 → EO 快 ~0.27s；②连接阶段 8 轮：prod conn 0.20/TLS 中位 0.43（2次>0.9s 尖峰）vs dev conn 0.25/TLS 0.53（平稳无尖峰）→ EO 网络层快 50-100ms 但稳定性差；③favicon 静态 6 轮：prod 0.60-1.41 均0.84（有1.4s尖峰）vs dev 0.70-0.85 均0.75 → CF 反而更稳更快。
+- 【结论】EO vs CF 对南宁同一量级互有胜负，无碾压差异；动态页 EO 略快，静态/稳定性 CF 优。差异更多源于回源链路+边缘抖动而非 CDN 标签本身。局限：凌晨单点、http1.1、生产/测试后端实例不同（变量未隔离）；白天高峰需复测。
+
+## EO vs CF 正式 A/B（01:40-01:47，南宁，http1.1，后端不同服务器-残余变量已注明）
+- 【方法】robots.txt（静态文本近零后端耗时）30 轮交替 + 随机 query 强制回源 15 轮 + 此前 TCP/TLS/首页/favicon 数据汇总。
+- 【robots 30轮】EO med 0.61s/mean 0.74/p90 1.16/>1s×7；CF med 1.16/mean 1.34/p90 2.23/全部>1s（min 1.03）。
+- 【强制回源 15轮】EO med 0.83/mean 0.97；CF med 1.56/mean 1.68（CF min 1.39）→ EO 快 ~0.7s 近 2 倍。
+- 【综合】TCP 0.20vs0.25、TLS 0.43vs0.53、首页 1.22vs1.49：大样本下 EO 全面领先；favicon 6轮小样本 CF 略快（缓存状态差异）不改变结论。
+- 【坑】本机 Windows curl(Schannel) 不支持 --http2，勿用于 A/B；上轮 --http2 全失败 999。Bash 同名 /tmp 文件曾出现残留污染→用 $$ 文件名。
+- 【说明】CF 回源走 tunnel(cloudflared)、EO 回源直连；源站不同为残余变量，strict A/B 需同源(把 dev 挂 EO 或 prod 挂 CF)。
+
+## autoban 敏感特征补强：sensitiveFragments 片段匹配（用户选"补强 WP 特征表"，备份 .workbuddy/backup/wp-fragments-20260906/）
+- 【背景】生产日志见 wlwmanifest 扫描：//wp/wp-includes/wlwmanifest.xml、//news/...、//2018/...（枚举前缀变体）全部 302 放行。根因：① 所有未注册路径走 f.NotFound→ctx.Redirect("/") 得 302（非 404，注释"先写404"与实际不符，flamego Redirect 覆盖状态）；② TrackNotFound=false 后 404 不计数；③ IsSensitivePath 前缀匹配抓不到中部敏感段 + 特征表无 wp-includes/xmlrpc/wlwmanifest。
+- 【改动 autoban.go】新增 sensitiveFragments 数组（子串匹配强指纹，仅 WP 特征业务必无）：/wp-includes/、/wp-json/、/wp-cron.php、/wp-trackback.php、/wp-admin、/wp-content、/wp-login.php、/wlwmanifest.xml、/xmlrpc.php、/wordpress；IsSensitivePath 增加 Contains 第二循环（大小写不敏感）。前缀表 sensitivePaths 保留不动（防 /administratorx 类误伤语义不变）。
+- 【测试】TestIsSensitivePath 补 9 正例（含日志真实形态 //wp/wp-includes/wlwmanifest.xml 等）+ 6 负例（/_/tamakyi、/_/admin6、/api/v1/question/xxx、/explore、/i18n 不误伤）。
+- 【验证】gofmt clean；autoban 全测 PASS；route 带 overlay 编译+测试通过（IsSensitivePath 由 internal/route/autoban.go:35 中间件调用，改匹配器全链生效）。
+
+## 域名迁移方案：box.tama.guru → box.shiroko.one（方案阶段，未动代码）
+- 【用户决策】tama.guru 不续费（2026-12-24 到期，RDAP 实证，注册商 DNSPod）→ 硬过渡；新域 box.shiroko.one；Bing+GSC 全套；umami 随迁 mami.shiroko.one。方案文档 outputs/domain-migration-box-shiroko-2026-09-06.md。
+- 【取证要点】shiroko.one 未配置（NS=spaceship，http 200 为注册商 Parking Page）；tama.guru apex=导航页 Hugo/CF Pages，box 走 DNSPod 三线路(境内 EO/境外+默认 CF SaaS)；mami=Vercel。
+- 【SEO 现状】box sitemap 仅 8 条（/ /explore /register /login /_/tamakyi /change-logs），explore 是唯一内容页；robots Disallow /_/ 与 sitemap 提交 /_/tamakyi 矛盾；页面无 canonical；og:url/邮件链接均依赖必填配置 external_url；static/robots.txt+sitemap.xml go:embed 硬编码旧域；register.go:64 Bloglink 硬编码；censor TrustedHosts 含 tama.guru/337845818.best；R2 CORS 白名单需加新域。
+- 【核心机制】301 逐 URL 是唯一可靠保排名路径；Bing Site Move 工具可用性不稳定(2021 传闻下线)仅加速器；Site Move 后新域 6 个月禁再迁；通行 301 保持 6-12 月 vs 本方案仅 3.5 月窗口=R1 主风险，靠索引面小+早切换(≤10/01)+IndexNow 缓解。
+- 【301 载体推荐】旧域 DNS 切换日统一 CNAME → CF Pages 跳转项目(_redirects: /* https://box.shiroko.one/:splat 301!)，与源站/旧 CDN 解耦；弃"源站 nginx 按 Host 301"(回源 Host=旧域会成环)。
+- 【开放项待用户】站群 blog/status/share/chat 是否迁(影响 footer/home 内链)；/_/tamakyi 是否保(决定 robots/sitemap 取舍)；cloudflared ingress 是否按 hostname。
+
+## 域名迁移批1落地：全项目 tama.guru → shiroko.one（本地代码，备份 .workbuddy/backup/domain-shiroko-20260906/）
+- 【用户决策】其他 blog 之类子域一并调整到 shiroko.one；/_/tamakyi 不保（sitemap 移除，robots 维持 Disallow /_/）；先做本地操作。
+- 【替换规则】*.tama.guru → *.shiroko.one（box/blog/chat/share/status/mami），apex tama.guru → shiroko.one。
+- 【改 11 文件】static/robots.txt(Sitemap行)；static/sitemap.xml(5条换域+删/_/tamakyi+去重旧域无斜杠重复项+lastmod全刷2026-09-06)；static/llms.txt(6处)；static/llms-full.txt(7处)；templates/base/footer.html(6条链接)；templates/base/header.html(umami注释同步+验证token加迁移提醒注释)；templates/home.html(站长箱/投票/Markdown/4条blog链/explore)；route/auth/register.go:64 Bloglink默认值；internal/security/censor/text.go(TrustedHosts 新增 shiroko.one，**保留** tama.guru 过渡期)；conf/app.sample.ini(补齐缺失的必填项 external_url，conf.go:36 强制校验，原模板缺失→照抄即启动失败)；dev/eo-*.py(3脚本 --host 默认值)。
+- 【关键发现】① header 的 mami src 此前已先行改为 mami.shiroko.one（仅注释待同步）；② google-site-verification(636行) 与 msvalidate.01(7行+637行重复) 是域名绑定 token，新域验证后必须替换 content，否则 GSC/Bing 无法验证新站→Site Move/Change of Address 无法提交；③ app.sample.ini 缺 external_url 必填键（模板缺陷）。
+- 【验证】sitemap XML 解析通过(5条无重复)；go test ./templates/ + ./internal/security/censor/ 通过；route/auth、static、internal/conf 带 overlay 编译通过。
+- 【方案文档同步】outputs/domain-migration-box-shiroko-2026-09-06.md：§0 补两条决策；§11 开放项标 1/2 已答并新增 token 项；新增 §12 批1实施记录；附批次标批1完成。
+- 【待用户操作】blog/chat/share/status 各子域实际服务搬迁（否则新域链接成死链）；censor 旧域条目待旧域到期后删。
+
+## IndexNow key 文件 302 修复（static/index-now/<key>.txt 无法访问）
+- 【现象】用户新建 static/index-now/66e5e0911b0941f2ba7dbfbbd961e9be.txt 并改 fs.go 的 //go:embed，但访问 302 跳首页。
+- 【根因】internal/route/route.go:138 的 flamego.Static 中间件 **Prefix="/static"** 只接管 /static/... 前缀；而 robots.txt/sitemap.xml/llms*.txt/favicon.ico 等根目录静态文件**每个都是单独注册的 f.Get handler**。新文件无对应路由 → 落 f.NotFound → ctx.Redirect("/") 得 302。embed 本身没问题（实测 FS.Open 可读，内容正确）。
+- 【修复】route.go：① import 加 regexp；② 包级 var indexNowKeyPattern = `^[0-9a-f]{32}\.txt$`（防路径穿越）；③ 在 llms-full.txt 路由后加 f.Get("/index-now/{key}")，校验白名单后 static.FS.Open("index-now/"+key)，Content-Type text/plain + max-age=86400，失败 404。备份 .workbuddy/backup/domain-shiroko-20260906/route.go.bak。
+- 【新增回归测试】internal/route/indexnow_route_test.go TestIndexNowKeyFileRoute：正确key→200+内容；路径穿越(..%2f 与 ../../)、合法格式但不存在、后缀不符→全 404。用 flamego.NewWithLogger(io.Discard) 构造最小实例（不依赖 New()）。
+- 【flamego 关键行为】internal/route/tree.go placeholderTree.match 把整个路径段赋给参数，**不排除点号** → /index-now/{key} 能匹配 <key>.txt。
+- 【验证】gofmt clean；带 overlay 编译 ./internal/route/ 通过；route/static/templates 三包测试 ok。
+- 【部署提醒】需重新编译部署（embed+路由均在二进制内）；IndexNow 提交时 keyLocation 填完整 URL https://box.shiroko.one/index-now/66e5e0911b0941f2ba7dbfbbd961e9be.txt；旧域 301 后该路径会被重定向，搜索引擎校验需 200 直出，故切换后应用新域 keyLocation 重新提交。
+
+## 域名变更全员邮件通知脚本（dev/notify_domain_change.py，不碰项目源码）
+- 【需求】用户改了站点域名，想向全体未注销用户发邮件通知；要求复用生产 conf/app.ini 的 DB+SMTP，不动项目源码。
+- 【依据】① users 表软删除用 gorm.Model，未注销=deleted_at IS NULL；收件=email 列；可顺带取 name/domain 做个性化。② 发信对齐 internal/mail/mail.go：发件人"TamaBox <mail.account>"，465=隐式SSL 否则 STARTTLS，支持 mail.skip_tls_verify。③ DSN 拼装见 internal/conf/db.go（postgres sslmode=disable+search_path=schema）。
+- 【实现】独立 Python 脚本：读 NEKOBOX_CONFIG_PATH 或 -c，configparser 设 strict=False（容忍示例 [upload] 重复键 image_endpoint）、去引号、去行内注释；fetch_recipients 查未注销有邮箱用户；smtp_login 复用生产配置；模板用 {{占位符}} 避免与 HTML 大括号冲突。
+- 【安全开关】默认 --dry-run；--send 才真发；--to 单测地址；--limit N 小批量；单条失败隔离+汇总；每封 --delay 默认 0.3s 防限流。
+- 【验证】py_compile OK；对 app.sample.ini 实测 load_config 解析正确（external_url 去引号、重复键容忍）；render 模板无残留占位符。依赖 psycopg2-binary(Postgres)/pymysql(MySQL)。
+- 【增强·四语言】TamaBox 为四语言站点，给脚本加 LANG_TEMPLATES（zh-CN/zh-TW/en/ja），fetch_recipients 多取 language 列；发送时按 users.language 选模板，回退 用户语言→[app] default_lang→zh-CN；--subject/--html/--plain 为全局覆盖。effective_templates() 选模板，build_message() 内统一 render 后才拼装（曾一度漏 render 已在自检发现并修正）。去掉默认模板 emoji。复测：四语言 text/plain+text/html 双部、box_link/site 就位、无残留占位符（正文 base64 传输编码属正常，解码核验通过）。
+
+## 用户问"前端还有什么要改造的" + "box.tama.guru 接 CF 自定义主机名如何配 301"
+- 【诊断残留】grep 全项目：tama.guru 残留仅在 sitemap.xml 注释、header.html 验证 token 提醒注释、censor/text.go（过渡期有意保留）、outputs/（文档）——即迁移批1已完成，无业务代码残留旧域。
+- 【R2 硬编码仍散落】`r2.337845818.best` 约 14 处：header.html(preconnect/waline css/favicon/OG)、pixel.html(neko-pixel css+js)、question-not-found.html & list.html(social icons + easy.qrcode.min.js)、user/profile.html(qrcode js + pickr css/js)、route/question/share.go(social icons)；waline serverURL `waline.337845818.best` 在 home.html/item.html。建议抽 `CdnBase`/`WalineURL` 模板变量集中管理（为同源化/换域铺路）。
+- 【301 指引（CF 自定义主机名架构）】规则建在承载该自定义主机名的 zone 上；迁移未完成前**不要**整站 301 到 shiroko.one（会断线上）。①现在做：SSL/TLS→Always Use HTTPS（http→https 自动301）+ www 规范化 Redirect Rule；②切换时做：Bulk Redirects（box.tama.guru→https://box.shiroko.one, 301, include subpaths+query）或 Single Redirect Dynamic `concat("https://box.shiroko.one", http.request.uri.path, http.request.uri.query!=""?concat("?",http.request.uri.query):"")`；③SEO 配套：sitemap 已换域重提交 GSC/Bing、旧域 DNS 保 6-12 月、header 638-639 行验证 token + 第7行 msvalidate.01 新域重新验证替换、canonical/OG 指向新域。
+- 【架构提醒】A/B 实测 EO 国内比 CF 快约 2 倍（EO 0.61 vs CF 1.16，CF 走 tunnel 回源）；box.tama.guru 接 CF 后国内（南宁电信）失 EO 提速优势，规划 box.shiroko.one CDN 时建议继续用 EO 或 CF China 保国内速。
+
+## 通知脚本三要求落地（dev/notify_domain_change.py，不碰项目源码）
+- 【需求】①发送前打印 DB 总用户/已注销/未注销/未注销有邮箱数，须人工 yes 确认才发；②不一口气发完留间隔；③正文明确换域原因+用户动作：新域 box.shiroko.one、旧域 2026-12-24 到期、期间 301 转发、到期后旧域停用；Why=.guru 连年涨价一年三百出头遭不住；Do=记新域+替换此前分享的二维码。
+- 【改动】抽 connect_db() 供 fetch_recipients/fetch_counts 复用；新增 fetch_counts() 打统计；main 发送前打印五类统计；--send 路径加 input("yes") 人工确认（EOFError→中止，--yes 跳过）；--delay 默认 1.0s，新增 --pause-every/--pause-for 分批长暂停；四语言模板全重写，加 {{old_domain}}/{{expire_date}} 占位符与「为什么/该做什么」问答段；--old-domain 默认 box.tama.guru、--expire-date 默认 2026-12-24（均可覆盖）。
+- 【验证】py_compile OK；四语言 build_message 解码核验：新域名/旧域名/2026-12-24/301 均就位、无残留 {{占位符}}、text/plain+text/html 双部。
+
+## 通知脚本二次微调（硬编码域名 + 价格模糊 + 无语言默认简中）
+- 【改动】① 新旧域名+到期日改为模块级硬编码常量 NEW_DOMAIN=box.shiroko.one / OLD_DOMAIN=box.tama.guru / EXPIRE_DATE=2026-12-24，删除 --old-domain/--expire-date 参数；site 与 box_link 改用硬编码新域（不再依赖 app.external_url，故移除其空值中止判断）。② 四语言「为什么换」文案去掉具体金额与「遭不住」，改为「.guru 连续涨价/续费成本越来越高」把原因写清。③ 语言回退：空语言直接→zh-CN（不再先落 default_lang）；未知语言→default_lang→zh-CN。
+- 【验证】py_compile OK；源码 grep 无「三百/over 300/年間300/遭不住」；四语言渲染含 box.shiroko.one/box.tama.guru/2026-12-24/301、无占位符；回退逻辑 空/未知→zh-CN、en→en。
+
+## 通知脚本加「断点续发」+「按语言分群」
+- 【改动】① 断点续发：新增 load_sent_state/record_sent/reset_state（JSONL 逐行追加，崩溃安全）；默认状态文件 DEFAULT_STATE=脚本同目录 notify_state.json（--state 可改）；发送前 load 已发邮箱集合并过滤，打印「已跳过 N 封 / 剩余待发送 N 封」；每成功一封 record 一行；--reset-state（仅 --send 时）清空后全量重发；测试 --to 模式不写状态避免污染。② 按语言分群：resolve_lang() 统一语言解析（空→zh-CN、未知→default_lang→zh-CN）；发送前打印「按语言分布」统计；main 发送循环改为按 LANG_ORDER=[zh-CN,zh-TW,en,ja]+其他 分组，每组打印「[语言分组 gi/gn] 语言(标签) : 本组 N 封」，组间 --group-pause 默认 3.0s（0 关）；组内仍走 --delay/--pause-every。
+- 【验证】py_compile OK；monkeypatch DB+SMTP 实测：RUN1(--limit 3)→发3、state 3 行且分组正确；RUN2(同 state 续发)→跳过3、发剩余3(zh-CN 组2+ja 组1)、state 6 行；RUN3(再续发)→跳过6、发0；RUN4(--reset-state)→清空并全量重发2。空语言/未知语言均归 zh-CN。
+- 【增强】捕获 send_message 返回字典（RCPT TO 阶段被拒收的 {addr:(code,err)}），非空时计为「[SMTP 拒收]」失败（不计入 sent、不写断点状态、可续发重试），避免误把"已被拒收"算成成功。验证：2 收件人第 2 封返回 550 拒收→成功1/失败1、state 仅1行。
+- 【用户现象】实测运行时显示"成功 N 封"但收不到信；定位：SMTP 250 OK 仅代表 RCPT TO 接收，不等于投递成功；截图收件人全是 *@admin.com（含 admin3x/admin4 等大概率不存在账号），最可能是收件不存在→退信回到 From(mail_account) 而未被监控，或发件域 SPF/DKIM 未对齐被静默丢信。建议用 `--to 真实外部邮箱 --send` 隔离验证。
+- 【增强】notify_domain_change.py 加「监控报告」+「测试模式命中数据库」：① 每次运行结束写 notify_report.json（JSON，含 db_stats/lang_distribution/sent/failed/smtp_rejected/skipped_already_sent/failed_list/config（无密码）/test_mode），`--report PATH` 改路径、`--no-report` 关闭，dry-run 与 send 都会写；② `--to 邮箱` 先查库，命中则套用该用户姓名/域名/语言，未命中按 zh-CN。验证：en 命中→英文主题、未命中→中文主题、报告字段与 SMTP 拒收单独计数均正确。
+
+## 通知脚本模板修正（box_link 路径 + 头部致谢/群发 + 底部版权）
+- 【用户反馈】实测邮件内容两点问题：① 提问箱个性域名实际为 `box.shiroko.one/_/xxx`（项目 templates/profile.html 与 base/footer.html 均为 `/_/{domain}` 路径），脚本写成 `box.shiroko.one/xxx` 不对；② 邮件头部应先感谢用户使用提问箱并说明是群发站内信；③ 底部加 `© 2026 狼的提问箱`。
+- 【改动】发送循环 box_link 由 `https://{NEW_DOMAIN}/{domain}` 改为 `https://{NEW_DOMAIN}/_/{domain}`；四语言 HTML+纯文本模板（zh-CN/zh-TW/en/ja）头部问候后新增「首先感谢使用（狼的提问箱）」+「这是群发的站内通知邮件，请放心查阅」两段；底部系统通知行追加 `© 2026 狼的提问箱`（英 Wolf's Question Box / 日 狼の質問箱 / 繁 狼的提問箱）。
+- 【验证】py_compile OK；四语言解码核验：box_link 含 `/_/`、致谢+群发+版权关键词均就位、无残留 {{占位符}}。
+
+## 通知脚本去外部依赖（零 pip 安装）
+- 【用户痛点】当前脚本依赖 psycopg2-binary（Postgres）/ pymysql（MySQL），但环境 pip install 基本不可用，装不了第三方包。
+- 【改动】DB 层改为「零依赖优先」：默认 auto 驱动优先调用系统自带命令行客户端 psql(Postgres)/mysql(MySQL)，纯标准库 subprocess，无需 pip；仅当客户端都不存在时才回退 psycopg2/pymysql（可选 pip 安装）。新增 _build_pg_uri（密码 URL 编码）、_choose_driver、_psql_query(-X -t -A -F '\x1f' -P null=\N -P footer=off)、_mysql_query(临时 cnf 传密码避免进程参数泄露)、_lib_query、run_query 统一入口；fetch_recipients/fetch_counts 改为接收 args 并调 run_query；新增 --db-driver {auto,psql,mysql,psycopg2,pymysql}；load_config 增加 db_sslmode（默认 disable，与旧 psycopg2 行为一致）；PG 统计用 COUNT FILTER(WHERE...) ，MySQL 用 SUM(CASE...)；main 打印 [DB 驱动]。
+- 【验证】py_compile OK；monkeypatch 实测：驱动选择(pg有psql→psql / mysql有mysql→mysql / 无客户端但可import psycopg2→lib / 全无→psql报错路径)；psql 路径解析(含空语言/空名/语言NULL→空)；mysql 路径解析；E2E 经 psql 路径 dry-run 写报告、send 6 封(按 zh-CN3/zh-TW1/en1/ja1 分组、空语言+未知fr回退zh-CN)、RESUME 跳过6发0、--to 命中库用户发往其邮箱。
+- 【结论】现在只需 Python 标准库 + 服务器上的 psql/mysql 客户端即可运行，彻底不依赖 pip。
+
+## 通知脚本 bug 修复：language 列不存在导致 FATAL
+- 【现象】用户用 `python3 notify_domain_change.py -c ./auto/conf/app.ini --to xxx@vip.qq.com --send` 报 `ERROR: column "language" does not exist`。
+- 【根因】GORM 模型 `User.Language` 默认 column=language，但线上 `nekobox` 库 schema 较旧，users 表无 language 列（可能叫 lang 或根本没有该列）。脚本此前在 fetch_recipients 里硬编码 `SELECT ..., language FROM users`。
+- 【修复】新增 resolve_lang_column(cfg, args)：默认 auto 探测 information_schema.columns 的 candidates(language/lang)，找到即用、都不存在返回 None（调用处用 `NULL AS language` 兜底，全员回退默认语言）；新增 `--lang-column` 参数可手动指定（如 --lang-column=lang）。fetch_recipients 改用探测到的列名拼 SQL；main 打印 `[语言列]` 行。mock 验证 4 场景（lang 命中/lang 缺失→NULL/显式指定/language 命中）均正确。
+- 【给用户建议】直接重跑即可；若库里列叫 lang 会自动识别，若真无该列则全员按 [app] default_lang(ja) 模板发送，不影响发信。
+
+## 通知脚本「依旧报错」二次排查：版本标记 + 改名验证法
+- 【现象】首轮修完用户报「依旧不行，报错一致」。初判为用户在 Linux 服务器跑的是仓库根 `/home/tamakyi/Github/Tamabox_v4/notify_domain_change.py`（state_file 路径证伪），而工作区仅 `dev/notify_domain_change.py` 一份；用户坚称没用错文件。
+- 【加版本标记】SCRIPT_VERSION = "2026-09-06.langdetect.v2"，main 配置头打印 `[版本] SCRIPT_VERSION = ...`。作用：运行输出若无此行即证明跑的不是最新副本，把"是否用错文件"变成客观判定（不再靠争论）。
+- 【改名验证】建议用户在服务器 `mv notify_domain_change.py notify_mail_v2.py` + `find . -name __pycache__ -exec rm -rf` 后跑新名，强制重编译以排除陈旧 .pyc / 同名模块作祟（用户自己提出的怀疑点）。
+- 【结论】修复后版本不可能再出现 `column "language" does not exist`（查询已无 language 字面量）；若改名+清缓存后仍报该错且带 [版本] 行，则需查 information_schema 探测是否异常。
diff --git a/.workbuddy/memory/2026-09-07.md b/.workbuddy/memory/2026-09-07.md
new file mode 100644
index 0000000..61290b3
--- /dev/null
+++ b/.workbuddy/memory/2026-09-07.md
@@ -0,0 +1,83 @@
+# 2026-09-07
+
+## notify_domain_change.py 语言列探测 v3（langprobe）
+- 上轮 information_schema 探测在线上误报（探测说 language 存在、真实查询报列不存在，疑似跨 schema 同名表干扰）。
+- 本轮重写为「真实试跑探测」`detect_lang_column()`：依次执行 `SELECT ... language / lang / NULL`（LIMIT 1），哪个能跑通用哪个；NULL 兜底必然成功，不会再因列缺失 FATAL。
+- `fetch_recipients(cfg, args, lang_expr=...)` 与 `main` 调用链对齐；版本号提升为 `2026-09-06.langprobe.v3`。
+- 6 场景 mock 验证全过：language 报错→降级 lang；全缺失→NULL 回退 default_lang(ja)；显式 --lang-column；自动探测拼 SQL 正确。
+- 测试脚本两处自身 bug（dict 键名 language 非 lang；mock 对 NULL 查询仍返回 'en'）已修正后 ALL_PASS。
+
+## v4（rfc5322.schema）：QQ 邮箱 550 退信 + 统计全 0 两个问题
+- 550 退信根因：`From: 狼的提问箱 <tamabox@...>` 中文显示名未做 RFC2047 编码，QQ（mx3.qq.com）回 550 "From header is missing or invalid"。修复：`formataddr((str(Header(显示名, utf-8)), 地址))` 编码 From，Subject 同样用 Header 编码，并补 Message-ID。
+- 统计全 0 根因：psql 未限定 schema，search_path 命中了别的 schema 里的同名空 users 表（也解释了 v2 information_schema 探测误报 language 存在）。修复：新增 `resolve_users_table()` 枚举所有 schema 的 users 表并逐个 COUNT，选有数据（其次带 language 列）的 schema，全部查询用 `"schema".users` 限定；main 打印 `[DB 连接]` 与 `[users 表]` 诊断行，全空时警告。
+- 5 场景 mock 验证 ALL_PASS（schema 定位/语言探测/counts/全空回退/From+Subject 编码与 Message-ID）。版本 `2026-09-07.rfc5322.schema.v4`。
+
+## 新项目 mail-broadcast/（站内信群发工具）
+- 用户确认 v4 后收件正常、数据正确，但邮件里提问箱链接显示成站点首页而非 `/_/个性域名`；要求新建独立可复用项目、四语言模板拆成独立 HTML。
+- 新建 `mail-broadcast/`：`broadcast.py`（通用化：去掉硬编码域名，`--site-url`/`--box-prefix`/`--var k=v` 自定义占位符；缺失占位符置空并上报）+ `templates/{zh-CN,zh-TW,en,ja}.{html,subject.txt}`（plain 可选，缺省由 HTML 自动抽取纯文本，HTMLParser 实现）+ README.md。
+- 保留 v4 全部 DB/SMTP 能力：schema 定位、语言列试跑探测、断点续发、分群限速、SMTP 拒收捕获、RFC2047 From/Subject、Message-ID。语言回退保持「空→zh-CN、未知→default_lang→zh-CN」。
+- 预览区直接打印每个收件人解析后的 box_link，方便发现链接问题。
+- 7 场景 mock 测试 ALL_PASS（含四语言渲染 box_link、缺失占位符上报、From 编码）。
+
+## params.ini 参数文件 + --interactive 交互模式
+- 用户新需求：运行时直接读参数文件，或运行后再交互。
+- 新增 `params.ini`（[site] site_url/box_prefix + [vars] 自定义占位符 + [send] to/delay/group_pause），默认自动读取脚本同目录 params.ini，`--params`/`--no-params` 可控；优先级 CLI > 文件 > 默认。
+- 安全边界：参数文件不提供 --send/--yes，正式发送必须命令行显式指定 + 终端确认。
+- `--interactive/-i`：逐项确认 site_url/box_prefix，自动扫描模板占位符（collect_template_placeholders 排除内置）逐个提问（模板加新占位符会被自动发现），可选测试邮箱，可选保存回 params.ini（save_params）。
+- 踩坑：测试脚本两次自身 bug（回答顺序没按字母序、Args 类属性 vs 实例属性）；跑挂的测试曾把 params.ini 写坏，已恢复标准值。7 场景 ALL_PASS。
+
+## conf 路径纳入 params.ini 与交互模式
+- params.ini 新增 `[path] config`（预填 ./auto/conf/app.ini）；`-c` 默认值改为 None，解析优先级：CLI > params.ini > 环境变量 TAMABOX_CONFIG_PATH > ./conf/app.ini。
+- `--interactive` 第一步先问配置文件路径（在 load_config 之前），保存回 params.ini 时含 config 路径（save_params 签名加 config 参数）。
+- 5 场景测试 ALL_PASS（params 读取/优先级/save round-trip 含 config/交互完整流程/标准值恢复）。
+
+## 交互选运行方式 + 模板对齐原程序邮件样式
+- 用户新需求：① send 之类的决策放进交互里而不是命令行；② 模板配色样式参照原程序 templates/mail/。
+- run_interactive 重构：占位符问完后进入「运行方式」选择（1 演练/2 测试/3 群发，默认回车=演练）；模式 2 问测试邮箱、模式 3 可问 limit（试水）并可选择是否保留最终确认（答 n → args.yes=True）。args.send/to/yes/limit 就地写入，交互全程无需 --send/--to/--yes。
+- 四语言模板重写为原程序 Google 风格：白底 #FFFFFF、#dadce0 细边框 8px 圆角卡片（max-width 516px）、标题 24px 带下边框、正文 Roboto 14px rgba(0,0,0,0.87)、次要信息 rgba(0,0,0,0.54)、新域名高亮框 #e8f0fe/#c6dafc、按钮 #4184F3 蓝底白字、页脚 11px rgba(0,0,0,0.54)。新增 `{{year}}` 内置占位符（ctx 用 datetime.now），run_interactive 的 builtin 集合同步排除。
+- 测试踩坑：render() 返回 (结果, missing) 元组需解包；群发路径交互共 8 次输入。24 项检查 ALL_PASS（四语言 box_link/按钮链接/配色/#year/占位符完整 + 4 交互场景 + From 头 ASCII）。
+
+## 默认交互模式 + 单文件通用模板（--single）
+- 用户新需求：① 默认就是交互模式不用手输；② 新增单文件模式（不按语言，所有人发同一个通用模板，模板单独存放便于以后复用）。
+- 默认交互：`--interactive` 改 default=None，parse 后判定——未给 --send/--to/--yes/--dry-run 之一即自动进入交互；`--no-interactive` 强制关闭（脚本化用）。
+- 单文件模式：templates/single.html + single.subject.txt（保留名，load_templates 排除不混入语言列表；load_single_template 单独加载，plain 自动抽取）。`--single` CLI 或交互「模板模式」选 2。发送时 grouping 固化为 single 组（不 resolve_lang），ctx 仍含每人 box_link/name/site/year；报告加 template_mode。
+- single.html 样式对齐原程序邮件，正文内容区用 HTML 注释标注「编辑这里」，含可复制的强调框示例。
+- 15 项检查 ALL_PASS（single 不混语言/加载/渲染/构建 + 4 交互组合场景）。
+
+## 交互只问缺失项（不再每次重复确认战役参数）
+- 用户反馈：site_url/box_prefix/old_domain/expire_date 这类一次性参数每次交互都问很烦，直接写死到这次 html 即可。
+- run_interactive 重构：开头打印「[参数确认]」摘要（沿用 params.ini/CLI/app.ini 的值），**有值一律不问**；只补问 ① 完全没值的 site_url（main 里先做 external_url 兜底）② 模板用到但 extra_vars 里还没有值的自定义占位符。box_prefix 不再询问（默认 /_/，CLI 可覆盖）。
+- 配置文件路径同理：CLI/params.ini 明确给了就打印沿用不问，仅默认猜测时才 ask。
+- 想改值：编辑 params.ini，或把一次性内容写死进模板 html 并删掉对应 {{占位符}}（占位符删了就不会被问）。
+- 测试踩坑：mock 回答数按实际提问数对齐（占位符 2 个非 3 个；摘要走 print 非 input 需 redirect_stdout 捕获）。7 项检查 ALL_PASS。
+
+## 文案修正：模板问句人称
+- 用户指出邮件模板「我该做什么？」应为「你该做什么？」（站方对收件人的口吻）。
+- 已修 templates/zh-CN.html 与 zh-TW.html 对应问句；渲染验证通过、无残留。en（What should I do?）/ ja（何をすればよいですか？）保持读者视角的惯用表达未改。
+
+## --limit 与断点续发顺序 bug 修复
+- 用户反馈：第一次发送部分成功，第二次 --limit 10 时「已跳过 10、剩余 0、一条没发」。
+- 根因：main 中 --limit 截取在断点续发过滤之前执行，limit 永远取名单头部那批已发用户，跳过后剩 0。
+- 修复：调整顺序为「先剔除已发 → 再取前 N」，--limit 提示语带上已剔除数量；补 had_state 标志控制「剩余待发送」打印。
+- 6 项回归测试 ALL_PASS（跳过+limit 组合、无重叠、limit>剩余、全已发、状态读写往返）。
+
+## 退信核查功能（bouncecheck.v2）
+- 背景：SMTP 250≠送达，阿里云对限流/无效地址先收下再异步退信到发件箱，用户要求发送后核查真实送达。
+- 新增零依赖 IMAP 退信扫描：--check-bounces 登录发件箱（imaplib 993，IMAP 域名由 smtp.→imap. 推导），两段式拉取（先头部命中退信特征再取全文），--since-days 默认 3。
+- 退信解析三层：标准 DSN（message/delivery-status, Action:failed）→ 中文「收信地址/收件人」标签 → 正文地址兜底（剔除发件人与 daemon/postmaster）；主题关键词 + multipart/report 双判定。
+- --prune-state 把退信用户从 broadcast_state.json 剔除 → 重跑自动补发；已核查 Message-ID 存 broadcast_bounces_seen.json 防重复报告。交互运行方式新增「4) 退信核查」（并移到模板模式之前，该模式跳过模板提问）。
+- 12 项单元测试 ALL_PASS（含用户真实退信格式、标准 DSN、限流退信全角冒号、prune 往返）。防御修正：正则加 (?<![A-Za-z0-9]) 防乱码前缀吞地址；测试须用 message_from_bytes 贴近 IMAP 真实路径（message_from_string 双编码会污染解析）。
+
+## 退信核查拆分三档（仅核查/仅剔除/剔除并补发）
+- 用户要求「仅剔除、不一定剔除后直接发送」。交互运行方式 4 下新增子选项：1 仅核查（默认，不改清单）/ 2 仅剔除（更新清单后结束，本次不发送）/ 3 剔除并补发（剔除后继续正常发送流程，发送前仍有统计确认）。
+- CLI 对应：--check-bounces 仅核查；--check-bounces --prune-state 仅剔除；--prune-state --send 剔除并补发（main 分支在 args.send 时不 sys.exit，落回正常发送流程）。
+- 4 项交互 mock 测试 ALL_PASS；README 同步。
+
+## 退信扫描起点改为群发首条记录
+- 用户反馈：固定近 3 天会把群发无关的退信/邮件扫进来。
+- 新增 resolve_scan_start()：auto（默认）取 broadcast_state.json 最早一条 ts - 1 天余量；--since YYYY-MM-DD 显式指定；无记录/无 ts 回退 --since-days（默认3）。IMAP search 用 SINCE 日期，控制台打印 [扫描起点] 说明。
+- 6 项测试 ALL_PASS（最早记录-1天/显式日期/非法日期回退/无清单回退/无 ts 回退）。
+
+## 移除扫描起点 -1 天余量
+- 用户反馈：提前 1 天余量导致扫描范围仍偏大。改为 auto 模式精确从群发首条记录的 ts 开始（不再 -1 天）；--since 显式日期与空清单回退 --since-days 逻辑不变。
+- 3 项测试 ALL_PASS（精确首条 ts/显式日期/空清单回退）；README 同步。
diff --git a/.workbuddy/memory/2026-09-08.md b/.workbuddy/memory/2026-09-08.md
new file mode 100644
index 0000000..c7b87d3
--- /dev/null
+++ b/.workbuddy/memory/2026-09-08.md
@@ -0,0 +1,19 @@
+
+## 安全告警邮件增加 IP 网络归属（2026-09-08）
+
+- 需求：autoban 批量扫描告警邮件中展示来源 IP 的云厂商/CDN 归属（用户提到"类似 cloudranger"），选定方案 A：`projectdiscovery/cdncheck v1.3.0`（MIT，离线签名，零外部请求）。
+- 新增 `internal/security/ipinfo`：`Lookup(ip) (label, proxied)`，依次查 CDN→WAF→Cloud，错误折叠为"识别失败"标签，不中断告警链路；缩写映射 aws→AWS 等。
+- `mail.SendSecurityAlertMail` 增加 `provider`/`proxied` 参数；`route.go` SendAlert 闭包注入 lookup；模板加「网络归属」行 + 命中代理网络时的红色提示块。
+- 验证：全模块类型检查 + 相关包测试通过（s3.go 磁盘换桩法）；smoke 实测 1.1.1.1→Cloudflare（WAF）、52.95.255.1→AWS（云厂商）。
+- 新增回归测试：`internal/mail/mail_alert_test.go`（模板渲染含 proxy_hint 条件分支）。
+- 教训（重要）：本机 Windows + go1.25.5 下 `-overlay` 行为异常（静默不生效 / "deleted in overlay"），**overlay 不可靠；本地验证用磁盘换桩法**：`cp dev/s3stub/s3_stub.go internal/storage/s3.go`（先备份）→ build/test → 还原。chai2010/webp 是 cgo 库，用户生产编译在 Linux，无需本地真编译。
+- `go mod tidy` 顺带升级了部分共享依赖（lipgloss 0.13、xid 1.5、testify 1.11 等），全量构建+测试通过。
+- dev/overlay.json 现指向 dev/s3stub/s3_stub.go（旧值指向已删除的 Downloads 副本，已过时）。
+
+## autoban 线上触发实测（box-dev-api.337845818.best，2026-09-08 13:38）
+
+- 基线：/ → 200；敏感路径 → 302（业务跳转，但会计入统计）。
+- 60s 窗口内连发 18 个敏感路径：前 ~9 个 302，第 ~10 个起全部 403；封禁后连首页也 403 "403 Forbidden"（中间件先于业务路由，全站拦截）。
+- ⚠️ 触发点 ≈ 9~10 次，不是配置的 15：疑似部署侧仍是默认阈值（DefaultThresholdSensitive=10）。需检查服务器 conf/app.ini [security] ban_threshold_sensitive = 15 是否落盘并重启服务。
+- 本次触发应已发出一封告警邮件（每 IP 仅一次），可借机验收新的「网络归属」字段。
+- 本机出口 IP 已被临时封禁（默认 15 分钟自动解除），期间再测会 403。
diff --git a/.workbuddy/memory/2026-09-10.md b/.workbuddy/memory/2026-09-10.md
new file mode 100644
index 0000000..a0c7f9a
--- /dev/null
+++ b/.workbuddy/memory/2026-09-10.md
@@ -0,0 +1,40 @@
+# 2026-09-10
+
+## 负面情绪提问拦截方案调研（评审，未改代码）
+
+- 盘点提问链路现有 5 道防线，结论：**无任何情绪/意图维度判定**，全部是字面/合规/可用性维度。
+- 已验证的代码事实（后续复用）：
+  - 文本审核走七牛 `POST https://ai.qiniuapi.com/v3/text/censor`，scene=`antispam`，10s 超时（`internal/security/censor/qiniu.go:85`）。
+  - `IsPass()` 只硬拦 `politics/terrorism/porn`，且 `review` 一律放行 → `abuse`（辱骂）实际漏过（`qiniu.go:55-68`）。
+  - `censor.go:50-53` 命中 31 天缓存后**重新用 parser 计算 Pass**，缓存不锁死判定 → 收紧 `IsPass()` 无需清缓存。
+  - 拉黑 `user_block` 只作用于私聊（`route/question/page.go:368` 在 `StartChat` 分支内），**不拦提问**。
+  - 项目无 at-rest 加密（grep aes/Encrypt 无结果）；无队列/Worker，异步只有 `shared.SafeGo` 裸 goroutine；Redis 仅 session/cache。
+  - 有内存滑动窗口限流器 `internal/route/ratelimit.go`，可复用做单 IP 限流。
+  - `conf.Limits.QuestionContentLen` 默认 1000；`AnswerContentLen`/`FollowUpContentLen` 默认 2000（= 七牛文本 2000 字上限的边界）。
+
+## 重要背景更正（用户指出）
+
+- **图片/文本审核服务是七牛云，不是阿里云**。阿里云通道虽仍在 `censor.go` 代码中，但 `conf/app.sample.ini` 的 `aliyun_access_key` 为空，实际不生效。后续所有审核相关评估以七牛为准。
+
+## 七牛云能力（官方文档已验证）
+
+- 文本审核 label 9 类：normal/spam/ad/politics/terrorism/**abuse**/porn/flood/contraband/meaningless；suggestion: block/review/pass + score；≤2000 字；不支持白名单（拉黑词库要提交工单）。
+- 七牛自有 LLM（MaaS）：`https://api.qnaigc.com/v1`，兼容 OpenAI `/v1/chat/completions` 与 Anthropic `/v1/messages`，50+ 模型，**用独立 API Key（非 AK/SK）**。
+
+## 产出
+
+- `outputs/llm-moderation-feasibility-2026-09-10.md`：LLM 内容审核方案可行性评审（数据流/失败降级/配置校验/Key 安全/邮件告警/成本限额）。
+- 4 个 P0：SSRF（用户自填 API 地址，连通性测试即探测入口）、Key 明文落库、用户 Key 被刷造成损失、失败即发信导致邮件轰炸。
+- 核心建议：分层 L1 收紧七牛 `IsPass()`（零成本）→ L2 本地情绪词库 → L3 LLM 只补七牛覆盖不到的语义部分。
+- 待用户确认 8 点，最关键：命中后是"提示+仍提交"还是"硬拦"。
+
+## 追加修订（用户实测反馈）
+
+- **用户反馈：七牛对「辱骂」判定过严，正常对话经常误伤** → 撤回原 L1 建议（把 abuse 纳入硬拦），照做会放大误伤。
+- 误伤两个真实成因（已代码复核）：
+  1. 七牛把正常内容判 `abuse` 且 `suggestion=block` → `qiniu.go:55-68` 拒绝 → 提问/私聊直接发不出去；
+  2. **审核服务不可用时 fail-closed 拒绝**（`page.go:574`、`chat_handler.go:258`）→ 七牛抖动期间全站发不出内容。
+- 关键约束：七牛文本审核**不支持白名单**、自定义词库需提交工单 → 无法调准也无法调松，**唯一可控的是"命中后怎么办"**。
+- 修订原则：**显式规则硬拦，算法推断只标记**。箱主自定义屏蔽词+高危三类(politics/terrorism/porn)硬拦；abuse/spam/ad/flood/contraband/meaningless 只打标记照常送达；审核不可用改 fail-open+标记待审。
+- 落地：questions/messages 加标记列（AutoMigrate 自动加列）+ 后台折叠/筛选 + 设置页「审核严格度」三档（严格/宽松(默认)/仅标记）+ 用 `detail.Score` 自建阈值（默认偏高）。
+- 该路线零延迟零外部依赖，顺带消掉 SSRF/Key 明文/Key 被刷/邮件轰炸 4 个 P0。
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..1527ce5
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,90 @@
+# TamaBox 功能与修复变更记录
+
+> 变更日期：2026-08-12 ~ 2026-08-13
+> 说明：本文档汇总本阶段对 TamaBox（NekoBox fork）新增的功能、修复的问题与性能/安全优化，供部署、维护与后续开发参考。
+
+---
+
+## 一、新增功能
+
+| # | 功能 | 说明 |
+|---|------|------|
+| 1 | **问题置顶 / 精选回答** | 提问箱主人在管理页可置顶/取消置顶提问，公开主页置顶优先展示（`is_pinned` 字段 + `PinFirst` 排序） |
+| 2 | **单题分享图** | 单个问题（提问+回答）生成分享卡片图，仅公开且已回答可生成；复用主页分享图的绘制/缓存/字体模块 |
+| 3 | **回答后追问** | 提问者凭 token/登录身份对已回答的问题最多追问 3 次，主人可回复；事务+行锁保证并发上限；追问框仅在主人回复上一轮后显示，等待期间提示提问者 |
+| 4 | **回答 Markdown 渲染** | 回答与追问回答支持 Markdown 排版，服务端渲染 + HTML 白名单过滤（防存储型 XSS），带 XSS 单测 |
+| 5 | **深色模式** | 全站一键切换深/浅色（cookie 持久化 365 天）；桌面端顶栏图标、移动端底部固定操作栏，双入口 |
+| 6 | **同 IP 重复内容拦截** | 同一 IP 在 5 分钟内提交相同内容（提问/私聊首条）会被拒绝，防刷屏 |
+| 7 | **匿名 / 登录分级限流** | 登录用户享有 3 倍请求额度，匿名与登录独立限流器统计（滑动窗口） |
+| 8 | **封禁用户连带清理** | 新增 CLI 命令 `TamaBox ban --email/--domain`：事务级联删除该用户提问、追问、私聊、消息、图片关联并物理删除账号（含二次确认） |
+| 9 | **提问箱统计看板** | 管理页顶部 6 张统计卡：总提问 / 已回答 / 未回答 / 私密 / 置顶 / 私聊会话 |
+| 10 | **热门标签榜** | 探索页展示高频用户标签（点击即搜索），热门问题区块按需移除 |
+| 11 | **全文搜索提问箱** | 管理页可按关键词搜索自己收到的提问与回答（LIKE 模糊匹配，通配符转义，含私密提问） |
+| 12 | **JSON 全量导出** | `/user/profile/export-json` 导出用户信息 + 提问/回答/追问/图片 + 私聊全部消息，满足数据可携带权；与既有 Excel 导出并存 |
+| 13 | **多语言（i18n）** | 简体中文 / 繁體中文 / English / 日本語；按 语言 cookie > 登录用户配置 > 提问箱主人配置 > 站点默认 解析；**注册页可直接选择界面语言**（登录后即刻生效），注册成功提示跟随所选语言 |
+| 14 | **私聊**（已有功能完善） | 登录用户可向开启私聊的提问箱发起会话，支持图片、拉黑、每日条数上限、会话关闭；管理页批量获取首条消息避免 N+1 |
+| 15 | **页面密码 / 提问密码** | 提问箱页面可设置访问密码、提问可设置密码（bcrypt 存储） |
+
+## 二、问题修复
+
+### 编译阻断（在 Linux 上也会编译失败，已全部修复）
+- `QuestionsStore` 接口缺失 `SetPinned` 方法 → **置顶功能无法编译**，已补接口声明
+- `internal/route` 限流、IP 黑名单中间件 `ctx.Request()` 类型错误（应为 `ctx.Request().Request`）→ 修复
+
+### 运行时 500 / 功能异常
+- `templates/embed.go` 遗漏 `about-me.html` → `/about-me` 页面 500，已补嵌入
+- **`/user/questions` 500**：`question-list.html` 在 `{{range}}` 内 6 处误用 `.LangCode`（应为 `$.LangCode`），渲染到私密/未回答/私聊条目即报错；已全部修正并新增渲染回归测试
+- "等待主人回复"提示误显示给提问箱主人 → 增加提问者身份判断
+- 邮箱 / 域名无唯一索引（并发注册可重复）→ 改为唯一索引
+- 验证码 remoteIP 未统一解析（反代部署失效）→ 统一走 `shared.ResolveClientIP`
+
+### 安全 / 稳定性
+- 图片代理无响应体大小限制（DoS）→ 10MB 上限
+- 图片代理缺少 302 重定向 SSRF 防护 → 域名白名单 + 内网 IP 拦截 + 逐跳重定向校验
+- 限流器每个实例泄漏常驻 goroutine → 包级注册表 + 单一清理循环
+- `censor.RemoveTrustedURL` 白名单删除机制保留（建议定期审查 TrustedHosts）
+
+### UI / 交互
+- 提问成功页复制按钮与链接栏大小不协调、两个操作按钮样式不统一 → 统一 flex 布局与按钮样式
+- 顶栏多语言文字（英文/日文）溢出：最终方案为**恢复 UIkit 居中三列布局**，桌面端原样；手机端（≤640px）改流式单行 + 横向滚动兜底，用户名限宽省略号截断
+- 管理页置顶按钮与"未回答"等标签不对齐 → 标签组改 flex 容器统一对齐；置顶按钮改用 `uk-label` 标签样式，完全继承 UIkit 尺寸（定制版 `.uk-label` 字号为 0.875rem，不再硬编码）
+- 语言切换 / 深色模式入口在移动端移入底部固定操作栏（毛玻璃样式）
+
+## 三、性能与体积优化（分享图）
+
+- **画布尺寸 1280×720 → 960×540**：绘制与编码工作量降至约 40%
+- **输出格式 PNG → JPEG（质量 88）**：单张体积约减小 90%（从数百 KB~1MB 降至约 100KB 量级），编码更快
+- **文字宽度测量改估算**（逐字符宽度累加，替代每次创建 freetype.Context + DrawString 测量）
+- 分享图结果缓存 TTL 由 30 分钟延长至 1 小时，远程图片缓存 1 小时不变
+- 名称文字增加柔和投影，增强复杂背景上的可读性
+
+## 四、新增命令与配置
+
+### CLI 命令
+| 命令 | 用途 |
+|------|------|
+| `TamaBox web` | 启动 Web 服务 |
+| `TamaBox censor` | 批量补审未审查的提问/回答（需配置文本审查服务） |
+| `TamaBox uid` | 为历史用户补生成 UID |
+| `TamaBox ban --email user@example.com`（或 `--domain`，可加 `--yes` 跳过确认） | 封禁用户并连带清理其全部数据（不可恢复） |
+
+### 配置项（conf/app.ini）
+| 配置 | 说明 |
+|------|------|
+| `[app] default_lang` | 站点默认语言（zh-CN / zh-TW / en / ja），留空默认简体中文 |
+| `[security] ip_blacklist` / `ip_blacklist_redirect_url` | 逗号分隔 IP/CIDR 黑名单，命中跳转指定 URL |
+| `[security] trust_proxy` | 反代部署且代理已覆盖 X-Real-IP/X-Forwarded-For 时设为 true，否则 false（防伪造 IP 绕过限流/黑名单） |
+| `[recaptcha] captcha_type` | recaptcha / turnstile / math（本地算数验证码） |
+| `[upload] image_*` / `aliyun_*` | 图片存储（R2/S3 或 OSS） |
+| `[mail] skip_tls_verify` | 自签名 SMTP 证书时跳过校验 |
+| `[service] tls_insecure_skip_verify` | 内网后端自签名证书时跳过校验 |
+
+### 编译依赖提示
+- `chai2010/webp` 需要 CGO 与系统 `libwebp`（Linux：`apt install libwebp-dev`），转换失败自动回退原始格式
+- 动画 GIF 转 WebP 需要系统 `cwebp` 命令，未安装时回退原始 GIF
+
+## 五、测试
+
+- 非 DB 依赖测试全部通过：`templates`（模板解析 + 交叉引用 + 渲染回归）、`internal/i18n`、`internal/shared`、`internal/security/censor`、`internal/template`（含 Markdown XSS 用例）
+- DB 层测试需要外部 MySQL/Postgres（`DB_TYPE` 环境变量），建议 CI 配置
+- 注意：Windows 上因 webp 依赖无法完整编译，请在 Linux 环境 `go build ./...` 复核
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..9176cd0
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,26 @@
+FROM golang:1.20-alpine as builder
+
+WORKDIR /app
+
+ENV CGO_ENABLED=0
+
+ARG GITHUB_SHA=dev
+
+COPY . .
+
+RUN go mod tidy
+RUN go build -v -ldflags "-w -s -extldflags '-static' -X 'github.com/NekoWheel/NekoBox/internal/conf.BuildCommit=$GITHUB_SHA'" -o NekoBox ./cmd/
+
+FROM alpine:latest
+
+RUN apk update && apk add tzdata && cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime \
+&& echo "Asia/Shanghai" > /etc/timezone
+
+WORKDIR /home/app
+
+COPY --from=builder /app/NekoBox .
+
+RUN chmod 777 /home/app/NekoBox
+
+ENTRYPOINT ["./NekoBox", "web"]
+EXPOSE 8080
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000..3d32474
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2022 E99p1ant
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..9ff5bd1
--- /dev/null
+++ b/README.md
@@ -0,0 +1,89 @@
+<h1 align="center">
+<img src="https://nekobox-public.oss-cn-hangzhou.aliyuncs.com/images/Neko.png" width=100px/>
+
+狼的提问箱
+</h1>
+
+<p align="center">
+匿名提问箱 / Anonymous Question Box
+
+基于原版NekoBox做了一些微小的修改。主要体现在：
+ - 率先引入二维码访问，同时增加更多自定义可行性，方便自行创作。
+ - 添加探索页面，允许用户自行选择添加标签并展示，为陌生人提问创造可能。
+ - 稍微调整了屏蔽词策略。
+
+## 截图
+
+### QRcode
+![QRCode](./dev/qrimg.png#gh-light-mode-only)
+<br>
+### Commit with picture
+![CWP](./dev/commitwithpic.png#gh-light-mode-only)
+<br>
+### Explorer
+![explore_setting](./dev/explore_setting.png#gh-light-mode-only)  
+<br>
+![explore](./dev/explore.png#gh-light-mode-only)  
+
+## 安装
+
+### 需求
+
+* [Go](https://golang.org/dl/) (v1.19 或更高版本)
+* [MySQL](https://www.mysql.com/downloads/) (v5.7 或更高版本)
+* [Redis](https://redis.io/download/) (v6.0 或更高版本)
+
+### 从源码编译
+
+```bash
+git clone https://github.com/tamakyi/TamaBox.git
+
+cd TamaBox
+
+go build -o TamaBox
+```
+
+### 编辑配置文件
+
+```bash
+cp conf/app.sample.ini conf/app.ini
+```
+
+### 运行
+
+```bash
+./TamaBox web
+```
+
+## 架构
+
+![Architecture](./dev/nekobox-arch-light.png#gh-light-mode-only)
+![Architecture](./dev/nekobox-arch-dark.png#gh-dark-mode-only)
+
+NekoBox 使用 GitHub Actions 进行持续集成和部署。
+
+当用户访问 NekoBox 时，请求将会被发送至阿里云 CDN，CDN 的访问日志将会被实时推送到阿里云日志服务
+(SLS)。日志数据将在 SLS 中存储 180 天，用于审计。
+
+用户的信息、提问和回答将被存储在 MySQL 数据库中。
+
+用户的会话、CSRF 令牌和电子邮件验证令牌将被暂时存储在 Redis 中。
+
+用户的整个请求和响应链路将被上传到 Uptrace 用于调试。这些数据将被储存 30 天。管理员可以使用用户提供的 `TraceID`
+来追踪查询指定的请求。
+
+当用户提交提问时，问题的内容将被发送到七牛文本审查服务进行审查。如果提问内容存在问题，该内容将被发送到阿里云文本审查服务进行二次审查。
+如果内容审查仍未通过，该提问将被拒绝发送。这是由于七牛文本审查服务不是很准确，一些非冒犯性的内容可能被七牛文本审查误报。
+
+当用户收到新的提问时，阿里云邮件服务（DM）会向用户的邮箱发送一封邮件。
+
+你可以在主页查看 NekoBox 的更新日志，也欢迎访问赞助页面来打钱支持 NekoBox。 更新日志和赞助商名单存储在独立部署的
+Pocketbase 服务中。
+
+## 开源协议
+
+MIT License
+
+## 备注
+
+* 基于原版[Nekobox](https://github.com/NekoWheel/NekoBox)修改，基本与原版无异，主要是添加了个人主页二维码和首页统计数，并修改了部分适合自己的参数。
diff --git a/README.zh-CN.md b/README.zh-CN.md
new file mode 100644
index 0000000..877e6ca
--- /dev/null
+++ b/README.zh-CN.md
@@ -0,0 +1,122 @@
+<h1 align="center">
+<img src="https://box-user-assets.n3ko.cc/public/Neko.png" width=100px/>
+
+NekoBox
+</h1>
+
+<p align="center">
+匿名提问箱 / Anonymous Question Box
+</p>
+<p align="center">
+<a href="https://goreportcard.com/badge/github.com/NekoWheel/NekoBox">
+    <img src="https://github.com/NekoWheel/NekoBox/workflows/Go/badge.svg" alt="Go Report Card">
+</a>
+<a href="https://sourcegraph.com/github.com/NekoWheel/NekoBox">
+    <img src="https://img.shields.io/badge/view%20on-Sourcegraph-brightgreen.svg?logo=sourcegraph" alt="Sourcegraph">
+</a>
+<a href="https://deepsource.io/gh/NekoWheel/NekoBox/?ref=repository-badge">
+    <img src="https://deepsource.io/gh/NekoWheel/NekoBox.svg/?label=active+issues&token=7nuU5C-4QG3CP_5g9qFf3Bl9" alt="DeepSource">
+</a>
+<a href="https://goreportcard.com/report/github.com/NekoWheel/NekoBox">
+    <img src="https://goreportcard.com/badge/github.com/NekoWheel/NekoBox" alt="Go Report Card">
+<a>
+</p>
+
+<p align="center">
+<a href="/README.zh-CN.md">简体中文</a> | <a href="/README.md">English</a>
+</p>
+
+![Screenshot](./dev/screenshot.svg)
+
+## 安装
+
+### 需求
+
+* [Go](https://golang.org/dl/) (v1.19 或更高版本，`go.mod` 声明 `go 1.25.0`)
+* [MySQL](https://www.mysql.com/downloads/) (v5.7 或更高版本)
+* [Redis](https://redis.io/download/) (v6.0 或更高版本)
+
+> 编译依赖说明：`chai2010/webp` 需要 CGO 与系统 `libwebp`（Debian/Ubuntu：`apt install libwebp-dev`），
+> 静态图片上传时会自动转换为 WebP。若安装失败，转换将自动回退为原始格式（不影响编译之外的功能）。
+> 动画 GIF 转 WebP 需要系统安装 `cwebp` 命令行工具，未安装时回退为原始 GIF。
+
+### 从源码编译
+
+```bash
+git clone https://github.com/NekoWheel/NekoBox.git
+
+cd NekoBox
+
+go build -o NekoBox
+```
+
+### 编辑配置文件
+
+```bash
+cp conf/app.sample.ini conf/app.ini
+```
+
+### 运行
+
+```bash
+./NekoBox web
+```
+
+### 常用命令
+
+| 命令 | 用途 |
+| ---- | ---- |
+| `./NekoBox web` | 启动 Web 服务 |
+| `./NekoBox censor` | 批量补审未审查的提问/回答（需配置文本审查服务） |
+| `./NekoBox uid` | 为历史用户补生成 UID |
+| `./NekoBox ban --email user@example.com` | 封禁用户并连带清理其提问、追问、私聊与消息（不可恢复，执行前二次确认） |
+
+## 功能特性
+
+- **匿名提问 / 私密提问**：支持匿名或登录后提问，可标记私密（仅通过 token 链接可见）
+- **问题置顶 / 精选回答**：提问箱主人在管理页置顶提问，公开主页置顶优先展示
+- **回答后追问**：提问者凭 token 可对已回答的问题最多追问 3 次，主人可回复
+- **Markdown 回答**：回答支持 Markdown 排版（服务端渲染 + 白名单过滤防 XSS）
+- **分享图**：提问箱主页分享图与单题分享图（含二维码，复用同一绘制模块）
+- **页面密码 / 提问密码**：可选为提问箱页面设置访问密码、为提问设置密码
+- **同 IP 重复内容拦截**：同一 IP 在 5 分钟内提交相同内容会被拒绝
+- **匿名 / 登录分级限流**：登录用户享有更高请求额度（端点级滑动窗口限流）
+- **IP 黑名单**：支持精确 IP 与 CIDR，命中后跳转到指定 URL
+- **私聊**：登录用户可向开启私聊的提问箱发起会话，支持图片、拉黑、每日上限
+- **提问箱统计看板**：管理页展示总提问 / 已回答 / 未回答 / 私密 / 置顶 / 私聊统计
+- **全文搜索**：管理页可按关键词搜索自己提问箱的提问与回答
+- **热门问题 / 标签榜**：探索页展示热门标签与最新活跃的公开提问
+- **数据导出**：支持 Excel 导出与 JSON 全量导出（含追问与私聊，可迁移备份）
+- **多语言**：简体中文 / 繁體中文 / English / 日本語，支持按 cookie、用户配置与提问箱配置切换
+- **深色模式**：全站一键切换深/浅色（cookie 持久化）
+- **内容审查**：七牛 + 阿里云文本审查（可配置），结果带 30 天缓存
+
+
+## 架构
+
+![Architecture](./dev/nekobox-arch-light.png#gh-light-mode-only)
+![Architecture](./dev/nekobox-arch-dark.png#gh-dark-mode-only)
+
+NekoBox 使用 GitHub Actions 进行持续集成和部署。
+
+当用户访问 NekoBox 时，请求将会被发送至阿里云 CDN，CDN 的访问日志将会被实时推送到阿里云日志服务
+(SLS)。日志数据将在 SLS 中存储 180 天，用于审计。
+
+用户的信息、提问和回答将被存储在 MySQL 数据库中。
+
+用户的会话、CSRF 令牌和电子邮件验证令牌将被暂时存储在 Redis 中。
+
+用户的整个请求和响应链路将被上传到 Uptrace 用于调试。这些数据将被储存 30 天。管理员可以使用用户提供的 `TraceID`
+来追踪查询指定的请求。
+
+当用户提交提问时，问题的内容将被发送到七牛文本审查服务进行审查。如果提问内容存在问题，该内容将被发送到阿里云文本审查服务进行二次审查。
+如果内容审查仍未通过，该提问将被拒绝发送。这是由于七牛文本审查服务不是很准确，一些非冒犯性的内容可能被七牛文本审查误报。
+
+当用户收到新的提问时，阿里云邮件服务（DM）会向用户的邮箱发送一封邮件。
+
+你可以在主页查看 NekoBox 的更新日志，也欢迎访问赞助页面来打钱支持 NekoBox。 更新日志和赞助商名单存储在独立部署的
+Pocketbase 服务中。
+
+## 开源协议
+
+MIT License
diff --git a/cmd/tamabox.go b/cmd/tamabox.go
new file mode 100644
index 0000000..6f2a60d
--- /dev/null
+++ b/cmd/tamabox.go
@@ -0,0 +1,29 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package main
+
+import (
+	"os"
+
+	"github.com/sirupsen/logrus"
+	"github.com/urfave/cli/v2"
+
+	"github.com/tamakyi/TamaBox/internal/cmd"
+)
+
+func main() {
+	app := cli.NewApp()
+	app.Name = "TamaBox"
+	app.Description = "Anonymous question box"
+
+	app.Commands = []*cli.Command{
+		cmd.Web,
+		cmd.Censor,
+		cmd.Uid,
+	}
+	if err := app.Run(os.Args); err != nil {
+		logrus.WithError(err).Fatal("Failed to start application")
+	}
+}
diff --git a/conf/app.sample.ini b/conf/app.sample.ini
new file mode 100644
index 0000000..d81c7da
--- /dev/null
+++ b/conf/app.sample.ini
@@ -0,0 +1,157 @@
+[app]
+production = true
+external_url = "https://box.shiroko.one"   ; 【必填】站点对外访问地址。用于生成 og:url 与邮件中的全部链接
+                                           ; （找回密码、私信通知等），必须以 http(s):// 开头、结尾不带斜杠
+                                           ; （程序会自动 TrimRight "/"）。域名迁移时只改这一处即可全局生效。
+title = "NekoBox"
+icp = ""
+default_lang = ""                        ; 站点默认语言：zh-CN / zh-TW / en / ja，留空默认简体中文（访客未设置语言时的兜底）
+uptrace_dsn = ""
+qiniu_access_key = ""
+qiniu_access_secret = ""
+aliyun_access_key = ""
+aliyun_access_key_secret = ""
+share_background = "https://your-default-background.jpg"  ; 默认分享图背景图链接（1280x720）
+font_path = "static/fonts/NotoSansSC-Regular.otf"         ; 中文字体文件路径（相对项目根目录）
+
+[security]
+enable_text_censor = true
+ip_blacklist =                     ; 逗号分隔的IP黑名单，支持精确IP(如1.2.3.4)和CIDR(如1.2.3.0/24)，留空不启用
+ip_blacklist_redirect_url =        ; 黑名单IP访问时强制跳转到该URL
+trust_proxy = false                ; 是否信任反向代理设置的 CF-Connecting-IP / X-Real-IP / X-Forwarded-For 头。
+                                   ; 仅当站点部署在可信反向代理（如 nginx/Cloudflare）之后且代理已覆盖这些头时设为 true；
+                                   ; 否则保持 false，防止客户端伪造 header 绕过速率限制与 IP 黑名单。
+                                   ; ⚠️ 若站点在 Cloudflare 后且需使用下面的自动封禁，必须设为 true，
+                                   ; 否则解析到的将是 Cloudflare 边缘 IP，自动封禁会误伤所有访客。
+                                   ; ⚠️ 开启 trust_proxy 时，必须配合「Cloudflare Tunnel / Authenticated Origin Pull /
+                                   ; 防火墙仅放行 Cloudflare / EdgeOne 回源网段」锁定源站，否则攻击者可直连源站并伪造
+                                   ; CF-Connecting-IP / EO-Client-IP 头。无需维护 CDN 庞大 CIDR 清单。
+                                   ;
+                                   ; —— 双 CDN（境内腾讯 EdgeOne + 境外 Cloudflare）场景 ——
+                                   ; EdgeOne 回源会用 EO-Client-IP 携带客户端真实 IP（等效 CF-Connecting-IP），
+                                   ; 本程序在 trust_proxy=true 时已同时信任这两个权威头。
+                                   ; 两家 CDN 并存时必须：① 防火墙仅放行两家回源网段；② 在各家 CDN 的规则引擎中
+                                   ; 删除回源请求里「对方 CDN」的权威头（经 EdgeOne 回源删 CF-Connecting-IP、
+                                   ; 经 Cloudflare 回源删 EO-Client-IP），否则攻击者可借道另一家伪造客户端身份，
+                                   ; 绕过限流 / 自动封禁 / 单 IP 投票限制。详细步骤见 outputs/edgeone-cloudflare-dual-cdn-guide.md。
+
+trusted_proxies =
+                                   ; 逗号分隔的「你自己的」反向代理/负载均衡 IP 或 CIDR（如 127.0.0.1、
+                                   ; 10.0.0.0/8）。仅当 TCP 对端落在该清单内时才解析 X-Forwarded-For / X-Real-IP。
+                                   ; 留空（默认）则这两个头永不被信任，仅采用 CDN 权威头 CF-Connecting-IP /
+                                   ; EO-Client-IP（需源站已锁定）。
+                                   ; 注意：此清单用于你自己的基础设施，不是 CDN 的全量 CIDR 清单。
+enable_auto_ban = true             ; 自动封禁（fail2ban 风格）：检测到批量扫描/探测后临时封禁来源 IP
+ban_track_notfound = false         ; 是否把「未注册路径的 404」计入封禁统计（默认 false）。正常业务
+                                   ; （域名/题目不存在等均走 302 业务跳转，不产生 404 计数）一律放行，
+                                   ; 仅命中后台扫描特征路径（/admin、/.env 等）才参与统计封禁，避免
+                                   ; 共享出口（CDN 边缘 / CGNAT）下正常用户被 404 探测连坐误伤。
+                                   ; 如需恢复对纯 404 字典扫描的封禁再置 true。
+ban_threshold_sensitive = 10       ; 统计窗口内命中敏感路径（/admin、/.env、/wp-admin 等）的次数阈值
+ban_threshold_404 = 20             ; 统计窗口内返回 404 的次数阈值（仅 ban_track_notfound = true 时生效）
+ban_window_seconds = 60            ; 统计窗口时长（秒）
+ban_duration_minutes = 15          ; 临时封禁时长（分钟），到期自动解除，重启即清零
+security_alert_email =             ; 触发封禁时发送告警邮件的收件人（复用下方 SMTP 发信配置），留空不发送
+
+[server]
+port = 80
+; 绑定监听地址（含端口）。Cloudflare Tunnel 部署时强烈建议设为 127.0.0.1:<port>，
+; 使源站端口仅对本地 cloudflared 可见，即使防火墙误配也无法被外部直连伪造 CF-Connecting-IP。
+; 留空（默认）则监听所有网卡 ":port"。
+listen =
+salt = ""
+# ⚠️ 必填：密码哈希盐，留空会导致启动失败（已在 conf.Init 强制校验）
+xsrf_key = ""
+# ⚠️ 必填：CSRF token 密钥，留空会导致启动失败（已强制校验）
+xsrf_expire = 3600
+
+[database]
+type = "postgres"
+user = "nekobox"
+password = ""
+host = "127.0.0.1"
+port = 5432
+name = "nekobox"
+schema = "public"
+# 仅在已确认需要自动清理重复 email/domain 时开启；默认关闭，避免启动时改写账号数据。
+dedupe_unique_fields = false
+
+[redis]
+addr = "127.0.0.1:6379"
+password = ""
+
+[recaptcha]
+captcha_type = recaptcha  ; recaptcha（默认）, turnstile, math（本地算数验证码，国内访问友好）
+domain = "https://www.recaptcha.net"
+site_key = ""
+server_key = ""
+turnstile_style = false
+
+[upload]
+default_avatar = ""
+default_background = ""
+
+# User avatar and background.
+aliyun_endpoint = ""
+aliyun_access_id = ""
+aliyun_access_secret = ""
+aliyun_bucket = ""
+aliyun_bucket_cdn_host = ""
+image_endpoint = ""
+image_access_id = ""
+image_access_secret =""
+image_bucket = ""
+image_bucket_cdn_host = ""
+
+# User uploaded images.
+image_endpoint = ""
+image_access_id = ""
+image_access_secret = ""
+image_bucket = ""
+image_bucket_cdn_host = ""
+
+[mail]
+account = ""
+password = ""
+port = 465
+smtp = ""
+
+[limits]
+; ── 全站内容 / 数量上限（运行时配置，修改后重启生效）──────────────────────
+; 缺失本段或个别键时按内置默认值运行。长度统一按字符（rune）计数。
+; 键留空或填 0/负数时自动回退内置默认值，不会导致启动失败，但也不会按你的意图生效，
+; 请按需填写正整数。本文件启用 IgnoreInlineComment，行内分号注释会被并入配置值，
+; 因此下面注释一律独占整行、勿写行内注释。
+
+; ── 标签与屏蔽词（账号设置页）──────────────────────────────────────────────
+; 最多标签个数
+max_tags = 5
+; 单个标签最大字符数
+max_tag_len = 5
+; 最多屏蔽词个数
+max_block_words = 10
+; 单个屏蔽词最大字符数
+max_block_word_len = 10
+
+; ── 投票 ────────────────────────────────────────────────────────────────────
+; 参与者填写的「自定义补充选项」（其他/自定义）最大字符数
+custom_answer_len = 200
+; 站长创建投票时单个「选项」文本最大字符数（预设选项）
+vote_option_len = 300
+
+; ── 提问 / 回答 / 追问 ─────────────────────────────────────────────────────
+; 提问正文最大字符数（访客提交的问题内容）
+question_content_len = 1000
+; 回答正文最大字符数（箱主对提问的回答，及对追问的回复，共用）
+answer_content_len = 2000
+; 追问正文最大字符数（提问者被回答后继续追问的内容）
+followup_content_len = 2000
+
+; ── 私聊 ────────────────────────────────────────────────────────────────────
+; 单条消息（发送/回复）最大字符数
+chat_message_len = 2000
+; 每个私聊会话的消息条数上限（系统硬顶）。用户只能在 1..该值 之间设置自己的
+; 会话条数上限；新注册用户的默认值即该硬顶。
+chat_max_messages = 200
+; 单用户每日私信条数上限（用户可设范围 0..该值；0 表示不限制每日条数）
+daily_message_limit_max = 999
diff --git a/dev/__pycache__/notify_domain_change.cpython-313.pyc b/dev/__pycache__/notify_domain_change.cpython-313.pyc
new file mode 100644
index 0000000..179d552
Binary files /dev/null and b/dev/__pycache__/notify_domain_change.cpython-313.pyc differ
diff --git a/dev/add_form_keys.py b/dev/add_form_keys.py
new file mode 100644
index 0000000..1250392
--- /dev/null
+++ b/dev/add_form_keys.py
@@ -0,0 +1,191 @@
+#!/usr/bin/env python3
+# Insert form-validation i18n keys (form.*) into all four dictionaries.
+import io, os
+
+base = os.path.join(os.path.dirname(__file__), "..", "internal", "i18n")
+
+# key -> {lang: text}
+keys = {
+    "form.register.email": {
+        "zh_cn": "请填写有效的电子邮箱地址（不超过 100 个字符）",
+        "zh_tw": "請填寫有效的電子郵件地址（不超過 100 個字元）",
+        "en": "Please enter a valid email address (max 100 characters)",
+        "ja": "有効なメールアドレスを入力してください（100文字以内）",
+    },
+    "form.register.domain": {
+        "zh_cn": "个性域名只能包含字母、数字和下划线，长度为 3 至 20 位",
+        "zh_tw": "個性網域只能包含字母、數字與底線，長度為 3 至 20 位",
+        "en": "The custom domain may only contain letters, digits and underscores, and must be 3–20 characters long",
+        "ja": "カスタムドメインは半角英数字とアンダースコアのみ使用でき、3〜20文字である必要があります",
+    },
+    "form.register.name": {
+        "zh_cn": "昵称不能为空，且不超过 20 个字符",
+        "zh_tw": "暱稱不能為空，且不超過 20 個字元",
+        "en": "Nickname is required and must be at most 20 characters",
+        "ja": "ニックネームは必須で、20文字以内である必要があります",
+    },
+    "form.register.password": {
+        "zh_cn": "请设置 8 至 30 位的密码",
+        "zh_tw": "請設定 8 至 30 位的密碼",
+        "en": "Please set a password of 8–30 characters",
+        "ja": "8〜30文字のパスワードを設定してください",
+    },
+    "form.register.repeatPassword": {
+        "zh_cn": "两次输入的密码不一致",
+        "zh_tw": "兩次輸入的密碼不一致",
+        "en": "The two passwords do not match",
+        "ja": "入力した2つのパスワードが一致しません",
+    },
+    "form.register.recaptcha": {
+        "zh_cn": "无法加载人机验证，请刷新页面或切换网络后重试",
+        "zh_tw": "無法人機驗證，請重新整理頁面或更換網路後重試",
+        "en": "Unable to load the CAPTCHA. Please refresh the page or switch your network and try again",
+        "ja": "CAPTCHAを読み込めません。ページを再読み込みするか、ネットワークを変更してお試しください",
+    },
+    "form.email.required": {
+        "zh_cn": "请填写有效的电子邮箱地址",
+        "zh_tw": "請填寫有效的電子郵件地址",
+        "en": "Please enter a valid email address",
+        "ja": "有効なメールアドレスを入力してください",
+    },
+    "form.login.password": {
+        "zh_cn": "请输入密码",
+        "zh_tw": "請輸入密碼",
+        "en": "Please enter your password",
+        "ja": "パスワードを入力してください",
+    },
+    "form.recaptcha": {
+        "zh_cn": "请完成人机验证",
+        "zh_tw": "請完成人機驗證",
+        "en": "Please complete the CAPTCHA verification",
+        "ja": "CAPTCHA認証を完了してください",
+    },
+    "form.recover.newPassword": {
+        "zh_cn": "请设置 8 至 30 位的新密码",
+        "zh_tw": "請設定 8 至 30 位的新密碼",
+        "en": "Please set a new password of 8–30 characters",
+        "ja": "8〜30文字の新しいパスワードを設定してください",
+    },
+    "form.recover.repeatPassword": {
+        "zh_cn": "两次输入的新密码不一致",
+        "zh_tw": "兩次輸入的新密碼不一致",
+        "en": "The two new passwords do not match",
+        "ja": "入力した2つの新しいパスワードが一致しません",
+    },
+    "form.question.content": {
+        "zh_cn": "问题内容不能为空，且不超过 2000 个字符",
+        "zh_tw": "問題內容不能為空，且不超過 2000 個字元",
+        "en": "Question content is required and must be at most 2000 characters",
+        "ja": "質問内容は必須で、2000文字以内である必要があります",
+    },
+    "form.question.receiveReplyEmail": {
+        "zh_cn": "请填写有效的电子邮箱地址以接收回复",
+        "zh_tw": "請填寫有效的電子郵件地址以接收回覆",
+        "en": "Please enter a valid email address to receive replies",
+        "ja": "返信を受け取るための有効なメールアドレスを入力してください",
+    },
+    "form.answer.content": {
+        "zh_cn": "回答内容不能为空，且不超过 2000 个字符",
+        "zh_tw": "回答內容不能為空，且不超過 2000 個字元",
+        "en": "Answer content is required and must be at most 2000 characters",
+        "ja": "回答内容は必須で、2000文字以内である必要があります",
+    },
+    "form.followup.content": {
+        "zh_cn": "追问内容不能为空，且不超过 2000 个字符",
+        "zh_tw": "追問內容不能為空，且不超過 2000 個字元",
+        "en": "Follow-up content is required and must be at most 2000 characters",
+        "ja": "フォローアップ内容は必須で、2000文字以内である必要があります",
+    },
+    "form.followup.answer": {
+        "zh_cn": "追问回答不能为空，且不超过 2000 个字符",
+        "zh_tw": "追問回答不能為空，且不超過 2000 個字元",
+        "en": "Follow-up answer is required and must be at most 2000 characters",
+        "ja": "フォローアップの回答は必須で、2000文字以内である必要があります",
+    },
+    "form.profile.name": {
+        "zh_cn": "昵称不能为空，且不超过 20 个字符",
+        "zh_tw": "暱稱不能為空，且不超過 20 個字元",
+        "en": "Nickname is required and must be at most 20 characters",
+        "ja": "ニックネームは必須で、20文字以内である必要があります",
+    },
+    "form.profile.newPassword": {
+        "zh_cn": "新密码长度不能超过 30 个字符",
+        "zh_tw": "新密碼長度不能超過 30 個字元",
+        "en": "New password must be at most 30 characters",
+        "ja": "新しいパスワードは30文字以内である必要があります",
+    },
+    "form.profile.intro": {
+        "zh_cn": "个人介绍不能为空，且不超过 100 个字符",
+        "zh_tw": "個人介紹不能為空，且不超過 100 個字元",
+        "en": "Bio is required and must be at most 100 characters",
+        "ja": "自己紹介は必須で、100文字以内である必要があります",
+    },
+    "form.profile.colorHex": {
+        "zh_cn": "请填写 7 位十六进制颜色代码（含 #）",
+        "zh_tw": "請填寫 7 位十六進制顏色代碼（含 #）",
+        "en": "Please enter a 7-character hex color code (including #)",
+        "ja": "7文字の16進数カラーコード（#を含む）を入力してください",
+    },
+    "form.profile.dotscale": {
+        "zh_cn": "请填写二维码点大小",
+        "zh_tw": "請填寫 QR Code 點大小",
+        "en": "Please enter the QR code dot size",
+        "ja": "QRコードの点の大きさを入力してください",
+    },
+    "form.profile.backgroundimagealpha": {
+        "zh_cn": "请填写二维码背景透明度",
+        "zh_tw": "請填寫 QR Code 背景透明度",
+        "en": "Please enter the QR code background opacity",
+        "ja": "QRコードの背景の不透明度を入力してください",
+    },
+    "form.profile.linkMax": {
+        "zh_cn": "主页链接长度不能超过 30 个字符",
+        "zh_tw": "主頁連結長度不能超過 30 個字元",
+        "en": "Profile link must be at most 30 characters",
+        "ja": "プロフィールリンクは30文字以内である必要があります",
+    },
+    "form.profile.passwordMax": {
+        "zh_cn": "密码长度不能超过 30 个字符",
+        "zh_tw": "密碼長度不能超過 30 個字元",
+        "en": "Password must be at most 30 characters",
+        "ja": "パスワードは30文字以内である必要があります",
+    },
+    "form.profile.chatMaxMessages": {
+        "zh_cn": "私聊消息上限需为 1 至 50 之间的整数",
+        "zh_tw": "私聊訊息上限需為 1 至 50 之間的整數",
+        "en": "The chat message limit must be an integer between 1 and 50",
+        "ja": "チャットメッセージ上限は1〜50の整数である必要があります",
+    },
+}
+
+files = {
+    "zh_cn": "dict_zh_cn.go",
+    "zh_tw": "dict_zh_tw.go",
+    "en": "dict_en.go",
+    "ja": "dict_ja.go",
+}
+
+# Build inserted block (sorted by key for determinism).
+ordered = sorted(keys.keys())
+block_lines = ["\n\t// 表单校验", "	// 表单校验 (form validation)"]
+# dedupe comment for non-en langs not needed; use single comment line per lang appropriately.
+for lang, fname in files.items():
+    path = os.path.join(base, fname)
+    with io.open(path, "r", encoding="utf-8") as fh:
+        text = fh.read()
+    # Insert before the final standalone "}" that closes the map.
+    idx = text.rfind("\n}")
+    if idx == -1:
+        raise SystemExit("cannot find closing brace in " + fname)
+    # Build entries.
+    lines = ["\n\t// 表单校验"]
+    for k in ordered:
+        v = keys[k][lang]
+        # Escape double quotes (none expected, but be safe).
+        v = v.replace('"', '\\"')
+        lines.append('\t"%s":\t"%s",' % (k, v))
+    insertion = "\n".join(lines) + "\n"
+    new_text = text[:idx] + insertion + text[idx:]
+    with io.open(path, "w", encoding="utf-8") as fh:
+        fh.write(new_text)
+    print("updated", fname, "with", len(ordered), "keys")
diff --git a/dev/bench-cdn.sh b/dev/bench-cdn.sh
new file mode 100644
index 0000000..f2d5d8b
--- /dev/null
+++ b/dev/bench-cdn.sh
@@ -0,0 +1,96 @@
+#!/bin/bash
+# ============================================================================
+# bench-cdn.sh — UIkit CDN 测速脚本（国内 / 海外双视角）
+#
+# 用途：对比"自建 R2 自托管 uikit"与"公共 CDN (cdnjs.snrat.com)"的加载速度，
+#       用于验证/复测 2026-09-05 的 CDN 迁移是否持续生效。
+#
+# 用法：
+#   bash dev/bench-cdn.sh cn      # 国内本机：每资源 5 次全量下载取中位
+#   bash dev/bench-cdn.sh global  # 海外：check-host.net 多区域节点 (p50/p90)
+#
+# 数据结论参考（2026-09-05 基线，国内中位）：
+#   css    R2 0.864s  -> snrat 0.200s   (4.3x)
+#   js     R2 0.796s  -> snrat 0.163s   (4.9x)
+#   icons  R2 0.824s  -> snrat 0.177s   (4.7x)
+#   海外（check-host p50）：css 打平；js R2 372ms vs snrat 647ms (R2 略快)
+# 结论：站点访客以国内为主 -> snrat 净收益大；海外属轻微下降可接受。
+# ============================================================================
+
+OLD_CSS="https://r2.337845818.best/tamabox/cdn/expire-1-y/uikit/3.3.3/css/modify-black-font/uikit.min.css"
+NEW_CSS="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/css/uikit.min.css"
+OLD_JS="https://r2.337845818.best/tamabox/cdn/lib/uikit/3.3.3/js/uikit.min.js"
+NEW_JS="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/js/uikit.min.js"
+OLD_ICONS="https://r2.337845818.best/tamabox/cdn/lib/uikit/3.3.3/js/uikit-icons.min.js"
+NEW_ICONS="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/js/uikit-icons.min.js"
+
+# ---------- 国内：全量下载计时 ----------
+bench_cn() {
+  echo "== 国内本机：每资源 5 次全量下载（秒），取中位 =="
+  local pairs=(
+    "OLD-css   (R2 modify):$OLD_CSS"
+    "NEW-css   (snrat)     :$NEW_CSS"
+    "OLD-js    (R2)        :$OLD_JS"
+    "NEW-js    (snrat)     :$NEW_JS"
+    "OLD-icons (R2)        :$OLD_ICONS"
+    "NEW-icons (snrat)     :$NEW_ICONS"
+  )
+  for entry in "${pairs[@]}"; do
+    local name="${entry%%:*}"; local url="${entry#*:}"
+    local vals=()
+    for i in 1 2 3 4 5; do
+      vals+=("$(curl -sS -o /dev/null -w '%{time_total}' --max-time 20 "$url" 2>/dev/null)")
+    done
+    local sorted=($(printf '%s\n' "${vals[@]}" | sort -n))
+    local med="${sorted[2]}"
+    printf '%-20s : [%s] 中位=%ss\n' "$name" "${vals[*]}" "$med"
+  done
+}
+
+# ---------- 海外：check-host.net 多区域节点 ----------
+probe_global() {
+  local name="$1" url="$2"
+  local enc
+  enc=$(python3 -c "import urllib.parse,sys;print(urllib.parse.quote(sys.argv[1],safe=''))" "$url")
+  local rid
+  rid=$(curl -sS -H "Accept: application/json" \
+        "https://check-host.net/check-http?host=$enc&max_nodes=12" 2>/dev/null \
+        | python3 -c "import sys,json;print(json.load(sys.stdin).get('request_id',''))")
+  [ -z "$rid" ] && { echo "$name: 请求失败"; return; }
+  sleep 8
+  curl -sS -H "Accept: application/json" "https://check-host.net/check-result/$rid" 2>/dev/null \
+  | python3 -c "
+import sys,json,statistics
+d=json.load(sys.stdin)
+ms=[]
+for node,arr in (d or {}).items():
+    if not arr or not arr[0]: continue
+    r=arr[0]
+    if len(r)>3 and str(r[3]).startswith('2') and isinstance(r[1],(int,float)):
+        ms.append(r[1]*1000)
+if ms:
+    ms.sort()
+    print(f'$name | n={len(ms)} | min={ms[0]:.0f} | p50={statistics.median(ms):.0f} | p90={ms[int(len(ms)*0.9)-1]:.0f} | max={ms[-1]:.0f} ms')
+else:
+    print(f'$name | 无有效节点')
+"
+}
+
+bench_global() {
+  echo "== 海外：check-host.net 多区域节点探测（HTTP 200 的耗时统计）=="
+  probe_global "OLD css (R2 modify)"  "$OLD_CSS"
+  probe_global "NEW css (snrat)"      "$NEW_CSS"
+  probe_global "OLD js  (R2)"         "$OLD_JS"
+  probe_global "NEW js  (snrat)"      "$NEW_JS"
+}
+
+case "$1" in
+  cn)     bench_cn ;;
+  global) bench_global ;;
+  *)
+    echo "用法: bash dev/bench-cdn.sh {cn|global}"
+    echo "  cn     = 国内本机全量下载测速"
+    echo "  global = 海外 check-host.net 多区域探测"
+    exit 1
+    ;;
+esac
diff --git a/dev/bg-test/box_background.png b/dev/bg-test/box_background.png
new file mode 100644
index 0000000..f3656e6
Binary files /dev/null and b/dev/bg-test/box_background.png differ
diff --git a/dev/changelog-source.md b/dev/changelog-source.md
new file mode 100644
index 0000000..4cf8f31
--- /dev/null
+++ b/dev/changelog-source.md
@@ -0,0 +1,11 @@
+## 2024-03-04 21:45:55
+新增：用户私信功能上线，可在「我的」页查看匿名来信。
+修复：移动端问题列表间距过窄的问题。
+优化：首页加载速度提升约 30%。
+
+## 2024-02-29 00:00:55
+修复：部分旧浏览器下时间显示异常。
+新增：修改记录页（本页），将完整更新历史从首页挪出，保持首页简洁。
+
+## 2023-06-03 13:11:55
+项目初始化：匿名提问 / 回答的基础流程跑通。
diff --git a/dev/checktpl/main.go b/dev/checktpl/main.go
new file mode 100644
index 0000000..39e43f6
--- /dev/null
+++ b/dev/checktpl/main.go
@@ -0,0 +1,45 @@
+package main
+
+import (
+	"fmt"
+	"io/fs"
+	"os"
+	"strings"
+	texttmpl "text/template"
+
+	"github.com/tamakyi/TamaBox/internal/template"
+	"github.com/tamakyi/TamaBox/templates"
+)
+
+// mergedFuncMap 将项目实际使用的模板函数（含 t 等 i18n 函数）合并为 text/template.FuncMap。
+// 不使用 FuncMap 直接解析会因 "t" 等函数未定义而误报模板错误。
+func mergedFuncMap() texttmpl.FuncMap {
+	fm := texttmpl.FuncMap{}
+	for _, m := range template.FuncMap() {
+		for k, v := range m {
+			fm[k] = v
+		}
+	}
+	return fm
+}
+
+func main() {
+	hasErr := false
+	_ = fs.WalkDir(templates.FS, ".", func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if d.IsDir() || !strings.HasSuffix(path, ".html") {
+			return nil
+		}
+		if _, err := texttmpl.New(path).Funcs(mergedFuncMap()).ParseFS(templates.FS, path); err != nil {
+			fmt.Println("TEMPLATE ERROR:", path, "->", err)
+			hasErr = true
+		}
+		return nil
+	})
+	if hasErr {
+		os.Exit(1)
+	}
+	fmt.Println("all templates syntax OK")
+}
diff --git a/dev/easy.qrcode.min.js b/dev/easy.qrcode.min.js
new file mode 100644
index 0000000..e3cd39d
--- /dev/null
+++ b/dev/easy.qrcode.min.js
@@ -0,0 +1,21 @@
+/**
+ * EasyQRCodeJS
+ * 
+ * Cross-browser QRCode generator for pure javascript. Support Canvas, SVG and Table drawing methods. Support Dot style, Logo, Background image, Colorful, Title etc. settings. Support Angular, Vue.js, React, Next.js, Svelte framework. Support binary(hex) data mode.(Running with DOM on client side)
+ * 
+ * Version 4.6.1
+ * 
+ * @author [ inthinkcolor@gmail.com ]
+ * 
+ * @see https://github.com/ushelp/EasyQRCodeJS 
+ * @see http://www.easyproject.cn/easyqrcodejs/tryit.html
+ * @see https://github.com/ushelp/EasyQRCodeJS-NodeJS
+ * 
+ * Copyright 2017 Ray, EasyProject
+ * Released under the MIT license
+ * 
+ * [Support AMD, CMD, CommonJS/Node.js]
+ * 
+ */
+!function(){"use strict";function a(a,b){var c,d=Object.keys(b);for(c=0;c<d.length;c++)a=a.replace(new RegExp("\\{"+d[c]+"\\}","gi"),b[d[c]]);return a}function b(a){var b,c,d;if(!a)throw new Error("cannot create a random attribute name for an undefined object");b="ABCDEFGHIJKLMNOPQRSTUVWXTZabcdefghiklmnopqrstuvwxyz",c="";do{for(c="",d=0;d<12;d++)c+=b[Math.floor(Math.random()*b.length)]}while(a[c]);return c}function c(a){var b={left:"start",right:"end",center:"middle",start:"start",end:"end"};return b[a]||b.start}function d(a){var b={alphabetic:"alphabetic",hanging:"hanging",top:"text-before-edge",bottom:"text-after-edge",middle:"central"};return b[a]||b.alphabetic}var e,f,g,h,i;i=function(a,b){var c,d,e,f={};for(a=a.split(","),b=b||10,c=0;c<a.length;c+=2)d="&"+a[c+1]+";",e=parseInt(a[c],b),f[d]="&#"+e+";";return f["\\xa0"]="&#160;",f}("50,nbsp,51,iexcl,52,cent,53,pound,54,curren,55,yen,56,brvbar,57,sect,58,uml,59,copy,5a,ordf,5b,laquo,5c,not,5d,shy,5e,reg,5f,macr,5g,deg,5h,plusmn,5i,sup2,5j,sup3,5k,acute,5l,micro,5m,para,5n,middot,5o,cedil,5p,sup1,5q,ordm,5r,raquo,5s,frac14,5t,frac12,5u,frac34,5v,iquest,60,Agrave,61,Aacute,62,Acirc,63,Atilde,64,Auml,65,Aring,66,AElig,67,Ccedil,68,Egrave,69,Eacute,6a,Ecirc,6b,Euml,6c,Igrave,6d,Iacute,6e,Icirc,6f,Iuml,6g,ETH,6h,Ntilde,6i,Ograve,6j,Oacute,6k,Ocirc,6l,Otilde,6m,Ouml,6n,times,6o,Oslash,6p,Ugrave,6q,Uacute,6r,Ucirc,6s,Uuml,6t,Yacute,6u,THORN,6v,szlig,70,agrave,71,aacute,72,acirc,73,atilde,74,auml,75,aring,76,aelig,77,ccedil,78,egrave,79,eacute,7a,ecirc,7b,euml,7c,igrave,7d,iacute,7e,icirc,7f,iuml,7g,eth,7h,ntilde,7i,ograve,7j,oacute,7k,ocirc,7l,otilde,7m,ouml,7n,divide,7o,oslash,7p,ugrave,7q,uacute,7r,ucirc,7s,uuml,7t,yacute,7u,thorn,7v,yuml,ci,fnof,sh,Alpha,si,Beta,sj,Gamma,sk,Delta,sl,Epsilon,sm,Zeta,sn,Eta,so,Theta,sp,Iota,sq,Kappa,sr,Lambda,ss,Mu,st,Nu,su,Xi,sv,Omicron,t0,Pi,t1,Rho,t3,Sigma,t4,Tau,t5,Upsilon,t6,Phi,t7,Chi,t8,Psi,t9,Omega,th,alpha,ti,beta,tj,gamma,tk,delta,tl,epsilon,tm,zeta,tn,eta,to,theta,tp,iota,tq,kappa,tr,lambda,ts,mu,tt,nu,tu,xi,tv,omicron,u0,pi,u1,rho,u2,sigmaf,u3,sigma,u4,tau,u5,upsilon,u6,phi,u7,chi,u8,psi,u9,omega,uh,thetasym,ui,upsih,um,piv,812,bull,816,hellip,81i,prime,81j,Prime,81u,oline,824,frasl,88o,weierp,88h,image,88s,real,892,trade,89l,alefsym,8cg,larr,8ch,uarr,8ci,rarr,8cj,darr,8ck,harr,8dl,crarr,8eg,lArr,8eh,uArr,8ei,rArr,8ej,dArr,8ek,hArr,8g0,forall,8g2,part,8g3,exist,8g5,empty,8g7,nabla,8g8,isin,8g9,notin,8gb,ni,8gf,prod,8gh,sum,8gi,minus,8gn,lowast,8gq,radic,8gt,prop,8gu,infin,8h0,ang,8h7,and,8h8,or,8h9,cap,8ha,cup,8hb,int,8hk,there4,8hs,sim,8i5,cong,8i8,asymp,8j0,ne,8j1,equiv,8j4,le,8j5,ge,8k2,sub,8k3,sup,8k4,nsub,8k6,sube,8k7,supe,8kl,oplus,8kn,otimes,8l5,perp,8m5,sdot,8o8,lceil,8o9,rceil,8oa,lfloor,8ob,rfloor,8p9,lang,8pa,rang,9ea,loz,9j0,spades,9j3,clubs,9j5,hearts,9j6,diams,ai,OElig,aj,oelig,b0,Scaron,b1,scaron,bo,Yuml,m6,circ,ms,tilde,802,ensp,803,emsp,809,thinsp,80c,zwnj,80d,zwj,80e,lrm,80f,rlm,80j,ndash,80k,mdash,80o,lsquo,80p,rsquo,80q,sbquo,80s,ldquo,80t,rdquo,80u,bdquo,810,dagger,811,Dagger,81g,permil,81p,lsaquo,81q,rsaquo,85c,euro",32),e={strokeStyle:{svgAttr:"stroke",canvas:"#000000",svg:"none",apply:"stroke"},fillStyle:{svgAttr:"fill",canvas:"#000000",svg:null,apply:"fill"},lineCap:{svgAttr:"stroke-linecap",canvas:"butt",svg:"butt",apply:"stroke"},lineJoin:{svgAttr:"stroke-linejoin",canvas:"miter",svg:"miter",apply:"stroke"},miterLimit:{svgAttr:"stroke-miterlimit",canvas:10,svg:4,apply:"stroke"},lineWidth:{svgAttr:"stroke-width",canvas:1,svg:1,apply:"stroke"},globalAlpha:{svgAttr:"opacity",canvas:1,svg:1,apply:"fill stroke"},font:{canvas:"10px sans-serif"},shadowColor:{canvas:"#000000"},shadowOffsetX:{canvas:0},shadowOffsetY:{canvas:0},shadowBlur:{canvas:0},textAlign:{canvas:"start"},textBaseline:{canvas:"alphabetic"},lineDash:{svgAttr:"stroke-dasharray",canvas:[],svg:null,apply:"stroke"}},g=function(a,b){this.__root=a,this.__ctx=b},g.prototype.addColorStop=function(b,c){var d,e,f=this.__ctx.__createElement("stop");f.setAttribute("offset",b),-1!==c.indexOf("rgba")?(d=/rgba\(\s*(\d+)\s*,\s*(\d+)\s*,\s*(\d+)\s*,\s*(\d?\.?\d*)\s*\)/gi,e=d.exec(c),f.setAttribute("stop-color",a("rgb({r},{g},{b})",{r:e[1],g:e[2],b:e[3]})),f.setAttribute("stop-opacity",e[4])):f.setAttribute("stop-color",c),this.__root.appendChild(f)},h=function(a,b){this.__root=a,this.__ctx=b},f=function(a){var b,c={width:500,height:500,enableMirroring:!1};if(arguments.length>1?(b=c,b.width=arguments[0],b.height=arguments[1]):b=a||c,!(this instanceof f))return new f(b);this.width=b.width||c.width,this.height=b.height||c.height,this.enableMirroring=void 0!==b.enableMirroring?b.enableMirroring:c.enableMirroring,this.canvas=this,this.__document=b.document||document,b.ctx?this.__ctx=b.ctx:(this.__canvas=this.__document.createElement("canvas"),this.__ctx=this.__canvas.getContext("2d")),this.__setDefaultStyles(),this.__stack=[this.__getStyleState()],this.__groupStack=[],this.__root=this.__document.createElementNS("http://www.w3.org/2000/svg","svg"),this.__root.setAttribute("version",1.1),this.__root.setAttribute("xmlns","http://www.w3.org/2000/svg"),this.__root.setAttributeNS("http://www.w3.org/2000/xmlns/","xmlns:xlink","http://www.w3.org/1999/xlink"),this.__root.setAttribute("width",this.width),this.__root.setAttribute("height",this.height),this.__ids={},this.__defs=this.__document.createElementNS("http://www.w3.org/2000/svg","defs"),this.__root.appendChild(this.__defs),this.__currentElement=this.__document.createElementNS("http://www.w3.org/2000/svg","g"),this.__root.appendChild(this.__currentElement)},f.prototype.__createElement=function(a,b,c){void 0===b&&(b={});var d,e,f=this.__document.createElementNS("http://www.w3.org/2000/svg",a),g=Object.keys(b);for(c&&(f.setAttribute("fill","none"),f.setAttribute("stroke","none")),d=0;d<g.length;d++)e=g[d],f.setAttribute(e,b[e]);return f},f.prototype.__setDefaultStyles=function(){var a,b,c=Object.keys(e);for(a=0;a<c.length;a++)b=c[a],this[b]=e[b].canvas},f.prototype.__applyStyleState=function(a){var b,c,d=Object.keys(a);for(b=0;b<d.length;b++)c=d[b],this[c]=a[c]},f.prototype.__getStyleState=function(){var a,b,c={},d=Object.keys(e);for(a=0;a<d.length;a++)b=d[a],c[b]=this[b];return c},f.prototype.__applyStyleToCurrentElement=function(b){var c=this.__currentElement,d=this.__currentElementsToStyle;d&&(c.setAttribute(b,""),c=d.element,d.children.forEach(function(a){a.setAttribute(b,"")}));var f,i,j,k,l,m,n=Object.keys(e);for(f=0;f<n.length;f++)if(i=e[n[f]],j=this[n[f]],i.apply)if(j instanceof h){if(j.__ctx)for(;j.__ctx.__defs.childNodes.length;)k=j.__ctx.__defs.childNodes[0].getAttribute("id"),this.__ids[k]=k,this.__defs.appendChild(j.__ctx.__defs.childNodes[0]);c.setAttribute(i.apply,a("url(#{id})",{id:j.__root.getAttribute("id")}))}else if(j instanceof g)c.setAttribute(i.apply,a("url(#{id})",{id:j.__root.getAttribute("id")}));else if(-1!==i.apply.indexOf(b)&&i.svg!==j)if("stroke"!==i.svgAttr&&"fill"!==i.svgAttr||-1===j.indexOf("rgba")){var o=i.svgAttr;if("globalAlpha"===n[f]&&(o=b+"-"+i.svgAttr,c.getAttribute(o)))continue;c.setAttribute(o,j)}else{l=/rgba\(\s*(\d+)\s*,\s*(\d+)\s*,\s*(\d+)\s*,\s*(\d?\.?\d*)\s*\)/gi,m=l.exec(j),c.setAttribute(i.svgAttr,a("rgb({r},{g},{b})",{r:m[1],g:m[2],b:m[3]}));var p=m[4],q=this.globalAlpha;null!=q&&(p*=q),c.setAttribute(i.svgAttr+"-opacity",p)}},f.prototype.__closestGroupOrSvg=function(a){return a=a||this.__currentElement,"g"===a.nodeName||"svg"===a.nodeName?a:this.__closestGroupOrSvg(a.parentNode)},f.prototype.getSerializedSvg=function(a){var b,c,d,e,f,g,h=(new XMLSerializer).serializeToString(this.__root);if(g=/xmlns="http:\/\/www\.w3\.org\/2000\/svg".+xmlns="http:\/\/www\.w3\.org\/2000\/svg/gi,g.test(h)&&(h=h.replace('xmlns="http://www.w3.org/2000/svg','xmlns:xlink="http://www.w3.org/1999/xlink')),a)for(b=Object.keys(i),c=0;c<b.length;c++)d=b[c],e=i[d],f=new RegExp(d,"gi"),f.test(h)&&(h=h.replace(f,e));return h},f.prototype.getSvg=function(){return this.__root},f.prototype.save=function(){var a=this.__createElement("g"),b=this.__closestGroupOrSvg();this.__groupStack.push(b),b.appendChild(a),this.__currentElement=a,this.__stack.push(this.__getStyleState())},f.prototype.restore=function(){this.__currentElement=this.__groupStack.pop(),this.__currentElementsToStyle=null,this.__currentElement||(this.__currentElement=this.__root.childNodes[1]);var a=this.__stack.pop();this.__applyStyleState(a)},f.prototype.__addTransform=function(a){var b=this.__closestGroupOrSvg();if(b.childNodes.length>0){"path"===this.__currentElement.nodeName&&(this.__currentElementsToStyle||(this.__currentElementsToStyle={element:b,children:[]}),this.__currentElementsToStyle.children.push(this.__currentElement),this.__applyCurrentDefaultPath());var c=this.__createElement("g");b.appendChild(c),this.__currentElement=c}var d=this.__currentElement.getAttribute("transform");d?d+=" ":d="",d+=a,this.__currentElement.setAttribute("transform",d)},f.prototype.scale=function(b,c){void 0===c&&(c=b),this.__addTransform(a("scale({x},{y})",{x:b,y:c}))},f.prototype.rotate=function(b){var c=180*b/Math.PI;this.__addTransform(a("rotate({angle},{cx},{cy})",{angle:c,cx:0,cy:0}))},f.prototype.translate=function(b,c){this.__addTransform(a("translate({x},{y})",{x:b,y:c}))},f.prototype.transform=function(b,c,d,e,f,g){this.__addTransform(a("matrix({a},{b},{c},{d},{e},{f})",{a:b,b:c,c:d,d:e,e:f,f:g}))},f.prototype.beginPath=function(){var a,b;this.__currentDefaultPath="",this.__currentPosition={},a=this.__createElement("path",{},!0),b=this.__closestGroupOrSvg(),b.appendChild(a),this.__currentElement=a},f.prototype.__applyCurrentDefaultPath=function(){var a=this.__currentElement;"path"===a.nodeName?a.setAttribute("d",this.__currentDefaultPath):console.error("Attempted to apply path command to node",a.nodeName)},f.prototype.__addPathCommand=function(a){this.__currentDefaultPath+=" ",this.__currentDefaultPath+=a},f.prototype.moveTo=function(b,c){"path"!==this.__currentElement.nodeName&&this.beginPath(),this.__currentPosition={x:b,y:c},this.__addPathCommand(a("M {x} {y}",{x:b,y:c}))},f.prototype.closePath=function(){this.__currentDefaultPath&&this.__addPathCommand("Z")},f.prototype.lineTo=function(b,c){this.__currentPosition={x:b,y:c},this.__currentDefaultPath.indexOf("M")>-1?this.__addPathCommand(a("L {x} {y}",{x:b,y:c})):this.__addPathCommand(a("M {x} {y}",{x:b,y:c}))},f.prototype.bezierCurveTo=function(b,c,d,e,f,g){this.__currentPosition={x:f,y:g},this.__addPathCommand(a("C {cp1x} {cp1y} {cp2x} {cp2y} {x} {y}",{cp1x:b,cp1y:c,cp2x:d,cp2y:e,x:f,y:g}))},f.prototype.quadraticCurveTo=function(b,c,d,e){this.__currentPosition={x:d,y:e},this.__addPathCommand(a("Q {cpx} {cpy} {x} {y}",{cpx:b,cpy:c,x:d,y:e}))};var j=function(a){var b=Math.sqrt(a[0]*a[0]+a[1]*a[1]);return[a[0]/b,a[1]/b]};f.prototype.arcTo=function(a,b,c,d,e){var f=this.__currentPosition&&this.__currentPosition.x,g=this.__currentPosition&&this.__currentPosition.y;if(void 0!==f&&void 0!==g){if(e<0)throw new Error("IndexSizeError: The radius provided ("+e+") is negative.");if(f===a&&g===b||a===c&&b===d||0===e)return void this.lineTo(a,b);var h=j([f-a,g-b]),i=j([c-a,d-b]);if(h[0]*i[1]==h[1]*i[0])return void this.lineTo(a,b);var k=h[0]*i[0]+h[1]*i[1],l=Math.acos(Math.abs(k)),m=j([h[0]+i[0],h[1]+i[1]]),n=e/Math.sin(l/2),o=a+n*m[0],p=b+n*m[1],q=[-h[1],h[0]],r=[i[1],-i[0]],s=function(a){var b=a[0];return a[1]>=0?Math.acos(b):-Math.acos(b)},t=s(q),u=s(r);this.lineTo(o+q[0]*e,p+q[1]*e),this.arc(o,p,e,t,u)}},f.prototype.stroke=function(){"path"===this.__currentElement.nodeName&&this.__currentElement.setAttribute("paint-order","fill stroke markers"),this.__applyCurrentDefaultPath(),this.__applyStyleToCurrentElement("stroke")},f.prototype.fill=function(){"path"===this.__currentElement.nodeName&&this.__currentElement.setAttribute("paint-order","stroke fill markers"),this.__applyCurrentDefaultPath(),this.__applyStyleToCurrentElement("fill")},f.prototype.rect=function(a,b,c,d){"path"!==this.__currentElement.nodeName&&this.beginPath(),this.moveTo(a,b),this.lineTo(a+c,b),this.lineTo(a+c,b+d),this.lineTo(a,b+d),this.lineTo(a,b),this.closePath()},f.prototype.fillRect=function(a,b,c,d){var e,f;e=this.__createElement("rect",{x:a,y:b,width:c,height:d,"shape-rendering":"crispEdges"},!0),f=this.__closestGroupOrSvg(),f.appendChild(e),this.__currentElement=e,this.__applyStyleToCurrentElement("fill")},f.prototype.strokeRect=function(a,b,c,d){var e,f;e=this.__createElement("rect",{x:a,y:b,width:c,height:d},!0),f=this.__closestGroupOrSvg(),f.appendChild(e),this.__currentElement=e,this.__applyStyleToCurrentElement("stroke")},f.prototype.__clearCanvas=function(){for(var a=this.__closestGroupOrSvg(),b=a.getAttribute("transform"),c=this.__root.childNodes[1],d=c.childNodes,e=d.length-1;e>=0;e--)d[e]&&c.removeChild(d[e]);this.__currentElement=c,this.__groupStack=[],b&&this.__addTransform(b)},f.prototype.clearRect=function(a,b,c,d){if(0===a&&0===b&&c===this.width&&d===this.height)return void this.__clearCanvas();var e,f=this.__closestGroupOrSvg();e=this.__createElement("rect",{x:a,y:b,width:c,height:d,fill:"#FFFFFF"},!0),f.appendChild(e)},f.prototype.createLinearGradient=function(a,c,d,e){var f=this.__createElement("linearGradient",{id:b(this.__ids),x1:a+"px",x2:d+"px",y1:c+"px",y2:e+"px",gradientUnits:"userSpaceOnUse"},!1);return this.__defs.appendChild(f),new g(f,this)},f.prototype.createRadialGradient=function(a,c,d,e,f,h){var i=this.__createElement("radialGradient",{id:b(this.__ids),cx:e+"px",cy:f+"px",r:h+"px",fx:a+"px",fy:c+"px",gradientUnits:"userSpaceOnUse"},!1);return this.__defs.appendChild(i),new g(i,this)},f.prototype.__parseFont=function(){var a=/^\s*(?=(?:(?:[-a-z]+\s*){0,2}(italic|oblique))?)(?=(?:(?:[-a-z]+\s*){0,2}(small-caps))?)(?=(?:(?:[-a-z]+\s*){0,2}(bold(?:er)?|lighter|[1-9]00))?)(?:(?:normal|\1|\2|\3)\s*){0,3}((?:xx?-)?(?:small|large)|medium|smaller|larger|[.\d]+(?:\%|in|[cem]m|ex|p[ctx]))(?:\s*\/\s*(normal|[.\d]+(?:\%|in|[cem]m|ex|p[ctx])))?\s*([-,\'\"\sa-z0-9]+?)\s*$/i,b=a.exec(this.font),c={style:b[1]||"normal",size:b[4]||"10px",family:b[6]||"sans-serif",weight:b[3]||"normal",decoration:b[2]||"normal",href:null};return"underline"===this.__fontUnderline&&(c.decoration="underline"),this.__fontHref&&(c.href=this.__fontHref),c},f.prototype.__wrapTextLink=function(a,b){if(a.href){var c=this.__createElement("a");return c.setAttributeNS("http://www.w3.org/1999/xlink","xlink:href",a.href),c.appendChild(b),c}return b},f.prototype.__applyText=function(a,b,e,f){var g=this.__parseFont(),h=this.__closestGroupOrSvg(),i=this.__createElement("text",{"font-family":g.family,"font-size":g.size,"font-style":g.style,"font-weight":g.weight,"text-decoration":g.decoration,x:b,y:e,"text-anchor":c(this.textAlign),"dominant-baseline":d(this.textBaseline)},!0);i.appendChild(this.__document.createTextNode(a)),this.__currentElement=i,this.__applyStyleToCurrentElement(f),h.appendChild(this.__wrapTextLink(g,i))},f.prototype.fillText=function(a,b,c){this.__applyText(a,b,c,"fill")},f.prototype.strokeText=function(a,b,c){this.__applyText(a,b,c,"stroke")},f.prototype.measureText=function(a){return this.__ctx.font=this.font,this.__ctx.measureText(a)},f.prototype.arc=function(b,c,d,e,f,g){if(e!==f){e%=2*Math.PI,f%=2*Math.PI,e===f&&(f=(f+2*Math.PI-.001*(g?-1:1))%(2*Math.PI));var h=b+d*Math.cos(f),i=c+d*Math.sin(f),j=b+d*Math.cos(e),k=c+d*Math.sin(e),l=g?0:1,m=0,n=f-e;n<0&&(n+=2*Math.PI),m=g?n>Math.PI?0:1:n>Math.PI?1:0,this.lineTo(j,k),this.__addPathCommand(a("A {rx} {ry} {xAxisRotation} {largeArcFlag} {sweepFlag} {endX} {endY}",{rx:d,ry:d,xAxisRotation:0,largeArcFlag:m,sweepFlag:l,endX:h,endY:i})),this.__currentPosition={x:h,y:i}}},f.prototype.clip=function(){var c=this.__closestGroupOrSvg(),d=this.__createElement("clipPath"),e=b(this.__ids),f=this.__createElement("g");this.__applyCurrentDefaultPath(),c.removeChild(this.__currentElement),d.setAttribute("id",e),d.appendChild(this.__currentElement),this.__defs.appendChild(d),c.setAttribute("clip-path",a("url(#{id})",{id:e})),c.appendChild(f),this.__currentElement=f},f.prototype.drawImage=function(){var a,b,c,d,e,g,h,i,j,k,l,m,n,o,p=Array.prototype.slice.call(arguments),q=p[0],r=0,s=0;if(3===p.length)a=p[1],b=p[2],e=q.width,g=q.height,c=e,d=g;else if(5===p.length)a=p[1],b=p[2],c=p[3],d=p[4],e=q.width,g=q.height;else{if(9!==p.length)throw new Error("Invalid number of arguments passed to drawImage: "+arguments.length);r=p[1],s=p[2],e=p[3],g=p[4],a=p[5],b=p[6],c=p[7],d=p[8]}h=this.__closestGroupOrSvg(),this.__currentElement;var t="translate("+a+", "+b+")";if(q instanceof f){if(i=q.getSvg().cloneNode(!0),i.childNodes&&i.childNodes.length>1){for(j=i.childNodes[0];j.childNodes.length;)o=j.childNodes[0].getAttribute("id"),this.__ids[o]=o,this.__defs.appendChild(j.childNodes[0]);if(k=i.childNodes[1]){var u,v=k.getAttribute("transform");u=v?v+" "+t:t,k.setAttribute("transform",u),h.appendChild(k)}}}else"CANVAS"!==q.nodeName&&"IMG"!==q.nodeName||(l=this.__createElement("image"),l.setAttribute("width",c),l.setAttribute("height",d),l.setAttribute("preserveAspectRatio","none"),l.setAttribute("opacity",this.globalAlpha),(r||s||e!==q.width||g!==q.height)&&(m=this.__document.createElement("canvas"),m.width=c,m.height=d,n=m.getContext("2d"),n.drawImage(q,r,s,e,g,0,0,c,d),q=m),l.setAttribute("transform",t),l.setAttributeNS("http://www.w3.org/1999/xlink","xlink:href","CANVAS"===q.nodeName?q.toDataURL():q.originalSrc),h.appendChild(l))},f.prototype.createPattern=function(a,c){var d,e=this.__document.createElementNS("http://www.w3.org/2000/svg","pattern"),g=b(this.__ids);return e.setAttribute("id",g),e.setAttribute("width",a.width),e.setAttribute("height",a.height),"CANVAS"===a.nodeName||"IMG"===a.nodeName?(d=this.__document.createElementNS("http://www.w3.org/2000/svg","image"),d.setAttribute("width",a.width),d.setAttribute("height",a.height),d.setAttributeNS("http://www.w3.org/1999/xlink","xlink:href","CANVAS"===a.nodeName?a.toDataURL():a.getAttribute("src")),e.appendChild(d),this.__defs.appendChild(e)):a instanceof f&&(e.appendChild(a.__root.childNodes[1]),this.__defs.appendChild(e)),new h(e,this)},f.prototype.setLineDash=function(a){a&&a.length>0?this.lineDash=a.join(","):this.lineDash=null},f.prototype.drawFocusRing=function(){},f.prototype.createImageData=function(){},f.prototype.getImageData=function(){},f.prototype.putImageData=function(){},f.prototype.globalCompositeOperation=function(){},f.prototype.setTransform=function(){},"object"==typeof window&&(window.C2S=f),"object"==typeof module&&"object"==typeof module.exports&&(module.exports=f)}(),function(){"use strict";function a(a,b,c){if(this.mode=q.MODE_8BIT_BYTE,this.data=a,this.parsedData=[],b){for(var d=0,e=this.data.length;d<e;d++){var f=[],g=this.data.charCodeAt(d);f[0]=g,this.parsedData.push(f)}this.parsedData=Array.prototype.concat.apply([],this.parsedData)}else this.parsedData=function(a){for(var b=[],c=0;c<a.length;c++){var d=a.charCodeAt(c);d<128?b.push(d):d<2048?b.push(192|d>>6,128|63&d):d<55296||d>=57344?b.push(224|d>>12,128|d>>6&63,128|63&d):(c++,d=65536+((1023&d)<<10|1023&a.charCodeAt(c)),b.push(240|d>>18,128|d>>12&63,128|d>>6&63,128|63&d))}return b}(a);this.parsedData=Array.prototype.concat.apply([],this.parsedData),c||this.parsedData.length==this.data.length||(this.parsedData.unshift(191),this.parsedData.unshift(187),this.parsedData.unshift(239))}function b(a,b){this.typeNumber=a,this.errorCorrectLevel=b,this.modules=null,this.moduleCount=0,this.dataCache=null,this.dataList=[]}function c(a,b){if(a.length==i)throw new Error(a.length+"/"+b);for(var c=0;c<a.length&&0==a[c];)c++;this.num=new Array(a.length-c+b);for(var d=0;d<a.length-c;d++)this.num[d]=a[d+c]}function d(a,b){this.totalCount=a,this.dataCount=b}function e(){this.buffer=[],this.length=0}function f(){var a=!1,b=navigator.userAgent;if(/android/i.test(b)){a=!0;var c=b.toString().match(/android ([0-9]\.[0-9])/i);c&&c[1]&&(a=parseFloat(c[1]))}return a}function g(a,b){for(var c=b.correctLevel,d=1,e=h(a),f=0,g=w.length;f<g;f++){var i=0;switch(c){case r.L:i=w[f][0];break;case r.M:i=w[f][1];break;case r.Q:i=w[f][2];break;case r.H:i=w[f][3]}if(e<=i)break;d++}if(d>w.length)throw new Error("Too long data. the CorrectLevel."+["M","L","H","Q"][c]+" limit length is "+i);return 0!=b.version&&(d<=b.version?(d=b.version,b.runVersion=d):(console.warn("QR Code version "+b.version+" too small, run version use "+d),b.runVersion=d)),d}function h(a){return encodeURI(a).toString().replace(/\%[0-9a-fA-F]{2}/g,"a").length}var i,j,k="object"==typeof global&&global&&global.Object===Object&&global,l="object"==typeof self&&self&&self.Object===Object&&self,m=k||l||Function("return this")(),n="object"==typeof exports&&exports&&!exports.nodeType&&exports,o=n&&"object"==typeof module&&module&&!module.nodeType&&module,p=m.QRCode;a.prototype={getLength:function(a){return this.parsedData.length},write:function(a){for(var b=0,c=this.parsedData.length;b<c;b++)a.put(this.parsedData[b],8)}},b.prototype={addData:function(b,c,d){var e=new a(b,c,d);this.dataList.push(e),this.dataCache=null},isDark:function(a,b){if(a<0||this.moduleCount<=a||b<0||this.moduleCount<=b)throw new Error(a+","+b);return this.modules[a][b][0]},getEye:function(a,b){if(a<0||this.moduleCount<=a||b<0||this.moduleCount<=b)throw new Error(a+","+b);var c=this.modules[a][b];if(c[1]){var d="P"+c[1]+"_"+c[2];return"A"==c[2]&&(d="A"+c[1]),{isDark:c[0],type:d}}return null},getModuleCount:function(){return this.moduleCount},make:function(){this.makeImpl(!1,this.getBestMaskPattern())},makeImpl:function(a,c){this.moduleCount=4*this.typeNumber+17,this.modules=new Array(this.moduleCount);for(var d=0;d<this.moduleCount;d++){this.modules[d]=new Array(this.moduleCount);for(var e=0;e<this.moduleCount;e++)this.modules[d][e]=[]}this.setupPositionProbePattern(0,0,"TL"),this.setupPositionProbePattern(this.moduleCount-7,0,"BL"),this.setupPositionProbePattern(0,this.moduleCount-7,"TR"),this.setupPositionAdjustPattern("A"),this.setupTimingPattern(),this.setupTypeInfo(a,c),this.typeNumber>=7&&this.setupTypeNumber(a),null==this.dataCache&&(this.dataCache=b.createData(this.typeNumber,this.errorCorrectLevel,this.dataList)),this.mapData(this.dataCache,c)},setupPositionProbePattern:function(a,b,c){for(var d=-1;d<=7;d++)if(!(a+d<=-1||this.moduleCount<=a+d))for(var e=-1;e<=7;e++)b+e<=-1||this.moduleCount<=b+e||(0<=d&&d<=6&&(0==e||6==e)||0<=e&&e<=6&&(0==d||6==d)||2<=d&&d<=4&&2<=e&&e<=4?(this.modules[a+d][b+e][0]=!0,this.modules[a+d][b+e][2]=c,this.modules[a+d][b+e][1]=-0==d||-0==e||6==d||6==e?"O":"I"):this.modules[a+d][b+e][0]=!1)},getBestMaskPattern:function(){for(var a=0,b=0,c=0;c<8;c++){this.makeImpl(!0,c);var d=t.getLostPoint(this);(0==c||a>d)&&(a=d,b=c)}return b},createMovieClip:function(a,b,c){var d=a.createEmptyMovieClip(b,c);this.make();for(var e=0;e<this.modules.length;e++)for(var f=1*e,g=0;g<this.modules[e].length;g++){var h=1*g,i=this.modules[e][g][0];i&&(d.beginFill(0,100),d.moveTo(h,f),d.lineTo(h+1,f),d.lineTo(h+1,f+1),d.lineTo(h,f+1),d.endFill())}return d},setupTimingPattern:function(){for(var a=8;a<this.moduleCount-8;a++)null==this.modules[a][6][0]&&(this.modules[a][6][0]=a%2==0);for(var b=8;b<this.moduleCount-8;b++)null==this.modules[6][b][0]&&(this.modules[6][b][0]=b%2==0)},setupPositionAdjustPattern:function(a){for(var b=t.getPatternPosition(this.typeNumber),c=0;c<b.length;c++)for(var d=0;d<b.length;d++){var e=b[c],f=b[d];if(null==this.modules[e][f][0])for(var g=-2;g<=2;g++)for(var h=-2;h<=2;h++)-2==g||2==g||-2==h||2==h||0==g&&0==h?(this.modules[e+g][f+h][0]=!0,this.modules[e+g][f+h][2]=a,this.modules[e+g][f+h][1]=-2==g||-2==h||2==g||2==h?"O":"I"):this.modules[e+g][f+h][0]=!1}},setupTypeNumber:function(a){for(var b=t.getBCHTypeNumber(this.typeNumber),c=0;c<18;c++){var d=!a&&1==(b>>c&1);this.modules[Math.floor(c/3)][c%3+this.moduleCount-8-3][0]=d}for(var c=0;c<18;c++){var d=!a&&1==(b>>c&1);this.modules[c%3+this.moduleCount-8-3][Math.floor(c/3)][0]=d}},setupTypeInfo:function(a,b){for(var c=this.errorCorrectLevel<<3|b,d=t.getBCHTypeInfo(c),e=0;e<15;e++){var f=!a&&1==(d>>e&1);e<6?this.modules[e][8][0]=f:e<8?this.modules[e+1][8][0]=f:this.modules[this.moduleCount-15+e][8][0]=f}for(var e=0;e<15;e++){var f=!a&&1==(d>>e&1);e<8?this.modules[8][this.moduleCount-e-1][0]=f:e<9?this.modules[8][15-e-1+1][0]=f:this.modules[8][15-e-1][0]=f}this.modules[this.moduleCount-8][8][0]=!a},mapData:function(a,b){for(var c=-1,d=this.moduleCount-1,e=7,f=0,g=this.moduleCount-1;g>0;g-=2)for(6==g&&g--;;){for(var h=0;h<2;h++)if(null==this.modules[d][g-h][0]){var i=!1;f<a.length&&(i=1==(a[f]>>>e&1));var j=t.getMask(b,d,g-h);j&&(i=!i),this.modules[d][g-h][0]=i,e--,-1==e&&(f++,e=7)}if((d+=c)<0||this.moduleCount<=d){d-=c,c=-c;break}}}},b.PAD0=236,b.PAD1=17,b.createData=function(a,c,f){for(var g=d.getRSBlocks(a,c),h=new e,i=0;i<f.length;i++){var j=f[i];h.put(j.mode,4),h.put(j.getLength(),t.getLengthInBits(j.mode,a)),j.write(h)}for(var k=0,i=0;i<g.length;i++)k+=g[i].dataCount;if(h.getLengthInBits()>8*k)throw new Error("code length overflow. ("+h.getLengthInBits()+">"+8*k+")");for(h.getLengthInBits()+4<=8*k&&h.put(0,4);h.getLengthInBits()%8!=0;)h.putBit(!1);for(;;){if(h.getLengthInBits()>=8*k)break;if(h.put(b.PAD0,8),h.getLengthInBits()>=8*k)break;h.put(b.PAD1,8)}return b.createBytes(h,g)},b.createBytes=function(a,b){for(var d=0,e=0,f=0,g=new Array(b.length),h=new Array(b.length),i=0;i<b.length;i++){var j=b[i].dataCount,k=b[i].totalCount-j;e=Math.max(e,j),f=Math.max(f,k),g[i]=new Array(j);for(var l=0;l<g[i].length;l++)g[i][l]=255&a.buffer[l+d];d+=j;var m=t.getErrorCorrectPolynomial(k),n=new c(g[i],m.getLength()-1),o=n.mod(m);h[i]=new Array(m.getLength()-1);for(var l=0;l<h[i].length;l++){var p=l+o.getLength()-h[i].length;h[i][l]=p>=0?o.get(p):0}}for(var q=0,l=0;l<b.length;l++)q+=b[l].totalCount;for(var r=new Array(q),s=0,l=0;l<e;l++)for(var i=0;i<b.length;i++)l<g[i].length&&(r[s++]=g[i][l]);for(var l=0;l<f;l++)for(var i=0;i<b.length;i++)l<h[i].length&&(r[s++]=h[i][l]);return r};for(var q={MODE_NUMBER:1,MODE_ALPHA_NUM:2,MODE_8BIT_BYTE:4,MODE_KANJI:8},r={L:1,M:0,Q:3,H:2},s={PATTERN000:0,PATTERN001:1,PATTERN010:2,PATTERN011:3,PATTERN100:4,PATTERN101:5,PATTERN110:6,PATTERN111:7},t={PATTERN_POSITION_TABLE:[[],[6,18],[6,22],[6,26],[6,30],[6,34],[6,22,38],[6,24,42],[6,26,46],[6,28,50],[6,30,54],[6,32,58],[6,34,62],[6,26,46,66],[6,26,48,70],[6,26,50,74],[6,30,54,78],[6,30,56,82],[6,30,58,86],[6,34,62,90],[6,28,50,72,94],[6,26,50,74,98],[6,30,54,78,102],[6,28,54,80,106],[6,32,58,84,110],[6,30,58,86,114],[6,34,62,90,118],[6,26,50,74,98,122],[6,30,54,78,102,126],[6,26,52,78,104,130],[6,30,56,82,108,134],[6,34,60,86,112,138],[6,30,58,86,114,142],[6,34,62,90,118,146],[6,30,54,78,102,126,150],[6,24,50,76,102,128,154],[6,28,54,80,106,132,158],[6,32,58,84,110,136,162],[6,26,54,82,110,138,166],[6,30,58,86,114,142,170]],G15:1335,G18:7973,G15_MASK:21522,getBCHTypeInfo:function(a){for(var b=a<<10;t.getBCHDigit(b)-t.getBCHDigit(t.G15)>=0;)b^=t.G15<<t.getBCHDigit(b)-t.getBCHDigit(t.G15);return(a<<10|b)^t.G15_MASK},getBCHTypeNumber:function(a){for(var b=a<<12;t.getBCHDigit(b)-t.getBCHDigit(t.G18)>=0;)b^=t.G18<<t.getBCHDigit(b)-t.getBCHDigit(t.G18);return a<<12|b},getBCHDigit:function(a){for(var b=0;0!=a;)b++,a>>>=1;return b},getPatternPosition:function(a){return t.PATTERN_POSITION_TABLE[a-1]},getMask:function(a,b,c){switch(a){case s.PATTERN000:return(b+c)%2==0;case s.PATTERN001:return b%2==0;case s.PATTERN010:return c%3==0;case s.PATTERN011:return(b+c)%3==0;case s.PATTERN100:return(Math.floor(b/2)+Math.floor(c/3))%2==0;case s.PATTERN101:return b*c%2+b*c%3==0;case s.PATTERN110:return(b*c%2+b*c%3)%2==0;case s.PATTERN111:return(b*c%3+(b+c)%2)%2==0;default:throw new Error("bad maskPattern:"+a)}},getErrorCorrectPolynomial:function(a){for(var b=new c([1],0),d=0;d<a;d++)b=b.multiply(new c([1,u.gexp(d)],0));return b},getLengthInBits:function(a,b){if(1<=b&&b<10)switch(a){case q.MODE_NUMBER:return 10;case q.MODE_ALPHA_NUM:return 9;case q.MODE_8BIT_BYTE:case q.MODE_KANJI:return 8;default:throw new Error("mode:"+a)}else if(b<27)switch(a){case q.MODE_NUMBER:return 12;case q.MODE_ALPHA_NUM:return 11;case q.MODE_8BIT_BYTE:return 16;case q.MODE_KANJI:return 10;default:throw new Error("mode:"+a)}else{if(!(b<41))throw new Error("type:"+b);switch(a){case q.MODE_NUMBER:return 14;case q.MODE_ALPHA_NUM:return 13;case q.MODE_8BIT_BYTE:return 16;case q.MODE_KANJI:return 12;default:throw new Error("mode:"+a)}}},getLostPoint:function(a){for(var b=a.getModuleCount(),c=0,d=0;d<b;d++)for(var e=0;e<b;e++){for(var f=0,g=a.isDark(d,e),h=-1;h<=1;h++)if(!(d+h<0||b<=d+h))for(var i=-1;i<=1;i++)e+i<0||b<=e+i||0==h&&0==i||g==a.isDark(d+h,e+i)&&f++;f>5&&(c+=3+f-5)}for(var d=0;d<b-1;d++)for(var e=0;e<b-1;e++){var j=0;a.isDark(d,e)&&j++,a.isDark(d+1,e)&&j++,a.isDark(d,e+1)&&j++,a.isDark(d+1,e+1)&&j++,0!=j&&4!=j||(c+=3)}for(var d=0;d<b;d++)for(var e=0;e<b-6;e++)a.isDark(d,e)&&!a.isDark(d,e+1)&&a.isDark(d,e+2)&&a.isDark(d,e+3)&&a.isDark(d,e+4)&&!a.isDark(d,e+5)&&a.isDark(d,e+6)&&(c+=40);for(var e=0;e<b;e++)for(var d=0;d<b-6;d++)a.isDark(d,e)&&!a.isDark(d+1,e)&&a.isDark(d+2,e)&&a.isDark(d+3,e)&&a.isDark(d+4,e)&&!a.isDark(d+5,e)&&a.isDark(d+6,e)&&(c+=40);for(var k=0,e=0;e<b;e++)for(var d=0;d<b;d++)a.isDark(d,e)&&k++;return c+=Math.abs(100*k/b/b-50)/5*10}},u={glog:function(a){if(a<1)throw new Error("glog("+a+")");return u.LOG_TABLE[a]},gexp:function(a){for(;a<0;)a+=255;for(;a>=256;)a-=255;return u.EXP_TABLE[a]},EXP_TABLE:new Array(256),LOG_TABLE:new Array(256)},v=0;v<8;v++)u.EXP_TABLE[v]=1<<v;for(var v=8;v<256;v++)u.EXP_TABLE[v]=u.EXP_TABLE[v-4]^u.EXP_TABLE[v-5]^u.EXP_TABLE[v-6]^u.EXP_TABLE[v-8];for(var v=0;v<255;v++)u.LOG_TABLE[u.EXP_TABLE[v]]=v;c.prototype={get:function(a){return this.num[a]},getLength:function(){return this.num.length},multiply:function(a){for(var b=new Array(this.getLength()+a.getLength()-1),d=0;d<this.getLength();d++)for(var e=0;e<a.getLength();e++)b[d+e]^=u.gexp(u.glog(this.get(d))+u.glog(a.get(e)));return new c(b,0)},mod:function(a){if(this.getLength()-a.getLength()<0)return this;for(var b=u.glog(this.get(0))-u.glog(a.get(0)),d=new Array(this.getLength()),e=0;e<this.getLength();e++)d[e]=this.get(e);for(var e=0;e<a.getLength();e++)d[e]^=u.gexp(u.glog(a.get(e))+b);return new c(d,0).mod(a)}},
+d.RS_BLOCK_TABLE=[[1,26,19],[1,26,16],[1,26,13],[1,26,9],[1,44,34],[1,44,28],[1,44,22],[1,44,16],[1,70,55],[1,70,44],[2,35,17],[2,35,13],[1,100,80],[2,50,32],[2,50,24],[4,25,9],[1,134,108],[2,67,43],[2,33,15,2,34,16],[2,33,11,2,34,12],[2,86,68],[4,43,27],[4,43,19],[4,43,15],[2,98,78],[4,49,31],[2,32,14,4,33,15],[4,39,13,1,40,14],[2,121,97],[2,60,38,2,61,39],[4,40,18,2,41,19],[4,40,14,2,41,15],[2,146,116],[3,58,36,2,59,37],[4,36,16,4,37,17],[4,36,12,4,37,13],[2,86,68,2,87,69],[4,69,43,1,70,44],[6,43,19,2,44,20],[6,43,15,2,44,16],[4,101,81],[1,80,50,4,81,51],[4,50,22,4,51,23],[3,36,12,8,37,13],[2,116,92,2,117,93],[6,58,36,2,59,37],[4,46,20,6,47,21],[7,42,14,4,43,15],[4,133,107],[8,59,37,1,60,38],[8,44,20,4,45,21],[12,33,11,4,34,12],[3,145,115,1,146,116],[4,64,40,5,65,41],[11,36,16,5,37,17],[11,36,12,5,37,13],[5,109,87,1,110,88],[5,65,41,5,66,42],[5,54,24,7,55,25],[11,36,12,7,37,13],[5,122,98,1,123,99],[7,73,45,3,74,46],[15,43,19,2,44,20],[3,45,15,13,46,16],[1,135,107,5,136,108],[10,74,46,1,75,47],[1,50,22,15,51,23],[2,42,14,17,43,15],[5,150,120,1,151,121],[9,69,43,4,70,44],[17,50,22,1,51,23],[2,42,14,19,43,15],[3,141,113,4,142,114],[3,70,44,11,71,45],[17,47,21,4,48,22],[9,39,13,16,40,14],[3,135,107,5,136,108],[3,67,41,13,68,42],[15,54,24,5,55,25],[15,43,15,10,44,16],[4,144,116,4,145,117],[17,68,42],[17,50,22,6,51,23],[19,46,16,6,47,17],[2,139,111,7,140,112],[17,74,46],[7,54,24,16,55,25],[34,37,13],[4,151,121,5,152,122],[4,75,47,14,76,48],[11,54,24,14,55,25],[16,45,15,14,46,16],[6,147,117,4,148,118],[6,73,45,14,74,46],[11,54,24,16,55,25],[30,46,16,2,47,17],[8,132,106,4,133,107],[8,75,47,13,76,48],[7,54,24,22,55,25],[22,45,15,13,46,16],[10,142,114,2,143,115],[19,74,46,4,75,47],[28,50,22,6,51,23],[33,46,16,4,47,17],[8,152,122,4,153,123],[22,73,45,3,74,46],[8,53,23,26,54,24],[12,45,15,28,46,16],[3,147,117,10,148,118],[3,73,45,23,74,46],[4,54,24,31,55,25],[11,45,15,31,46,16],[7,146,116,7,147,117],[21,73,45,7,74,46],[1,53,23,37,54,24],[19,45,15,26,46,16],[5,145,115,10,146,116],[19,75,47,10,76,48],[15,54,24,25,55,25],[23,45,15,25,46,16],[13,145,115,3,146,116],[2,74,46,29,75,47],[42,54,24,1,55,25],[23,45,15,28,46,16],[17,145,115],[10,74,46,23,75,47],[10,54,24,35,55,25],[19,45,15,35,46,16],[17,145,115,1,146,116],[14,74,46,21,75,47],[29,54,24,19,55,25],[11,45,15,46,46,16],[13,145,115,6,146,116],[14,74,46,23,75,47],[44,54,24,7,55,25],[59,46,16,1,47,17],[12,151,121,7,152,122],[12,75,47,26,76,48],[39,54,24,14,55,25],[22,45,15,41,46,16],[6,151,121,14,152,122],[6,75,47,34,76,48],[46,54,24,10,55,25],[2,45,15,64,46,16],[17,152,122,4,153,123],[29,74,46,14,75,47],[49,54,24,10,55,25],[24,45,15,46,46,16],[4,152,122,18,153,123],[13,74,46,32,75,47],[48,54,24,14,55,25],[42,45,15,32,46,16],[20,147,117,4,148,118],[40,75,47,7,76,48],[43,54,24,22,55,25],[10,45,15,67,46,16],[19,148,118,6,149,119],[18,75,47,31,76,48],[34,54,24,34,55,25],[20,45,15,61,46,16]],d.getRSBlocks=function(a,b){var c=d.getRsBlockTable(a,b);if(c==i)throw new Error("bad rs block @ typeNumber:"+a+"/errorCorrectLevel:"+b);for(var e=c.length/3,f=[],g=0;g<e;g++)for(var h=c[3*g+0],j=c[3*g+1],k=c[3*g+2],l=0;l<h;l++)f.push(new d(j,k));return f},d.getRsBlockTable=function(a,b){switch(b){case r.L:return d.RS_BLOCK_TABLE[4*(a-1)+0];case r.M:return d.RS_BLOCK_TABLE[4*(a-1)+1];case r.Q:return d.RS_BLOCK_TABLE[4*(a-1)+2];case r.H:return d.RS_BLOCK_TABLE[4*(a-1)+3];default:return i}},e.prototype={get:function(a){var b=Math.floor(a/8);return 1==(this.buffer[b]>>>7-a%8&1)},put:function(a,b){for(var c=0;c<b;c++)this.putBit(1==(a>>>b-c-1&1))},getLengthInBits:function(){return this.length},putBit:function(a){var b=Math.floor(this.length/8);this.buffer.length<=b&&this.buffer.push(0),a&&(this.buffer[b]|=128>>>this.length%8),this.length++}};var w=[[17,14,11,7],[32,26,20,14],[53,42,32,24],[78,62,46,34],[106,84,60,44],[134,106,74,58],[154,122,86,64],[192,152,108,84],[230,180,130,98],[271,213,151,119],[321,251,177,137],[367,287,203,155],[425,331,241,177],[458,362,258,194],[520,412,292,220],[586,450,322,250],[644,504,364,280],[718,560,394,310],[792,624,442,338],[858,666,482,382],[929,711,509,403],[1003,779,565,439],[1091,857,611,461],[1171,911,661,511],[1273,997,715,535],[1367,1059,751,593],[1465,1125,805,625],[1528,1190,868,658],[1628,1264,908,698],[1732,1370,982,742],[1840,1452,1030,790],[1952,1538,1112,842],[2068,1628,1168,898],[2188,1722,1228,958],[2303,1809,1283,983],[2431,1911,1351,1051],[2563,1989,1423,1093],[2699,2099,1499,1139],[2809,2213,1579,1219],[2953,2331,1663,1273]],x=function(){return"undefined"!=typeof CanvasRenderingContext2D}()?function(){function a(){if("svg"==this._htOption.drawer){var a=this._oContext.getSerializedSvg(!0);this.dataURL=a,this._el.innerHTML=a}else try{var b=this._elCanvas.toDataURL("image/png");this.dataURL=b}catch(a){console.error(a)}this._htOption.onRenderingEnd&&(this.dataURL||console.error("Can not get base64 data, please check: 1. Published the page and image to the server 2. The image request support CORS 3. Configured `crossOrigin:'anonymous'` option"),this._htOption.onRenderingEnd(this._htOption,this.dataURL))}function b(a,b){var c=this;if(c._fFail=b,c._fSuccess=a,null===c._bSupportDataURI){var d=document.createElement("img"),e=function(){c._bSupportDataURI=!1,c._fFail&&c._fFail.call(c)},f=function(){c._bSupportDataURI=!0,c._fSuccess&&c._fSuccess.call(c)};d.onabort=e,d.onerror=e,d.onload=f,d.src="data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg=="}else!0===c._bSupportDataURI&&c._fSuccess?c._fSuccess.call(c):!1===c._bSupportDataURI&&c._fFail&&c._fFail.call(c)}if(m._android&&m._android<=2.1){var c=1/window.devicePixelRatio,d=CanvasRenderingContext2D.prototype.drawImage;CanvasRenderingContext2D.prototype.drawImage=function(a,b,e,f,g,h,i,j,k){if("nodeName"in a&&/img/i.test(a.nodeName))for(var l=arguments.length-1;l>=1;l--)arguments[l]=arguments[l]*c;else void 0===j&&(arguments[1]*=c,arguments[2]*=c,arguments[3]*=c,arguments[4]*=c);d.apply(this,arguments)}}var e=function(a,b){this._bIsPainted=!1,this._android=f(),this._el=a,this._htOption=b,"svg"==this._htOption.drawer?(this._oContext={},this._elCanvas={}):(this._elCanvas=document.createElement("canvas"),this._el.appendChild(this._elCanvas),this._oContext=this._elCanvas.getContext("2d")),this._bSupportDataURI=null,this.dataURL=null};return e.prototype.draw=function(a){function b(){d.quietZone>0&&d.quietZoneColor&&(j.lineWidth=0,j.fillStyle=d.quietZoneColor,j.fillRect(0,0,k._elCanvas.width,d.quietZone),j.fillRect(0,d.quietZone,d.quietZone,k._elCanvas.height-2*d.quietZone),j.fillRect(k._elCanvas.width-d.quietZone,d.quietZone,d.quietZone,k._elCanvas.height-2*d.quietZone),j.fillRect(0,k._elCanvas.height-d.quietZone,k._elCanvas.width,d.quietZone))}function c(a){function c(a){var c=Math.round(d.width/3.5),e=Math.round(d.height/3.5);c!==e&&(c=e),d.logoMaxWidth?c=Math.round(d.logoMaxWidth):d.logoWidth&&(c=Math.round(d.logoWidth)),d.logoMaxHeight?e=Math.round(d.logoMaxHeight):d.logoHeight&&(e=Math.round(d.logoHeight));var f,g;void 0===a.naturalWidth?(f=a.width,g=a.height):(f=a.naturalWidth,g=a.naturalHeight),(d.logoMaxWidth||d.logoMaxHeight)&&(d.logoMaxWidth&&f<=c&&(c=f),d.logoMaxHeight&&g<=e&&(e=g),f<=c&&g<=e&&(c=f,e=g));var h=(d.realWidth-c)/2,i=(d.realHeight-e)/2,k=Math.min(c/f,e/g),l=f*k,m=g*k;(d.logoMaxWidth||d.logoMaxHeight)&&(c=l,e=m,h=(d.realWidth-c)/2,i=(d.realHeight-e)/2),d.logoBackgroundTransparent||(j.fillStyle=d.logoBackgroundColor,j.fillRect(h,i,c,e));var n=j.imageSmoothingQuality,o=j.imageSmoothingEnabled;j.imageSmoothingEnabled=!0,j.imageSmoothingQuality="high",j.drawImage(a,h+(c-l)/2,i+(e-m)/2,l,m),j.imageSmoothingEnabled=o,j.imageSmoothingQuality=n,b(),s._bIsPainted=!0,s.makeImage()}d.onRenderingStart&&d.onRenderingStart(d);for(var h=0;h<e;h++)for(var i=0;i<e;i++){var k=i*f+d.quietZone,l=h*g+d.quietZone,m=a.isDark(h,i),n=a.getEye(h,i),o=d.dotScale;j.lineWidth=0;var p,q;n?(p=d[n.type]||d[n.type.substring(0,2)]||d.colorDark,q=d.colorLight):d.backgroundImage?(q="rgba(0,0,0,0)",6==h?d.autoColor?(p=d.timing_H||d.timing||d.autoColorDark,q=d.autoColorLight):p=d.timing_H||d.timing||d.colorDark:6==i?d.autoColor?(p=d.timing_V||d.timing||d.autoColorDark,q=d.autoColorLight):p=d.timing_V||d.timing||d.colorDark:d.autoColor?(p=d.autoColorDark,q=d.autoColorLight):p=d.colorDark):(p=6==h?d.timing_H||d.timing||d.colorDark:6==i?d.timing_V||d.timing||d.colorDark:d.colorDark,q=d.colorLight),j.strokeStyle=m?p:q,j.fillStyle=m?p:q,n?(o="AO"==n.type?d.dotScaleAO:"AI"==n.type?d.dotScaleAI:1,d.backgroundImage&&d.autoColor?(p=("AO"==n.type?d.AI:d.AO)||d.autoColorDark,q=d.autoColorLight):p=("AO"==n.type?d.AI:d.AO)||p,m=n.isDark,j.fillRect(Math.ceil(k+f*(1-o)/2),Math.ceil(d.titleHeight+l+g*(1-o)/2),Math.ceil(f*o),Math.ceil(g*o))):6==h?(o=d.dotScaleTiming_H,j.fillRect(Math.ceil(k+f*(1-o)/2),Math.ceil(d.titleHeight+l+g*(1-o)/2),Math.ceil(f*o),Math.ceil(g*o))):6==i?(o=d.dotScaleTiming_V,j.fillRect(Math.ceil(k+f*(1-o)/2),Math.ceil(d.titleHeight+l+g*(1-o)/2),Math.ceil(f*o),Math.ceil(g*o))):(d.backgroundImage,j.fillRect(Math.ceil(k+f*(1-o)/2),Math.ceil(d.titleHeight+l+g*(1-o)/2),Math.ceil(f*o),Math.ceil(g*o))),1==d.dotScale||n||(j.strokeStyle=d.colorLight)}if(d.title&&(j.fillStyle=d.titleBackgroundColor,j.fillRect(d.quietZone,d.quietZone,d.width,d.titleHeight),j.font=d.titleFont,j.fillStyle=d.titleColor,j.textAlign="center",j.fillText(d.title,this._elCanvas.width/2,+d.quietZone+d.titleTop)),d.subTitle&&(j.font=d.subTitleFont,j.fillStyle=d.subTitleColor,j.fillText(d.subTitle,this._elCanvas.width/2,+d.quietZone+d.subTitleTop)),d.logo){var r=new Image,s=this;r.onload=function(){c(r)},r.onerror=function(a){console.error(a)},null!=d.crossOrigin&&(r.crossOrigin=d.crossOrigin),r.originalSrc=d.logo,r.src=d.logo}else b(),this._bIsPainted=!0,this.makeImage()}var d=this._htOption,e=a.getModuleCount(),f=d.width/e,g=d.height/e;f<=1&&(f=1),g<=1&&(g=1);var h=f*e,i=g*e;d.heightWithTitle=i+d.titleHeight,d.realHeight=d.heightWithTitle+2*d.quietZone,d.realWidth=h+2*d.quietZone,this._elCanvas.width=d.realWidth,this._elCanvas.height=d.realHeight,"canvas"!=d.drawer&&(this._oContext=new C2S(this._elCanvas.width,this._elCanvas.height)),this.clear();var j=this._oContext;j.lineWidth=0,j.fillStyle=d.colorLight,j.fillRect(0,0,this._elCanvas.width,this._elCanvas.height),j.clearRect(d.quietZone,d.quietZone,d.width,d.titleHeight);var k=this;if(d.backgroundImage){var l=new Image;l.onload=function(){j.globalAlpha=1,j.globalAlpha=d.backgroundImageAlpha;var b=j.imageSmoothingQuality,e=j.imageSmoothingEnabled;j.imageSmoothingEnabled=!0,j.imageSmoothingQuality="high",(d.title||d.subTitle)&&d.titleHeight?j.drawImage(l,d.quietZone,d.quietZone+d.titleHeight,d.width,d.height):j.drawImage(l,0,0,d.realWidth,d.realHeight),j.imageSmoothingEnabled=e,j.imageSmoothingQuality=b,j.globalAlpha=1,c.call(k,a)},null!=d.crossOrigin&&(l.crossOrigin=d.crossOrigin),l.originalSrc=d.backgroundImage,l.src=d.backgroundImage}else c.call(k,a)},e.prototype.makeImage=function(){this._bIsPainted&&b.call(this,a)},e.prototype.isPainted=function(){return this._bIsPainted},e.prototype.clear=function(){this._oContext.clearRect(0,0,this._elCanvas.width,this._elCanvas.height),this._bIsPainted=!1},e.prototype.remove=function(){this._oContext.clearRect(0,0,this._elCanvas.width,this._elCanvas.height),this._bIsPainted=!1,this._el.innerHTML=""},e.prototype.round=function(a){return a?Math.floor(1e3*a)/1e3:a},e}():function(){var a=function(a,b){this._el=a,this._htOption=b};return a.prototype.draw=function(a){var b=this._htOption,c=this._el,d=a.getModuleCount(),e=b.width/d,f=b.height/d;e<=1&&(e=1),f<=1&&(f=1);var g=e*d,h=f*d;b.heightWithTitle=h+b.titleHeight,b.realHeight=b.heightWithTitle+2*b.quietZone,b.realWidth=g+2*b.quietZone;var i=[],j="",k=Math.round(e*b.dotScale),l=Math.round(f*b.dotScale);k<4&&(k=4,l=4);var m=b.colorDark,n=b.colorLight;if(b.backgroundImage){b.autoColor?(b.colorDark="rgba(0, 0, 0, .6);filter:progid:DXImageTransform.Microsoft.Gradient(GradientType=0, StartColorStr='#99000000', EndColorStr='#99000000');",b.colorLight="rgba(255, 255, 255, .7);filter:progid:DXImageTransform.Microsoft.Gradient(GradientType=0, StartColorStr='#B2FFFFFF', EndColorStr='#B2FFFFFF');"):b.colorLight="rgba(0,0,0,0)";var o='<div style="display:inline-block; z-index:-10;position:absolute;"><img src="'+b.backgroundImage+'" width="'+(b.width+2*b.quietZone)+'" height="'+b.realHeight+'" style="opacity:'+b.backgroundImageAlpha+";filter:alpha(opacity="+100*b.backgroundImageAlpha+'); "/></div>';i.push(o)}if(b.quietZone&&(j="display:inline-block; width:"+(b.width+2*b.quietZone)+"px; height:"+(b.width+2*b.quietZone)+"px;background:"+b.quietZoneColor+"; text-align:center;"),i.push('<div style="font-size:0;'+j+'">'),i.push('<table  style="font-size:0;border:0;border-collapse:collapse; margin-top:'+b.quietZone+'px;" border="0" cellspacing="0" cellspadding="0" align="center" valign="middle">'),i.push('<tr height="'+b.titleHeight+'" align="center"><td style="border:0;border-collapse:collapse;margin:0;padding:0" colspan="'+d+'">'),b.title){var p=b.titleColor,q=b.titleFont;i.push('<div style="width:100%;margin-top:'+b.titleTop+"px;color:"+p+";font:"+q+";background:"+b.titleBackgroundColor+'">'+b.title+"</div>")}b.subTitle&&i.push('<div style="width:100%;margin-top:'+(b.subTitleTop-b.titleTop)+"px;color:"+b.subTitleColor+"; font:"+b.subTitleFont+'">'+b.subTitle+"</div>"),i.push("</td></tr>");for(var r=0;r<d;r++){i.push('<tr style="border:0; padding:0; margin:0;" height="7">');for(var s=0;s<d;s++){var t=a.isDark(r,s),u=a.getEye(r,s);if(u){t=u.isDark;var v=u.type,w=b[v]||b[v.substring(0,2)]||m;i.push('<td style="border:0;border-collapse:collapse;padding:0;margin:0;width:'+e+"px;height:"+f+'px;"><span style="width:'+e+"px;height:"+f+"px;background-color:"+(t?w:n)+';display:inline-block"></span></td>')}else{var x=b.colorDark;6==r?(x=b.timing_H||b.timing||m,i.push('<td style="border:0;border-collapse:collapse;padding:0;margin:0;width:'+e+"px;height:"+f+"px;background-color:"+(t?x:n)+';"></td>')):6==s?(x=b.timing_V||b.timing||m,i.push('<td style="border:0;border-collapse:collapse;padding:0;margin:0;width:'+e+"px;height:"+f+"px;background-color:"+(t?x:n)+';"></td>')):i.push('<td style="border:0;border-collapse:collapse;padding:0;margin:0;width:'+e+"px;height:"+f+'px;"><div style="display:inline-block;width:'+k+"px;height:"+l+"px;background-color:"+(t?x:b.colorLight)+';"></div></td>')}}i.push("</tr>")}if(i.push("</table>"),i.push("</div>"),b.logo){var y=new Image;null!=b.crossOrigin&&(y.crossOrigin=b.crossOrigin),y.src=b.logo;var z=b.width/3.5,A=b.height/3.5;z!=A&&(z=A),b.logoWidth&&(z=b.logoWidth),b.logoHeight&&(A=b.logoHeight);var B="position:relative; z-index:1;display:table-cell;top:-"+(b.height/2+A/2+b.quietZone)+"px;text-align:center; width:"+z+"px; height:"+A+"px;line-height:"+z+"px; vertical-align: middle;";b.logoBackgroundTransparent||(B+="background:"+b.logoBackgroundColor),i.push('<div style="'+B+'"><img  src="'+b.logo+'"  style="max-width: '+z+"px; max-height: "+A+'px;" /> <div style=" display: none; width:1px;margin-left: -1px;"></div></div>')}b.onRenderingStart&&b.onRenderingStart(b),c.innerHTML=i.join("");var C=c.childNodes[0],D=(b.width-C.offsetWidth)/2,E=(b.heightWithTitle-C.offsetHeight)/2;D>0&&E>0&&(C.style.margin=E+"px "+D+"px"),this._htOption.onRenderingEnd&&this._htOption.onRenderingEnd(this._htOption,null)},a.prototype.clear=function(){this._el.innerHTML=""},a}();j=function(a,b){if(this._htOption={width:256,height:256,typeNumber:4,colorDark:"#000000",colorLight:"#ffffff",correctLevel:r.H,dotScale:1,dotScaleTiming:1,dotScaleTiming_H:i,dotScaleTiming_V:i,dotScaleA:1,dotScaleAO:i,dotScaleAI:i,quietZone:0,quietZoneColor:"rgba(0,0,0,0)",title:"",titleFont:"normal normal bold 16px Arial",titleColor:"#000000",titleBackgroundColor:"#ffffff",titleHeight:0,titleTop:30,subTitle:"",subTitleFont:"normal normal normal 14px Arial",subTitleColor:"#4F4F4F",subTitleTop:60,logo:i,logoWidth:i,logoHeight:i,logoMaxWidth:i,logoMaxHeight:i,logoBackgroundColor:"#ffffff",logoBackgroundTransparent:!1,PO:i,PI:i,PO_TL:i,PI_TL:i,PO_TR:i,PI_TR:i,PO_BL:i,PI_BL:i,AO:i,AI:i,timing:i,timing_H:i,timing_V:i,backgroundImage:i,backgroundImageAlpha:1,autoColor:!1,autoColorDark:"rgba(0, 0, 0, .6)",autoColorLight:"rgba(255, 255, 255, .7)",onRenderingStart:i,onRenderingEnd:i,version:0,tooltip:!1,binary:!1,drawer:"canvas",crossOrigin:null,utf8WithoutBOM:!0},"string"==typeof b&&(b={text:b}),b)for(var c in b)this._htOption[c]=b[c];this._htOption.title||this._htOption.subTitle||(this._htOption.titleHeight=0),(this._htOption.version<0||this._htOption.version>40)&&(console.warn("QR Code version '"+this._htOption.version+"' is invalidate, reset to 0"),this._htOption.version=0),(this._htOption.dotScale<0||this._htOption.dotScale>1)&&(console.warn(this._htOption.dotScale+" , is invalidate, dotScale must greater than 0, less than or equal to 1, now reset to 1. "),this._htOption.dotScale=1),(this._htOption.dotScaleTiming<0||this._htOption.dotScaleTiming>1)&&(console.warn(this._htOption.dotScaleTiming+" , is invalidate, dotScaleTiming must greater than 0, less than or equal to 1, now reset to 1. "),this._htOption.dotScaleTiming=1),this._htOption.dotScaleTiming_H?(this._htOption.dotScaleTiming_H<0||this._htOption.dotScaleTiming_H>1)&&(console.warn(this._htOption.dotScaleTiming_H+" , is invalidate, dotScaleTiming_H must greater than 0, less than or equal to 1, now reset to 1. "),this._htOption.dotScaleTiming_H=1):this._htOption.dotScaleTiming_H=this._htOption.dotScaleTiming,this._htOption.dotScaleTiming_V?(this._htOption.dotScaleTiming_V<0||this._htOption.dotScaleTiming_V>1)&&(console.warn(this._htOption.dotScaleTiming_V+" , is invalidate, dotScaleTiming_V must greater than 0, less than or equal to 1, now reset to 1. "),this._htOption.dotScaleTiming_V=1):this._htOption.dotScaleTiming_V=this._htOption.dotScaleTiming,(this._htOption.dotScaleA<0||this._htOption.dotScaleA>1)&&(console.warn(this._htOption.dotScaleA+" , is invalidate, dotScaleA must greater than 0, less than or equal to 1, now reset to 1. "),this._htOption.dotScaleA=1),this._htOption.dotScaleAO?(this._htOption.dotScaleAO<0||this._htOption.dotScaleAO>1)&&(console.warn(this._htOption.dotScaleAO+" , is invalidate, dotScaleAO must greater than 0, less than or equal to 1, now reset to 1. "),this._htOption.dotScaleAO=1):this._htOption.dotScaleAO=this._htOption.dotScaleA,this._htOption.dotScaleAI?(this._htOption.dotScaleAI<0||this._htOption.dotScaleAI>1)&&(console.warn(this._htOption.dotScaleAI+" , is invalidate, dotScaleAI must greater than 0, less than or equal to 1, now reset to 1. "),this._htOption.dotScaleAI=1):this._htOption.dotScaleAI=this._htOption.dotScaleA,(this._htOption.backgroundImageAlpha<0||this._htOption.backgroundImageAlpha>1)&&(console.warn(this._htOption.backgroundImageAlpha+" , is invalidate, backgroundImageAlpha must between 0 and 1, now reset to 1. "),this._htOption.backgroundImageAlpha=1),this._htOption.quietZone||(this._htOption.quietZone=0),this._htOption.titleHeight||(this._htOption.titleHeight=0),this._htOption.width=Math.round(this._htOption.width),this._htOption.height=Math.round(this._htOption.height),this._htOption.quietZone=Math.round(this._htOption.quietZone),this._htOption.titleHeight=Math.round(this._htOption.titleHeight),"string"==typeof a&&(a=document.getElementById(a)),(!this._htOption.drawer||"svg"!=this._htOption.drawer&&"canvas"!=this._htOption.drawer)&&(this._htOption.drawer="canvas"),this._android=f(),this._el=a,this._oQRCode=null,this._htOption._element=a;var d={};for(var c in this._htOption)d[c]=this._htOption[c];this._oDrawing=new x(this._el,d),this._htOption.text&&this.makeCode(this._htOption.text)},j.prototype.makeCode=function(a){this._oQRCode=new b(g(a,this._htOption),this._htOption.correctLevel),this._oQRCode.addData(a,this._htOption.binary,this._htOption.utf8WithoutBOM),this._oQRCode.make(),this._htOption.tooltip&&(this._el.title=a),this._oDrawing.draw(this._oQRCode)},j.prototype.makeImage=function(){"function"==typeof this._oDrawing.makeImage&&(!this._android||this._android>=3)&&this._oDrawing.makeImage()},j.prototype.clear=function(){this._oDrawing.remove()},j.prototype.resize=function(a,b){this._oDrawing._htOption.width=a,this._oDrawing._htOption.height=b,this._oDrawing.draw(this._oQRCode)},j.prototype.download=function(a){var b=this._oDrawing.dataURL,c=document.createElement("a");if("svg"==this._htOption.drawer){a+=".svg";var d=new Blob([b],{type:"text/plain"});if(navigator.msSaveBlob)navigator.msSaveBlob(d,a);else{c.download=a;var e=new FileReader;e.onload=function(){c.href=e.result,c.click()},e.readAsDataURL(d)}}else if(a+=".png",navigator.msSaveBlob){var f=function(a){var b=atob(a.split(",")[1]),c=a.split(",")[0].split(":")[1].split(";")[0],d=new ArrayBuffer(b.length),e=new Uint8Array(d);for(v=0;v<b.length;v++)e[v]=b.charCodeAt(v);return new Blob([d],{type:c})}(b);navigator.msSaveBlob(f,a)}else c.download=a,c.href=b,c.click()},j.prototype.noConflict=function(){return m.QRCode===this&&(m.QRCode=p),j},j.CorrectLevel=r,"function"==typeof define&&(define.amd||define.cmd)?define([],function(){return j}):o?((o.exports=j).QRCode=j,n.QRCode=j):m.QRCode=j}.call(this);
\ No newline at end of file
diff --git a/dev/eo-hits-150.json b/dev/eo-hits-150.json
new file mode 100644
index 0000000..df9c9ce
--- /dev/null
+++ b/dev/eo-hits-150.json
@@ -0,0 +1,219 @@
+[
+  {
+    "ip": "43.174.150.2",
+    "tcp_ms": 176.9,
+    "handshake_ms": 599.1,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.4",
+    "tcp_ms": 609.9,
+    "handshake_ms": 794.4,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.9",
+    "tcp_ms": 791.7,
+    "handshake_ms": 973.8,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.10",
+    "tcp_ms": 973.8,
+    "handshake_ms": 1153.9,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.7",
+    "tcp_ms": 1156.6,
+    "handshake_ms": 1914.6,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.21",
+    "tcp_ms": 1906.3,
+    "handshake_ms": 2689.0,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.1",
+    "tcp_ms": 2703.3,
+    "handshake_ms": 3606.3,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.11",
+    "tcp_ms": 3600.5,
+    "handshake_ms": 3795.7,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.5",
+    "tcp_ms": 3800.5,
+    "handshake_ms": 3996.5,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.6",
+    "tcp_ms": 3996.7,
+    "handshake_ms": 4194.4,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.8",
+    "tcp_ms": 4194.1,
+    "handshake_ms": 5120.6,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.18",
+    "tcp_ms": 5114.5,
+    "handshake_ms": 5299.6,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.20",
+    "tcp_ms": 5298.5,
+    "handshake_ms": 6025.5,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.12",
+    "tcp_ms": 6031.7,
+    "handshake_ms": 6218.7,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.3",
+    "tcp_ms": 6225.4,
+    "handshake_ms": 7469.9,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.23",
+    "tcp_ms": 7457.2,
+    "handshake_ms": 7648.1,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.29",
+    "tcp_ms": 7644.9,
+    "handshake_ms": 7827.4,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.26",
+    "tcp_ms": 7829.8,
+    "handshake_ms": 8188.7,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.15",
+    "tcp_ms": 8197.2,
+    "handshake_ms": 8388.9,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.16",
+    "tcp_ms": 8388.6,
+    "handshake_ms": 8585.0,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.32",
+    "tcp_ms": 8574.8,
+    "handshake_ms": 9287.3,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.19",
+    "tcp_ms": 9297.3,
+    "handshake_ms": 9490.1,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.13",
+    "tcp_ms": 9494.5,
+    "handshake_ms": 9692.0,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.22",
+    "tcp_ms": 9686.6,
+    "handshake_ms": 10704.7,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.24",
+    "tcp_ms": 10704.7,
+    "handshake_ms": 11717.3,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.25",
+    "tcp_ms": 11717.6,
+    "handshake_ms": 12484.2,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.34",
+    "tcp_ms": 12479.1,
+    "handshake_ms": 12667.2,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.14",
+    "tcp_ms": 12681.3,
+    "handshake_ms": 13862.1,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.42",
+    "tcp_ms": 13843.7,
+    "handshake_ms": 14038.8,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.37",
+    "tcp_ms": 14043.4,
+    "handshake_ms": 14412.6,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  },
+  {
+    "ip": "43.174.150.35",
+    "tcp_ms": 14414.9,
+    "handshake_ms": 15780.7,
+    "tls": "TLSv1.3",
+    "alpn": "http/1.1"
+  }
+]
\ No newline at end of file
diff --git a/dev/eo-hits-hkjp.json b/dev/eo-hits-hkjp.json
new file mode 100644
index 0000000..e59593c
--- /dev/null
+++ b/dev/eo-hits-hkjp.json
@@ -0,0 +1,114 @@
+[
+  {
+    "ip": "43.175.107.217",
+    "http": "400",
+    "total_s": 1.010907,
+    "elapsed_ms": 3525.3,
+    "note": ""
+  },
+  {
+    "ip": "43.175.118.111",
+    "http": "400",
+    "total_s": 1.113784,
+    "elapsed_ms": 2782.9,
+    "note": ""
+  },
+  {
+    "ip": "43.175.18.50",
+    "http": "200",
+    "total_s": 1.504578,
+    "elapsed_ms": 1629.3,
+    "note": ""
+  },
+  {
+    "ip": "43.175.17.109",
+    "http": "200",
+    "total_s": 1.675108,
+    "elapsed_ms": 2895.5,
+    "note": ""
+  },
+  {
+    "ip": "43.175.113.139",
+    "http": "200",
+    "total_s": 1.79808,
+    "elapsed_ms": 3461.2,
+    "note": ""
+  },
+  {
+    "ip": "43.175.119.214",
+    "http": "200",
+    "total_s": 1.836886,
+    "elapsed_ms": 4706.9,
+    "note": ""
+  },
+  {
+    "ip": "43.175.115.202",
+    "http": "200",
+    "total_s": 1.977182,
+    "elapsed_ms": 3401.5,
+    "note": ""
+  },
+  {
+    "ip": "43.175.115.123",
+    "http": "200",
+    "total_s": 1.987886,
+    "elapsed_ms": 3563.1,
+    "note": ""
+  },
+  {
+    "ip": "43.175.115.149",
+    "http": "200",
+    "total_s": 2.029702,
+    "elapsed_ms": 3139.6,
+    "note": ""
+  },
+  {
+    "ip": "43.175.119.174",
+    "http": "200",
+    "total_s": 2.116343,
+    "elapsed_ms": 3937.1,
+    "note": ""
+  },
+  {
+    "ip": "43.175.119.230",
+    "http": "200",
+    "total_s": 2.65339,
+    "elapsed_ms": 4696.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.126.220",
+    "http": "200",
+    "total_s": 3.056871,
+    "elapsed_ms": 4404.8,
+    "note": ""
+  },
+  {
+    "ip": "43.175.115.41",
+    "http": "200",
+    "total_s": 3.309262,
+    "elapsed_ms": 4261.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.126.152",
+    "http": "200",
+    "total_s": 3.333779,
+    "elapsed_ms": 4557.8,
+    "note": ""
+  },
+  {
+    "ip": "43.175.17.185",
+    "http": "200",
+    "total_s": 3.525846,
+    "elapsed_ms": 5194.5,
+    "note": ""
+  },
+  {
+    "ip": "43.175.16.233",
+    "http": "200",
+    "total_s": 4.754878,
+    "elapsed_ms": 6255.5,
+    "note": ""
+  }
+]
\ No newline at end of file
diff --git a/dev/eo-hits-v2.json b/dev/eo-hits-v2.json
new file mode 100644
index 0000000..8949e45
--- /dev/null
+++ b/dev/eo-hits-v2.json
@@ -0,0 +1,3579 @@
+[
+  {
+    "ip": "43.174.246.71",
+    "http": "200",
+    "total_s": 0.838209,
+    "elapsed_ms": 3283.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.5",
+    "http": "200",
+    "total_s": 0.870677,
+    "elapsed_ms": 4607.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.237",
+    "http": "200",
+    "total_s": 0.876535,
+    "elapsed_ms": 3318.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.140",
+    "http": "200",
+    "total_s": 0.877835,
+    "elapsed_ms": 4922.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.12",
+    "http": "200",
+    "total_s": 0.890373,
+    "elapsed_ms": 3840.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.135",
+    "http": "200",
+    "total_s": 0.892,
+    "elapsed_ms": 6013.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.75",
+    "http": "200",
+    "total_s": 0.892464,
+    "elapsed_ms": 4049.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.139",
+    "http": "200",
+    "total_s": 0.904853,
+    "elapsed_ms": 5402.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.194",
+    "http": "200",
+    "total_s": 0.91717,
+    "elapsed_ms": 3284.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.10",
+    "http": "200",
+    "total_s": 0.926434,
+    "elapsed_ms": 5166.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.96",
+    "http": "200",
+    "total_s": 0.932807,
+    "elapsed_ms": 3506.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.63",
+    "http": "200",
+    "total_s": 0.939603,
+    "elapsed_ms": 3517.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.224",
+    "http": "200",
+    "total_s": 0.940487,
+    "elapsed_ms": 3707.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.138",
+    "http": "200",
+    "total_s": 0.947846,
+    "elapsed_ms": 5024.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.144",
+    "http": "200",
+    "total_s": 0.94812,
+    "elapsed_ms": 3438.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.250",
+    "http": "200",
+    "total_s": 0.95631,
+    "elapsed_ms": 3212.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.243",
+    "http": "200",
+    "total_s": 0.960245,
+    "elapsed_ms": 3230.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.82",
+    "http": "200",
+    "total_s": 0.963879,
+    "elapsed_ms": 5356.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.219",
+    "http": "200",
+    "total_s": 0.97272,
+    "elapsed_ms": 4356.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.216",
+    "http": "200",
+    "total_s": 0.975055,
+    "elapsed_ms": 3734.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.143",
+    "http": "200",
+    "total_s": 0.979911,
+    "elapsed_ms": 6605.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.244",
+    "http": "200",
+    "total_s": 0.981014,
+    "elapsed_ms": 3803.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.16",
+    "http": "200",
+    "total_s": 0.984056,
+    "elapsed_ms": 2330.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.177",
+    "http": "200",
+    "total_s": 0.988189,
+    "elapsed_ms": 3824.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.248",
+    "http": "200",
+    "total_s": 0.99089,
+    "elapsed_ms": 3420.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.103",
+    "http": "200",
+    "total_s": 0.99223,
+    "elapsed_ms": 6811.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.146",
+    "http": "200",
+    "total_s": 0.993211,
+    "elapsed_ms": 7022.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.220",
+    "http": "200",
+    "total_s": 0.99538,
+    "elapsed_ms": 3386.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.105",
+    "http": "200",
+    "total_s": 0.995551,
+    "elapsed_ms": 4284.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.153",
+    "http": "200",
+    "total_s": 0.996567,
+    "elapsed_ms": 3849.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.15",
+    "http": "200",
+    "total_s": 0.999474,
+    "elapsed_ms": 3030.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.142",
+    "http": "200",
+    "total_s": 1.000035,
+    "elapsed_ms": 6198.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.166",
+    "http": "200",
+    "total_s": 1.002033,
+    "elapsed_ms": 4601.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.9",
+    "http": "200",
+    "total_s": 1.00328,
+    "elapsed_ms": 4580.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.132",
+    "http": "200",
+    "total_s": 1.009433,
+    "elapsed_ms": 3533.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.253",
+    "http": "200",
+    "total_s": 1.009832,
+    "elapsed_ms": 3296.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.164",
+    "http": "200",
+    "total_s": 1.012488,
+    "elapsed_ms": 4816.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.102",
+    "http": "200",
+    "total_s": 1.018577,
+    "elapsed_ms": 4100.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.137",
+    "http": "200",
+    "total_s": 1.020221,
+    "elapsed_ms": 3115.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.190",
+    "http": "200",
+    "total_s": 1.021737,
+    "elapsed_ms": 4160.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.252",
+    "http": "200",
+    "total_s": 1.022151,
+    "elapsed_ms": 4619.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.91",
+    "http": "200",
+    "total_s": 1.028672,
+    "elapsed_ms": 3582.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.123",
+    "http": "200",
+    "total_s": 1.038392,
+    "elapsed_ms": 6442.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.174",
+    "http": "200",
+    "total_s": 1.04072,
+    "elapsed_ms": 2793.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.101",
+    "http": "200",
+    "total_s": 1.041007,
+    "elapsed_ms": 4342.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.29",
+    "http": "200",
+    "total_s": 1.041127,
+    "elapsed_ms": 3890.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.185",
+    "http": "200",
+    "total_s": 1.04364,
+    "elapsed_ms": 3537.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.44",
+    "http": "200",
+    "total_s": 1.048137,
+    "elapsed_ms": 4596.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.134",
+    "http": "200",
+    "total_s": 1.051216,
+    "elapsed_ms": 6504.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.150",
+    "http": "200",
+    "total_s": 1.053947,
+    "elapsed_ms": 3228.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.43",
+    "http": "200",
+    "total_s": 1.054746,
+    "elapsed_ms": 4178.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.132",
+    "http": "200",
+    "total_s": 1.056904,
+    "elapsed_ms": 2297.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.241",
+    "http": "200",
+    "total_s": 1.057129,
+    "elapsed_ms": 6730.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.50",
+    "http": "200",
+    "total_s": 1.060257,
+    "elapsed_ms": 3095.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.225",
+    "http": "200",
+    "total_s": 1.063042,
+    "elapsed_ms": 4632.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.193",
+    "http": "200",
+    "total_s": 1.064523,
+    "elapsed_ms": 4617.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.52",
+    "http": "200",
+    "total_s": 1.064871,
+    "elapsed_ms": 3129.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.15",
+    "http": "200",
+    "total_s": 1.068246,
+    "elapsed_ms": 5714.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.32",
+    "http": "200",
+    "total_s": 1.068418,
+    "elapsed_ms": 5573.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.6",
+    "http": "200",
+    "total_s": 1.069138,
+    "elapsed_ms": 2672.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.42",
+    "http": "200",
+    "total_s": 1.069893,
+    "elapsed_ms": 6177.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.119",
+    "http": "200",
+    "total_s": 1.072212,
+    "elapsed_ms": 6151.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.247",
+    "http": "200",
+    "total_s": 1.073713,
+    "elapsed_ms": 4732.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.64",
+    "http": "200",
+    "total_s": 1.074727,
+    "elapsed_ms": 3635.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.250",
+    "http": "200",
+    "total_s": 1.075135,
+    "elapsed_ms": 3657.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.45",
+    "http": "200",
+    "total_s": 1.075798,
+    "elapsed_ms": 4935.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.239",
+    "http": "200",
+    "total_s": 1.075909,
+    "elapsed_ms": 3903.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.152",
+    "http": "200",
+    "total_s": 1.079937,
+    "elapsed_ms": 2095.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.87",
+    "http": "200",
+    "total_s": 1.080859,
+    "elapsed_ms": 4848.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.16",
+    "http": "200",
+    "total_s": 1.083418,
+    "elapsed_ms": 5757.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.41",
+    "http": "200",
+    "total_s": 1.084123,
+    "elapsed_ms": 2135.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.27",
+    "http": "200",
+    "total_s": 1.086101,
+    "elapsed_ms": 5946.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.121",
+    "http": "200",
+    "total_s": 1.086321,
+    "elapsed_ms": 3446.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.17",
+    "http": "200",
+    "total_s": 1.089349,
+    "elapsed_ms": 3626.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.224",
+    "http": "200",
+    "total_s": 1.093188,
+    "elapsed_ms": 4401.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.146",
+    "http": "200",
+    "total_s": 1.094806,
+    "elapsed_ms": 5605.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.48",
+    "http": "200",
+    "total_s": 1.104556,
+    "elapsed_ms": 5405.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.189",
+    "http": "200",
+    "total_s": 1.105373,
+    "elapsed_ms": 3627.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.173",
+    "http": "200",
+    "total_s": 1.105866,
+    "elapsed_ms": 5535.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.119",
+    "http": "200",
+    "total_s": 1.107124,
+    "elapsed_ms": 6805.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.37",
+    "http": "200",
+    "total_s": 1.108453,
+    "elapsed_ms": 3310.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.8",
+    "http": "200",
+    "total_s": 1.109525,
+    "elapsed_ms": 6569.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.218",
+    "http": "200",
+    "total_s": 1.112566,
+    "elapsed_ms": 3424.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.13",
+    "http": "200",
+    "total_s": 1.115387,
+    "elapsed_ms": 3272.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.39",
+    "http": "200",
+    "total_s": 1.117842,
+    "elapsed_ms": 1906.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.252",
+    "http": "200",
+    "total_s": 1.118521,
+    "elapsed_ms": 3584.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.136",
+    "http": "200",
+    "total_s": 1.120197,
+    "elapsed_ms": 2948.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.240",
+    "http": "200",
+    "total_s": 1.120316,
+    "elapsed_ms": 4608.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.175",
+    "http": "200",
+    "total_s": 1.121603,
+    "elapsed_ms": 4742.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.201",
+    "http": "200",
+    "total_s": 1.122323,
+    "elapsed_ms": 3295.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.229",
+    "http": "200",
+    "total_s": 1.123445,
+    "elapsed_ms": 4375.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.150",
+    "http": "200",
+    "total_s": 1.124728,
+    "elapsed_ms": 5545.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.194",
+    "http": "200",
+    "total_s": 1.125825,
+    "elapsed_ms": 4980.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.213",
+    "http": "200",
+    "total_s": 1.131747,
+    "elapsed_ms": 3108.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.231",
+    "http": "200",
+    "total_s": 1.136834,
+    "elapsed_ms": 4329.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.85",
+    "http": "200",
+    "total_s": 1.141632,
+    "elapsed_ms": 3692.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.233",
+    "http": "200",
+    "total_s": 1.141667,
+    "elapsed_ms": 4304.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.57",
+    "http": "200",
+    "total_s": 1.144416,
+    "elapsed_ms": 4469.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.108",
+    "http": "200",
+    "total_s": 1.145149,
+    "elapsed_ms": 3374.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.41",
+    "http": "200",
+    "total_s": 1.153781,
+    "elapsed_ms": 4405.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.80",
+    "http": "200",
+    "total_s": 1.156239,
+    "elapsed_ms": 6079.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.40",
+    "http": "200",
+    "total_s": 1.156582,
+    "elapsed_ms": 5660.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.251",
+    "http": "200",
+    "total_s": 1.16069,
+    "elapsed_ms": 3454.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.203",
+    "http": "200",
+    "total_s": 1.166114,
+    "elapsed_ms": 3753.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.53",
+    "http": "200",
+    "total_s": 1.166151,
+    "elapsed_ms": 4240.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.246",
+    "http": "200",
+    "total_s": 1.168796,
+    "elapsed_ms": 3701.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.196",
+    "http": "200",
+    "total_s": 1.169312,
+    "elapsed_ms": 3403.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.22",
+    "http": "200",
+    "total_s": 1.170169,
+    "elapsed_ms": 3775.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.124",
+    "http": "200",
+    "total_s": 1.173257,
+    "elapsed_ms": 4582.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.222",
+    "http": "200",
+    "total_s": 1.173504,
+    "elapsed_ms": 2474.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.214",
+    "http": "200",
+    "total_s": 1.180963,
+    "elapsed_ms": 5028.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.204",
+    "http": "200",
+    "total_s": 1.180978,
+    "elapsed_ms": 3708.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.30",
+    "http": "200",
+    "total_s": 1.181347,
+    "elapsed_ms": 6333.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.223",
+    "http": "200",
+    "total_s": 1.185084,
+    "elapsed_ms": 4990.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.200",
+    "http": "200",
+    "total_s": 1.187928,
+    "elapsed_ms": 3417.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.243",
+    "http": "200",
+    "total_s": 1.189754,
+    "elapsed_ms": 4477.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.107",
+    "http": "200",
+    "total_s": 1.193969,
+    "elapsed_ms": 7989.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.234",
+    "http": "200",
+    "total_s": 1.194158,
+    "elapsed_ms": 2620.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.179",
+    "http": "200",
+    "total_s": 1.195839,
+    "elapsed_ms": 5145.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.212",
+    "http": "200",
+    "total_s": 1.196743,
+    "elapsed_ms": 3076.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.60",
+    "http": "200",
+    "total_s": 1.198275,
+    "elapsed_ms": 4586.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.171",
+    "http": "200",
+    "total_s": 1.208451,
+    "elapsed_ms": 5139.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.67",
+    "http": "200",
+    "total_s": 1.210885,
+    "elapsed_ms": 4046.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.106",
+    "http": "200",
+    "total_s": 1.212999,
+    "elapsed_ms": 2511.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.147",
+    "http": "200",
+    "total_s": 1.217859,
+    "elapsed_ms": 5518.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.156",
+    "http": "200",
+    "total_s": 1.218521,
+    "elapsed_ms": 4832.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.77",
+    "http": "200",
+    "total_s": 1.220087,
+    "elapsed_ms": 4206.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.207",
+    "http": "200",
+    "total_s": 1.230254,
+    "elapsed_ms": 5006.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.24",
+    "http": "200",
+    "total_s": 1.234271,
+    "elapsed_ms": 3374.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.160",
+    "http": "200",
+    "total_s": 1.23627,
+    "elapsed_ms": 2696.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.254",
+    "http": "200",
+    "total_s": 1.239155,
+    "elapsed_ms": 2937.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.205",
+    "http": "200",
+    "total_s": 1.243022,
+    "elapsed_ms": 3720.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.85",
+    "http": "200",
+    "total_s": 1.243859,
+    "elapsed_ms": 3911.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.43",
+    "http": "200",
+    "total_s": 1.253305,
+    "elapsed_ms": 5870.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.168",
+    "http": "200",
+    "total_s": 1.254757,
+    "elapsed_ms": 4725.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.34",
+    "http": "200",
+    "total_s": 1.256225,
+    "elapsed_ms": 1975.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.232",
+    "http": "200",
+    "total_s": 1.260786,
+    "elapsed_ms": 3965.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.238",
+    "http": "200",
+    "total_s": 1.276664,
+    "elapsed_ms": 4168.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.167",
+    "http": "200",
+    "total_s": 1.288798,
+    "elapsed_ms": 5467.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.211",
+    "http": "200",
+    "total_s": 1.289903,
+    "elapsed_ms": 3710.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.56",
+    "http": "200",
+    "total_s": 1.291712,
+    "elapsed_ms": 4232.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.197",
+    "http": "200",
+    "total_s": 1.293167,
+    "elapsed_ms": 3701.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.111",
+    "http": "200",
+    "total_s": 1.29369,
+    "elapsed_ms": 7484.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.117",
+    "http": "200",
+    "total_s": 1.294816,
+    "elapsed_ms": 6595.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.197",
+    "http": "200",
+    "total_s": 1.295909,
+    "elapsed_ms": 4108.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.61",
+    "http": "200",
+    "total_s": 1.30014,
+    "elapsed_ms": 3720.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.46",
+    "http": "200",
+    "total_s": 1.306012,
+    "elapsed_ms": 6090.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.154",
+    "http": "200",
+    "total_s": 1.306347,
+    "elapsed_ms": 5935.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.213",
+    "http": "200",
+    "total_s": 1.308387,
+    "elapsed_ms": 2944.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.189",
+    "http": "200",
+    "total_s": 1.314226,
+    "elapsed_ms": 4670.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.222",
+    "http": "200",
+    "total_s": 1.315277,
+    "elapsed_ms": 5004.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.70",
+    "http": "200",
+    "total_s": 1.318427,
+    "elapsed_ms": 4285.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.115",
+    "http": "200",
+    "total_s": 1.320488,
+    "elapsed_ms": 3944.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.182",
+    "http": "200",
+    "total_s": 1.324407,
+    "elapsed_ms": 5260.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.232",
+    "http": "200",
+    "total_s": 1.325755,
+    "elapsed_ms": 4742.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.7",
+    "http": "200",
+    "total_s": 1.325818,
+    "elapsed_ms": 2330.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.129",
+    "http": "200",
+    "total_s": 1.333303,
+    "elapsed_ms": 4646.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.216",
+    "http": "200",
+    "total_s": 1.335473,
+    "elapsed_ms": 3763.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.46",
+    "http": "200",
+    "total_s": 1.336278,
+    "elapsed_ms": 3206.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.82",
+    "http": "200",
+    "total_s": 1.33912,
+    "elapsed_ms": 4126.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.62",
+    "http": "200",
+    "total_s": 1.345256,
+    "elapsed_ms": 4371.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.237",
+    "http": "200",
+    "total_s": 1.349078,
+    "elapsed_ms": 4275.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.208",
+    "http": "200",
+    "total_s": 1.350667,
+    "elapsed_ms": 3882.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.2",
+    "http": "200",
+    "total_s": 1.352351,
+    "elapsed_ms": 3171.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.163",
+    "http": "200",
+    "total_s": 1.352937,
+    "elapsed_ms": 5879.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.44",
+    "http": "200",
+    "total_s": 1.35401,
+    "elapsed_ms": 3833.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.191",
+    "http": "200",
+    "total_s": 1.358102,
+    "elapsed_ms": 5246.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.63",
+    "http": "200",
+    "total_s": 1.360419,
+    "elapsed_ms": 4802.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.47",
+    "http": "200",
+    "total_s": 1.365353,
+    "elapsed_ms": 5421.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.162",
+    "http": "200",
+    "total_s": 1.365614,
+    "elapsed_ms": 4970.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.202",
+    "http": "200",
+    "total_s": 1.37004,
+    "elapsed_ms": 3827.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.49",
+    "http": "200",
+    "total_s": 1.382676,
+    "elapsed_ms": 4270.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.169",
+    "http": "200",
+    "total_s": 1.388137,
+    "elapsed_ms": 5711.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.128",
+    "http": "200",
+    "total_s": 1.390017,
+    "elapsed_ms": 9634.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.181",
+    "http": "200",
+    "total_s": 1.399887,
+    "elapsed_ms": 4195.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.228",
+    "http": "200",
+    "total_s": 1.401774,
+    "elapsed_ms": 4575.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.186",
+    "http": "200",
+    "total_s": 1.402413,
+    "elapsed_ms": 4946.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.158",
+    "http": "200",
+    "total_s": 1.403615,
+    "elapsed_ms": 5736.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.136",
+    "http": "200",
+    "total_s": 1.406667,
+    "elapsed_ms": 6447.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.226",
+    "http": "200",
+    "total_s": 1.407233,
+    "elapsed_ms": 5154.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.148",
+    "http": "200",
+    "total_s": 1.409313,
+    "elapsed_ms": 6183.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.10",
+    "http": "200",
+    "total_s": 1.410416,
+    "elapsed_ms": 4832.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.73",
+    "http": "200",
+    "total_s": 1.412037,
+    "elapsed_ms": 4708.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.78",
+    "http": "200",
+    "total_s": 1.412747,
+    "elapsed_ms": 3919.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.229",
+    "http": "200",
+    "total_s": 1.415007,
+    "elapsed_ms": 3710.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.186",
+    "http": "200",
+    "total_s": 1.418721,
+    "elapsed_ms": 4412.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.170",
+    "http": "200",
+    "total_s": 1.419823,
+    "elapsed_ms": 2761.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.238",
+    "http": "200",
+    "total_s": 1.424711,
+    "elapsed_ms": 4228.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.208",
+    "http": "200",
+    "total_s": 1.426893,
+    "elapsed_ms": 4049.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.118",
+    "http": "200",
+    "total_s": 1.429025,
+    "elapsed_ms": 3813.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.128",
+    "http": "200",
+    "total_s": 1.430177,
+    "elapsed_ms": 6504.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.94",
+    "http": "200",
+    "total_s": 1.441693,
+    "elapsed_ms": 3747.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.162",
+    "http": "200",
+    "total_s": 1.442061,
+    "elapsed_ms": 5980.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.124",
+    "http": "200",
+    "total_s": 1.44702,
+    "elapsed_ms": 4755.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.151",
+    "http": "200",
+    "total_s": 1.450888,
+    "elapsed_ms": 2711.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.199",
+    "http": "200",
+    "total_s": 1.455705,
+    "elapsed_ms": 3868.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.127",
+    "http": "200",
+    "total_s": 1.476021,
+    "elapsed_ms": 3255.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.66",
+    "http": "200",
+    "total_s": 1.480976,
+    "elapsed_ms": 4390.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.126",
+    "http": "200",
+    "total_s": 1.482655,
+    "elapsed_ms": 6821.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.149",
+    "http": "200",
+    "total_s": 1.484204,
+    "elapsed_ms": 4667.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.62",
+    "http": "200",
+    "total_s": 1.49124,
+    "elapsed_ms": 3761.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.209",
+    "http": "200",
+    "total_s": 1.495284,
+    "elapsed_ms": 4230.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.35",
+    "http": "200",
+    "total_s": 1.499978,
+    "elapsed_ms": 6526.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.182",
+    "http": "200",
+    "total_s": 1.501298,
+    "elapsed_ms": 4940.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.75",
+    "http": "200",
+    "total_s": 1.514465,
+    "elapsed_ms": 4251.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.195",
+    "http": "200",
+    "total_s": 1.517426,
+    "elapsed_ms": 4346.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.253",
+    "http": "200",
+    "total_s": 1.5199,
+    "elapsed_ms": 5490.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.72",
+    "http": "200",
+    "total_s": 1.520912,
+    "elapsed_ms": 4077.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.116",
+    "http": "200",
+    "total_s": 1.525366,
+    "elapsed_ms": 4075.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.240",
+    "http": "200",
+    "total_s": 1.533052,
+    "elapsed_ms": 3836.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.227",
+    "http": "200",
+    "total_s": 1.54445,
+    "elapsed_ms": 4800.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.76",
+    "http": "200",
+    "total_s": 1.553992,
+    "elapsed_ms": 4431.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.211",
+    "http": "200",
+    "total_s": 1.563649,
+    "elapsed_ms": 4338.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.1",
+    "http": "200",
+    "total_s": 1.571149,
+    "elapsed_ms": 5475.9,
+    "note": ""
+  },
+  {
+    "ip": "43.175.185.239",
+    "http": "200",
+    "total_s": 1.574511,
+    "elapsed_ms": 4355.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.183",
+    "http": "200",
+    "total_s": 1.579795,
+    "elapsed_ms": 5268.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.64",
+    "http": "200",
+    "total_s": 1.588534,
+    "elapsed_ms": 4502.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.83",
+    "http": "200",
+    "total_s": 1.589051,
+    "elapsed_ms": 4268.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.18",
+    "http": "200",
+    "total_s": 1.597938,
+    "elapsed_ms": 4832.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.227",
+    "http": "200",
+    "total_s": 1.598464,
+    "elapsed_ms": 3893.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.242",
+    "http": "200",
+    "total_s": 1.598901,
+    "elapsed_ms": 3806.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.11",
+    "http": "200",
+    "total_s": 1.600631,
+    "elapsed_ms": 3459.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.138",
+    "http": "200",
+    "total_s": 1.600826,
+    "elapsed_ms": 5447.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.161",
+    "http": "200",
+    "total_s": 1.603442,
+    "elapsed_ms": 5796.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.204",
+    "http": "200",
+    "total_s": 1.604135,
+    "elapsed_ms": 4042.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.145",
+    "http": "200",
+    "total_s": 1.605239,
+    "elapsed_ms": 2337.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.120",
+    "http": "200",
+    "total_s": 1.607421,
+    "elapsed_ms": 8834.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.177",
+    "http": "200",
+    "total_s": 1.607982,
+    "elapsed_ms": 4322.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.91",
+    "http": "200",
+    "total_s": 1.610317,
+    "elapsed_ms": 4270.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.207",
+    "http": "200",
+    "total_s": 1.617829,
+    "elapsed_ms": 6105.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.27",
+    "http": "200",
+    "total_s": 1.624662,
+    "elapsed_ms": 3263.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.159",
+    "http": "200",
+    "total_s": 1.624933,
+    "elapsed_ms": 4997.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.215",
+    "http": "200",
+    "total_s": 1.626755,
+    "elapsed_ms": 4839.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.86",
+    "http": "200",
+    "total_s": 1.627552,
+    "elapsed_ms": 4212.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.228",
+    "http": "200",
+    "total_s": 1.628591,
+    "elapsed_ms": 7365.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.35",
+    "http": "200",
+    "total_s": 1.630338,
+    "elapsed_ms": 5220.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.26",
+    "http": "200",
+    "total_s": 1.631207,
+    "elapsed_ms": 4912.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.137",
+    "http": "200",
+    "total_s": 1.633354,
+    "elapsed_ms": 4535.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.53",
+    "http": "200",
+    "total_s": 1.635905,
+    "elapsed_ms": 4362.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.7",
+    "http": "200",
+    "total_s": 1.641151,
+    "elapsed_ms": 7150.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.95",
+    "http": "200",
+    "total_s": 1.641703,
+    "elapsed_ms": 5290.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.99",
+    "http": "200",
+    "total_s": 1.644203,
+    "elapsed_ms": 3396.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.192",
+    "http": "200",
+    "total_s": 1.64449,
+    "elapsed_ms": 4320.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.139",
+    "http": "200",
+    "total_s": 1.647033,
+    "elapsed_ms": 5706.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.59",
+    "http": "200",
+    "total_s": 1.649484,
+    "elapsed_ms": 4974.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.89",
+    "http": "200",
+    "total_s": 1.654242,
+    "elapsed_ms": 4738.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.218",
+    "http": "200",
+    "total_s": 1.65842,
+    "elapsed_ms": 5442.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.21",
+    "http": "200",
+    "total_s": 1.667731,
+    "elapsed_ms": 6340.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.23",
+    "http": "200",
+    "total_s": 1.669505,
+    "elapsed_ms": 4498.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.104",
+    "http": "200",
+    "total_s": 1.67124,
+    "elapsed_ms": 4708.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.105",
+    "http": "200",
+    "total_s": 1.677506,
+    "elapsed_ms": 5583.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.251",
+    "http": "200",
+    "total_s": 1.6799,
+    "elapsed_ms": 5577.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.226",
+    "http": "200",
+    "total_s": 1.682578,
+    "elapsed_ms": 3804.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.210",
+    "http": "200",
+    "total_s": 1.688651,
+    "elapsed_ms": 3794.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.109",
+    "http": "200",
+    "total_s": 1.688726,
+    "elapsed_ms": 4060.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.94",
+    "http": "200",
+    "total_s": 1.691317,
+    "elapsed_ms": 3378.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.29",
+    "http": "200",
+    "total_s": 1.692899,
+    "elapsed_ms": 4764.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.157",
+    "http": "200",
+    "total_s": 1.694797,
+    "elapsed_ms": 5181.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.31",
+    "http": "200",
+    "total_s": 1.69524,
+    "elapsed_ms": 3378.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.206",
+    "http": "200",
+    "total_s": 1.698545,
+    "elapsed_ms": 5425.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.67",
+    "http": "200",
+    "total_s": 1.701457,
+    "elapsed_ms": 4831.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.30",
+    "http": "200",
+    "total_s": 1.70178,
+    "elapsed_ms": 4427.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.170",
+    "http": "200",
+    "total_s": 1.702493,
+    "elapsed_ms": 5153.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.112",
+    "http": "200",
+    "total_s": 1.705965,
+    "elapsed_ms": 6474.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.246",
+    "http": "200",
+    "total_s": 1.716395,
+    "elapsed_ms": 3212.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.155",
+    "http": "200",
+    "total_s": 1.722613,
+    "elapsed_ms": 2662.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.98",
+    "http": "200",
+    "total_s": 1.723152,
+    "elapsed_ms": 4762.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.254",
+    "http": "200",
+    "total_s": 1.726579,
+    "elapsed_ms": 7063.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.31",
+    "http": "200",
+    "total_s": 1.726788,
+    "elapsed_ms": 6477.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.116",
+    "http": "200",
+    "total_s": 1.734177,
+    "elapsed_ms": 3738.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.5",
+    "http": "200",
+    "total_s": 1.737657,
+    "elapsed_ms": 5366.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.25",
+    "http": "200",
+    "total_s": 1.737736,
+    "elapsed_ms": 5245.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.101",
+    "http": "200",
+    "total_s": 1.740147,
+    "elapsed_ms": 3671.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.145",
+    "http": "200",
+    "total_s": 1.744918,
+    "elapsed_ms": 2644.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.98",
+    "http": "200",
+    "total_s": 1.745876,
+    "elapsed_ms": 3607.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.187",
+    "http": "200",
+    "total_s": 1.746162,
+    "elapsed_ms": 5424.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.180",
+    "http": "200",
+    "total_s": 1.747638,
+    "elapsed_ms": 4744.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.89",
+    "http": "200",
+    "total_s": 1.749299,
+    "elapsed_ms": 4369.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.120",
+    "http": "200",
+    "total_s": 1.756871,
+    "elapsed_ms": 2759.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.179",
+    "http": "200",
+    "total_s": 1.764893,
+    "elapsed_ms": 3826.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.183",
+    "http": "200",
+    "total_s": 1.766793,
+    "elapsed_ms": 4631.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.97",
+    "http": "200",
+    "total_s": 1.76993,
+    "elapsed_ms": 4090.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.214",
+    "http": "200",
+    "total_s": 1.777076,
+    "elapsed_ms": 5081.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.79",
+    "http": "200",
+    "total_s": 1.777735,
+    "elapsed_ms": 4854.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.113",
+    "http": "200",
+    "total_s": 1.782179,
+    "elapsed_ms": 4219.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.249",
+    "http": "200",
+    "total_s": 1.785876,
+    "elapsed_ms": 3651.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.167",
+    "http": "200",
+    "total_s": 1.786949,
+    "elapsed_ms": 4265.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.28",
+    "http": "200",
+    "total_s": 1.790476,
+    "elapsed_ms": 4779.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.188",
+    "http": "200",
+    "total_s": 1.791891,
+    "elapsed_ms": 5146.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.24",
+    "http": "200",
+    "total_s": 1.792156,
+    "elapsed_ms": 4613.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.110",
+    "http": "200",
+    "total_s": 1.792264,
+    "elapsed_ms": 6068.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.84",
+    "http": "200",
+    "total_s": 1.794873,
+    "elapsed_ms": 4606.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.18",
+    "http": "200",
+    "total_s": 1.796073,
+    "elapsed_ms": 6214.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.130",
+    "http": "200",
+    "total_s": 1.806501,
+    "elapsed_ms": 5802.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.236",
+    "http": "200",
+    "total_s": 1.811126,
+    "elapsed_ms": 4222.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.52",
+    "http": "200",
+    "total_s": 1.816519,
+    "elapsed_ms": 3961.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.241",
+    "http": "200",
+    "total_s": 1.817842,
+    "elapsed_ms": 4656.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.217",
+    "http": "200",
+    "total_s": 1.82227,
+    "elapsed_ms": 5045.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.245",
+    "http": "200",
+    "total_s": 1.822451,
+    "elapsed_ms": 7187.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.61",
+    "http": "200",
+    "total_s": 1.823181,
+    "elapsed_ms": 5074.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.42",
+    "http": "200",
+    "total_s": 1.82699,
+    "elapsed_ms": 4359.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.149",
+    "http": "200",
+    "total_s": 1.827824,
+    "elapsed_ms": 5491.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.65",
+    "http": "200",
+    "total_s": 1.828167,
+    "elapsed_ms": 4245.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.21",
+    "http": "200",
+    "total_s": 1.835765,
+    "elapsed_ms": 3686.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.201",
+    "http": "200",
+    "total_s": 1.839566,
+    "elapsed_ms": 4328.4,
+    "note": ""
+  },
+  {
+    "ip": "43.175.185.72",
+    "http": "200",
+    "total_s": 1.843082,
+    "elapsed_ms": 3926.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.133",
+    "http": "200",
+    "total_s": 1.84409,
+    "elapsed_ms": 5963.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.36",
+    "http": "200",
+    "total_s": 1.847474,
+    "elapsed_ms": 4059.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.148",
+    "http": "200",
+    "total_s": 1.849728,
+    "elapsed_ms": 6748.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.181",
+    "http": "200",
+    "total_s": 1.856281,
+    "elapsed_ms": 4992.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.87",
+    "http": "200",
+    "total_s": 1.865075,
+    "elapsed_ms": 3762.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.239",
+    "http": "200",
+    "total_s": 1.865196,
+    "elapsed_ms": 4239.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.33",
+    "http": "200",
+    "total_s": 1.8739,
+    "elapsed_ms": 6834.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.140",
+    "http": "200",
+    "total_s": 1.877287,
+    "elapsed_ms": 6198.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.45",
+    "http": "200",
+    "total_s": 1.885724,
+    "elapsed_ms": 4593.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.106",
+    "http": "200",
+    "total_s": 1.888937,
+    "elapsed_ms": 4768.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.69",
+    "http": "200",
+    "total_s": 1.894885,
+    "elapsed_ms": 4626.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.115",
+    "http": "200",
+    "total_s": 1.903285,
+    "elapsed_ms": 4792.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.231",
+    "http": "200",
+    "total_s": 1.906383,
+    "elapsed_ms": 7902.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.159",
+    "http": "200",
+    "total_s": 1.911976,
+    "elapsed_ms": 5834.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.135",
+    "http": "200",
+    "total_s": 1.912197,
+    "elapsed_ms": 2647.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.244",
+    "http": "200",
+    "total_s": 1.914309,
+    "elapsed_ms": 4251.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.51",
+    "http": "200",
+    "total_s": 1.915284,
+    "elapsed_ms": 4137.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.37",
+    "http": "200",
+    "total_s": 1.917763,
+    "elapsed_ms": 6244.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.210",
+    "http": "200",
+    "total_s": 1.923626,
+    "elapsed_ms": 5151.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.54",
+    "http": "200",
+    "total_s": 1.924362,
+    "elapsed_ms": 4842.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.40",
+    "http": "200",
+    "total_s": 1.929775,
+    "elapsed_ms": 4169.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.160",
+    "http": "200",
+    "total_s": 1.931697,
+    "elapsed_ms": 6106.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.158",
+    "http": "200",
+    "total_s": 1.934182,
+    "elapsed_ms": 6273.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.157",
+    "http": "200",
+    "total_s": 1.936886,
+    "elapsed_ms": 6361.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.141",
+    "http": "200",
+    "total_s": 1.936954,
+    "elapsed_ms": 2804.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.23",
+    "http": "200",
+    "total_s": 1.937128,
+    "elapsed_ms": 4931.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.58",
+    "http": "200",
+    "total_s": 1.93751,
+    "elapsed_ms": 5341.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.68",
+    "http": "200",
+    "total_s": 1.944868,
+    "elapsed_ms": 4822.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.71",
+    "http": "200",
+    "total_s": 1.946285,
+    "elapsed_ms": 4935.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.38",
+    "http": "200",
+    "total_s": 1.950314,
+    "elapsed_ms": 4164.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.173",
+    "http": "200",
+    "total_s": 1.95061,
+    "elapsed_ms": 4021.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.20",
+    "http": "200",
+    "total_s": 1.952642,
+    "elapsed_ms": 4624.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.100",
+    "http": "200",
+    "total_s": 1.956969,
+    "elapsed_ms": 8393.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.109",
+    "http": "200",
+    "total_s": 1.956979,
+    "elapsed_ms": 8228.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.19",
+    "http": "200",
+    "total_s": 1.960809,
+    "elapsed_ms": 4971.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.202",
+    "http": "200",
+    "total_s": 1.965947,
+    "elapsed_ms": 4356.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.185",
+    "http": "200",
+    "total_s": 1.967477,
+    "elapsed_ms": 5004.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.175",
+    "http": "200",
+    "total_s": 1.969888,
+    "elapsed_ms": 3944.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.103",
+    "http": "200",
+    "total_s": 1.969947,
+    "elapsed_ms": 4694.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.110",
+    "http": "200",
+    "total_s": 1.970075,
+    "elapsed_ms": 4136.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.178",
+    "http": "200",
+    "total_s": 1.970595,
+    "elapsed_ms": 4795.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.3",
+    "http": "200",
+    "total_s": 1.975893,
+    "elapsed_ms": 4209.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.153",
+    "http": "200",
+    "total_s": 1.978944,
+    "elapsed_ms": 5265.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.191",
+    "http": "200",
+    "total_s": 1.989996,
+    "elapsed_ms": 6095.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.203",
+    "http": "200",
+    "total_s": 2.002264,
+    "elapsed_ms": 4733.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.122",
+    "http": "200",
+    "total_s": 2.004723,
+    "elapsed_ms": 6437.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.93",
+    "http": "200",
+    "total_s": 2.007383,
+    "elapsed_ms": 4690.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.49",
+    "http": "200",
+    "total_s": 2.01356,
+    "elapsed_ms": 4160.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.108",
+    "http": "200",
+    "total_s": 2.01821,
+    "elapsed_ms": 8024.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.76",
+    "http": "200",
+    "total_s": 2.020211,
+    "elapsed_ms": 4617.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.193",
+    "http": "200",
+    "total_s": 2.020936,
+    "elapsed_ms": 4921.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.188",
+    "http": "200",
+    "total_s": 2.021097,
+    "elapsed_ms": 4291.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.249",
+    "http": "200",
+    "total_s": 2.022571,
+    "elapsed_ms": 7931.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.17",
+    "http": "200",
+    "total_s": 2.024717,
+    "elapsed_ms": 5431.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.112",
+    "http": "200",
+    "total_s": 2.028329,
+    "elapsed_ms": 3967.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.198",
+    "http": "200",
+    "total_s": 2.028939,
+    "elapsed_ms": 5861.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.152",
+    "http": "200",
+    "total_s": 2.029861,
+    "elapsed_ms": 5790.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.234",
+    "http": "200",
+    "total_s": 2.035663,
+    "elapsed_ms": 4410.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.171",
+    "http": "200",
+    "total_s": 2.03704,
+    "elapsed_ms": 6064.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.38",
+    "http": "200",
+    "total_s": 2.038778,
+    "elapsed_ms": 6813.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.127",
+    "http": "200",
+    "total_s": 2.046269,
+    "elapsed_ms": 4904.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.163",
+    "http": "200",
+    "total_s": 2.050335,
+    "elapsed_ms": 6157.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.48",
+    "http": "200",
+    "total_s": 2.055251,
+    "elapsed_ms": 5387.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.79",
+    "http": "200",
+    "total_s": 2.057692,
+    "elapsed_ms": 4789.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.172",
+    "http": "200",
+    "total_s": 2.058856,
+    "elapsed_ms": 4699.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.68",
+    "http": "200",
+    "total_s": 2.065646,
+    "elapsed_ms": 4839.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.74",
+    "http": "200",
+    "total_s": 2.075186,
+    "elapsed_ms": 4987.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.200",
+    "http": "200",
+    "total_s": 2.080141,
+    "elapsed_ms": 4625.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.90",
+    "http": "200",
+    "total_s": 2.082612,
+    "elapsed_ms": 5505.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.34",
+    "http": "200",
+    "total_s": 2.089582,
+    "elapsed_ms": 5056.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.88",
+    "http": "200",
+    "total_s": 2.091538,
+    "elapsed_ms": 5308.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.134",
+    "http": "200",
+    "total_s": 2.094925,
+    "elapsed_ms": 4214.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.131",
+    "http": "200",
+    "total_s": 2.095861,
+    "elapsed_ms": 6988.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.83",
+    "http": "200",
+    "total_s": 2.102292,
+    "elapsed_ms": 5531.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.172",
+    "http": "200",
+    "total_s": 2.103742,
+    "elapsed_ms": 5486.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.70",
+    "http": "200",
+    "total_s": 2.108848,
+    "elapsed_ms": 5180.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.90",
+    "http": "200",
+    "total_s": 2.110934,
+    "elapsed_ms": 4977.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.57",
+    "http": "200",
+    "total_s": 2.111719,
+    "elapsed_ms": 4911.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.55",
+    "http": "200",
+    "total_s": 2.112694,
+    "elapsed_ms": 5012.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.195",
+    "http": "200",
+    "total_s": 2.129296,
+    "elapsed_ms": 4674.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.156",
+    "http": "200",
+    "total_s": 2.132826,
+    "elapsed_ms": 6569.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.47",
+    "http": "200",
+    "total_s": 2.140163,
+    "elapsed_ms": 4812.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.100",
+    "http": "200",
+    "total_s": 2.144644,
+    "elapsed_ms": 5435.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.81",
+    "http": "200",
+    "total_s": 2.14636,
+    "elapsed_ms": 5392.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.206",
+    "http": "200",
+    "total_s": 2.146387,
+    "elapsed_ms": 4484.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.58",
+    "http": "200",
+    "total_s": 2.148949,
+    "elapsed_ms": 4961.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.141",
+    "http": "200",
+    "total_s": 2.149583,
+    "elapsed_ms": 4829.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.99",
+    "http": "200",
+    "total_s": 2.152461,
+    "elapsed_ms": 4505.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.221",
+    "http": "200",
+    "total_s": 2.154399,
+    "elapsed_ms": 5809.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.9",
+    "http": "200",
+    "total_s": 2.164546,
+    "elapsed_ms": 6544.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.12",
+    "http": "200",
+    "total_s": 2.165331,
+    "elapsed_ms": 7864.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.161",
+    "http": "200",
+    "total_s": 2.166278,
+    "elapsed_ms": 2948.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.14",
+    "http": "200",
+    "total_s": 2.168413,
+    "elapsed_ms": 2900.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.242",
+    "http": "200",
+    "total_s": 2.176626,
+    "elapsed_ms": 4676.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.78",
+    "http": "200",
+    "total_s": 2.181956,
+    "elapsed_ms": 4888.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.95",
+    "http": "200",
+    "total_s": 2.182578,
+    "elapsed_ms": 3626.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.92",
+    "http": "200",
+    "total_s": 2.183061,
+    "elapsed_ms": 4717.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.215",
+    "http": "200",
+    "total_s": 2.198131,
+    "elapsed_ms": 3820.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.125",
+    "http": "200",
+    "total_s": 2.199556,
+    "elapsed_ms": 7974.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.184",
+    "http": "200",
+    "total_s": 2.200303,
+    "elapsed_ms": 5681.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.212",
+    "http": "200",
+    "total_s": 2.203608,
+    "elapsed_ms": 3850.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.165",
+    "http": "200",
+    "total_s": 2.207582,
+    "elapsed_ms": 5432.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.96",
+    "http": "200",
+    "total_s": 2.21175,
+    "elapsed_ms": 5079.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.122",
+    "http": "200",
+    "total_s": 2.212263,
+    "elapsed_ms": 7200.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.81",
+    "http": "200",
+    "total_s": 2.216558,
+    "elapsed_ms": 5134.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.178",
+    "http": "200",
+    "total_s": 2.224233,
+    "elapsed_ms": 7657.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.235",
+    "http": "200",
+    "total_s": 2.226559,
+    "elapsed_ms": 4458.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.102",
+    "http": "200",
+    "total_s": 2.232423,
+    "elapsed_ms": 5448.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.92",
+    "http": "200",
+    "total_s": 2.244579,
+    "elapsed_ms": 4534.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.176",
+    "http": "200",
+    "total_s": 2.252101,
+    "elapsed_ms": 4198.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.93",
+    "http": "200",
+    "total_s": 2.252425,
+    "elapsed_ms": 4635.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.220",
+    "http": "200",
+    "total_s": 2.263809,
+    "elapsed_ms": 3760.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.26",
+    "http": "200",
+    "total_s": 2.264807,
+    "elapsed_ms": 6667.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.118",
+    "http": "200",
+    "total_s": 2.266413,
+    "elapsed_ms": 7673.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.54",
+    "http": "200",
+    "total_s": 2.27846,
+    "elapsed_ms": 6469.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.184",
+    "http": "200",
+    "total_s": 2.27853,
+    "elapsed_ms": 5201.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.50",
+    "http": "200",
+    "total_s": 2.279687,
+    "elapsed_ms": 4924.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.33",
+    "http": "200",
+    "total_s": 2.280854,
+    "elapsed_ms": 5068.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.165",
+    "http": "200",
+    "total_s": 2.289343,
+    "elapsed_ms": 7500.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.74",
+    "http": "200",
+    "total_s": 2.298754,
+    "elapsed_ms": 4951.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.233",
+    "http": "200",
+    "total_s": 2.299963,
+    "elapsed_ms": 8698.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.117",
+    "http": "200",
+    "total_s": 2.309485,
+    "elapsed_ms": 5730.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.25",
+    "http": "200",
+    "total_s": 2.312386,
+    "elapsed_ms": 4742.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.121",
+    "http": "200",
+    "total_s": 2.328938,
+    "elapsed_ms": 4201.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.168",
+    "http": "200",
+    "total_s": 2.336243,
+    "elapsed_ms": 6817.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.154",
+    "http": "200",
+    "total_s": 2.336657,
+    "elapsed_ms": 5756.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.36",
+    "http": "200",
+    "total_s": 2.337302,
+    "elapsed_ms": 5326.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.88",
+    "http": "200",
+    "total_s": 2.344656,
+    "elapsed_ms": 4765.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.155",
+    "http": "200",
+    "total_s": 2.348956,
+    "elapsed_ms": 4966.1,
+    "note": ""
+  },
+  {
+    "ip": "43.175.185.73",
+    "http": "200",
+    "total_s": 2.349053,
+    "elapsed_ms": 3600.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.77",
+    "http": "200",
+    "total_s": 2.351033,
+    "elapsed_ms": 5331.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.39",
+    "http": "200",
+    "total_s": 2.363729,
+    "elapsed_ms": 5512.2,
+    "note": ""
+  },
+  {
+    "ip": "43.175.185.71",
+    "http": "200",
+    "total_s": 2.37191,
+    "elapsed_ms": 4034.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.114",
+    "http": "200",
+    "total_s": 2.379905,
+    "elapsed_ms": 4423.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.147",
+    "http": "200",
+    "total_s": 2.381777,
+    "elapsed_ms": 5418.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.20",
+    "http": "200",
+    "total_s": 2.41757,
+    "elapsed_ms": 7122.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.19",
+    "http": "200",
+    "total_s": 2.420789,
+    "elapsed_ms": 4402.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.230",
+    "http": "200",
+    "total_s": 2.421391,
+    "elapsed_ms": 8293.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.230",
+    "http": "200",
+    "total_s": 2.422148,
+    "elapsed_ms": 5615.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.1",
+    "http": "200",
+    "total_s": 2.431145,
+    "elapsed_ms": 3411.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.3",
+    "http": "200",
+    "total_s": 2.438417,
+    "elapsed_ms": 7601.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.86",
+    "http": "200",
+    "total_s": 2.447324,
+    "elapsed_ms": 5034.3,
+    "note": ""
+  },
+  {
+    "ip": "43.175.131.30",
+    "http": "200",
+    "total_s": 2.452819,
+    "elapsed_ms": 5003.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.4",
+    "http": "200",
+    "total_s": 2.46111,
+    "elapsed_ms": 4904.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.174",
+    "http": "200",
+    "total_s": 2.463284,
+    "elapsed_ms": 4434.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.235",
+    "http": "200",
+    "total_s": 2.463751,
+    "elapsed_ms": 5283.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.59",
+    "http": "200",
+    "total_s": 2.464366,
+    "elapsed_ms": 5250.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.143",
+    "http": "200",
+    "total_s": 2.471468,
+    "elapsed_ms": 7217.1,
+    "note": ""
+  },
+  {
+    "ip": "43.175.185.88",
+    "http": "200",
+    "total_s": 2.472708,
+    "elapsed_ms": 3871.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.217",
+    "http": "200",
+    "total_s": 2.497191,
+    "elapsed_ms": 5024.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.60",
+    "http": "200",
+    "total_s": 2.501655,
+    "elapsed_ms": 5063.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.130",
+    "http": "200",
+    "total_s": 2.544042,
+    "elapsed_ms": 4966.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.55",
+    "http": "200",
+    "total_s": 2.554525,
+    "elapsed_ms": 6036.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.245",
+    "http": "200",
+    "total_s": 2.558855,
+    "elapsed_ms": 5177.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.187",
+    "http": "200",
+    "total_s": 2.562172,
+    "elapsed_ms": 5816.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.66",
+    "http": "200",
+    "total_s": 2.583277,
+    "elapsed_ms": 5479.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.13",
+    "http": "200",
+    "total_s": 2.591963,
+    "elapsed_ms": 4996.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.209",
+    "http": "200",
+    "total_s": 2.594555,
+    "elapsed_ms": 4974.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.219",
+    "http": "200",
+    "total_s": 2.623027,
+    "elapsed_ms": 5567.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.144",
+    "http": "200",
+    "total_s": 2.631251,
+    "elapsed_ms": 6067.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.80",
+    "http": "200",
+    "total_s": 2.635424,
+    "elapsed_ms": 4992.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.180",
+    "http": "200",
+    "total_s": 2.637205,
+    "elapsed_ms": 6418.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.69",
+    "http": "200",
+    "total_s": 2.652696,
+    "elapsed_ms": 5465.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.151",
+    "http": "200",
+    "total_s": 2.663823,
+    "elapsed_ms": 5728.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.126",
+    "http": "200",
+    "total_s": 2.695389,
+    "elapsed_ms": 6215.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.247",
+    "http": "200",
+    "total_s": 2.701284,
+    "elapsed_ms": 5390.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.169",
+    "http": "200",
+    "total_s": 2.703084,
+    "elapsed_ms": 5346.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.73",
+    "http": "200",
+    "total_s": 2.703873,
+    "elapsed_ms": 5715.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.192",
+    "http": "200",
+    "total_s": 2.711344,
+    "elapsed_ms": 5491.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.225",
+    "http": "200",
+    "total_s": 2.72931,
+    "elapsed_ms": 4751.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.51",
+    "http": "200",
+    "total_s": 2.730687,
+    "elapsed_ms": 6089.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.199",
+    "http": "200",
+    "total_s": 2.769879,
+    "elapsed_ms": 5926.5,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.113",
+    "http": "200",
+    "total_s": 2.781376,
+    "elapsed_ms": 7144.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.248",
+    "http": "200",
+    "total_s": 2.785384,
+    "elapsed_ms": 4530.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.164",
+    "http": "200",
+    "total_s": 2.793055,
+    "elapsed_ms": 5393.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.65",
+    "http": "200",
+    "total_s": 2.798515,
+    "elapsed_ms": 6079.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.205",
+    "http": "200",
+    "total_s": 2.810596,
+    "elapsed_ms": 5922.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.221",
+    "http": "200",
+    "total_s": 2.835419,
+    "elapsed_ms": 5533.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.84",
+    "http": "200",
+    "total_s": 2.83738,
+    "elapsed_ms": 5977.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.97",
+    "http": "200",
+    "total_s": 2.847885,
+    "elapsed_ms": 5685.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.6",
+    "http": "200",
+    "total_s": 2.858784,
+    "elapsed_ms": 4153.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.56",
+    "http": "200",
+    "total_s": 2.883381,
+    "elapsed_ms": 6759.0,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.142",
+    "http": "200",
+    "total_s": 2.909836,
+    "elapsed_ms": 6839.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.72",
+    "http": "200",
+    "total_s": 3.014455,
+    "elapsed_ms": 5917.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.196",
+    "http": "200",
+    "total_s": 3.02688,
+    "elapsed_ms": 5603.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.14",
+    "http": "200",
+    "total_s": 3.041732,
+    "elapsed_ms": 4414.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.8",
+    "http": "200",
+    "total_s": 3.064449,
+    "elapsed_ms": 5640.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.107",
+    "http": "200",
+    "total_s": 3.077893,
+    "elapsed_ms": 6042.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.32",
+    "http": "200",
+    "total_s": 3.082886,
+    "elapsed_ms": 5074.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.133",
+    "http": "200",
+    "total_s": 3.105843,
+    "elapsed_ms": 7242.4,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.190",
+    "http": "200",
+    "total_s": 3.123811,
+    "elapsed_ms": 6703.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.166",
+    "http": "200",
+    "total_s": 3.124653,
+    "elapsed_ms": 7034.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.4",
+    "http": "200",
+    "total_s": 3.124669,
+    "elapsed_ms": 7083.7,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.125",
+    "http": "200",
+    "total_s": 3.141551,
+    "elapsed_ms": 5086.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.223",
+    "http": "200",
+    "total_s": 3.199224,
+    "elapsed_ms": 4433.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.123",
+    "http": "200",
+    "total_s": 3.24681,
+    "elapsed_ms": 7149.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.11",
+    "http": "200",
+    "total_s": 3.274011,
+    "elapsed_ms": 7541.2,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.176",
+    "http": "200",
+    "total_s": 3.360875,
+    "elapsed_ms": 6640.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.247.236",
+    "http": "200",
+    "total_s": 3.376406,
+    "elapsed_ms": 6405.9,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.22",
+    "http": "200",
+    "total_s": 3.405451,
+    "elapsed_ms": 6666.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.28",
+    "http": "200",
+    "total_s": 3.575171,
+    "elapsed_ms": 4669.8,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.2",
+    "http": "200",
+    "total_s": 3.783785,
+    "elapsed_ms": 5841.1,
+    "note": ""
+  },
+  {
+    "ip": "43.174.152.63",
+    "http": "200",
+    "total_s": 3.944352,
+    "elapsed_ms": 7321.3,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.131",
+    "http": "200",
+    "total_s": 4.936041,
+    "elapsed_ms": 7451.6,
+    "note": ""
+  },
+  {
+    "ip": "43.174.246.114",
+    "http": "200",
+    "total_s": 5.011309,
+    "elapsed_ms": 8600.5,
+    "note": "curl: (28) Operation timed out after 5010 milliseconds with 985 bytes received"
+  }
+]
\ No newline at end of file
diff --git a/dev/eo-probe-ips.py b/dev/eo-probe-ips.py
new file mode 100644
index 0000000..ca600ee
--- /dev/null
+++ b/dev/eo-probe-ips.py
@@ -0,0 +1,114 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+EO 优选 IP 免费探测脚本 (方案 B 免费替代 wetest.vip)
+原理: EdgeOne 边缘节点(腾讯云香港 43.174.x/43.175.x 段)对任意 EO 接入域名做 SNI 路由。
+      若某 IP:443 能对 box.shiroko.one 完成 TLS 握手, 则该 IP 可作为境内 A 记录直连目标。
+用法:
+  python eo-probe-ips.py                     # 扫默认段列表(已知优选 IP 所在 /24)
+  python eo-probe-ips.py --host box.shiroko.one --out eo-hits.json
+判定: TCP 连通 + TLS 握手成功(SNI=目标host) -> hit; 记录握手 RTT。
+"""
+import argparse
+import asyncio
+import json
+import socket
+import ssl
+import sys
+import time
+
+# 已知/疑似 EO 香港优质 IP 所在段(来自社区 itdog 截图统计 + 教程)
+DEFAULT_CIDRS = [
+    "43.174.150.0/24", "43.174.78.0/24", "43.174.79.0/24", "43.174.57.0/24",
+    "43.175.130.0/24", "43.175.132.0/24", "43.175.151.0/24", "43.175.165.0/24",
+    "43.175.185.0/24", "43.175.150.0/24", "43.174.152.0/24", "43.174.153.0/24",
+    "43.175.131.0/24", "43.175.133.0/24",
+]
+
+def cidr_hosts(cidr: str):
+    net, bits = cidr.split("/")
+    bits = int(bits)
+    a, b, c, d = map(int, net.split("."))
+    base = (a << 24) + (b << 16) + (c << 8) + d
+    count = 1 << (32 - bits)
+    for i in range(1, count - 1):  # skip network & broadcast
+        v = base + i
+        yield f"{(v >> 24) & 255}.{(v >> 16) & 255}.{(v >> 8) & 255}.{v & 255}"
+
+async def probe(ip: str, host: str, timeout: float, sem: asyncio.Semaphore):
+    """TCP connect + TLS handshake (SNI=host). Return dict or None."""
+    async with sem:
+        loop = asyncio.get_running_loop()
+        t0 = time.perf_counter()
+        try:
+            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+            sock.settimeout(timeout)
+            # async connect
+            await loop.sock_connect(sock, (ip, 443))
+            tcp_ms = (time.perf_counter() - t0) * 1000
+            ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+            ctx.check_hostname = False
+            ctx.verify_mode = ssl.CERT_NONE
+            ctx.set_alpn_protocols(["http/1.1"])
+            tls_sock = ctx.wrap_socket(sock, server_hostname=host)
+            tls_sock.settimeout(timeout)
+            tls_ms = (time.perf_counter() - t0) * 1000
+            ver = tls_sock.version()
+            alpn = tls_sock.selected_alpn_protocol()
+            tls_sock.close()
+            sock.close()
+            return {"ip": ip, "tcp_ms": round(tcp_ms, 1),
+                    "handshake_ms": round(tls_ms, 1), "tls": ver, "alpn": alpn}
+        except Exception as e:
+            try:
+                sock.close()
+            except Exception:
+                pass
+            return None
+
+async def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--host", default="box.shiroko.one")
+    ap.add_argument("--cidrs", nargs="*", default=None)
+    ap.add_argument("--concurrency", type=int, default=256)
+    ap.add_argument("--timeout", type=float, default=2.5)
+    ap.add_argument("--out", default="eo-hits.json")
+    args = ap.parse_args()
+
+    cidrs = args.cidrs or DEFAULT_CIDRS
+    ips = []
+    for c in cidrs:
+        ips.extend(cidr_hosts(c))
+    print(f"[*] 目标 host: {args.host}  段数: {len(cidrs)}  待测 IP: {len(ips)}  并发: {args.concurrency}")
+
+    sem = asyncio.Semaphore(args.concurrency)
+    hits = []
+    done = 0
+    t_start = time.perf_counter()
+
+    # chunk to avoid building all tasks at once
+    CH = args.concurrency * 4
+    for i in range(0, len(ips), CH):
+        chunk = ips[i:i + CH]
+        tasks = [asyncio.create_task(probe(ip, args.host, args.timeout, sem)) for ip in chunk]
+        results = await asyncio.gather(*tasks)
+        for r in results:
+            if r:
+                hits.append(r)
+        done += len(chunk)
+        if done % (len(ips) // 10 or 1) == 0 or done == len(ips):
+            el = time.perf_counter() - t_start
+            print(f"    [{done}/{len(ips)}] hits={len(hits)}  elapsed={el:.1f}s")
+
+    hits.sort(key=lambda x: x["handshake_ms"])
+    print(f"\n[*] 完成: {done} IP 用时 {time.perf_counter()-t_start:.1f}s, 命中 {len(hits)}")
+    for h in hits[:40]:
+        print(f"    {h['ip']:16s} tcp={h['tcp_ms']:6.1f}ms  hs={h['handshake_ms']:6.1f}ms  tls={h['tls']}  alpn={h['alpn']}")
+
+    if hits and args.out:
+        with open(args.out, "w", encoding="utf-8") as f:
+            json.dump(hits, f, ensure_ascii=False, indent=2)
+        print(f"[*] 结果已存: {args.out}")
+
+if __name__ == "__main__":
+    asyncio.run(main())
diff --git a/dev/eo-probe-v2.py b/dev/eo-probe-v2.py
new file mode 100644
index 0000000..07a009b
--- /dev/null
+++ b/dev/eo-probe-v2.py
@@ -0,0 +1,101 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+EO 优选 IP 扫描 v2 (schannel 证书校验版)
+判据更严格: 用 curl (Windows schannel, 系统证书链) + --resolve 强制 SNI,
+           只有当 TLS 证书链校验通过(浏览器视角可访问)且返回 HTTP 响应才算 hit。
+这能区分 "CDN 通用池 IP (证书 *.cdn.myqcloud.com 不匹配)" 与 "真正承载目标站点的 EO 边缘"。
+用法: python eo-probe-v2.py --cidrs 43.174.246.0/24 43.174.247.0/24 ...
+"""
+import argparse
+import concurrent.futures
+import json
+import subprocess
+import time
+
+DEFAULT_CIDRS = [
+    "43.174.150.0/24", "43.174.151.0/24", "43.174.152.0/24", "43.174.153.0/24",
+    "43.174.78.0/24", "43.174.79.0/24", "43.174.57.0/24",
+    "43.175.130.0/24", "43.175.131.0/24", "43.175.132.0/24", "43.175.133.0/24",
+    "43.175.150.0/24", "43.175.151.0/24", "43.175.152.0/24",
+    "43.175.165.0/24", "43.175.166.0/24",
+    "43.175.185.0/24", "43.175.186.0/24",
+    "43.174.246.0/24", "43.174.247.0/24",  # EO 官方当前分配段(新加坡)
+]
+
+def cidr_hosts(cidr):
+    net, bits = cidr.split("/")
+    bits = int(bits)
+    a, b, c, d = map(int, net.split("."))
+    base = (a << 24) + (b << 16) + (c << 8) + d
+    count = 1 << (32 - bits)
+    for i in range(1, count - 1):
+        v = base + i
+        yield f"{(v >> 24) & 255}.{(v >> 16) & 255}.{(v >> 8) & 255}.{v & 255}"
+
+def probe(ip, host, timeout):
+    t0 = time.perf_counter()
+    # schannel on Windows: 默认走系统 CA, 证书不匹配会直接失败 => http_code 000 + 错误
+    cmd = ["curl", "-sS", "--resolve", f"{host}:443:{ip}",
+           "--connect-timeout", str(timeout), "--max-time", str(timeout * 2),
+           "-o", "NUL", "-w", "%{http_code}|%{time_total}|%{time_starttransfer}",
+           f"https://{host}/"]
+    try:
+        r = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout * 3,
+                           errors="replace")
+        out = r.stdout.strip()
+        parts = out.split("|")
+        code = parts[0] if parts else "000"
+        el = (time.perf_counter() - t0) * 1000
+        err = r.stderr.strip() if r.stderr else ""
+        if code not in ("000",):
+            return {"ip": ip, "http": code, "total_s": float(parts[1]) if len(parts) > 1 else None,
+                    "elapsed_ms": round(el, 1), "note": err.splitlines()[-1] if err else ""}
+        # 000: 看看是不是证书错误
+        note = ""
+        if "SEC_E_WRONG_PRINCIPAL" in err or "certificate" in err.lower():
+            note = "cert-mismatch"
+        elif err:
+            note = err.splitlines()[-1][:80]
+        return None
+    except Exception as e:
+        return None
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--host", default="box.shiroko.one")
+    ap.add_argument("--cidrs", nargs="*", default=None)
+    ap.add_argument("--workers", type=int, default=64)
+    ap.add_argument("--timeout", type=float, default=3)
+    ap.add_argument("--out", default="eo-hits-v2.json")
+    args = ap.parse_args()
+
+    cidrs = args.cidrs or DEFAULT_CIDRS
+    ips = []
+    for c in cidrs:
+        ips.extend(cidr_hosts(c))
+    print(f"[*] host={args.host} 段={len(cidrs)} IP={len(ips)} workers={args.workers}")
+
+    hits = []
+    t_start = time.perf_counter()
+    with concurrent.futures.ThreadPoolExecutor(max_workers=args.workers) as ex:
+        futs = {ex.submit(probe, ip, args.host, args.timeout): ip for ip in ips}
+        done = 0
+        for fut in concurrent.futures.as_completed(futs):
+            done += 1
+            r = fut.result()
+            if r:
+                hits.append(r)
+                print(f"  HIT {r['ip']:16s} http={r['http']} total={r['total_s']}s {r['note']}")
+            if done % 500 == 0:
+                print(f"  [{done}/{len(ips)}] hits={len(hits)} elapsed={time.perf_counter()-t_start:.0f}s")
+
+    print(f"\n[*] done in {time.perf_counter()-t_start:.0f}s, hits={len(hits)}")
+    if hits:
+        hits.sort(key=lambda x: x["total_s"] or 99)
+        with open(args.out, "w", encoding="utf-8") as f:
+            json.dump(hits, f, ensure_ascii=False, indent=2)
+        print(f"[*] saved: {args.out}")
+
+if __name__ == "__main__":
+    main()
diff --git a/dev/eo-scan-all.py b/dev/eo-scan-all.py
new file mode 100644
index 0000000..efbed06
--- /dev/null
+++ b/dev/eo-scan-all.py
@@ -0,0 +1,127 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+EO 全段扫描 v3 (方案 B: 找所有能服务 box.shiroko.one 的 EO 边缘 IP)
+两段式: 1) asyncio TCP:443 预筛全段  2) openssl 对 TCP 通的 IP 做 SNI 证书核验 (CN 含 host)
+输出: eo-all-hits.json  [{ip, cn, tcp_ms}]
+用法: python eo-scan-all.py --host box.shiroko.one --nets 43.174.0.0/16 43.175.0.0/16 --workers 400
+"""
+import argparse
+import asyncio
+import json
+import socket
+import subprocess
+import time
+from concurrent.futures import ThreadPoolExecutor
+
+def iter_hosts(net: str):
+    net, bits = net.split("/")
+    bits = int(bits)
+    a, b, c, d = map(int, net.split("."))
+    base = (a << 24) + (b << 16) + (c << 8) + d
+    count = 1 << (32 - bits)
+    for i in range(1, count - 1):
+        v = base + i
+        yield f"{(v >> 24) & 255}.{(v >> 16) & 255}.{(v >> 8) & 255}.{v & 255}"
+
+async def tcp_probe(ip: str, port: int, timeout: float, sem: asyncio.Semaphore):
+    async with sem:
+        t0 = time.perf_counter()
+        try:
+            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+            s.setblocking(False)
+            loop = asyncio.get_running_loop()
+            await asyncio.wait_for(loop.sock_connect(s, (ip, port)), timeout)
+            ms = (time.perf_counter() - t0) * 1000
+            s.close()
+            return ip, ms
+        except Exception:
+            try:
+                s.close()
+            except Exception:
+                pass
+            return None
+
+def tls_cn(ip: str, host: str, timeout: float):
+    try:
+        r = subprocess.run(
+            ["openssl", "s_client", "-connect", f"{ip}:443", "-servername", host,
+             "-tlsextdebug", "-no_ign_eof"],
+            capture_output=True, text=True, timeout=timeout, errors="replace",
+            input="Q")
+        out = r.stdout + r.stderr
+        cn = ""
+        for line in out.splitlines():
+            ls = line.strip()
+            if ls.startswith("subject="):
+                cn = ls
+                break
+        return {"ip": ip, "cn": cn or "(no-subject)", "ok": host in cn}
+    except Exception as e:
+        return {"ip": ip, "cn": f"ERR:{type(e).__name__}", "ok": False}
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--host", default="box.shiroko.one")
+    ap.add_argument("--nets", nargs="*",
+                    default=["43.174.0.0/16", "43.175.0.0/16"])
+    ap.add_argument("--workers", type=int, default=300)
+    ap.add_argument("--timeout", type=float, default=2.0)
+    ap.add_argument("--out", default="eo-all-hits.json")
+    args = ap.parse_args()
+
+    all_ips = []
+    for n in args.nets:
+        all_ips.extend(iter_hosts(n))
+    print(f"[*] host={args.host} 网段={args.nets} 总IP={len(all_ips)}")
+
+    # Stage 1: TCP 预筛
+    sem = asyncio.Semaphore(args.workers)
+    open_ips = []
+
+    async def run_tcp():
+        CH = args.workers * 6
+        for i in range(0, len(all_ips), CH):
+            chunk = all_ips[i:i + CH]
+            tasks = [asyncio.create_task(tcp_probe(ip, 443, args.timeout, sem)) for ip in chunk]
+            res = await asyncio.gather(*tasks)
+            for r in res:
+                if r:
+                    open_ips.append(r)
+            if (i + CH) % 20000 < CH or i + CH >= len(all_ips):
+                print(f"    tcp预筛 [{i+CH}/{len(all_ips)}] open={len(open_ips)}", flush=True)
+    t0 = time.perf_counter()
+    asyncio.run(run_tcp())
+    print(f"[*] TCP 预筛完成: {len(all_ips)} -> {len(open_ips)} open, {time.perf_counter()-t0:.0f}s")
+
+    if not open_ips:
+        print("[!] 无开放 IP")
+        return
+
+    # Stage 2: openssl 证书核验
+    hits = []
+    with ThreadPoolExecutor(max_workers=64) as ex:
+        futs = [ex.submit(tls_cn, ip, args.host, args.timeout * 2) for ip, _ in open_ips]
+        done = 0
+        for fut in futures_as_completed(futs):
+            done += 1
+            r = fut.result()
+            if r and r["ok"]:
+                hits.append(r)
+                print(f"  HIT {r['ip']:16s} {r['cn']}", flush=True)
+            if done % 200 == 0:
+                print(f"    证书核验 [{done}/{len(open_ips)}] hits={len(hits)}", flush=True)
+
+    print(f"\n[*] 全部完成: hits={len(hits)}")
+    if hits:
+        with open(args.out, "w", encoding="utf-8") as f:
+            json.dump(hits, f, ensure_ascii=False, indent=2)
+        print(f"[*] saved: {args.out}")
+
+def futures_as_completed(futs):
+    import concurrent.futures
+    for fut in concurrent.futures.as_completed(futs):
+        yield fut
+
+if __name__ == "__main__":
+    main()
diff --git a/dev/gen_changelog.py b/dev/gen_changelog.py
new file mode 100644
index 0000000..b9beb0f
--- /dev/null
+++ b/dev/gen_changelog.py
@@ -0,0 +1,129 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+gen_changelog.py — 生成 PocketBase 风格的 changelogs JSON（无需 PocketBase 服务）
+
+用途：
+    你在本地维护一个 Markdown 源文件（按 `## <时间戳>` 分段写 changelog），
+    本脚本把它导出成前端 change-logs.html 所 fetch 的 tamabox.changelogs.json。
+    输出格式完全兼容 PocketBase list API 的返回结构，但无需部署任何后端服务，
+    因此不会在你的 1C1G 服务器上多占哪怕 1 MB 常驻内存。
+
+    输出位置：static/tamabox.changelogs.json —— 该文件被 static 包以 //go:embed 打入
+    二进制，由 flamego.Static 在 /static 路径同源提供，前端直接 fetch 同源路径，
+    不再依赖任何外部域名（去掉 api-direct.337845818.best 等外链，降低可用性/安全风险）。
+
+源文件格式（dev/changelog-source.md 示例）：
+    ## 2024-03-04 21:45:55
+    新增：用户私信功能上线。
+    修复：移动端问题列表间距过窄。
+
+    ## 2024-02-29 00:00:55
+    优化：首页加载速度提升约 30%。
+
+注意：
+    - 时间戳支持 `YYYY-MM-DD HH:MM:SS` / `YYYY-MM-DD` / 带毫秒的 `...fffZ` / ISO 格式，
+      脚本会统一归一化为 PocketBase 风格的 `YYYY-MM-DD HH:MM:SS.fffZ`（UTC）。
+    - 正文里的换行默认会被转成 `<br>`，因为前端用 x-html 渲染；传 --no-br 可关闭。
+    - 导出时按时间倒序排列，最新一条排在最前（前端读 items[0] 即取最新）。
+
+用法：
+    python dev/gen_changelog.py
+    python dev/gen_changelog.py 源文件.md 输出.json
+    python dev/gen_changelog.py 源文件.md 输出.json --no-br
+"""
+import json
+import re
+import sys
+from datetime import datetime, timezone
+
+COLLECTION_ID = "tamabox"
+COLLECTION_NAME = "tamabox-changelogs"
+DEFAULT_SRC = "dev/changelog-source.md"
+DEFAULT_OUT = "static/tamabox.changelogs.json"
+
+TS_LINE = re.compile(r"^##\s+(.+?)\s*$")
+FULL_TS = re.compile(r"^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}\.\d{3}Z$")
+
+
+def normalize_ts(raw: str) -> str:
+    """把用户输入的时间归一化为 PocketBase 风格时间戳：YYYY-MM-DD HH:MM:SS.fffZ（UTC）。"""
+    raw = raw.strip()
+    if FULL_TS.match(raw):
+        return raw
+    for fmt in ("%Y-%m-%d %H:%M:%S.%fZ", "%Y-%m-%d %H:%M:%S",
+                "%Y-%m-%d %H:%M", "%Y-%m-%d"):
+        try:
+            dt = datetime.strptime(raw, fmt)
+            return dt.strftime("%Y-%m-%d %H:%M:%S") + ".000Z"
+        except ValueError:
+            continue
+    try:
+        dt = datetime.fromisoformat(raw.replace("Z", "+00:00"))
+        return dt.astimezone(timezone.utc).strftime("%Y-%m-%d %H:%M:%S") + ".000Z"
+    except ValueError:
+        sys.exit(f"[错误] 无法解析时间戳: {raw!r}")
+
+
+def parse_source(text: str):
+    """按 `## <时间戳>` 分段，返回 [(ts, content), ...]，顺序与源文件一致。"""
+    entries, cur_ts, buf = [], None, []
+    for line in text.splitlines():
+        m = TS_LINE.match(line)
+        if m:
+            if cur_ts is not None:
+                entries.append((cur_ts, "\n".join(buf).strip()))
+            cur_ts, buf = m.group(1).strip(), []
+        elif cur_ts is not None:
+            buf.append(line)
+    if cur_ts is not None:
+        entries.append((cur_ts, "\n".join(buf).strip()))
+    if not entries:
+        sys.exit("[错误] 源文件未找到任何 '## <时间戳>' 分段")
+    return entries
+
+
+def build(entries, br=True):
+    """把条目导出为 PocketBase list API 风格 JSON（最新在前）。"""
+    parsed = [(normalize_ts(ts), c) for ts, c in entries]
+    parsed.sort(key=lambda x: x[0], reverse=True)  # 倒序：最新 published_at 在前
+    items = []
+    for ts, content in parsed:
+        items.append({
+            "collectionId": COLLECTION_ID,
+            "collectionName": COLLECTION_NAME,
+            "content": content.replace("\n", "<br>\n") if br else content,
+            "created": ts,
+            "id": "none",
+            "published_at": ts,
+            "updated": ts,
+        })
+    return {
+        "page": 1,
+        "perPage": len(items) or 1,
+        "totalItems": len(items),
+        "totalPages": 1,
+        "items": items,
+    }
+
+
+def main():
+    args = sys.argv[1:]
+    br = "--no-br" not in args
+    paths = [a for a in args if not a.startswith("--")]
+    src = paths[0] if len(paths) > 0 else DEFAULT_SRC
+    out = paths[1] if len(paths) > 1 else DEFAULT_OUT
+    try:
+        with open(src, encoding="utf-8") as f:
+            text = f.read()
+    except FileNotFoundError:
+        sys.exit(f"[错误] 找不到源文件: {src}")
+    data = build(parse_source(text), br=br)
+    with open(out, "w", encoding="utf-8") as f:
+        json.dump(data, f, ensure_ascii=False, indent=2)
+    latest = data["items"][0]["published_at"] if data["items"] else "N/A"
+    print(f"[完成] 已生成 {out}（{data['totalItems']} 条记录，最新发布于 {latest}）")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/dev/notify_domain_change.py b/dev/notify_domain_change.py
new file mode 100644
index 0000000..ac9e8c1
--- /dev/null
+++ b/dev/notify_domain_change.py
@@ -0,0 +1,1269 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+TamaBox 域名变更 · 全员邮件通知脚本（独立维护脚本，不依赖、不修改项目源码）
+
+直接复用生产环境 conf/app.ini 中的 [database] 与 [mail] 配置：
+  - 连接数据库，查询 users 表中「未注销」(deleted_at IS NULL) 且已填写邮箱的用户
+  - 通过生产 SMTP 账号，给每位用户发送一封域名变更通知邮件（含个性化提问箱链接）
+  - 新旧域名（box.shiroko.one / box.tama.guru）与到期日（2026-12-24）在脚本中硬编码，已确认无误
+
+与线上发信行为保持一致（参见 internal/mail/mail.go）：
+  - 发件人： "{site_title} <mail.account>"
+  - 端口 465 → 隐式 SSL（SMTP_SSL）；其他端口 → STARTTLS
+  - 支持 [mail] skip_tls_verify=true 跳过证书校验（自签名/内网 SMTP）
+
+邮件正文按收件人语言（users.language，取值 zh-CN/zh-TW/en/ja）自动选择对应模板，
+回退顺序：用户语言 → [app] default_lang → zh-CN（用户无语言信息时直接按 zh-CN）；--subject/--html/--plain 为全局覆盖。
+
+安全设计（面向「全体用户」群发）：
+  - 默认 --dry-run：只列出收件人，绝不真正发信
+  - 发送前先打印数据库用户统计（总用户 / 已注销 / 未注销 / 未注销且有邮箱），便于核对应发数量
+  - 真正发信前必须人工确认（终端输入 yes），除非显式加 --yes（非交互/自动化用）
+  - --to 测试地址：仅向该邮箱发一封，用于验证模板与发信链路。发送前会在数据库里查找该邮箱：
+      命中 → 直接套用该用户的姓名/域名/语言（最贴近真实用户的渲染效果）
+      未命中 → 按简体中文（zh-CN）发送
+  - 监控报告：每次运行结束会把统计与发送结果写入报告文件（默认脚本同目录 notify_report.json），
+    可用 --report 改路径、--no-report 关闭；内容含 DB 统计、各语言分布、成功/失败/SMTP 拒收/已跳过数、失败清单，便于事后核查
+  - --limit N：限制发送条数，便于先小批量试水
+  - 不在一次发完：每封间隔 --delay 秒（默认 1.0）；可加 --pause-every N --pause-for S 分批长暂停防限流
+  - 按语言分群发送：同一语言的用户归为一组依次发送，组间间隔 --group-pause 秒（默认 3.0），便于分群控制节奏与监控
+  - 断点续发：已发送邮箱记录在状态文件（--state，默认脚本同目录 notify_state.json，JSONL），重跑脚本自动跳过已发用户；--reset-state 清空后从头全量发送
+  - 单条失败不影响整体，结束汇总成功/失败数并打印失败清单
+
+用法示例：
+  # 1) 演练：列出收件人 + 数据库统计（不连 SMTP）
+  python3 notify_domain_change.py --config /path/to/conf/app.ini --dry-run
+
+  # 2) 发一封到测试地址，验证模板 + SMTP 链路（仍需 yes 确认）
+  python3 notify_domain_change.py --config /path/to/conf/app.ini --to you@example.com --send
+
+  # 3) 正式全员群发（建议先用 --limit 50 小批量试水）
+  python3 notify_domain_change.py --config /path/to/conf/app.ini --send --limit 50
+  python3 notify_domain_change.py --config /path/to/conf/app.ini --send
+
+  # 4) 非交互环境自动确认（请自行确保数量无误）
+  python3 notify_domain_change.py --config /path/to/conf/app.ini --send --yes
+
+  # 5) 断点续发：中断后重跑会自动跳过已发用户（状态默认脚本同目录 notify_state.json）
+  #    如需从头全量重发，追加 --reset-state（会清状态并重新发给所有人，慎用）
+  python3 notify_domain_change.py --config /path/to/conf/app.ini --send --reset-state
+
+依赖（默认零依赖）：
+  - 默认优先调用系统自带的 psql（PostgreSQL）/ mysql（MySQL）命令行客户端，纯 Python 标准库
+    subprocess，无需 pip install 任何包；
+  - 仅当服务器上没有对应命令行客户端时，才需要 pip install psycopg2-binary（Postgres）或
+    pymysql（MySQL），可用 --db-driver 显式指定；
+  - SMTP 使用 Python 标准库 smtplib，无需额外依赖。
+"""
+
+import argparse
+import configparser
+import email.utils
+import json
+import os
+import shutil
+import subprocess
+import tempfile
+from datetime import datetime
+import smtplib
+import ssl
+import sys
+import time
+from email.header import Header
+from email.mime.multipart import MIMEMultipart
+from email.mime.text import MIMEText
+from email.utils import formataddr, make_msgid
+from urllib.parse import quote_plus
+
+
+# ---------------------------------------------------------------------------
+# 硬编码的域名迁移信息（两个域名均已确认无误）
+# ---------------------------------------------------------------------------
+NEW_DOMAIN = "box.shiroko.one"    # 新域名（站点已切换至此）
+OLD_DOMAIN = "box.tama.guru"      # 原域名（2026-12-24 到期）
+EXPIRE_DATE = "2026-12-24"        # 原域名到期日
+
+# 脚本版本标记：每次重新部署后运行，若输出未出现此行，说明跑的不是最新副本
+SCRIPT_VERSION = "2026-09-07.rfc5322.schema.v4"
+
+# 断点续发状态文件：默认与脚本同目录，记录已发送邮箱（JSONL，每行一条），重跑可跳过已发用户
+DEFAULT_STATE = os.path.join(os.path.dirname(os.path.abspath(__file__)), "notify_state.json")
+
+# 监控报告文件：默认与脚本同目录，记录每次运行的统计与发送结果，便于事后核查/监控
+DEFAULT_REPORT = os.path.join(os.path.dirname(os.path.abspath(__file__)), "notify_report.json")
+
+
+# ---------------------------------------------------------------------------
+# 配置读取：兼容 ini 行内注释（与项目 IgnoreInlineComment:true 一致），并去包围引号
+# ---------------------------------------------------------------------------
+def load_config(path):
+    if not os.path.isfile(path):
+        sys.exit(f"[FATAL] 配置文件不存在: {path}")
+
+    cp = configparser.ConfigParser(
+        comment_prefixes=(";", "#"),
+        inline_comment_prefixes=(";",),
+        interpolation=None,
+        # 与生产 ini 库一致：允许重复键（取后者），例如示例 [upload] 段存在两个 image_endpoint
+        strict=False,
+    )
+    # 保留键大小写
+    cp.optionxform = str
+    try:
+        cp.read(path, encoding="utf-8")
+    except Exception as e:  # noqa: BLE001
+        sys.exit(f"[FATAL] 解析配置文件失败: {e}")
+
+    def get(section, key, default=""):
+        try:
+            v = cp.get(section, key)
+        except (configparser.NoSectionError, configparser.NoOptionError):
+            return default
+        if v is None:
+            return default
+        v = v.strip()
+        # 去掉 ini 值可能带的两侧双引号（如 title = "NekoBox"）
+        if len(v) >= 2 and v[0] == '"' and v[-1] == '"':
+            v = v[1:-1]
+        return v
+
+    cfg = {
+        # [app]
+        "app_external_url": get("app", "external_url").rstrip("/"),
+        "app_title": get("app", "title") or "TamaBox",
+        "app_default_lang": (get("app", "default_lang") or "zh-CN").strip(),
+        # [database]
+        "db_type": get("database", "type") or "postgres",
+        "db_user": get("database", "user"),
+        "db_password": get("database", "password"),
+        "db_host": get("database", "host") or "127.0.0.1",
+        "db_port": int(get("database", "port") or 5432),
+        "db_name": get("database", "name"),
+        "db_schema": get("database", "schema"),
+        "db_sslmode": get("database", "sslmode") or "disable",
+        # [mail]
+        "mail_account": get("mail", "account"),
+        "mail_password": get("mail", "password"),
+        "mail_port": int(get("mail", "port") or 465),
+        "mail_smtp": get("mail", "smtp"),
+        "mail_skip_tls_verify": get("mail", "skip_tls_verify").lower() in ("1", "true", "yes"),
+    }
+    return cfg
+
+
+# ---------------------------------------------------------------------------
+# 数据库连接（零依赖优先：默认直接调用系统自带的 psql / mysql 命令行客户端，
+# 纯标准库 subprocess，无需 pip install 任何包；若客户端不可用再回退到
+# psycopg2 / pymysql 等 Python 驱动（需 pip install）。）
+# ---------------------------------------------------------------------------
+def _build_pg_uri(cfg):
+    """拼接 PostgreSQL 连接 URI（密码做 URL 编码，避免特殊字符破坏连接串）。"""
+    user = quote_plus(cfg["db_user"])
+    pw = quote_plus(cfg["db_password"])
+    sslmode = cfg.get("db_sslmode") or "disable"
+    return (
+        f"postgresql://{user}:{pw}@{cfg['db_host']}:{cfg['db_port']}"
+        f"/{quote_plus(cfg['db_name'])}?sslmode={sslmode}"
+    )
+
+
+def _choose_driver(cfg, args):
+    """选择 DB 驱动：auto 时优先用命令行客户端（零依赖），否则回退 Python 库。"""
+    want = (getattr(args, "db_driver", "auto") or "auto").lower()
+    db_type = cfg["db_type"]
+
+    def cli_or_lib(cli_name, lib_import):
+        if shutil.which(cli_name):
+            return cli_name
+        try:
+            __import__(lib_import)
+            return "lib"
+        except ImportError:
+            return cli_name  # 后续执行时会给出清晰报错
+
+    if want == "psql":
+        return "psql"
+    if want == "mysql":
+        return "mysql"
+    if want in ("psycopg2", "pymysql", "lib"):
+        return "lib"
+    # auto 或未知取值
+    if db_type == "postgres":
+        return cli_or_lib("psql", "psycopg2")
+    return cli_or_lib("mysql", "pymysql")
+
+
+def _psql_query(cfg, sql):
+    uri = _build_pg_uri(cfg)
+    sep = "\x1f"  # 单元分隔符，数据里几乎不可能出现
+    cmd = ["psql", uri, "-X", "-t", "-A", "-F", sep, "-P", "null=\\N",
+           "-P", "footer=off", "-c", sql]
+    try:
+        r = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
+    except FileNotFoundError:
+        sys.exit("[FATAL] 未找到 psql 客户端：请安装 PostgreSQL 客户端（如 apt install postgresql-client），"
+                 "或用 --db-driver psycopg2 并 pip install psycopg2-binary")
+    if r.returncode != 0:
+        sys.exit(f"[FATAL] psql 执行失败: {r.stderr.strip()[:500]}")
+    rows = []
+    for line in r.stdout.splitlines():
+        if not line:
+            continue
+        parts = [None if p == "\\N" else p for p in line.split(sep)]
+        rows.append(parts)
+    return rows
+
+
+def _mysql_query(cfg, sql):
+    # 用临时配置文件传密码，避免明文出现在进程参数列表
+    fd, cnf = tempfile.mkstemp(suffix=".cnf", prefix="neko_my_")
+    try:
+        with os.fdopen(fd, "w") as f:
+            f.write("[client]\npassword=%s\n" % cfg["db_password"])
+        os.chmod(cnf, 0o600)
+        cmd = ["mysql", f"-h{cfg['db_host']}", f"-P{cfg['db_port']}",
+               f"-u{cfg['db_user']}", f"--defaults-extra-file={cnf}",
+               "-D", cfg["db_name"], "-N", "-B",
+               "--default-character-set=utf8mb4", "-e", sql]
+        try:
+            r = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
+        except FileNotFoundError:
+            sys.exit("[FATAL] 未找到 mysql 客户端：请安装 MySQL 客户端（如 apt install mysql-client），"
+                     "或用 --db-driver pymysql 并 pip install pymysql")
+        if r.returncode != 0:
+            sys.exit(f"[FATAL] mysql 执行失败: {r.stderr.strip()[:500]}")
+    finally:
+        try:
+            os.remove(cnf)
+        except OSError:
+            pass
+    rows = []
+    for line in r.stdout.splitlines():
+        if not line:
+            continue
+        parts = [None if p == "\\N" else p for p in line.split("\t")]
+        rows.append(parts)
+    return rows
+
+
+def _lib_query(cfg, sql):
+    db_type = cfg["db_type"]
+    if db_type == "postgres":
+        try:
+            import psycopg2
+        except ImportError:
+            sys.exit("[FATAL] 需要 psycopg2 驱动：pip install psycopg2-binary")
+        kwargs = dict(host=cfg["db_host"], port=cfg["db_port"], user=cfg["db_user"],
+                      password=cfg["db_password"], dbname=cfg["db_name"],
+                      sslmode=cfg.get("db_sslmode") or "disable", connect_timeout=10)
+        if cfg["db_schema"]:
+            kwargs["options"] = f"-c search_path={cfg['db_schema']}"
+        try:
+            conn = psycopg2.connect(**kwargs)
+        except Exception as e:  # noqa: BLE001
+            sys.exit(f"[FATAL] 连接 PostgreSQL 失败: {e}")
+    else:
+        try:
+            import pymysql
+        except ImportError:
+            sys.exit("[FATAL] 需要 pymysql 驱动：pip install pymysql")
+        try:
+            conn = pymysql.connect(host=cfg["db_host"], port=cfg["db_port"], user=cfg["db_user"],
+                                   password=cfg["db_password"], database=cfg["db_name"],
+                                   connect_timeout=10, charset="utf8mb4")
+        except Exception as e:  # noqa: BLE001
+            sys.exit(f"[FATAL] 连接 MySQL 失败: {e}")
+    try:
+        with conn.cursor() as cur:
+            cur.execute(sql)
+            rows = cur.fetchall()
+    finally:
+        conn.close()
+    return [list(r) for r in rows]
+
+
+def run_query(cfg, sql, args):
+    """统一查询入口：按所选驱动执行 SQL，返回 list[list]（NULL 为 None）。"""
+    drv = _choose_driver(cfg, args)
+    if drv == "psql":
+        return _psql_query(cfg, sql)
+    if drv == "mysql":
+        return _mysql_query(cfg, sql)
+    return _lib_query(cfg, sql)
+
+
+# ---------------------------------------------------------------------------
+# 语言列探测：不同版本数据库 schema 下该列可能叫 language / lang，
+# 老库甚至可能根本没有这一列。
+# 注意：不能查 information_schema 来探测——它会跨 schema 误报（同名的 users
+# 表在别的 schema 带 language 列，但当前查询命中的 users 没有）。所以这里用
+# 「真实执行探测」：依次试 language / lang / NULL，哪个能跑通用哪个。
+# ---------------------------------------------------------------------------
+# ---------------------------------------------------------------------------
+# users 表定位：同库不同 schema 可能有同名 users 表（GORM 实际用的 schema
+# 与 public 里的旧表不同），不限定 schema 时 psql 会按 search_path 命中错误
+# 的空表（表现为统计全 0、语言列探测失败）。这里枚举所有 schema 的 users
+# 表并计数，选有数据的那个；多个有数据时优先带 language/lang 列、其次行数多。
+# ---------------------------------------------------------------------------
+def _qid(s):
+    """SQL 标识符安全引用（schema 名）。"""
+    return '"' + s.replace('"', '""') + '"'
+
+
+def resolve_users_table(cfg, args):
+    """返回 (限定表名, schema 名, 信息或 None)。非 postgres / 探测失败时退回裸 users。"""
+    if cfg["db_type"] != "postgres":
+        return "users", "", None
+    sql = (
+        "SELECT table_schema FROM information_schema.tables "
+        "WHERE table_name = 'users' "
+        "AND table_schema NOT LIKE 'pg\\_%' ESCAPE '\\' "
+        "AND table_schema <> 'information_schema' ORDER BY table_schema"
+    )
+    try:
+        rows = run_query(cfg, sql, args)
+    except SystemExit:
+        raise
+    except Exception:  # noqa: BLE001
+        return "users", "", None
+    schemas = [str(r[0]) for r in rows if r and r[0]]
+    if not schemas:
+        return "users", "", None
+
+    stats = []
+    for s in schemas:
+        n = 0
+        try:
+            cnt_rows = run_query(cfg, f"SELECT COUNT(*) FROM {_qid(s)}.users", args)
+            if cnt_rows and cnt_rows[0] and cnt_rows[0][0]:
+                n = int(cnt_rows[0][0])
+        except Exception:  # noqa: BLE001
+            n = 0
+        lang_col = None
+        try:
+            lrows = run_query(
+                cfg,
+                "SELECT column_name FROM information_schema.columns "
+                "WHERE table_name = 'users' AND table_schema = "
+                "'" + s.replace("'", "''") + "' "
+                "AND column_name IN ('language', 'lang') ORDER BY column_name DESC",
+                args,
+            )
+            if lrows and lrows[0] and lrows[0][0]:
+                lang_col = str(lrows[0][0])
+        except Exception:  # noqa: BLE001
+            pass
+        stats.append((s, n, lang_col))
+
+    # 选择：有数据 > 带 language 列 > 行数多
+    stats.sort(key=lambda st: (1 if st[1] > 0 else 0, 1 if st[2] else 0, st[1]), reverse=True)
+    s, n, lang = stats[0]
+    return f"{_qid(s)}.users", s, {"rows": n, "lang_col": lang, "all": stats}
+
+
+def detect_lang_column(cfg, args, tbl="users"):
+    """返回 (sql 表达式, 用于打印的列名或 None)。
+
+    显式 --lang-column 时直接采用该列（不回退）；否则自动依次尝试
+    language → lang → NULL（全员回退默认语言）。NULL 兜底必然成功，
+    因此本函数不会让脚本因「列不存在」而 FATAL。
+    """
+    specified = getattr(args, "lang_column", "auto")
+    if specified not in (None, "", "auto"):
+        return specified, specified  # 显式指定：直接采用，失败由查询报错暴露
+
+    last_exc = None
+    for cand in ("language", "lang", None):
+        expr = cand if cand else "NULL"
+        probe = (
+            f"SELECT name, domain, email, {expr} FROM {tbl} "
+            "WHERE deleted_at IS NULL AND email IS NOT NULL AND email <> '' "
+            "ORDER BY id LIMIT 1"
+        )
+        try:
+            run_query(cfg, probe, args)
+            return expr, cand  # 该列可用
+        except (SystemExit, Exception) as e:  # noqa: BLE001
+            last_exc = e
+            continue
+    # 连 NULL 兜底都失败：说明 users 表不存在 / 无权限，已无回退空间
+    sys.exit(f"[FATAL] 语言列探测全失败（含 NULL 兜底），疑似 users 表不存在或权限不足: {last_exc}")
+
+
+# ---------------------------------------------------------------------------
+# 取收件人：未注销且已填邮箱的用户
+# ---------------------------------------------------------------------------
+def fetch_recipients(cfg, args, lang_expr=None, tbl="users"):
+    if lang_expr is None:
+        lang_expr, _ = detect_lang_column(cfg, args, tbl)
+    # 软删除列 deleted_at 为 NULL 表示未注销（gorm.Model / MySQL datetime 同义）
+    sql = (
+        f"SELECT name, domain, email, {lang_expr} FROM {tbl} "
+        "WHERE deleted_at IS NULL AND email IS NOT NULL AND email <> '' "
+        "ORDER BY id"
+    )
+    try:
+        rows = run_query(cfg, sql, args)
+    except SystemExit:
+        raise
+    except Exception as e:  # noqa: BLE001
+        sys.exit(f"[FATAL] 查询 users 失败: {e}")
+
+    recipients = []
+    for row in rows:
+        name, domain, email_addr, lang = (list(row) + [None, None, None, None])[:4]
+        recipients.append(
+            {
+                "name": (name or "").strip(),
+                "domain": (domain or "").strip(),
+                "email": (email_addr or "").strip(),
+                "language": (lang or "").strip(),
+            }
+        )
+    return recipients
+
+
+# ---------------------------------------------------------------------------
+# 数据库用户统计：用于发送前人工核对数量
+# ---------------------------------------------------------------------------
+def fetch_counts(cfg, args, tbl="users"):
+    if cfg["db_type"] == "postgres":
+        sql = (
+            "SELECT COUNT(*), "
+            "COUNT(*) FILTER (WHERE deleted_at IS NOT NULL), "
+            "COUNT(*) FILTER (WHERE deleted_at IS NULL), "
+            "COUNT(*) FILTER (WHERE deleted_at IS NULL AND email <> ''), "
+            "COUNT(*) FILTER (WHERE deleted_at IS NULL AND (email IS NULL OR email = '')) "
+            f"FROM {tbl}"
+        )
+    else:
+        # MySQL 不支持 FILTER，改用 SUM(CASE ...)
+        sql = (
+            "SELECT COUNT(*), "
+            "SUM(CASE WHEN deleted_at IS NOT NULL THEN 1 ELSE 0 END), "
+            "SUM(CASE WHEN deleted_at IS NULL THEN 1 ELSE 0 END), "
+            "SUM(CASE WHEN deleted_at IS NULL AND email <> '' THEN 1 ELSE 0 END), "
+            "SUM(CASE WHEN deleted_at IS NULL AND (email IS NULL OR email = '') THEN 1 ELSE 0 END) "
+            f"FROM {tbl}"
+        )
+    try:
+        rows = run_query(cfg, sql, args)
+    except SystemExit:
+        raise
+    except Exception as e:  # noqa: BLE001
+        sys.exit(f"[FATAL] 统计 users 失败: {e}")
+    if not rows:
+        sys.exit("[FATAL] 统计 users 返回空结果")
+    vals = [int(v) if v is not None else 0 for v in rows[0]]
+    total, deactivated, active, active_with_email, active_no_email = (vals + [0] * 5)[:5]
+    return {
+        "total": total,
+        "deactivated": deactivated,
+        "active": active,
+        "active_with_email": active_with_email,
+        "active_no_email": active_no_email,
+    }
+
+
+# ---------------------------------------------------------------------------
+# 邮件内容模板（占位符用 {{key}}，避免与 HTML/CSS 的大括号冲突）
+#   占位符：{{name}} {{domain}} {{box_link}} {{site}} {{site_title}}
+#           {{old_domain}} {{expire_date}}
+# ---------------------------------------------------------------------------
+DEFAULT_SUBJECT = "【{{site_title}}】重要通知：本站已更换域名为 {{site}}"
+
+DEFAULT_HTML = """<!doctype html>
+<html lang="zh-CN">
+<head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"></head>
+<body style="margin:0;padding:0;background:#f5f5f7;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'PingFang SC','Microsoft YaHei',sans-serif;color:#1d1d1f;">
+  <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background:#f5f5f7;padding:24px 0;">
+    <tr><td align="center">
+      <table role="presentation" width="600" cellpadding="0" cellspacing="0" style="max-width:600px;width:100%;background:#ffffff;border-radius:12px;overflow:hidden;box-shadow:0 1px 4px rgba(0,0,0,.08);">
+        <tr><td style="background:#6f42c1;padding:24px 28px;color:#fff;font-size:20px;font-weight:600;">
+          {{site_title}} 域名变更通知
+        </td></tr>
+        <tr><td style="padding:28px;">
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;">你好，{{name}}：</p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;">首先，感谢你一直以来使用 {{site_title}}（狼的提问箱）。</p>
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;color:#444;">这是一封群发的站内通知邮件，由站点统一发送给全体注册用户，请放心查阅。</p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;">
+            本站已正式切换到新域名：<strong style="color:#6f42c1;">{{site}}</strong>（原域名：{{old_domain}}）。
+          </p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 6px;"><strong>为什么换域名？</strong></p>
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;color:#444;">
+            .guru 域名近年来连续涨价，续费成本越来越高，因此我们迁移到了更稳定的 .one 域名。
+          </p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 6px;"><strong>原域名会怎样？</strong></p>
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;color:#444;">
+            原域名将在 <strong>{{expire_date}}</strong> 到期。到期前，访问原域名会通过 301 永久重定向自动跳转到新域名，
+            你的账号和数据都不变；到期之后，旧域名将彻底不再使用。
+          </p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 6px;"><strong>我该做什么？</strong></p>
+          <p style="font-size:15px;line-height:1.7;margin:0 0 6px;color:#444;">1. 记住新域名 {{site}}，以后直接访问这里。</p>
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;color:#444;">2. 如果你之前通过二维码分享过自己的提问箱，记得把二维码替换成新域名对应的新二维码。</p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 6px;">你的提问箱地址（建议收藏）：</p>
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;">
+            <a href="{{box_link}}" style="color:#6f42c1;word-break:break-all;">{{box_link}}</a>
+          </p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 4px;">感谢一直以来的陪伴与支持</p>
+        </td></tr>
+        <tr><td style="padding:16px 28px;background:#fafafa;color:#86868b;font-size:12px;border-top:1px solid #eee;">
+          这是一封系统通知邮件，由站点管理员发送给全体注册用户。<br>
+          © 2026 狼的提问箱
+        </td></tr>
+      </table>
+    </td></tr>
+  </table>
+</body>
+</html>
+"""
+
+DEFAULT_PLAIN = """你好，{{name}}：
+
+首先，感谢你一直以来使用 {{site_title}}（狼的提问箱）。
+这是一封群发的站内通知邮件，由站点统一发送给全体注册用户，请放心查阅。
+
+本站已正式切换到新域名：{{site}}（原域名：{{old_domain}}）。
+
+为什么换域名？
+.guru 域名近年来连续涨价，续费成本越来越高，因此我们迁移到了更稳定的 .one 域名。
+
+原域名会怎样？
+原域名将在 {{expire_date}} 到期。到期前，访问原域名会通过 301 永久重定向自动跳转到新域名，你的账号和数据都不变；到期之后，旧域名将彻底不再使用。
+
+我该做什么？
+1. 记住新域名 {{site}}，以后直接访问这里。
+2. 如果你之前通过二维码分享过自己的提问箱，记得把二维码替换成新域名对应的新二维码。
+
+你的提问箱地址（建议收藏）：
+{{box_link}}
+
+感谢一直以来的陪伴与支持。
+—— {{site_title}}
+© 2026 狼的提问箱
+"""
+
+
+# 多语言模板：按 users.language 选择；zh-CN 即上方 DEFAULT_*，其余为翻译版。
+# 占位符统一为 {{name}}/{{domain}}/{{box_link}}/{{site}}/{{site_title}}/{{old_domain}}/{{expire_date}}
+ZH_TW_HTML = """<!doctype html>
+<html lang="zh-TW">
+<head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"></head>
+<body style="margin:0;padding:0;background:#f5f5f7;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'PingFang TC','Microsoft JhengHei',sans-serif;color:#1d1d1f;">
+  <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background:#f5f5f7;padding:24px 0;">
+    <tr><td align="center">
+      <table role="presentation" width="600" cellpadding="0" cellspacing="0" style="max-width:600px;width:100%;background:#ffffff;border-radius:12px;overflow:hidden;box-shadow:0 1px 4px rgba(0,0,0,.08);">
+        <tr><td style="background:#6f42c1;padding:24px 28px;color:#fff;font-size:20px;font-weight:600;">
+          {{site_title}} 域名變更通知
+        </td></tr>
+        <tr><td style="padding:28px;">
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;">你好，{{name}}：</p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;">首先，感謝你一直以來使用 {{site_title}}（狼的提問箱）。</p>
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;color:#444;">這是一封群發的站內通知郵件，由站點統一發送給全體註冊用戶，請放心查閱。</p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;">
+            本站已正式切換到新域名：<strong style="color:#6f42c1;">{{site}}</strong>（原域名：{{old_domain}}）。
+          </p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 6px;"><strong>為什麼換域名？</strong></p>
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;color:#444;">
+            .guru 域名近年來連續漲價，續費成本越來越高，因此我們遷移到了更穩定的 .one 域名。
+          </p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 6px;"><strong>原域名會怎樣？</strong></p>
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;color:#444;">
+            原域名將在 <strong>{{expire_date}}</strong> 到期。到期前，訪問原域名會通過 301 永久重定向自動跳轉到新域名，
+            你的帳號和資料都不變；到期之後，舊域名將徹底不再使用。
+          </p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 6px;"><strong>我該做什麼？</strong></p>
+          <p style="font-size:15px;line-height:1.7;margin:0 0 6px;color:#444;">1. 記住新域名 {{site}}，以後直接訪問這裡。</p>
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;color:#444;">2. 如果你之前透過 QR 碼分享過自己的提問箱，記得把 QR 碼替換成新域名對應的新 QR 碼。</p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 6px;">你的提問箱地址（建議收藏）：</p>
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;">
+            <a href="{{box_link}}" style="color:#6f42c1;word-break:break-all;">{{box_link}}</a>
+          </p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 4px;">感謝一直以來的陪伴與支持</p>
+        </td></tr>
+        <tr><td style="padding:16px 28px;background:#fafafa;color:#86868b;font-size:12px;border-top:1px solid #eee;">
+          這是一封系統通知郵件，由站點管理員發送給全體註冊用戶。<br>
+          © 2026 狼的提問箱
+        </td></tr>
+      </table>
+    </td></tr>
+  </table>
+</body>
+</html>
+"""
+
+ZH_TW_PLAIN = """你好，{{name}}：
+
+首先，感謝你一直以來使用 {{site_title}}（狼的提問箱）。
+這是一封群發的站內通知郵件，由站點統一發送給全體註冊用戶，請放心查閱。
+
+本站已正式切換到新域名：{{site}}（原域名：{{old_domain}}）。
+
+為什麼換域名？
+.guru 域名近年來連續漲價，續費成本越來越高，因此我們遷移到了更穩定的 .one 域名。
+
+原域名會怎樣？
+原域名將在 {{expire_date}} 到期。到期前，訪問原域名會通過 301 永久重定向自動跳轉到新域名，你的帳號和資料都不變；到期之後，舊域名將徹底不再使用。
+
+我該做什麼？
+1. 記住新域名 {{site}}，以後直接訪問這裡。
+2. 如果你之前透過 QR 碼分享過自己的提問箱，記得把 QR 碼替換成新域名對應的新 QR 碼。
+
+你的提問箱地址（建議收藏）：
+{{box_link}}
+
+感謝一直以來的陪伴與支持。
+—— {{site_title}}
+© 2026 狼的提問箱
+"""
+
+EN_HTML = """<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"></head>
+<body style="margin:0;padding:0;background:#f5f5f7;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;color:#1d1d1f;">
+  <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background:#f5f5f7;padding:24px 0;">
+    <tr><td align="center">
+      <table role="presentation" width="600" cellpadding="0" cellspacing="0" style="max-width:600px;width:100%;background:#ffffff;border-radius:12px;overflow:hidden;box-shadow:0 1px 4px rgba(0,0,0,.08);">
+        <tr><td style="background:#6f42c1;padding:24px 28px;color:#fff;font-size:20px;font-weight:600;">
+          {{site_title}} Domain change notice
+        </td></tr>
+        <tr><td style="padding:28px;">
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;">Hello, {{name}}:</p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;">First of all, thank you for using {{site_title}} (Wolf's Question Box).</p>
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;color:#444;">This is a mass internal notification email sent by the site to all registered users. Please read it with confidence.</p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;">
+            Our site has officially moved to a new domain: <strong style="color:#6f42c1;">{{site}}</strong> (previously: {{old_domain}}).
+          </p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 6px;"><strong>Why the move?</strong></p>
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;color:#444;">
+              The .guru domain has kept raising its renewal price year after year, so we've migrated to the more stable .one domain.
+          </p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 6px;"><strong>What happens to the old domain?</strong></p>
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;color:#444;">
+            The old domain will expire on <strong>{{expire_date}}</strong>. Until then, visiting the old domain will automatically
+            301-redirect to the new one, and your account and data stay exactly the same. After that date, the old domain will be retired completely.
+          </p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 6px;"><strong>What do you need to do?</strong></p>
+          <p style="font-size:15px;line-height:1.7;margin:0 0 6px;color:#444;">1. Remember the new domain {{site}} and use it from now on.</p>
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;color:#444;">2. If you previously shared your question box via a QR code, please replace it with a new QR code pointing to the new domain.</p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 6px;">Your question box (recommended to bookmark):</p>
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;">
+            <a href="{{box_link}}" style="color:#6f42c1;word-break:break-all;">{{box_link}}</a>
+          </p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 4px;">Thank you for being with us.</p>
+        </td></tr>
+        <tr><td style="padding:16px 28px;background:#fafafa;color:#86868b;font-size:12px;border-top:1px solid #eee;">
+          This is a system notification sent by the site administrator to all registered users.<br>
+          © 2026 Wolf's Question Box
+        </td></tr>
+      </table>
+    </td></tr>
+  </table>
+</body>
+</html>
+"""
+
+EN_PLAIN = """Hello, {{name}}:
+
+First of all, thank you for using {{site_title}} (Wolf's Question Box).
+This is a mass internal notification email sent by the site to all registered users. Please read it with confidence.
+
+Our site has officially moved to a new domain: {{site}} (previously: {{old_domain}}).
+
+Why the move?
+The .guru domain has kept raising its renewal price year after year, so we've migrated to the more stable .one domain.
+
+What happens to the old domain?
+The old domain will expire on {{expire_date}}. Until then, visiting the old domain will automatically 301-redirect to the new one, and your account and data stay exactly the same. After that date, the old domain will be retired completely.
+
+What do you need to do?
+1. Remember the new domain {{site}} and use it from now on.
+2. If you previously shared your question box via a QR code, please replace it with a new QR code pointing to the new domain.
+
+Your question box (recommended to bookmark):
+{{box_link}}
+
+Thank you for being with us.
+—— {{site_title}}
+© 2026 Wolf's Question Box
+"""
+
+JA_HTML = """<!doctype html>
+<html lang="ja">
+<head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"></head>
+<body style="margin:0;padding:0;background:#f5f5f7;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Hiragino Sans','Yu Gothic',Meiryo,sans-serif;color:#1d1d1f;">
+  <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background:#f5f5f7;padding:24px 0;">
+    <tr><td align="center">
+      <table role="presentation" width="600" cellpadding="0" cellspacing="0" style="max-width:600px;width:100%;background:#ffffff;border-radius:12px;overflow:hidden;box-shadow:0 1px 4px rgba(0,0,0,.08);">
+        <tr><td style="background:#6f42c1;padding:24px 28px;color:#fff;font-size:20px;font-weight:600;">
+          {{site_title}} ドメイン移転のお知らせ
+        </td></tr>
+        <tr><td style="padding:28px;">
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;">{{name}} さん、こんにちは：</p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;">まず、いつも {{site_title}}（狼の質問箱）をご利用いただき、ありがとうございます。</p>
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;color:#444;">本メールはサイトから全登録ユーザーへ一斉送信されるシステム内通知です。安心してご覧ください。</p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;">
+            サイトは新しいドメインへ正式に移転しました：<strong style="color:#6f42c1;">{{site}}</strong>（旧ドメイン：{{old_domain}}）。
+          </p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 6px;"><strong>なぜ移転したのですか？</strong></p>
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;color:#444;">
+            .guru ドメインの更新料金がこの数年で連続して値上がりし、維持コストがかさむため、より安定した .one ドメインへ移行しました。
+          </p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 6px;"><strong>旧ドメインはどうなるのですか？</strong></p>
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;color:#444;">
+            旧ドメインは <strong>{{expire_date}}</strong> に失効します。失効までは旧ドメインへのアクセスが 301 リダイレクトで新ドメインに自動転送され、アカウントやデータはそのまま引き継がれます。失効後は旧ドメインは完全に利用できなくなります。
+          </p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 6px;"><strong>あなたにご対応いただきたいこと：</strong></p>
+          <p style="font-size:15px;line-height:1.7;margin:0 0 6px;color:#444;">1. 新ドメイン {{site}} を覚えて、今後はこちらをご利用ください。</p>
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;color:#444;">2. これまで QR コードで質問箱を共有されていた場合は、新ドメインの QR コードに差し替えてください。</p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 6px;">あなたの質問箱（ブックマーク推奨）：</p>
+          <p style="font-size:15px;line-height:1.7;margin:0 0 16px;">
+            <a href="{{box_link}}" style="color:#6f42c1;word-break:break-all;">{{box_link}}</a>
+          </p>
+
+          <p style="font-size:15px;line-height:1.7;margin:0 0 4px;">いつもご利用いただきありがとうございます。</p>
+        </td></tr>
+        <tr><td style="padding:16px 28px;background:#fafafa;color:#86868b;font-size:12px;border-top:1px solid #eee;">
+          本メールはサイト管理者から全登録ユーザーへ送信されるシステム通知です。<br>
+          © 2026 狼の質問箱
+        </td></tr>
+      </table>
+    </td></tr>
+  </table>
+</body>
+</html>
+"""
+
+JA_PLAIN = """{{name}} さん、こんにちは：
+
+まず、いつも {{site_title}}（狼の質問箱）をご利用いただき、ありがとうございます。
+本メールはサイトから全登録ユーザーへ一斉送信されるシステム内通知です。安心してご覧ください。
+
+サイトは新しいドメインへ正式に移転しました：{{site}}（旧ドメイン：{{old_domain}}）。
+
+なぜ移転したのですか？
+.guru ドメインの更新料金がこの数年で連続して値上がりし、維持コストがかさむため、より安定した .one ドメインへ移行しました。
+
+旧ドメインはどうなるのですか？
+旧ドメインは {{expire_date}} に失効します。失効までは旧ドメインへのアクセスが 301 リダイレクトで新ドメインに自動転送され、アカウントやデータはそのまま引き継がれます。失効後は旧ドメインは完全に利用できなくなります。
+
+あなたにご対応いただきたいこと：
+1. 新ドメイン {{site}} を覚えて、今後はこちらをご利用ください。
+2. これまで QR コードで質問箱を共有されていた場合は、新ドメインの QR コードに差し替えてください。
+
+あなたの質問箱（ブックマーク推奨）：
+{{box_link}}
+
+いつもご利用いただきありがとうございます。
+—— {{site_title}}
+© 2026 狼の質問箱
+"""
+
+LANG_TEMPLATES = {
+    "zh-CN": {"subject": DEFAULT_SUBJECT, "html": DEFAULT_HTML, "plain": DEFAULT_PLAIN},
+    "zh-TW": {"subject": "【{{site_title}}】重要通知：本站已更換域名為 {{site}}", "html": ZH_TW_HTML, "plain": ZH_TW_PLAIN},
+    "en": {"subject": "【{{site_title}}】Important: we've moved to {{site}}", "html": EN_HTML, "plain": EN_PLAIN},
+    "ja": {"subject": "【{{site_title}}】重要：サイトは {{site}} に移転しました", "html": JA_HTML, "plain": JA_PLAIN},
+}
+
+# 语言分组发送的固定顺序 + 展示标签
+LANG_ORDER = ["zh-CN", "zh-TW", "en", "ja"]
+LANG_LABEL = {
+    "zh-CN": "简体中文",
+    "zh-TW": "繁體中文",
+    "en": "English",
+    "ja": "日本語",
+}
+
+
+def render(template, ctx):
+    for k, v in ctx.items():
+        template = template.replace("{{" + k + "}}", v)
+    return template
+
+
+def resolve_lang(lang_field, default_lang):
+    """解析收件人语言：空 -> zh-CN；未知语言码 -> default_lang -> zh-CN。"""
+    lang = (lang_field or "").strip()
+    if not lang:
+        lang = "zh-CN"
+    if lang not in LANG_TEMPLATES:
+        lang = (default_lang or "").strip() or "zh-CN"
+        if lang not in LANG_TEMPLATES:
+            lang = "zh-CN"
+    return lang
+
+
+def effective_templates(lang, args):
+    """按语言选择模板；--subject/--html/--plain 为全局覆盖，优先级高于按语言默认模板。"""
+    base = LANG_TEMPLATES.get(lang) or LANG_TEMPLATES["zh-CN"]
+    subject = args.subject if args.subject != DEFAULT_SUBJECT else base["subject"]
+    html = args.html_template if args.html else base["html"]
+    plain = args.plain_template if args.plain else base["plain"]
+    return subject, html, plain
+
+
+def build_message(cfg, to_addr, ctx, subject, html, plain):
+    subject = render(subject, ctx)
+    html = render(html, ctx)
+    plain = render(plain, ctx)
+
+    msg = MIMEMultipart("alternative")
+    from_user = cfg.get("app_title") or ""
+    from_addr = cfg["mail_account"]
+    # RFC5322/RFC2047：非 ASCII 显示名（如「狼的提问箱」）必须先编码再放进 From，
+    # 否则 QQ 邮箱等会以 "From header is missing or invalid" 550 拒收。
+    msg["From"] = formataddr((str(Header(from_user, "utf-8")), from_addr))
+    msg["To"] = to_addr
+    msg["Subject"] = Header(subject, "utf-8")
+    msg["Date"] = email.utils.formatdate(localtime=True)
+    msg["Message-ID"] = make_msgid(domain=from_addr.split("@")[-1])
+    msg.attach(MIMEText(plain, "plain", "utf-8"))
+    msg.attach(MIMEText(html, "html", "utf-8"))
+    return msg
+
+
+def smtp_login(cfg):
+    port = cfg["mail_port"]
+    context = ssl.create_default_context()
+    if cfg["mail_skip_tls_verify"]:
+        context.check_hostname = False
+        context.verify_mode = ssl.CERT_NONE
+
+    if port == 465:
+        server = smtplib.SMTP_SSL(cfg["mail_smtp"], port, timeout=30, context=context)
+    else:
+        server = smtplib.SMTP(cfg["mail_smtp"], port, timeout=30)
+        server.ehlo()
+        server.starttls(context=context)
+        server.ehlo()
+    server.login(cfg["mail_account"], cfg["mail_password"])
+    return server
+
+
+# ---------------------------------------------------------------------------
+# 断点续发状态：以 JSONL 记录已发送邮箱，崩溃安全（逐行追加写）
+# ---------------------------------------------------------------------------
+def load_sent_state(state_path):
+    """读取已发送清单（JSONL），返回 {email_lower: entry}。"""
+    sent = {}
+    if not os.path.isfile(state_path):
+        return sent
+    try:
+        with open(state_path, "r", encoding="utf-8") as f:
+            for line in f:
+                line = line.strip()
+                if not line:
+                    continue
+                try:
+                    obj = json.loads(line)
+                except Exception:  # noqa: BLE001
+                    continue
+                em = (obj.get("email") or "").strip().lower()
+                if em:
+                    sent[em] = obj
+    except Exception as e:  # noqa: BLE001
+        print(f"[警告] 读取断点续发清单失败，将视为空清单继续：{e}")
+    return sent
+
+
+def record_sent(state_path, entry):
+    """追加一条已发送记录（JSONL 追加写，崩溃安全）。"""
+    try:
+        with open(state_path, "a", encoding="utf-8") as f:
+            f.write(json.dumps(entry, ensure_ascii=False) + "\n")
+    except Exception as e:  # noqa: BLE001
+        print(f"[警告] 写入断点续发清单失败（不影响本次发送）：{e}")
+
+
+def reset_state(state_path):
+    try:
+        if os.path.isfile(state_path):
+            os.remove(state_path)
+    except Exception as e:  # noqa: BLE001
+        print(f"[警告] 清除断点续发清单失败：{e}")
+
+
+# ---------------------------------------------------------------------------
+# 主流程
+# ---------------------------------------------------------------------------
+def main():
+    parser = argparse.ArgumentParser(
+        description="TamaBox 域名变更全员邮件通知（读取生产 conf/app.ini）",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+    )
+    parser.add_argument(
+        "-c", "--config",
+        default=os.environ.get("NEKOBOX_CONFIG_PATH", "conf/app.ini"),
+        help="conf/app.ini 路径（默认取环境变量 NEKOBOX_CONFIG_PATH，否则 conf/app.ini）",
+    )
+    parser.add_argument("--dry-run", action="store_true",
+                        help="只列出收件人 + 统计，不真正发信（默认行为；与 --send 互斥）")
+    parser.add_argument("--send", action="store_true",
+                        help="真正发信（不指定则仅 dry-run）")
+    parser.add_argument("--to", metavar="EMAIL",
+                        help="只发给该测试地址（用于验证模板与发信链路），覆盖收件人列表")
+    parser.add_argument("--limit", type=int, default=0,
+                        help="最多发送 N 封（0 表示不限制），便于小批量试水")
+    parser.add_argument("--delay", type=float, default=1.0,
+                        help="每封之间的间隔秒数，默认 1.0，避免触发 SMTP 限流")
+    parser.add_argument("--pause-every", type=int, default=0,
+                        help="每发送 N 封后额外长暂停一次（0 表示不启用），配合 --pause-for 防限流")
+    parser.add_argument("--pause-for", type=float, default=15.0,
+                        help="--pause-every 触发时的长暂停秒数，默认 15.0")
+    parser.add_argument("--group-pause", type=float, default=3.0,
+                        help="不同语言分组之间的额外暂停秒数，默认 3.0，便于分群控制节奏（0 关闭）")
+    parser.add_argument("--db-driver", default="auto",
+                        choices=["auto", "psql", "mysql", "psycopg2", "pymysql"],
+                        help="DB 驱动：auto（默认，优先用系统 psql/mysql 客户端，零依赖）/ "
+                             "psql / mysql（命令行客户端）/ psycopg2 / pymysql（Python 库，需 pip install）")
+    parser.add_argument("--lang-column", default="auto",
+                        help="users 表中存储界面语言的列名。auto（默认）=自动探测（language/lang），"
+                             "若都不存在则全员回退默认语言；也可手动指定如 --lang-column=lang")
+    parser.add_argument("--state", default=DEFAULT_STATE,
+                        help="断点续发状态文件路径（JSONL，记录已发送邮箱）；默认与脚本同目录 notify_state.json")
+    parser.add_argument("--reset-state", action="store_true",
+                        help="发送前清空断点续发状态文件，从头全量发送（慎用：会重新发给所有人）；仅在 --send 时生效")
+    parser.add_argument("--report", default=DEFAULT_REPORT,
+                        help="监控报告文件路径（JSON，记录统计与发送结果）；默认脚本同目录 notify_report.json")
+    parser.add_argument("--no-report", action="store_true",
+                        help="关闭监控报告写入（默认会写 notify_report.json）")
+    parser.add_argument("--yes", action="store_true",
+                        help="跳过发送前的人工确认（非交互/自动化用，请自行确保数量无误）")
+    parser.add_argument("--subject", default=DEFAULT_SUBJECT,
+                        help="邮件主题（支持 {{site_title}}/{{site}} 占位符）")
+    parser.add_argument("--html", metavar="FILE",
+                        help="自定义 HTML 正文模板文件路径（支持 {{name}}/{{domain}}/{{box_link}}/{{site}}/{{site_title}}/{{old_domain}}/{{expire_date}}）")
+    parser.add_argument("--plain", metavar="FILE",
+                        help="自定义纯文本正文模板文件路径（占位符同上）")
+    global args
+    args = parser.parse_args()
+
+    # 载入自定义模板文件
+    args.html_template = DEFAULT_HTML
+    args.plain_template = DEFAULT_PLAIN
+    if args.html:
+        with open(args.html, "r", encoding="utf-8") as f:
+            args.html_template = f.read()
+    if args.plain:
+        with open(args.plain, "r", encoding="utf-8") as f:
+            args.plain_template = f.read()
+
+    cfg = load_config(args.config)
+
+    # 透明输出已解析的配置（不打密码）
+    print("=" * 56)
+    print("已解析配置（来自生产 conf/app.ini）")
+    print("=" * 56)
+    print(f"  [版本]   SCRIPT_VERSION = {SCRIPT_VERSION}")
+    print(f"  [app]    external_url = {cfg['app_external_url'] or '(空)'}")
+    print(f"  [app]    title        = {cfg['app_title']}")
+    print(f"  [app]    default_lang = {cfg['app_default_lang']}")
+    print(f"  [db]     type         = {cfg['db_type']}")
+    print(f"  [db]     host:port    = {cfg['db_host']}:{cfg['db_port']} db={cfg['db_name'] or '(空)'}")
+    print(f"  [mail]   smtp:port    = {cfg['mail_smtp']}:{cfg['mail_port']}")
+    print(f"  [mail]   account      = {cfg['mail_account'] or '(空)'}")
+    print(f"  [mail]   skip_tls     = {cfg['mail_skip_tls_verify']}")
+    print(f"  [硬编码] new_domain   = {NEW_DOMAIN}")
+    print(f"  [硬编码] old_domain   = {OLD_DOMAIN}")
+    print(f"  [硬编码] expire_date  = {EXPIRE_DATE}")
+    print(f"  [断点续发] state_file  = {args.state}")
+    print("=" * 56)
+
+    if not cfg["mail_account"] or not cfg["mail_smtp"]:
+        sys.exit("[FATAL] [mail] account/smtp 为空，无法发信，已中止。")
+
+    drv = _choose_driver(cfg, args)
+    print(f"  [DB 驱动] {drv}")
+
+    # 连接诊断：确认 psql 实际连到的库和用户
+    if drv == "psql":
+        try:
+            cur = run_query(cfg, "SELECT current_database(), current_user", args)
+            if cur and cur[0]:
+                print(f"  [DB 连接] database={cur[0][0]}  user={cur[0][1]}")
+        except Exception:  # noqa: BLE001
+            pass
+
+    # 定位 users 表（避免 search_path 命中别的 schema 里的同名空表）
+    users_table, schema_name, schema_info = resolve_users_table(cfg, args)
+    if schema_name:
+        others = "、".join(
+            f"{s}({c}行)" for s, c, _ in schema_info["all"] if s != schema_name
+        ) or "无"
+        print(
+            f"  [users 表] {schema_name}.users"
+            f"（{schema_info['rows']} 行，语言列={schema_info['lang_col'] or '无'}）；"
+            f"其他同名表：{others}"
+        )
+        if schema_info["rows"] == 0:
+            print("  [警告] 所有 schema 的 users 表均为空，请确认库名/连接串是否指向生产库！")
+    else:
+        print("  [users 表] users（未做 schema 定位，按默认 search_path）")
+
+    lang_expr, lang_name = detect_lang_column(cfg, args, users_table)
+    print(f"  [语言列] {lang_name if lang_name else '(无，全员回退默认语言 ' + str(cfg['app_default_lang']) + ')'}")
+    recipients = fetch_recipients(cfg, args, lang_expr=lang_expr, tbl=users_table)
+    counts = fetch_counts(cfg, args, tbl=users_table)
+
+    # 发送前先打印数据库统计，便于人工核对应发数量
+    print("数据库用户统计：")
+    print(f"  总用户数（含已注销）        : {counts['total']}")
+    print(f"  已注销用户数                : {counts['deactivated']}")
+    print(f"  未注销用户数                : {counts['active']}")
+    print(f"  未注销且有邮箱（应发送）    : {counts['active_with_email']}")
+    print(f"  未注销但无邮箱（跳过）      : {counts['active_no_email']}")
+
+    # 按语言分布（用于发送前核对）
+    lang_dist = {}
+    for r in recipients:
+        lg = resolve_lang(r.get("language"), cfg["app_default_lang"])
+        lang_dist[lg] = lang_dist.get(lg, 0) + 1
+    dist_parts = []
+    for lg in LANG_ORDER:
+        if lang_dist.get(lg):
+            dist_parts.append(f"{lg}({LANG_LABEL.get(lg, lg)}):{lang_dist[lg]}")
+    for lg in lang_dist:
+        if lg not in LANG_ORDER:
+            dist_parts.append(f"{lg}:{lang_dist[lg]}")
+    print(f"  按语言分布（应发送）        : {', '.join(dist_parts) if dist_parts else '-'}")
+
+    if args.to:
+        test_email = args.to.strip()
+        match = None
+        for r in recipients:
+            if (r.get("email") or "").strip().lower() == test_email.lower():
+                match = r
+                break
+        if match:
+            recipients = [match]
+            print(f"[测试模式] 命中数据库用户：{match['name'] or '(无名)'} "
+                  f"(lang={match['language'] or '空'})，套用该用户姓名/域名/语言发送")
+        else:
+            recipients = [{"name": "测试", "domain": "", "email": test_email, "language": "zh-CN"}]
+            print(f"[测试模式] 测试邮箱 {test_email} 在数据库中未找到，按简体中文（zh-CN）发送")
+
+    if args.limit and args.limit > 0:
+        if args.to:
+            print(f"[注意] --to 与 --limit 同时指定时，--limit 不生效（仅 1 个测试地址）。")
+        else:
+            recipients = recipients[: args.limit]
+            print(f"[限制] 仅发送前 {len(recipients)} 封。")
+
+    # 断点续发：读取已发清单，过滤掉已发送用户（测试 --to 模式不应用去重，避免污染清单）
+    skipped = 0
+    if not args.to:
+        sent_set = load_sent_state(args.state)
+        if args.reset_state:
+            if args.send:
+                reset_state(args.state)
+                sent_set = {}
+                print("  [断点续发] 已按 --reset-state 清空状态，将从头全量发送。")
+            else:
+                print("  [断点续发] --reset-state 仅在 --send 时生效，dry-run 未清空。")
+        if sent_set:
+            before = len(recipients)
+            recipients = [
+                r for r in recipients
+                if (r["email"] or "").strip().lower() not in sent_set
+            ]
+            skipped = before - len(recipients)
+            if skipped:
+                print(f"  [断点续发] 已跳过 {skipped} 封（此前已发送，见状态文件）")
+            print(f"  [断点续发] 剩余待发送：{len(recipients)} 封")
+
+    print(f"\n本次将发送：{len(recipients)} 封邮件。")
+
+    # ---- 监控报告骨架：运行结束写入报告文件，便于事后核查 / 监控 ----
+    report = {
+        "generated_at": datetime.now().strftime("%Y-%m-%d %H:%M:%S"),
+        "mode": "send" if args.send else "dry-run",
+        "config": {
+            "app_title": cfg["app_title"],
+            "mail_account": cfg["mail_account"] or "(空)",
+            "mail_smtp": cfg["mail_smtp"] or "(空)",
+            "db_type": cfg["db_type"],
+            "new_domain": NEW_DOMAIN,
+            "old_domain": OLD_DOMAIN,
+            "expire_date": EXPIRE_DATE,
+        },
+        "db_stats": counts,
+        "lang_distribution": dict(lang_dist),
+        "target": len(recipients),
+        "sent": 0,
+        "failed": 0,
+        "smtp_rejected": 0,
+        "skipped_already_sent": skipped,
+        "failed_list": [],
+        "test_mode": bool(args.to),
+        "test_email": args.to or None,
+        "state_file": args.state,
+        "report_file": None if args.no_report else args.report,
+    }
+
+    def write_report_now():
+        if args.no_report:
+            return
+        try:
+            with open(args.report, "w", encoding="utf-8") as f:
+                json.dump(report, f, ensure_ascii=False, indent=2)
+            print(f"\n[监控报告] 已写入：{args.report}")
+        except Exception as e:  # noqa: BLE001
+            print(f"[警告] 写入监控报告失败：{e}")
+
+    if not recipients:
+        report["note"] = "没有可发送的收件人"
+        write_report_now()
+        print("没有可发送的收件人，结束。")
+        return
+
+    # 预览前 3 条（邮箱打码）
+    print("预览收件人（前 3 条，邮箱打码）：")
+    for r in recipients[:3]:
+        e = r["email"]
+        masked = (e[:2] + "***" + e[e.rfind("@"):]) if "@" in e else e
+        print(f"  - {r['name'] or '(无名)'}  <{masked}>  domain={r['domain'] or '-'}  lang={r.get('language') or '-'}")
+
+    if not args.send:
+        write_report_now()
+        print("\n[dry-run] 未指定 --send，仅演练，未发送任何邮件。")
+        print("如需正式发送，请追加 --send（会先打印统计并要求输入 yes 确认；可先 --to 测试 / --limit 小批量）。")
+        return
+
+    # 真正发送：必须人工确认
+    if not args.yes:
+        try:
+            ans = input(
+                f"\n请确认向以上 {len(recipients)} 位用户发送域名变更通知（输入 yes 并回车继续，其他任意输入取消）："
+            ).strip().lower()
+        except EOFError:
+            print("\n[中止] 非交互环境未提供确认，已取消发送。如需自动确认请加 --yes。")
+            report["note"] = "非交互环境未确认，已取消"
+            write_report_now()
+            return
+        if ans not in ("yes", "y"):
+            print("[已取消] 未确认，未发送任何邮件。")
+            report["note"] = "用户取消"
+            write_report_now()
+            return
+
+    # 真正发送（按语言分组，控制节奏）
+    sent, failed = 0, []
+    smtp_rejected = 0
+    total = len(recipients)
+    print(f"\n[发送中] 目标 {total} 封，每封间隔 {args.delay}s"
+          + (f"，每组间隔 {args.group_pause}s" if args.group_pause > 0 else "")
+          + (f"，每 {args.pause_every} 封暂停 {args.pause_for}s" if args.pause_every > 0 else "") + " ...")
+
+    # 按语言分组，顺序固定：zh-CN, zh-TW, en, ja, 其他
+    groups = {}
+    for r in recipients:
+        lg = resolve_lang(r.get("language"), cfg["app_default_lang"])
+        groups.setdefault(lg, []).append(r)
+    group_order = [lg for lg in LANG_ORDER if lg in groups] + [lg for lg in groups if lg not in LANG_ORDER]
+
+    try:
+        server = smtp_login(cfg)
+    except Exception as e:  # noqa: BLE001
+        sys.exit(f"[FATAL] SMTP 登录失败: {e}")
+
+    try:
+        for gi, lg in enumerate(group_order, 1):
+            grp = groups[lg]
+            label = LANG_LABEL.get(lg, lg)
+            print(f"\n[语言分组 {gi}/{len(group_order)}] {lg} ({label}) : 本组 {len(grp)} 封")
+            for r in grp:
+                box_link = f"https://{NEW_DOMAIN}/_/{r['domain']}" if r["domain"] else f"https://{NEW_DOMAIN}"
+                subject, html, plain = effective_templates(lg, args)
+                ctx = {
+                    "name": r["name"] or "用户",
+                    "domain": r["domain"],
+                    "box_link": box_link,
+                    "site": f"https://{NEW_DOMAIN}",
+                    "site_title": cfg["app_title"],
+                    "old_domain": OLD_DOMAIN,
+                    "expire_date": EXPIRE_DATE,
+                }
+                msg = build_message(cfg, r["email"], ctx, subject, html, plain)
+                try:
+                    refused = server.send_message(msg)
+                    if refused:
+                        # RCPT TO 阶段有收件人被 SMTP 拒收：send_message 不抛异常，
+                        # 而是返回 {地址: (code, error)}；这种应计入失败而非成功
+                        refused_desc = "; ".join(f"{a} {c}:{err}" for a, (c, err) in refused.items())
+                        failed.append((r["email"], f"SMTP 拒收 {refused_desc}"))
+                        smtp_rejected += 1
+                        print(f"  [SMTP 拒收] {r['email']}: {refused_desc}")
+                    else:
+                        sent += 1
+                        # 记录断点续发状态（测试 --to 模式不记录，避免污染清单）
+                        if not args.to:
+                            record_sent(args.state, {"email": r["email"], "lang": lg, "ts": time.time()})
+                        if sent % 25 == 0 or sent == total:
+                            print(f"  进度 {sent}/{total}  已成功 {sent}")
+                except Exception as e:  # noqa: BLE001
+                    failed.append((r["email"], str(e)))
+                    print(f"  [失败] {r['email']}: {e}")
+                if sent < total:
+                    time.sleep(max(0.0, args.delay))
+                    if args.pause_every > 0 and sent % args.pause_every == 0:
+                        print(f"  [间隔] 已发 {sent} 封，暂停 {args.pause_for}s 防限流 ...")
+                        time.sleep(max(0.0, args.pause_for))
+            # 组间暂停
+            if args.group_pause > 0 and gi < len(group_order):
+                print(f"  [组间间隔] 下一组前暂停 {args.group_pause}s ...")
+                time.sleep(max(0.0, args.group_pause))
+    finally:
+        try:
+            server.quit()
+        except Exception:  # noqa: BLE001
+            pass
+
+    # 汇总到报告
+    report["sent"] = sent
+    report["failed"] = len(failed)
+    report["smtp_rejected"] = smtp_rejected
+    report["failed_list"] = [{"email": e, "error": err} for e, err in failed]
+    write_report_now()
+
+    print("\n" + "=" * 56)
+    print(f"发送完成：成功 {sent} 封，失败 {len(failed)} 封（其中 SMTP 拒收 {smtp_rejected} 封）。")
+    if not args.to and args.send:
+        print(f"断点续发状态已写入：{args.state}（重跑脚本会自动跳过已发用户）")
+    if failed:
+        print("失败清单：")
+        for e, err in failed:
+            print(f"  - {e}: {err}")
+    print("=" * 56)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/dev/overlay.json b/dev/overlay.json
new file mode 100644
index 0000000..ebb1692
--- /dev/null
+++ b/dev/overlay.json
@@ -0,0 +1 @@
+{"Replace": {"C:/OtherFiles/Github/TamaBox-v4-mainline/internal/storage/s3.go": "C:/Users/TAMAKY~1/AppData/Local/Temp/tamabox_s3_stub.go"}}
diff --git a/dev/s3stub/s3_stub.go b/dev/s3stub/s3_stub.go
new file mode 100644
index 0000000..2bc65ae
--- /dev/null
+++ b/dev/s3stub/s3_stub.go
@@ -0,0 +1,31 @@
+// s3_stub.go 是 internal/storage/s3.go 的本地编译桩：s3.go 依赖 cgo 库
+// chai2010/webp（需要 libwebp + C 工具链），Windows 沙箱无此环境。
+// 通过 `go build -overlay=dev/overlay.json` 用本文件替换 s3.go，做全模块类型检查。
+// 符号覆盖 = s3.go 中被包内其他文件（oss.go 引用 isSupportedImage）与
+// 包外调用方（route/user、route/question、route/chat 等）引用的全部标识符。
+// 桩仅在类型检查时生效，不会被真正调用；生产构建在 Linux（cgo + libwebp）下不受影响。
+package storage
+
+import (
+	"io"
+	"mime/multipart"
+)
+
+// MaxUploadBytes 与真实实现保持一致（8MB 单图上限，bodylimit 中间件依赖此值语义）。
+const MaxUploadBytes = 8 * 1024 * 1024
+
+func UploadPictureToS3(file multipart.File, fileHeader *multipart.FileHeader) (string, error) {
+	return "", nil
+}
+
+func UploadAvatarToS3(file multipart.File, fileHeader *multipart.FileHeader) (string, error) {
+	return "", nil
+}
+
+func UploadBackgroundToS3(file multipart.File, fileHeader *multipart.FileHeader) (string, error) {
+	return "", nil
+}
+
+func ConvertStaticImageToWebP(r io.Reader) ([]byte, error) { return nil, nil }
+
+func isSupportedImage(data []byte) bool { return true }
diff --git a/dev/security-selfcheck.sh b/dev/security-selfcheck.sh
new file mode 100644
index 0000000..d0faa2d
--- /dev/null
+++ b/dev/security-selfcheck.sh
@@ -0,0 +1,156 @@
+#!/usr/bin/env bash
+# TamaBox Cloudflare Tunnel 部署安全自检脚本
+#
+# 架构前提：
+#   访客 → Cloudflare 边缘（a.b.com 自定义主机名证书 / a.a.com 主域）
+#        → cloudflared Tunnel（源站仅出站连接）→ 127.0.0.1:5877 (TamaBox)
+#
+# 用法：
+#   第一部分（在源站服务器上执行）：  ./security-selfcheck.sh local
+#   第二部分（在你自己的电脑上执行）：SERVER_IP=源站公网IP CF_DOMAIN=a.a.com CUSTOM_DOMAIN=a.b.com ./security-selfcheck.sh remote
+#   两部分都跑：                     ./security-selfcheck.sh all
+#
+set -u
+
+MODE="${1:-all}"
+SERVER_IP="${SERVER_IP:-}"
+CF_DOMAIN="${CF_DOMAIN:-a.a.com}"
+CUSTOM_DOMAIN="${CUSTOM_DOMAIN:-a.b.com}"
+APP_PORT="${APP_PORT:-5877}"
+
+section() { printf "\n========== %s ==========\n" "$1"; }
+ok()      { echo "[✓] $1"; }
+warn()    { echo "[!] $1"; }
+bad()     { echo "[✗] $1"; }
+
+# 用 bash /dev/tcp 探测 TCP 端口是否可达（3 秒超时）
+port_open() {
+  (timeout 3 bash -c "echo > /dev/tcp/$1/$2") 2>/dev/null
+}
+
+# ----------------------------------------------------------------
+# 第一部分：源站本地检查
+# ----------------------------------------------------------------
+local_checks() {
+  section "1. 应用与数据库端口绑定检查（核心）"
+
+  BIND=$(ss -tlnp 2>/dev/null | grep ":${APP_PORT} " || true)
+  echo "$BIND"
+  if echo "$BIND" | grep -qE "127\.0\.0\.1:${APP_PORT}|\[::1\]:${APP_PORT}"; then
+    ok "TamaBox 只绑定在 127.0.0.1:${APP_PORT}，外部无法直连（正确）"
+  elif [ -z "$BIND" ]; then
+    warn "端口 ${APP_PORT} 未监听——确认 TamaBox 是否在运行"
+  else
+    bad "TamaBox 绑定在 0.0.0.0/*:${APP_PORT}（监听所有网卡）！"
+    echo "    修复：conf/app.ini [server] 段设置 listen = 127.0.0.1:${APP_PORT} 并重启"
+  fi
+
+  section "2. PostgreSQL / Redis 是否暴露公网"
+  for p in 5432 6379; do
+    BIND=$(ss -tlnp 2>/dev/null | grep ":${p} " || true)
+    if echo "$BIND" | grep -qE "0\.0\.0\.0:${p}|\*:${p}"; then
+      bad "端口 ${p} 绑定在所有网卡！必须改为 127.0.0.1 或加防火墙（云数据库直接暴露=高危）"
+    else
+      ok "端口 ${p} 未对外监听（${BIND:-未运行}）"
+    fi
+  done
+
+  section "3. cloudflared 状态与 ingress 配置"
+  if systemctl is-active --quiet cloudflared 2>/dev/null || pgrep -x cloudflared >/dev/null 2>&1; then
+    ok "cloudflared 正在运行"
+  else
+    bad "cloudflared 未运行——Tunnel 断开，所有域名不可达"
+  fi
+  CFG=""
+  for f in /etc/cloudflared/config.yml /root/.cloudflared/config.yml /home/*/.cloudflared/config.yml; do
+    [ -f "$f" ] && CFG="$f" && break
+  done
+  if [ -n "$CFG" ]; then
+    echo "配置文件：$CFG"
+    grep -nE "hostname|service|originRequest" "$CFG" || true
+    if grep -qE "service:\s*http://127\.0\.0\.1:${APP_PORT}|localhost:${APP_PORT}" "$CFG"; then
+      ok "ingress service 指向 127.0.0.1:${APP_PORT}（正确）"
+    else
+      warn "未在 config.yml 中找到指向 127.0.0.1:${APP_PORT} 的 service，请人工核对 ingress 规则"
+    fi
+  else
+    warn "未找到 config.yml（若用 token 模式 + 远端 ingress，请到 Cloudflare 面板核对 Public Hostname 的 service 地址）"
+  fi
+
+  section "4. 本地请求验证（模拟 cloudflared 的视角）"
+  RESP=$(curl -s -m 5 -o /dev/null -w "%{http_code}" "http://127.0.0.1:${APP_PORT}/" || true)
+  if [ "$RESP" = "200" ] || [ "$RESP" = "302" ] || [ "$RESP" = "303" ]; then
+    ok "本地 HTTP 请求返回 $RESP，应用正常"
+  else
+    warn "本地请求返回 ${RESP:-无响应}，请人工确认"
+  fi
+
+  section "5. 防火墙状态（仅供参考）"
+  if command -v ufw >/dev/null 2>&1; then
+    ufw status verbose 2>/dev/null | head -15 || true
+  elif command -v firewall-cmd >/dev/null 2>&1; then
+    firewall-cmd --list-all 2>/dev/null || true
+  else
+    iptables -L INPUT -n --line-numbers 2>/dev/null | head -15 || true
+  fi
+  warn "请人工确认：除 SSH(22) 外，80/443/5877 等端口不应有公网入站放行规则"
+}
+
+# ----------------------------------------------------------------
+# 第二部分：外部探测（在自己的电脑上执行）
+# ----------------------------------------------------------------
+remote_checks() {
+  if [ -z "$SERVER_IP" ]; then
+    bad "未设置 SERVER_IP 环境变量，跳过直连探测（用法见文件头注释）"
+  else
+    section "6. 直连源站 IP 探测（核心：防 IP+端口直连）"
+    for p in "$APP_PORT" 80 443 5432 6379; do
+      if port_open "$SERVER_IP" "$p"; then
+        case "$p" in
+          22)   warn "端口 22 开放（SSH，正常，但建议改密钥登录/限来源 IP）" ;;
+          *)    bad "端口 ${p} 从公网可达！存在被直连/攻击面，去服务器防火墙封掉它" ;;
+        esac
+      else
+        ok "端口 ${p} 从公网不可达"
+      fi
+    done
+  fi
+
+  section "7. 经域名的正常访问验证"
+  for d in "$CF_DOMAIN" "$CUSTOM_DOMAIN"; do
+    CODE=$(curl -s -m 10 -o /dev/null -w "%{http_code}" "https://${d}/" || true)
+    RAY=$(curl -sI -m 10 "https://${d}/" | grep -i "^cf-ray:" || true)
+    if [ -n "$RAY" ]; then
+      ok "https://${d}/ 返回 ${CODE:-?}，且带 ${RAY%%$'\r'} → 确认流量经过 Cloudflare 边缘"
+    elif [ "$CODE" = "200" ] || [ "$CODE" = "302" ] || [ "$CODE" = "303" ]; then
+      warn "https://${d}/ 返回 ${CODE} 但没有 cf-ray 头 → 流量可能没走 Cloudflare（自定义主机名未生效？）"
+    else
+      bad "https://${d}/ 不可达（${CODE:-无响应}）"
+    fi
+  done
+
+  section "8. 伪造头穿透测试（验证 Cloudflare 会重写伪造头）"
+  # 若伪造头被 CF 覆盖，应用侧记录的仍是真实 IP；此测试主要用于演示，无法从响应直接观察，
+  # 需配合 TamaBox 侧日志/封禁记录核对（见第 9 项说明）。
+  curl -s -m 10 -o /dev/null \
+    -H "CF-Connecting-IP: 203.0.113.66" \
+    -H "X-Forwarded-For: 203.0.113.66" \
+    "https://${CUSTOM_DOMAIN}/" || true
+  ok "已发送带伪造 CF-Connecting-IP 的请求（CF 边缘会将其重写为你的真实 IP）"
+
+  section "9. HTTP 明文与 HSTS 检查"
+  LOC=$(curl -sI -m 10 "http://${CUSTOM_DOMAIN}/" | grep -iE "^(HTTP|location):" | tr -d '\r')
+  echo "$LOC"
+  HSTS=$(curl -sI -m 10 "https://${CUSTOM_DOMAIN}/" | grep -i "strict-transport-security" | tr -d '\r')
+  if [ -n "$HSTS" ]; then ok "$HSTS"; else warn "未返回 HSTS 头（若浏览器直访 http 可能被中间人，建议确认 securityHeaders 已生效）"; fi
+}
+
+case "$MODE" in
+  local)  local_checks ;;
+  remote) remote_checks ;;
+  all)    local_checks; remote_checks ;;
+  *) echo "用法: $0 {local|remote|all}"; exit 1 ;;
+esac
+
+section "自检完成"
+echo "逐项核对上面的 [✓]/[!]/[✗]，所有 [✗] 都需要修复后再跑一遍。"
diff --git a/dev/time.box.js b/dev/time.box.js
new file mode 100644
index 0000000..2d0978c
--- /dev/null
+++ b/dev/time.box.js
@@ -0,0 +1,44 @@
+function secondToDate(second) {
+	    if (!second) {
+		            return 0;
+		        }
+	    var time = new Array(0, 0, 0, 0, 0);
+	    if (second >= 365 * 24 * 3600) {
+		            time[0] = parseInt(second / (365 * 24 * 3600));
+		            second %= 365 * 24 * 3600;
+		        }
+	    if (second >= 24 * 3600) {
+		            time[1] = parseInt(second / (24 * 3600));
+		            second %= 24 * 3600;
+		        }
+	    if (second >= 3600) {
+		            time[2] = parseInt(second / 3600);
+		            second %= 3600;
+		        }
+	    if (second >= 60) {
+		            time[3] = parseInt(second / 60);
+		            second %= 60;
+		        }
+	    if (second > 0) {
+		            time[4] = second;
+		        }
+	    return time;
+}
+function setTime() {
+	    var create_time = Math.round(new Date(Date.UTC(2023, 06, 01, 18, 15, 43)).getTime() / 1000);
+	    var timestamp = Math.round((new Date().getTime() + 8 * 60 * 60 * 1000) / 1000);
+	    currentTime = secondToDate((timestamp - create_time));
+	    currentTimeHtml = currentTime[0] + '年 ' + currentTime[1] + '天 ' + currentTime[2] + '时 ' + currentTime[3] + '分 ' + currentTime[4] + '秒 ';
+	    document.getElementById("box_runtime").innerHTML = currentTimeHtml;
+        var boxRuntime = document.getElementById("box_runtime");
+        if (boxRuntime) {
+            boxRuntime.innerHTML = currentTimeHtml;
+        } else {
+            console.error("Element with id 'box_runtime' not found!");
+        }
+    }
+
+    // 确保 DOM 加载完成后执行
+    document.addEventListener('DOMContentLoaded', function() {
+        setInterval(setTime, 1000);
+	});
\ No newline at end of file
diff --git a/dev/webpstub/webp.go b/dev/webpstub/webp.go
new file mode 100644
index 0000000..a6a46d6
--- /dev/null
+++ b/dev/webpstub/webp.go
@@ -0,0 +1,20 @@
+// webpstub（package webp）是 chai2010/webp 的本地编译桩：仅用于在缺少 libwebp 的
+// Windows 沙箱中通过 `go build -overlay` 对依赖 internal/storage 的包做完整
+// 类型检查。API 只覆盖项目实际用到的 Encode/Options。
+package webp
+
+import (
+	"image"
+	"io"
+)
+
+// Options 与 github.com/chai2010/webp 的 Options 字段保持兼容（项目仅用 Quality）。
+type Options struct {
+	Lossless bool
+	Quality  float32
+}
+
+// Encode 是 webp.Encode 的签名兼容桩（类型检查期间不会被真正调用）。
+func Encode(w io.Writer, m image.Image, o *Options) error {
+	return nil
+}
diff --git a/go.mod b/go.mod
new file mode 100644
index 0000000..f0b5403
--- /dev/null
+++ b/go.mod
@@ -0,0 +1,163 @@
+module github.com/tamakyi/TamaBox
+
+go 1.25.0
+
+replace golang.org/x/image => golang.org/x/image v0.13.0
+
+require (
+	github.com/aliyun/alibaba-cloud-sdk-go v1.62.26
+	github.com/aliyun/aliyun-oss-go-sdk v2.2.4+incompatible
+	github.com/aws/aws-sdk-go-v2 v1.24.0
+	github.com/aws/aws-sdk-go-v2/config v1.26.1
+	github.com/aws/aws-sdk-go-v2/credentials v1.16.12
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.47.5
+	github.com/chai2010/webp v1.4.0
+	github.com/disintegration/imaging v1.6.2
+	github.com/flamego/cache v1.1.0
+	github.com/flamego/csrf v1.3.0
+	github.com/flamego/flamego v1.9.4
+	github.com/flamego/recaptcha v1.2.0
+	github.com/flamego/session v1.6.5
+	github.com/flamego/template v1.2.2
+	github.com/go-sql-driver/mysql v1.8.1
+	github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0
+	github.com/jackc/pgconn v1.13.0
+	github.com/pkg/errors v0.9.1
+	github.com/projectdiscovery/cdncheck v1.3.0
+	github.com/qiniu/go-sdk/v7 v7.13.0
+	github.com/rs/xid v1.5.0
+	github.com/russross/blackfriday/v2 v2.1.0
+	github.com/samber/lo v1.34.0
+	github.com/sirupsen/logrus v1.9.3
+	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
+	github.com/stretchr/testify v1.11.1
+	github.com/tdewolff/minify/v2 v2.12.4
+	github.com/thanhpk/randstr v1.0.4
+	github.com/unknwon/com v1.0.1
+	github.com/uptrace/opentelemetry-go-extra/otelgorm v0.1.16
+	github.com/uptrace/opentelemetry-go-extra/otellogrus v0.1.16
+	github.com/uptrace/uptrace-go v1.9.0
+	github.com/urfave/cli/v2 v2.26.0
+	github.com/wuhan005/gadget v0.0.0-20221206194113-7619e407f1a0
+	github.com/wuhan005/govalid v0.0.0-20230216091828-820aa255fd21
+	github.com/xuri/excelize/v2 v2.6.0
+	go.opentelemetry.io/otel v1.10.0
+	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.9.0
+	go.opentelemetry.io/otel/sdk v1.9.0
+	go.opentelemetry.io/otel/trace v1.10.0
+	golang.org/x/crypto v0.54.0
+	golang.org/x/net v0.56.0
+	gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df
+	gopkg.in/ini.v1 v1.66.2
+	gorm.io/datatypes v1.0.7
+	gorm.io/driver/mysql v1.3.6
+	gorm.io/driver/postgres v1.4.5
+	gorm.io/gorm v1.24.1-0.20221019064659-5dd2bb482755
+)
+
+require (
+	filippo.io/edwards25519 v1.1.0 // indirect
+	github.com/alecthomas/participle/v2 v2.0.0 // indirect
+	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.5.4 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.10 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.9 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.9 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.2.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.2.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.16.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.18.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.26.5 // indirect
+	github.com/aws/smithy-go v1.19.0 // indirect
+	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
+	github.com/aymerick/douceur v0.2.0 // indirect
+	github.com/baiyubin/aliyun-sts-go-sdk v0.0.0-20180326062324-cfa1a18b161f // indirect
+	github.com/cenkalti/backoff/v4 v4.1.3 // indirect
+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/charmbracelet/lipgloss v0.13.0 // indirect
+	github.com/charmbracelet/log v0.2.3 // indirect
+	github.com/charmbracelet/x/ansi v0.3.2 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.3 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
+	github.com/gaissmai/bart v0.26.1 // indirect
+	github.com/go-logfmt/logfmt v0.6.0 // indirect
+	github.com/go-logr/logr v1.3.0 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-redis/redis/v8 v8.11.5 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/gopherjs/gopherjs v0.0.0-20190430165422-3e4dfb77656c // indirect
+	github.com/gorilla/css v1.0.1 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3 // indirect
+	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
+	github.com/jackc/pgio v1.0.0 // indirect
+	github.com/jackc/pgpassfile v1.0.0 // indirect
+	github.com/jackc/pgproto3/v2 v2.3.1 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
+	github.com/jackc/pgtype v1.12.0 // indirect
+	github.com/jackc/pgx/v4 v4.17.2 // indirect
+	github.com/jinzhu/inflection v1.0.0 // indirect
+	github.com/jinzhu/now v1.1.5 // indirect
+	github.com/jmespath/go-jmespath v0.4.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/kr/pretty v0.3.1 // indirect
+	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/microcosm-cc/bluemonday v1.0.27 // indirect
+	github.com/miekg/dns v1.1.72 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect
+	github.com/muesli/termenv v0.15.3-0.20240618155329-98d742f6907a // indirect
+	github.com/onsi/gomega v1.29.0 // indirect
+	github.com/opentracing/opentracing-go v1.2.1-0.20220228012449-10b1cf09e00b // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/projectdiscovery/blackrock v0.0.2 // indirect
+	github.com/projectdiscovery/retryabledns v1.0.115 // indirect
+	github.com/projectdiscovery/utils v0.11.1 // indirect
+	github.com/redis/go-redis/v9 v9.5.1 // indirect
+	github.com/richardlehane/mscfb v1.0.4 // indirect
+	github.com/richardlehane/msoleps v1.0.1 // indirect
+	github.com/rivo/uniseg v0.4.7 // indirect
+	github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d // indirect
+	github.com/smartystreets/assertions v1.0.1 // indirect
+	github.com/tdewolff/parse/v2 v2.6.4 // indirect
+	github.com/tidwall/gjson v1.18.0 // indirect
+	github.com/tidwall/match v1.2.0 // indirect
+	github.com/tidwall/pretty v1.2.1 // indirect
+	github.com/uptrace/opentelemetry-go-extra/otelsql v0.1.16 // indirect
+	github.com/uptrace/opentelemetry-go-extra/otelutil v0.1.16 // indirect
+	github.com/weppos/publicsuffix-go v0.50.3-0.20260104170930-90713dec78f2 // indirect
+	github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
+	github.com/xuri/efp v0.0.0-20220407160117-ad0f7a785be8 // indirect
+	github.com/xuri/nfp v0.0.0-20220409054826-5e722a1d9e22 // indirect
+	go.opentelemetry.io/contrib/instrumentation/runtime v0.34.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.9.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric v0.31.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v0.31.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.9.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.9.0 // indirect
+	go.opentelemetry.io/otel/metric v0.32.1 // indirect
+	go.opentelemetry.io/otel/sdk/metric v0.31.0 // indirect
+	go.opentelemetry.io/proto/otlp v0.19.0 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	golang.org/x/exp v0.0.0-20260112195511-716be5621a96 // indirect
+	golang.org/x/image v0.13.0 // indirect
+	golang.org/x/mod v0.37.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/time v0.0.0-20191024005414-555d28b269f0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
+	google.golang.org/genproto v0.0.0-20231120223509-83a465c0220f // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20231127180814-3a041ad873d4 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20231127180814-3a041ad873d4 // indirect
+	google.golang.org/grpc v1.59.0 // indirect
+	google.golang.org/protobuf v1.33.0 // indirect
+	gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)
diff --git a/go.sum b/go.sum
new file mode 100644
index 0000000..68ce297
--- /dev/null
+++ b/go.sum
@@ -0,0 +1,1020 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
+cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
+cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
+cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
+cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
+cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To=
+cloud.google.com/go v0.52.0/go.mod h1:pXajvRH/6o3+F9jDHZWQ5PbGhn+o8w9qiu/CffaVdO4=
+cloud.google.com/go v0.53.0/go.mod h1:fp/UouUEsRkN6ryDKNW/Upv/JBKnv6WDthjR6+vze6M=
+cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bPc=
+cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk=
+cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
+cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
+cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
+cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
+cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
+cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
+cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
+cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
+cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
+cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
+cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
+cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
+cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
+cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
+cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
+cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
+cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
+cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
+cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
+cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
+dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
+filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
+filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v0.19.0/go.mod h1:h6H6c8enJmmocHUbLiiGY6sx7f9i+X3m1CHdd5c6Rdw=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v0.11.0/go.mod h1:HcM1YX14R7CJcghJGOYCgdezslRSVzqwLf/q+4Y2r/0=
+github.com/Azure/azure-sdk-for-go/sdk/internal v0.7.0/go.mod h1:yqy467j36fJxcRV2TzfVZ1pCb5vxm4BtZPUdYWe/Xo8=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
+github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
+github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
+github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
+github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
+github.com/alecthomas/assert/v2 v2.2.2 h1:Z/iVC0xZfWTaFNE6bA3z07T86hd45Xe2eLt6WVy2bbk=
+github.com/alecthomas/assert/v2 v2.2.2/go.mod h1:pXcQ2Asjp247dahGEmsZ6ru0UVwnkhktn7S0bBDLxvQ=
+github.com/alecthomas/participle/v2 v2.0.0-alpha7/go.mod h1:NumScqsC42o9x+dGj8/YqsIfhrIQjFEOFovxotbBirA=
+github.com/alecthomas/participle/v2 v2.0.0 h1:Fgrq+MbuSsJwIkw3fEj9h75vDP0Er5JzepJ0/HNHv0g=
+github.com/alecthomas/participle/v2 v2.0.0/go.mod h1:rAKZdJldHu8084ojcWevWAL8KmEU+AT+Olodb+WoN2Y=
+github.com/alecthomas/repr v0.0.0-20181024024818-d37bc2a10ba1/go.mod h1:xTS7Pm1pD1mvyM075QCDSRqH6qRLXylzS24ZTpRiSzQ=
+github.com/alecthomas/repr v0.2.0 h1:HAzS41CIzNW5syS8Mf9UwXhNH1J9aix/BvDRf1Ml2Yk=
+github.com/alecthomas/repr v0.2.0/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
+github.com/aliyun/alibaba-cloud-sdk-go v1.62.26 h1:WvhbWN/8MqYY20LVi6vqkZ1ZHUibvnUoV9IF4jKA/Kw=
+github.com/aliyun/alibaba-cloud-sdk-go v1.62.26/go.mod h1:Api2AkmMgGaSUAhmk76oaFObkoeCPc/bKAqcyplPODs=
+github.com/aliyun/aliyun-oss-go-sdk v2.2.4+incompatible h1:cD1bK/FmYTpL+r5i9lQ9EU6ScAjA173EVsii7gAc6SQ=
+github.com/aliyun/aliyun-oss-go-sdk v2.2.4+incompatible/go.mod h1:T/Aws4fEfogEE9v+HPhhw+CntffsBHJ8nXQCwKr0/g8=
+github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
+github.com/aws/aws-sdk-go-v2 v1.24.0 h1:890+mqQ+hTpNuw0gGP6/4akolQkSToDJgHfQE7AwGuk=
+github.com/aws/aws-sdk-go-v2 v1.24.0/go.mod h1:LNh45Br1YAkEKaAqvmE1m8FUx6a5b/V0oAKV7of29b4=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.5.4 h1:OCs21ST2LrepDfD3lwlQiOqIGp6JiEUqG84GzTDoyJs=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.5.4/go.mod h1:usURWEKSNNAcAZuzRn/9ZYPT8aZQkR7xcCtunK/LkJo=
+github.com/aws/aws-sdk-go-v2/config v1.26.1 h1:z6DqMxclFGL3Zfo+4Q0rLnAZ6yVkzCRxhRMsiRQnD1o=
+github.com/aws/aws-sdk-go-v2/config v1.26.1/go.mod h1:ZB+CuKHRbb5v5F0oJtGdhFTelmrxd4iWO1lf0rQwSAg=
+github.com/aws/aws-sdk-go-v2/credentials v1.16.12 h1:v/WgB8NxprNvr5inKIiVVrXPuuTegM+K8nncFkr1usU=
+github.com/aws/aws-sdk-go-v2/credentials v1.16.12/go.mod h1:X21k0FjEJe+/pauud82HYiQbEr9jRKY3kXEIQ4hXeTQ=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.10 h1:w98BT5w+ao1/r5sUuiH6JkVzjowOKeOJRHERyy1vh58=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.10/go.mod h1:K2WGI7vUvkIv1HoNbfBA1bvIZ+9kL3YVmWxeKuLQsiw=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.9 h1:v+HbZaCGmOwnTTVS86Fleq0vPzOd7tnJGbFhP0stNLs=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.9/go.mod h1:Xjqy+Nyj7VDLBtCMkQYOw1QYfAEZCVLrfI0ezve8wd4=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.9 h1:N94sVhRACtXyVcjXxrwK1SKFIJrA9pOJ5yu2eSHnmls=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.9/go.mod h1:hqamLz7g1/4EJP+GH5NBhcUMLjW+gKLQabgyz6/7WAU=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2 h1:GrSw8s0Gs/5zZ0SX+gX4zQjRnRsMJDJ2sLur1gRBhEM=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2/go.mod h1:6fQQgfuGmw8Al/3M2IgIllycxV7ZW7WCdVSqfBeUiCY=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.2.9 h1:ugD6qzjYtB7zM5PN/ZIeaAIyefPaD82G8+SJopgvUpw=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.2.9/go.mod h1:YD0aYBWCrPENpHolhKw2XDlTIWae2GKXT1T4o6N6hiM=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4 h1:/b31bi3YVNlkzkBrm9LfpaKoaYZUxIAj4sHfOTmLfqw=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4/go.mod h1:2aGXHFmbInwgP9ZfpmdIfOELL79zhdNYNmReK8qDfdQ=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.2.9 h1:/90OR2XbSYfXucBMJ4U14wrjlfleq/0SB6dZDPncgmo=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.2.9/go.mod h1:dN/Of9/fNZet7UrQQ6kTDo/VSwKPIq94vjlU16bRARc=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.9 h1:Nf2sHxjMJR8CSImIVCONRi4g0Su3J+TSTbS7G0pUeMU=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.9/go.mod h1:idky4TER38YIjr2cADF1/ugFMKvZV7p//pVeV5LZbF0=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.16.9 h1:iEAeF6YC3l4FzlJPP9H3Ko1TXpdjdqWffxXjp8SY6uk=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.16.9/go.mod h1:kjsXoK23q9Z/tLBrckZLLyvjhZoS+AGrzqzUfEClvMM=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.47.5 h1:Keso8lIOS+IzI2MkPZyK6G0LYcK3My2LQ+T5bxghEAY=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.47.5/go.mod h1:vADO6Jn+Rq4nDtfwNjhgR84qkZwiC6FqCaXdw/kYwjA=
+github.com/aws/aws-sdk-go-v2/service/sso v1.18.5 h1:ldSFWz9tEHAwHNmjx2Cvy1MjP5/L9kNoR0skc6wyOOM=
+github.com/aws/aws-sdk-go-v2/service/sso v1.18.5/go.mod h1:CaFfXLYL376jgbP7VKC96uFcU8Rlavak0UlAwk1Dlhc=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.5 h1:2k9KmFawS63euAkY4/ixVNsYYwrwnd5fIvgEKkfZFNM=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.5/go.mod h1:W+nd4wWDVkSUIox9bacmkBP5NMFQeTJ/xqNabpzSR38=
+github.com/aws/aws-sdk-go-v2/service/sts v1.26.5 h1:5UYvv8JUvllZsRnfrcMQ+hJ9jNICmcgKPAO1CER25Wg=
+github.com/aws/aws-sdk-go-v2/service/sts v1.26.5/go.mod h1:XX5gh4CB7wAs4KhcF46G6C8a2i7eupU19dcAAE+EydU=
+github.com/aws/smithy-go v1.19.0 h1:KWFKQV80DpP3vJrrA9sVAHQ5gc2z8i4EzrLhLlWXcBM=
+github.com/aws/smithy-go v1.19.0/go.mod h1:NukqUGpCZIILqqiV0NIjeFh24kd/FAa4beRb6nbIUPE=
+github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
+github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
+github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
+github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
+github.com/baiyubin/aliyun-sts-go-sdk v0.0.0-20180326062324-cfa1a18b161f h1:ZNv7On9kyUzm7fvRZumSyy/IUiSC7AzL0I1jKKtwooA=
+github.com/baiyubin/aliyun-sts-go-sdk v0.0.0-20180326062324-cfa1a18b161f/go.mod h1:AuiFmCCPBSrqvVMvuqFuk0qogytodnVFVSN5CeJB8Gc=
+github.com/benbjohnson/clock v1.3.0 h1:ip6w0uFQkncKQ979AypyG0ER7mqUSBdKLOgAle/AT8A=
+github.com/benbjohnson/clock v1.3.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
+github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
+github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
+github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
+github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
+github.com/cenkalti/backoff/v4 v4.1.3 h1:cFAlzYUlVYDysBEH2T5hyJZMh3+5+WCBvSnK6Q8UtC4=
+github.com/cenkalti/backoff/v4 v4.1.3/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
+github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
+github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
+github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
+github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/chai2010/webp v1.4.0 h1:6DA2pkkRUPnbOHvvsmGI3He1hBKf/bkRlniAiSGuEko=
+github.com/chai2010/webp v1.4.0/go.mod h1:0XVwvZWdjjdxpUEIf7b9g9VkHFnInUSYujwqTLEuldU=
+github.com/charmbracelet/lipgloss v0.13.0 h1:4X3PPeoWEDCMvzDvGmTajSyYPcZM4+y8sCA/SsA3cjw=
+github.com/charmbracelet/lipgloss v0.13.0/go.mod h1:nw4zy0SBX/F/eAO1cWdcvy6qnkDUxr8Lw7dvFrAIbbY=
+github.com/charmbracelet/log v0.2.3 h1:YVmBhJtpGL7nW/nlf5u+SEloU8XYljxozGzZpgwIvhs=
+github.com/charmbracelet/log v0.2.3/go.mod h1:ZApwwzDbbETVTIRTk7724yQRJAXIktt98yGVMMaa3y8=
+github.com/charmbracelet/x/ansi v0.3.2 h1:wsEwgAN+C9U06l9dCVMX0/L3x7ptvY1qmjMwyfE6USY=
+github.com/charmbracelet/x/ansi v0.3.2/go.mod h1:dk73KoMTT5AX5BsX0KrqhsTqAnhZZoCBjs7dGWp4Ktw=
+github.com/cheekybits/is v0.0.0-20150225183255-68e9c0620927/go.mod h1:h/aW8ynjgkuj+NQRlZcDbAbM1ORAbXjXX77sX7T289U=
+github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
+github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
+github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
+github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
+github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
+github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cockroachdb/apd v1.1.0 h1:3LFP3629v+1aKXU5Q37mxmRxX/pIu1nijXydLShEq5I=
+github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ=
+github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/cpuguy83/go-md2man/v2 v2.0.3 h1:qMCsGGgs+MAzDFyp9LpAe1Lqy/fY/qCovCm0qnXZOBM=
+github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/denisenkom/go-mssqldb v0.12.0 h1:VtrkII767ttSPNRfFekePK3sctr+joXgO58stqQbtUA=
+github.com/denisenkom/go-mssqldb v0.12.0/go.mod h1:iiK0YP1ZeepvmBQk/QpLEhhTNJgfzrpArPY/aFvc9yU=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
+github.com/disintegration/imaging v1.6.2 h1:w1LecBlG2Lnp8B3jk5zSuNqd7b4DXhcjwek1ei82L+c=
+github.com/disintegration/imaging v1.6.2/go.mod h1:44/5580QXChDfwIclfc/PCwrr44amcmDAg8hxG0Ewe4=
+github.com/djherbis/atime v1.1.0/go.mod h1:28OF6Y8s3NQWwacXc5eZTsEsiMzp7LF8MbXE+XJPdBE=
+github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
+github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
+github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
+github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
+github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
+github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
+github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/fatih/color v1.10.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
+github.com/flamego/cache v1.1.0 h1:/zvvyzR10qbWrYu8RoOCdrZVW5RVldlDqON1763GPDc=
+github.com/flamego/cache v1.1.0/go.mod h1:tKq5uIx2jF5r4U2fJcH6JK1wo0CkwLhI4UeWzldmS0s=
+github.com/flamego/csrf v1.3.0 h1:rbbn9Iippu0iZdBudt6diMtzD8T69s+TZQmsZzCOfdc=
+github.com/flamego/csrf v1.3.0/go.mod h1:lB4vmeiEE7TJsw02EbjLP6QxY/iPX+2wabmel3/ODYg=
+github.com/flamego/flamego v1.0.0/go.mod h1:apiAxIxeHujHFX4Yr0BHmQFJuZUM07XztdQSChbeuPw=
+github.com/flamego/flamego v1.9.4 h1:SNsooIfNa6ljQM1rBmfg4cFcXPIhQdG/uvNHqXxPvD8=
+github.com/flamego/flamego v1.9.4/go.mod h1:2tAVbugA3fgX8xOBoqR2jmJSSvZDLBFGXTFCR5h5eAU=
+github.com/flamego/recaptcha v1.2.0 h1:sfaUwDmD2Y0AugWRo9s6p2Qpt8vceog0YWsgA8jCrbM=
+github.com/flamego/recaptcha v1.2.0/go.mod h1:n0pZ4moxi/itCYong9SZPUt7XnFR1kEN2GHJ6pq0KLU=
+github.com/flamego/session v1.6.5 h1:YlQfMGjV84JcGihg5OjufKP5qOh/05iOfHYrf5qta5I=
+github.com/flamego/session v1.6.5/go.mod h1:EhBKxrWSmkqa2XwQSC6WbwXn7pLzyFY0BREtTwJBpQU=
+github.com/flamego/template v1.2.2 h1:aMpt8RzXBb2ZGuABf9p/q8oBBpXrurUV8rgBbz7mj2o=
+github.com/flamego/template v1.2.2/go.mod h1:xTAmwCCPaOuxN5t4CpzOP7WZN5WkLRiJfJCpsiB0aUg=
+github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
+github.com/fsnotify/fsnotify v1.5.4 h1:jRbGcIw6P2Meqdwuo0H1p6JVLbL5DHKAKlYndzMwVZI=
+github.com/fsnotify/fsnotify v1.5.4/go.mod h1:OVB6XrOHzAwXMpEM7uPOzcehqUV2UqJxmVXmkdnm1bU=
+github.com/gaissmai/bart v0.26.1 h1:+w4rnLGNlA2GDVn382Tfe3jOsK5vOr5n4KmigJ9lbTo=
+github.com/gaissmai/bart v0.26.1/go.mod h1:GREWQfTLRWz/c5FTOsIw+KkscuFkIV5t8Rp7Nd1Td5c=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
+github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
+github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
+github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
+github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
+github.com/go-logfmt/logfmt v0.6.0 h1:wGYYu3uicYdqXVgoYbvnkrPVXkuLM1p1ifugDMEdRi4=
+github.com/go-logfmt/logfmt v0.6.0/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.3.0 h1:2y3SDp0ZXuc6/cjLSZ+Q3ir+QB9T/iG5yYRXqsagWSY=
+github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-playground/assert/v2 v2.0.1/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
+github.com/go-playground/locales v0.13.0/go.mod h1:taPMhCMXrRLJO55olJkUXHZBHCxTMfnGwq/HNwmWNS8=
+github.com/go-playground/locales v0.14.0/go.mod h1:sawfccIbzZTqEDETgFXqTho0QybSa7l++s0DH+LDiLs=
+github.com/go-playground/universal-translator v0.17.0/go.mod h1:UkSxE5sNxxRwHyU+Scu5vgOQjsIJAF8j9muTVoKLVtA=
+github.com/go-playground/universal-translator v0.18.0/go.mod h1:UvRDBj+xPUEGrFYl+lu/H90nyDXpg0fqeB/AQUGNTVA=
+github.com/go-playground/validator/v10 v10.8.0/go.mod h1:9JhgTzTaE31GZDpH/HSvHiRJrJ3iKAgqqH0Bl/Ocjdk=
+github.com/go-redis/redis/v8 v8.11.4/go.mod h1:2Z2wHZXdQpCDXEGzqMockDpNyYvi2l4Pxt6RJr792+w=
+github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC0oI=
+github.com/go-redis/redis/v8 v8.11.5/go.mod h1:gREzHqY1hg6oD9ngVRbLStwAWKhA0FEgq8Jd4h5lpwo=
+github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
+github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
+github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
+github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
+github.com/gofrs/uuid v4.0.0+incompatible h1:1SD/1F5pU8p29ybwgQSwpQk+mwdRrXCYuPhW6m+TnJw=
+github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
+github.com/goji/httpauth v0.0.0-20160601135302-2da839ab0f4d/go.mod h1:nnjvkQ9ptGaCkuDUx6wNykzzlUixGxvkme+H/lnzb+A=
+github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
+github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 h1:au07oEsX2xN0ktxqI+Sida1w446QrXBRJ0nee3SNZlA=
+github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
+github.com/golang-sql/sqlexp v0.0.0-20170517235910-f1bb20e5a188 h1:+eHOFJl1BaXrQxKX+T06f78590z4qA2ZzBTqahsKSE4=
+github.com/golang-sql/sqlexp v0.0.0-20170517235910-f1bb20e5a188/go.mod h1:vXjM/+wXQnTPR4KqTKDgJukSZ6amVRtWMPEjE6sQoK8=
+github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 h1:DACJavvAHhabrF08vX0COfcOBJRhZ8lUbR+ZWIs0Y5g=
+github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/glog v1.0.0/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4=
+github.com/golang/glog v1.1.2 h1:DVjP2PbBOzHyzA+dn3WhHIq4NdVu3Q+pvivFICf/7fo=
+github.com/golang/glog v1.1.2/go.mod h1:zR+okUeTbrL6EL3xHUDxZuEtGv04p5shwip1+mL/rLQ=
+github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
+github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
+github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
+github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
+github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
+github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
+github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
+github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
+github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
+github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
+github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
+github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
+github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
+github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
+github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
+github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
+github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
+github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
+github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
+github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
+github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
+github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
+github.com/gopherjs/gopherjs v0.0.0-20190430165422-3e4dfb77656c h1:7lF+Vz0LqiRidnzC1Oq86fpX1q/iEv2KJdrCtttYjT4=
+github.com/gopherjs/gopherjs v0.0.0-20190430165422-3e4dfb77656c/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
+github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
+github.com/gorilla/css v1.0.1/go.mod h1:BvnYkspnSzMmwRK+b8/xgNPLiIuNZr6vbZBTPQ2A3b0=
+github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0/go.mod h1:hgWBS7lorOAVIJEQMi4ZsPv9hVvWI6+ch50m39Pf2Ks=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3 h1:lLT7ZLSzGLI08vc9cpd+tYmNWjdKDqyr/2L+f6U12Fk=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3/go.mod h1:o//XUCC/F+yRGJoPO/VU0GSB0f8Nhgmxx0VIRUvaC0w=
+github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
+github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
+github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
+github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
+github.com/jackc/chunkreader v1.0.0/go.mod h1:RT6O25fNZIuasFJRyZ4R/Y2BbhasbmZXF9QQ7T3kePo=
+github.com/jackc/chunkreader/v2 v2.0.0/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
+github.com/jackc/chunkreader/v2 v2.0.1 h1:i+RDz65UE+mmpjTfyz0MoVTnzeYxroil2G82ki7MGG8=
+github.com/jackc/chunkreader/v2 v2.0.1/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
+github.com/jackc/pgconn v0.0.0-20190420214824-7e0022ef6ba3/go.mod h1:jkELnwuX+w9qN5YIfX0fl88Ehu4XC3keFuOJJk9pcnA=
+github.com/jackc/pgconn v0.0.0-20190824142844-760dd75542eb/go.mod h1:lLjNuW/+OfW9/pnVKPazfWOgNfH2aPem8YQ7ilXGvJE=
+github.com/jackc/pgconn v0.0.0-20190831204454-2fabfa3c18b7/go.mod h1:ZJKsE/KZfsUgOEh9hBm+xYTstcNHg7UPMVJqRfQxq4s=
+github.com/jackc/pgconn v1.8.0/go.mod h1:1C2Pb36bGIP9QHGBYCjnyhqu7Rv3sGshaQUvmfGIB/o=
+github.com/jackc/pgconn v1.9.0/go.mod h1:YctiPyvzfU11JFxoXokUOOKQXQmDMoJL9vJzHH8/2JY=
+github.com/jackc/pgconn v1.9.1-0.20210724152538-d89c8390a530/go.mod h1:4z2w8XhRbP1hYxkpTuBjTS3ne3J48K83+u0zoyvg2pI=
+github.com/jackc/pgconn v1.10.0/go.mod h1:4z2w8XhRbP1hYxkpTuBjTS3ne3J48K83+u0zoyvg2pI=
+github.com/jackc/pgconn v1.11.0/go.mod h1:4z2w8XhRbP1hYxkpTuBjTS3ne3J48K83+u0zoyvg2pI=
+github.com/jackc/pgconn v1.13.0 h1:3L1XMNV2Zvca/8BYhzcRFS70Lr0WlDg16Di6SFGAbys=
+github.com/jackc/pgconn v1.13.0/go.mod h1:AnowpAqO4CMIIJNZl2VJp+KrkAZciAkhEl0W0JIobpI=
+github.com/jackc/pgio v1.0.0 h1:g12B9UwVnzGhueNavwioyEEpAmqMe1E/BN9ES+8ovkE=
+github.com/jackc/pgio v1.0.0/go.mod h1:oP+2QK2wFfUWgr+gxjoBH9KGBb31Eio69xUb0w5bYf8=
+github.com/jackc/pgmock v0.0.0-20190831213851-13a1b77aafa2/go.mod h1:fGZlG77KXmcq05nJLRkk0+p82V8B8Dw8KN2/V9c/OAE=
+github.com/jackc/pgmock v0.0.0-20201204152224-4fe30f7445fd/go.mod h1:hrBW0Enj2AZTNpt/7Y5rr2xe/9Mn757Wtb2xeBzPv2c=
+github.com/jackc/pgmock v0.0.0-20210724152146-4ad1a8207f65 h1:DadwsjnMwFjfWc9y5Wi/+Zz7xoE5ALHsRQlOctkOiHc=
+github.com/jackc/pgmock v0.0.0-20210724152146-4ad1a8207f65/go.mod h1:5R2h2EEX+qri8jOWMbJCtaPWkrrNc7OHwsp2TCqp7ak=
+github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
+github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
+github.com/jackc/pgproto3 v1.1.0/go.mod h1:eR5FA3leWg7p9aeAqi37XOTgTIbkABlvcPB3E5rlc78=
+github.com/jackc/pgproto3/v2 v2.0.0-alpha1.0.20190420180111-c116219b62db/go.mod h1:bhq50y+xrl9n5mRYyCBFKkpRVTLYJVWeCc+mEAI3yXA=
+github.com/jackc/pgproto3/v2 v2.0.0-alpha1.0.20190609003834-432c2951c711/go.mod h1:uH0AWtUmuShn0bcesswc4aBTWGvw0cAxIJp+6OB//Wg=
+github.com/jackc/pgproto3/v2 v2.0.0-rc3/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvWKnT95C46ckYeM=
+github.com/jackc/pgproto3/v2 v2.0.0-rc3.0.20190831210041-4c03ce451f29/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvWKnT95C46ckYeM=
+github.com/jackc/pgproto3/v2 v2.0.6/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
+github.com/jackc/pgproto3/v2 v2.1.1/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
+github.com/jackc/pgproto3/v2 v2.2.0/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
+github.com/jackc/pgproto3/v2 v2.3.1 h1:nwj7qwf0S+Q7ISFfBndqeLwSwxs+4DPsbRFjECT1Y4Y=
+github.com/jackc/pgproto3/v2 v2.3.1/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
+github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b/go.mod h1:vsD4gTJCa9TptPL8sPkXrLZ+hDuNrZCnj29CQpr4X1E=
+github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a h1:bbPeKD0xmW/Y25WS6cokEszi5g+S0QxI/d45PkRi7Nk=
+github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgtype v0.0.0-20190421001408-4ed0de4755e0/go.mod h1:hdSHsc1V01CGwFsrv11mJRHWJ6aifDLfdV3aVjFF0zg=
+github.com/jackc/pgtype v0.0.0-20190824184912-ab885b375b90/go.mod h1:KcahbBH1nCMSo2DXpzsoWOAfFkdEtEJpPbVLq8eE+mc=
+github.com/jackc/pgtype v0.0.0-20190828014616-a8802b16cc59/go.mod h1:MWlu30kVJrUS8lot6TQqcg7mtthZ9T0EoIBFiJcmcyw=
+github.com/jackc/pgtype v1.8.1-0.20210724151600-32e20a603178/go.mod h1:C516IlIV9NKqfsMCXTdChteoXmwgUceqaLfjg2e3NlM=
+github.com/jackc/pgtype v1.8.1/go.mod h1:LUMuVrfsFfdKGLw+AFFVv6KtHOFMwRgDDzBt76IqCA4=
+github.com/jackc/pgtype v1.10.0/go.mod h1:LUMuVrfsFfdKGLw+AFFVv6KtHOFMwRgDDzBt76IqCA4=
+github.com/jackc/pgtype v1.12.0 h1:Dlq8Qvcch7kiehm8wPGIW0W3KsCCHJnRacKW0UM8n5w=
+github.com/jackc/pgtype v1.12.0/go.mod h1:LUMuVrfsFfdKGLw+AFFVv6KtHOFMwRgDDzBt76IqCA4=
+github.com/jackc/pgx/v4 v4.0.0-20190420224344-cc3461e65d96/go.mod h1:mdxmSJJuR08CZQyj1PVQBHy9XOp5p8/SHH6a0psbY9Y=
+github.com/jackc/pgx/v4 v4.0.0-20190421002000-1b8f0016e912/go.mod h1:no/Y67Jkk/9WuGR0JG/JseM9irFbnEPbuWV2EELPNuM=
+github.com/jackc/pgx/v4 v4.0.0-pre1.0.20190824185557-6972a5742186/go.mod h1:X+GQnOEnf1dqHGpw7JmHqHc1NxDoalibchSk9/RWuDc=
+github.com/jackc/pgx/v4 v4.12.1-0.20210724153913-640aa07df17c/go.mod h1:1QD0+tgSXP7iUjYm9C1NxKhny7lq6ee99u/z+IHFcgs=
+github.com/jackc/pgx/v4 v4.13.0/go.mod h1:9P4X524sErlaxj0XSGZk7s+LD0eOyu1ZDUrrpznYDF0=
+github.com/jackc/pgx/v4 v4.15.0/go.mod h1:D/zyOyXiaM1TmVWnOM18p0xdDtdakRBa0RsVGI3U3bw=
+github.com/jackc/pgx/v4 v4.17.2 h1:0Ut0rpeKwvIVbMQ1KbMBU4h6wxehBI535LK6Flheh8E=
+github.com/jackc/pgx/v4 v4.17.2/go.mod h1:lcxIZN44yMIrWI78a5CpucdD14hX0SBDbNRvjDBItsw=
+github.com/jackc/puddle v0.0.0-20190413234325-e4ced69a3a2b/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jackc/puddle v0.0.0-20190608224051-11cab39313c9/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jackc/puddle v1.1.3/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jackc/puddle v1.2.1/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jackc/puddle v1.3.0/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
+github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
+github.com/jinzhu/now v1.1.4/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
+github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
+github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
+github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
+github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
+github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
+github.com/json-iterator/go v1.1.5/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
+github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
+github.com/jtolds/gls v4.2.1+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
+github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
+github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/leodido/go-urn v1.2.1/go.mod h1:zt4jvISO2HfUBqxjfIshjdMTYS56ZS/qv49ictyFfxY=
+github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lib/pq v1.1.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lib/pq v1.10.2 h1:AqzbZs4ZoCBp+GtejcpCpcxM3zlSMx29dXbUSeVtJb8=
+github.com/lib/pq v1.10.2/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
+github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/matryer/try v0.0.0-20161228173917-9ac251b645a2/go.mod h1:0KeJpeMD6o+O4hW7qJOT7vyQPKrWmj26uf5wMc/IiIs=
+github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
+github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.7/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-sqlite3 v1.14.9/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
+github.com/mattn/go-sqlite3 v1.14.12 h1:TJ1bhYJPV44phC+IMu1u2K/i5RriLTPe+yc68XDJ1Z0=
+github.com/mattn/go-sqlite3 v1.14.12/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
+github.com/microcosm-cc/bluemonday v1.0.27 h1:MpEUotklkwCSLeH+Qdx1VJgNqLlpY2KXwXFM08ygZfk=
+github.com/microcosm-cc/bluemonday v1.0.27/go.mod h1:jFi9vgW+H7c3V0lb6nR74Ib/DIB5OBs92Dimizgw2cA=
+github.com/miekg/dns v1.1.72 h1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI=
+github.com/miekg/dns v1.1.72/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modocache/gover v0.0.0-20171022184752-b58185e213c5/go.mod h1:caMODM3PzxT8aQXRPkAt8xlV/e7d7w8GM5g0fa5F0D8=
+github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 h1:RWengNIwukTxcDr9M+97sNutRR1RKhG96O6jWumTTnw=
+github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
+github.com/montanaflynn/stats v0.0.0-20171201202039-1bf9dbcd8cbe/go.mod h1:wL8QJuTMNUDYhXwkmfOly8iTdp5TEcJFWZD2D7SIkUc=
+github.com/muesli/termenv v0.15.3-0.20240618155329-98d742f6907a h1:2MaM6YC3mGu54x+RKAA6JiFFHlHDY1UbkxqppT7wYOg=
+github.com/muesli/termenv v0.15.3-0.20240618155329-98d742f6907a/go.mod h1:hxSnBBYLK21Vtq/PHd0S2FYCxBXzBua8ov5s1RobyRQ=
+github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
+github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
+github.com/nxadm/tail v1.4.11 h1:8feyoE3OzPrcshW5/MJ4sGESc5cqmGkGCWlco4l0bqY=
+github.com/nxadm/tail v1.4.11/go.mod h1:OTaG3NK980DZzxbRq6lEuzgU+mug70nY11sMd4JXXHc=
+github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
+github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
+github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
+github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
+github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
+github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
+github.com/onsi/gomega v1.16.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
+github.com/onsi/gomega v1.29.0 h1:KIA/t2t5UBzoirT4H9tsML45GEbo3ouUnBHsCfD2tVg=
+github.com/onsi/gomega v1.29.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ=
+github.com/opentracing/opentracing-go v1.2.1-0.20220228012449-10b1cf09e00b h1:FfH+VrHHk6Lxt9HdVS0PXzSXFyS2NbZKXv33FYPol0A=
+github.com/opentracing/opentracing-go v1.2.1-0.20220228012449-10b1cf09e00b/go.mod h1:AC62GU6hc0BrNm+9RK9VSiwa/EUe1bkIeFORAMcHvJU=
+github.com/pkg/browser v0.0.0-20180916011732-0a3d74bf9ce4/go.mod h1:4OwLy04Bl9Ef3GJJCoec+30X3LQs/0/m4HFRt/2LUSA=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/projectdiscovery/blackrock v0.0.2 h1:mxXdu0uM8P2L2Qi210COlU8QiICPFW/Rxk5QUhlPO2k=
+github.com/projectdiscovery/blackrock v0.0.2/go.mod h1:ANUtjDfaVrqB453bzToU+YB4cUbvBRpLvEwoWIwlTss=
+github.com/projectdiscovery/cdncheck v1.3.0 h1:/bWdNXIU1P5ASZuW8QA+tAw1FNHhmWlWXk/qiUHyx2c=
+github.com/projectdiscovery/cdncheck v1.3.0/go.mod h1:GIAA0SqjDfxzDQjHR/X+bK05BGmUGfsVplP5Zdv/kHA=
+github.com/projectdiscovery/retryabledns v1.0.115 h1:RKV63FNIznFHUoawg/1hs53pVH3wqPtFhwstCuxVSoA=
+github.com/projectdiscovery/retryabledns v1.0.115/go.mod h1:+fEMWoPigw+M0lGNKY7AZ+g8FIgj+4sONjsinMmeL3k=
+github.com/projectdiscovery/utils v0.11.1 h1:PWj1KjIASxt8icxommH72C0TQqNOvGkcSODRkiq0SQw=
+github.com/projectdiscovery/utils v0.11.1/go.mod h1:yktGrHGk2CTjNiccXovnvGrLHX9sV2bqz9nSnbA3V8M=
+github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/qiniu/dyn v1.3.0/go.mod h1:E8oERcm8TtwJiZvkQPbcAh0RL8jO1G0VXJMW3FAWdkk=
+github.com/qiniu/go-sdk/v7 v7.13.0 h1:0bWRh/oAC2cArUILZLuWN+s9hPep1JYch5sA2Mfxq7A=
+github.com/qiniu/go-sdk/v7 v7.13.0/go.mod h1:btsaOc8CA3hdVloULfFdDgDc+g4f3TDZEFsDY0BLE+w=
+github.com/qiniu/x v1.10.5/go.mod h1:03Ni9tj+N2h2aKnAz+6N0Xfl8FwMEDRC2PAlxekASDs=
+github.com/redis/go-redis/v9 v9.5.1 h1:H1X4D3yHPaYrkL5X06Wh6xNVM/pX0Ft4RV0vMGvLBh8=
+github.com/redis/go-redis/v9 v9.5.1/go.mod h1:hdY0cQFCN4fnSYT6TkisLufl/4W5UIXyv0b/CLO2V2M=
+github.com/richardlehane/mscfb v1.0.4 h1:WULscsljNPConisD5hR0+OyZjwK46Pfyr6mPu5ZawpM=
+github.com/richardlehane/mscfb v1.0.4/go.mod h1:YzVpcZg9czvAuhk9T+a3avCpcFPMUWm7gK3DypaEsUk=
+github.com/richardlehane/msoleps v1.0.1 h1:RfrALnSNXzmXLbGct/P2b4xkFz4e8Gmj/0Vj9M9xC1o=
+github.com/richardlehane/msoleps v1.0.1/go.mod h1:BWev5JBpU9Ko2WAgmZEuiz4/u3ZYTKbjLycmwiWUfWg=
+github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
+github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
+github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
+github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
+github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
+github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE=
+github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
+github.com/rs/xid v1.5.0 h1:mKX4bl4iPYJtEIxp6CYiUuLQ/8DYMoz0PUdtGgMFRVc=
+github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
+github.com/rs/zerolog v1.13.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OKkWU=
+github.com/rs/zerolog v1.15.0/go.mod h1:xYTKnLHcpfU2225ny5qZjxnj9NvkumZYjJHlAThCjNc=
+github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d h1:hrujxIzL1woJ7AwssoOcM/tq5JjjG2yYOc8odClEiXA=
+github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d/go.mod h1:uugorj2VCxiV1x+LzaIdVa9b4S4qGAcH6cbhh4qVxOU=
+github.com/samber/lo v1.34.0 h1:1ZqcyX4642t1E/4gKEfA7ycqSYMqsKYN09AVZbME+aQ=
+github.com/samber/lo v1.34.0/go.mod h1:HLeWcJRRyLKp3+/XBJvOrerCQn9mhdKMHyd7IRlgeQ8=
+github.com/satori/go.uuid v1.2.0 h1:0uYX9dsZ2yD7q2RtLRtPSdGDWzjeM3TbMJP9utgA0ww=
+github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
+github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24/go.mod h1:M+9NzErvs504Cn4c5DxATwIqPbtswREoFCre64PpcG4=
+github.com/shopspring/decimal v1.2.0 h1:abSATXmQEYyShuxI4/vyW3tV1MrKAJzCZ/0zLUXYbsQ=
+github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
+github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
+github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e h1:MRM5ITcdelLK2j1vwZ3Je0FKVCfqOLp5zO6trqMLYs0=
+github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e/go.mod h1:XV66xRDqSt+GTGFMVlhk3ULuV0y9ZmzeVGR4mloJI3M=
+github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
+github.com/smartystreets/assertions v0.0.0-20190116191733-b6c0e53d7304/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
+github.com/smartystreets/assertions v1.0.1 h1:voD4ITNjPL5jjBfgR/r8fPIIBrliWrWHeiJApdr3r4w=
+github.com/smartystreets/assertions v1.0.1/go.mod h1:kHHU4qYBaI3q23Pp3VPrmWhuIUrLW/7eUrw0BU5VaoM=
+github.com/smartystreets/goconvey v0.0.0-20181108003508-044398e4856c/go.mod h1:XDJAKZRPZ1CvBcN2aX5YOUTYGHki24fSF0Iv48Ibg0s=
+github.com/smartystreets/goconvey v1.6.4 h1:fv0U8FUIMPNf1L9lnHLvLhgicrIVChEkdzIKYqbNC9s=
+github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
+github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/tdewolff/minify/v2 v2.12.4 h1:kejsHQMM17n6/gwdw53qsi6lg0TGddZADVyQOz1KMdE=
+github.com/tdewolff/minify/v2 v2.12.4/go.mod h1:h+SRvSIX3kwgwTFOpSckvSxgax3uy8kZTSF1Ojrr3bk=
+github.com/tdewolff/parse/v2 v2.6.4 h1:KCkDvNUMof10e3QExio9OPZJT8SbdKojLBumw8YZycQ=
+github.com/tdewolff/parse/v2 v2.6.4/go.mod h1:woz0cgbLwFdtbjJu8PIKxhW05KplTFQkOdX78o+Jgrs=
+github.com/tdewolff/test v1.0.7 h1:8Vs0142DmPFW/bQeHRP3MV19m1gvndjUb1sn8yy74LM=
+github.com/tdewolff/test v1.0.7/go.mod h1:6DAvZliBAAnD7rhVgwaM7DE5/d9NMOAJ09SqYqeK4QE=
+github.com/thanhpk/randstr v1.0.4 h1:IN78qu/bR+My+gHCvMEXhR/i5oriVHcTB/BJJIRTsNo=
+github.com/thanhpk/randstr v1.0.4/go.mod h1:M/H2P1eNLZzlDwAzpkkkUvoyNNMbzRGhESZuEQk3r0U=
+github.com/thoas/go-funk v0.9.1 h1:O549iLZqPpTUQ10ykd26sZhzD+rmR5pWhuElrhbC20M=
+github.com/thoas/go-funk v0.9.1/go.mod h1:+IWnUfUmFO1+WVYQWQtIJHeRRdaIyyYglZN7xzUPe4Q=
+github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
+github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/match v1.2.0 h1:0pt8FlkOwjN2fPt4bIl4BoNxb98gGHN2ObFEDkrfZnM=
+github.com/tidwall/match v1.2.0/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
+github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
+github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/uber/jaeger-client-go v2.30.0+incompatible h1:D6wyKGCecFaSRUpo8lCVbaOOb6ThwMmTEbhRwtKR97o=
+github.com/uber/jaeger-client-go v2.30.0+incompatible/go.mod h1:WVhlPFC8FDjOFMMWRy2pZqQJSXxYSwNYOkTr/Z6d3Kk=
+github.com/uber/jaeger-lib v2.4.1+incompatible h1:td4jdvLcExb4cBISKIpHuGoVXh+dVKhn2Um6rjCsSsg=
+github.com/uber/jaeger-lib v2.4.1+incompatible/go.mod h1:ComeNDZlWwrWnDv8aPp0Ba6+uUTzImX/AauajbLI56U=
+github.com/unknwon/com v1.0.1 h1:3d1LTxD+Lnf3soQiD4Cp/0BRB+Rsa/+RTvz8GMMzIXs=
+github.com/unknwon/com v1.0.1/go.mod h1:tOOxU81rwgoCLoOVVPHb6T/wt8HZygqH5id+GNnlCXM=
+github.com/uptrace/opentelemetry-go-extra/otelgorm v0.1.16 h1:WBsTsLkHGaURNRsEGpJY3FxfNOId6u9fl7H/ST6UwBc=
+github.com/uptrace/opentelemetry-go-extra/otelgorm v0.1.16/go.mod h1:KGPB5/pr9k+Bkgaay/dSWYV+zLi1kUgdHiH/8FqK2P8=
+github.com/uptrace/opentelemetry-go-extra/otellogrus v0.1.16 h1:Um7W0ZO+1wTDWWP/io3YO1VnI6rgJXVUQN6t8Y9iuiI=
+github.com/uptrace/opentelemetry-go-extra/otellogrus v0.1.16/go.mod h1:6KDfooqEgH8sXFCBYwk2L1Yfd5nFfrkZAn23oziv6W8=
+github.com/uptrace/opentelemetry-go-extra/otelsql v0.1.16 h1:Mv9E8XPDSHpvIfpJas/UmGtbfB3DAT40xRBHyiRo43A=
+github.com/uptrace/opentelemetry-go-extra/otelsql v0.1.16/go.mod h1:oVZIFMuoT5O/h8Do8+Jk/WQrNgr8M0082qCZT9rx3yM=
+github.com/uptrace/opentelemetry-go-extra/otelutil v0.1.16 h1:bJld2pB1BJjbsh4SDOazz3Gies8gJhjTh/oapV54Vtw=
+github.com/uptrace/opentelemetry-go-extra/otelutil v0.1.16/go.mod h1:Z26JCmg3BtsTgXO/MuvyuCPXfzQVsw4TjFgjGpjTM9A=
+github.com/uptrace/uptrace-go v1.9.0 h1:GlSrbkUgirS99mVUkeSSXz9LQyknv2FTtDSxqv2u5lE=
+github.com/uptrace/uptrace-go v1.9.0/go.mod h1:EJpFb3syIxnGa6cuvIxAMGzySSNn+CFOI7BczxLA52k=
+github.com/urfave/cli/v2 v2.26.0 h1:3f3AMg3HpThFNT4I++TKOejZO8yU55t3JnnSr4S4QEI=
+github.com/urfave/cli/v2 v2.26.0/go.mod h1:8qnjx1vcq5s2/wpsqoZFndg2CE5tNFyrTvS6SinrnYQ=
+github.com/weppos/publicsuffix-go v0.50.3-0.20260104170930-90713dec78f2 h1:LiQSn5u8Nc6V/GixI+SWxt+YkNIyfKIlkVRULSw2Zt0=
+github.com/weppos/publicsuffix-go v0.50.3-0.20260104170930-90713dec78f2/go.mod h1:CbQCKDtXF8UcT7hrxeMa0MDjwhpOI9iYOU7cfq+yo8k=
+github.com/wuhan005/gadget v0.0.0-20221206194113-7619e407f1a0 h1:zOXiOJRG/FOohTliJiykpwIaCPtUTIh+G0jw2bOJkA8=
+github.com/wuhan005/gadget v0.0.0-20221206194113-7619e407f1a0/go.mod h1:vmC2IdgzTpIRwn1ZpuV/I3k9AIbRJ7oqTHFenq/qwkE=
+github.com/wuhan005/govalid v0.0.0-20230216091828-820aa255fd21 h1:EHaQ4hLfjckhbI+AEleDHeb0cEN1bIAfvWJEhCe7e2Y=
+github.com/wuhan005/govalid v0.0.0-20230216091828-820aa255fd21/go.mod h1:zRrIdMbJM3Xe4lmXyrUi2xF9CE0+D4Y0OpQIMpjC0Vo=
+github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
+github.com/xdg-go/scram v1.0.2/go.mod h1:1WAq6h33pAW+iRreB34OORO2Nf7qel3VV3fjBj+hCSs=
+github.com/xdg-go/stringprep v1.0.2/go.mod h1:8F9zXuvzgwmyT5DUm4GUfZGDdT3W+LCvS6+da4O5kxM=
+github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 h1:bAn7/zixMGCfxrRTfdpNzjtPYqr8smhKouy9mxVdGPU=
+github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673/go.mod h1:N3UwUGtsrSj3ccvlPHLoLsHnpR27oXr4ZE984MbSER8=
+github.com/xuri/efp v0.0.0-20220407160117-ad0f7a785be8 h1:3X7aE0iLKJ5j+tz58BpvIZkXNV7Yq4jC93Z/rbN2Fxk=
+github.com/xuri/efp v0.0.0-20220407160117-ad0f7a785be8/go.mod h1:ybY/Jr0T0GTCnYjKqmdwxyxn2BQf2RcQIIvex5QldPI=
+github.com/xuri/excelize/v2 v2.6.0 h1:m/aXAzSAqxgt74Nfd+sNzpzVKhTGl7+S9nbG4A57mF4=
+github.com/xuri/excelize/v2 v2.6.0/go.mod h1:Q1YetlHesXEKwGFfeJn7PfEZz2IvHb6wdOeYjBxVcVs=
+github.com/xuri/nfp v0.0.0-20220409054826-5e722a1d9e22 h1:OAmKAfT06//esDdpi/DZ8Qsdt4+M5+ltca05dA5bG2M=
+github.com/xuri/nfp v0.0.0-20220409054826-5e722a1d9e22/go.mod h1:WwHg+CVyzlv/TX9xqBFXEZAuxOPxn2k1GNHwG41IIUQ=
+github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d/go.mod h1:rHwXgn7JulP+udvsHwJoVG1YGAP6VLg4y9I5dyZdqmA=
+github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/zenazn/goji v0.9.0/go.mod h1:7S9M489iMyHBNxwZnk9/EHS098H4/F6TATF2mIxtB1Q=
+go.mongodb.org/mongo-driver v1.8.0/go.mod h1:0sQWfOeY63QTntERDJJ/0SuKK0T1uVSgKCuAROlKEPY=
+go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
+go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
+go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
+go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
+go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
+go.opentelemetry.io/contrib/instrumentation/runtime v0.34.0 h1:zt4RDodWkgiHk8tyUmFOjFoOOfyGH7vwIbUzKP6CCh8=
+go.opentelemetry.io/contrib/instrumentation/runtime v0.34.0/go.mod h1:5wIoZE96WbcQVU3D6UF/ukRfFQXbB6OYgeWi9CjHa90=
+go.opentelemetry.io/otel v1.10.0 h1:Y7DTJMR6zs1xkS/upamJYk0SxxN4C9AqRd77jmZnyY4=
+go.opentelemetry.io/otel v1.10.0/go.mod h1:NbvWjCthWHKBEUMpf0/v8ZRZlni86PpGFEMA9pnQSnQ=
+go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.9.0 h1:ggqApEjDKczicksfvZUCxuvoyDmR6Sbm56LwiK8DVR0=
+go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.9.0/go.mod h1:78XhIg8Ht9vR4tbLNUhXsiOnE2HOuSeKAiAcoVQEpOY=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric v0.31.0 h1:H0+xwv4shKw0gfj/ZqR13qO2N/dBQogB1OcRjJjV39Y=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric v0.31.0/go.mod h1:nkenGD8vcvs0uN6WhR90ZVHQlgDsRmXicnNadMnk+XQ=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v0.31.0 h1:BaQ2xM5cPmldVCMvbLoy5tcLUhXCtIhItDYBNw83B7Y=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v0.31.0/go.mod h1:VRr8tlXQEsTdesDCh0qBe2iKDWhpi3ZqDYw6VlZ8MhI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.9.0 h1:NN90Cuna0CnBg8YNu1Q0V35i2E8LDByFOwHRCq/ZP9I=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.9.0/go.mod h1:0EsCXjZAiiZGnLdEUXM9YjCKuuLZMYyglh2QDXcYKVA=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.9.0 h1:M0/hqGuJBLeIEu20f89H74RGtqV2dn+SFWEz9ATAAwY=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.9.0/go.mod h1:K5G92gbtCrYJ0mn6zj9Pst7YFsDFuvSYEhYKRMcufnM=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.9.0 h1:0uV0qzHk48i1SF8qRI8odMYiwPOLh9gBhiJFpj8H6JY=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.9.0/go.mod h1:Fl1iS5ZhWgXXXTdJMuBSVsS5nkL5XluHbg97kjOuYU4=
+go.opentelemetry.io/otel/metric v0.32.1 h1:ftff5LSBCIDwL0UkhBuDg8j9NNxx2IusvJ18q9h6RC4=
+go.opentelemetry.io/otel/metric v0.32.1/go.mod h1:iLPP7FaKMAD5BIxJ2VX7f2KTuz//0QK2hEUyti5psqQ=
+go.opentelemetry.io/otel/sdk v1.9.0 h1:LNXp1vrr83fNXTHgU8eO89mhzxb/bbWAsHG6fNf3qWo=
+go.opentelemetry.io/otel/sdk v1.9.0/go.mod h1:AEZc8nt5bd2F7BC24J5R0mrjYnpEgYHyTcM/vrSple4=
+go.opentelemetry.io/otel/sdk/metric v0.31.0 h1:2sZx4R43ZMhJdteKAlKoHvRgrMp53V1aRxvEf5lCq8Q=
+go.opentelemetry.io/otel/sdk/metric v0.31.0/go.mod h1:fl0SmNnX9mN9xgU6OLYLMBMrNAsaZQi7qBwprwO3abk=
+go.opentelemetry.io/otel/trace v1.10.0 h1:npQMbR8o7mum8uF95yFbOEJffhs1sbCOfDh8zAJiH5E=
+go.opentelemetry.io/otel/trace v1.10.0/go.mod h1:Sij3YYczqAdz+EhmGhE6TpTxUO5/F/AzrK+kxfGqySM=
+go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
+go.opentelemetry.io/proto/otlp v0.19.0 h1:IVN6GR+mhC4s5yfcTbmzHYODqvWAp3ZedA2SJPI1Nnw=
+go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
+go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
+go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
+go.uber.org/atomic v1.9.0 h1:ECmE8Bn/WFTYwEW/bpKD3M8VtR/zQVbavAoalC1PYyE=
+go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/goleak v1.1.12 h1:gZAh5/EyT/HQwlpkCy6wTpqfH9H8Lz8zbm3dZh+OyzA=
+go.uber.org/goleak v1.1.12/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
+go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
+go.uber.org/multierr v1.3.0/go.mod h1:VgVr7evmIr6uPjLBxg28wmKNXyqE9akIJ5XnfpiKl+4=
+go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
+go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
+go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee/go.mod h1:vJERXedbb3MVM5f9Ejo0C68/HhF8uaILCdgjnY+goOA=
+go.uber.org/zap v1.9.1/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
+go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
+go.uber.org/zap v1.13.0/go.mod h1:zwrFLgMcdUuIBviXEYEH1YKNaOBnKXsx2IPda5bBwHM=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190411191339-88737f569e3a/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
+golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20201203163018-be400aefbc4c/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
+golang.org/x/crypto v0.0.0-20201216223049-8b5274cf687f/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
+golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20220214200702-86341886e292/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.0.0-20220408190544-5352b0902921/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
+golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
+golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek=
+golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY=
+golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
+golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
+golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
+golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
+golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
+golang.org/x/exp v0.0.0-20260112195511-716be5621a96 h1:Z/6YuSHTLOHfNFdb8zVZomZr7cqNgTJvA8+Qz75D8gU=
+golang.org/x/exp v0.0.0-20260112195511-716be5621a96/go.mod h1:nzimsREAkjBCIEFtHiYkrJyT+2uy9YZJB7H1k68CXZU=
+golang.org/x/image v0.13.0 h1:3cge/F/QTkNLauhf2QoE9zp+7sr+ZcL4HnoZmdwg9sg=
+golang.org/x/image v0.13.0/go.mod h1:6mmbMOeV28HuMTgA6OSRkdXKYw/t5W9Uwn2Yv1r3Yxk=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
+golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
+golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
+golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
+golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
+golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
+golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
+golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200222125558-5a598a2470a0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
+golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
+golang.org/x/net v0.0.0-20210610132358-84b48f89b13b/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20220407224826-aac1ed45d8e3/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190403152447-81d4e9dc473e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211020174200-9d6173849985/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20191024005414-555d28b269f0 h1:/5xXl8Y5W96D+TtHSlonuFqGHIWVuyCkGJLwGh9JJFs=
+golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190425163242-31fd60d6bfdc/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190531172133-b3315ee88b7d/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20190823170909-c4a336ef6a2f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191029190741-b9c20aec41a5/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200103221440-774c71fcf114/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200204074204-1cc6d1ef6c74/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200224181240-023911ca70b2/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200227222343-706bc42d1f0d/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
+golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
+golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
+golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
+golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
+golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
+golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
+google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
+google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
+google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
+google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
+google.golang.org/api v0.14.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
+google.golang.org/api v0.15.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
+google.golang.org/api v0.17.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
+google.golang.org/api v0.18.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
+google.golang.org/api v0.19.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
+google.golang.org/api v0.20.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
+google.golang.org/api v0.22.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
+google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
+google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
+google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
+google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
+google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
+google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20191115194625-c23dd37a84c9/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA=
+google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200224152610-e50cd9704f63/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200228133532-8c2c7df3a383/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
+google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
+google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
+google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20231120223509-83a465c0220f h1:Vn+VyHU5guc9KjB5KrjI2q0wCOWEOIh0OEsleqakHJg=
+google.golang.org/genproto v0.0.0-20231120223509-83a465c0220f/go.mod h1:nWSwAFPb+qfNJXsoeO3Io7zf4tMSfN8EA8RlDA04GhY=
+google.golang.org/genproto/googleapis/api v0.0.0-20231127180814-3a041ad873d4 h1:ZcOkrmX74HbKFYnpPY8Qsw93fC29TbJXspYKaBkSXDQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20231127180814-3a041ad873d4/go.mod h1:k2dtGpRrbsSyKcNPKKI5sstZkrNCZwpU/ns96JoHbGg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20231127180814-3a041ad873d4 h1:DC7wcm+i+P1rN3Ff07vL+OndGg5OhNddHyTA+ocPqYE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20231127180814-3a041ad873d4/go.mod h1:eJVxU6o+4G1PSczBr85xmyvSNYAKvAYgkub40YGomFM=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
+google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
+google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
+google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
+google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
+google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
+google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
+google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
+google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
+google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
+google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
+google.golang.org/grpc v1.59.0 h1:Z5Iec2pjwb+LEOqzpB2MR12/eKFhDPhuqW91O+4bwUk=
+google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98=
+google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
+google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
+google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
+google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
+google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
+google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
+google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
+google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc h1:2gGKlE2+asNV9m7xrywl36YYNnBG5ZQ0r/BOOxqPpmk=
+gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc/go.mod h1:m7x9LTH6d71AHyAX77c9yqWCCa3UKHcVEj9y7hAtKDk=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df h1:n7WqCuqOuCbNr617RXOY0AWRXxgwEyPp2z+p0+hgMuE=
+gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df/go.mod h1:LRQQ+SO6ZHR7tOkpBDuZnXENFzX8qRjMDMyPD6BRkCw=
+gopkg.in/inconshreveable/log15.v2 v2.0.0-20180818164646-67afb5ed74ec/go.mod h1:aPpfJ7XW+gOuirDoZ8gHhLh3kZ1B08FtV2bbmy7Jv3s=
+gopkg.in/ini.v1 v1.66.2 h1:XfR1dOYubytKy4Shzc2LHrrGhU0lDCfDGG1yLPmpgsI=
+gopkg.in/ini.v1 v1.66.2/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gorm.io/datatypes v1.0.7 h1:8NhJN4+annFjwV1WufDhFiPjdUvV1lSGUdg1UCjQIWY=
+gorm.io/datatypes v1.0.7/go.mod h1:l9qkCuy0CdzDEop9HKUdcnC9gHC2sRlaFtHkTzsZRqg=
+gorm.io/driver/mysql v1.3.2/go.mod h1:ChK6AHbHgDCFZyJp0F+BmVGb06PSIoh9uVYKAlRbb2U=
+gorm.io/driver/mysql v1.3.6 h1:BhX1Y/RyALb+T9bZ3t07wLnPZBukt+IRkMn8UZSNbGM=
+gorm.io/driver/mysql v1.3.6/go.mod h1:sSIebwZAVPiT+27jK9HIwvsqOGKx3YMPmrA3mBJR10c=
+gorm.io/driver/postgres v1.3.4/go.mod h1:y0vEuInFKJtijuSGu9e5bs5hzzSzPK+LancpKpvbRBw=
+gorm.io/driver/postgres v1.4.5 h1:mTeXTTtHAgnS9PgmhN2YeUbazYpLhUI1doLnw42XUZc=
+gorm.io/driver/postgres v1.4.5/go.mod h1:GKNQYSJ14qvWkvPwXljMGehpKrhlDNsqYRr5HnYGncg=
+gorm.io/driver/sqlite v1.3.1 h1:bwfE+zTEWklBYoEodIOIBwuWHpnx52Z9zJFW5F33WLk=
+gorm.io/driver/sqlite v1.3.1/go.mod h1:wJx0hJspfycZ6myN38x1O/AqLtNS6c5o9TndewFbELg=
+gorm.io/driver/sqlserver v1.3.1 h1:F5t6ScMzOgy1zukRTIZgLZwKahgt3q1woAILVolKpOI=
+gorm.io/driver/sqlserver v1.3.1/go.mod h1:w25Vrx2BG+CJNUu/xKbFhaKlGxT/nzRkhWCCoptX8tQ=
+gorm.io/gorm v1.23.1/go.mod h1:l2lP/RyAtc1ynaTjFksBde/O8v9oOGIApu2/xRitmZk=
+gorm.io/gorm v1.23.6/go.mod h1:l2lP/RyAtc1ynaTjFksBde/O8v9oOGIApu2/xRitmZk=
+gorm.io/gorm v1.23.8/go.mod h1:l2lP/RyAtc1ynaTjFksBde/O8v9oOGIApu2/xRitmZk=
+gorm.io/gorm v1.24.1-0.20221019064659-5dd2bb482755 h1:7AdrbfcvKnzejfqP5g37fdSZOXH/JvaPIzBIHTOqXKk=
+gorm.io/gorm v1.24.1-0.20221019064659-5dd2bb482755/go.mod h1:DVrVomtaYTbqs7gB/x2uVvqnXzv0nqjB396B8cG4dBA=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
+honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
+honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
+rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
+rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
+rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
diff --git a/internal/cache/cache.go b/internal/cache/cache.go
new file mode 100644
index 0000000..cea9edf
--- /dev/null
+++ b/internal/cache/cache.go
@@ -0,0 +1,87 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+// Package cache 提供进程内、并发安全的短 TTL 缓存。
+//
+// 适用场景：结果聚合统计等"非强一致"数据，用短 TTL 换取数据库实时重算压力的显著降低
+// （投票结果页、探索页热门投票等）。需注意：进程内存缓存在多实例横向扩容时不会共享，
+// 因此仅用于可接受短暂陈旧的数据；强一致数据请勿使用本缓存。
+package cache
+
+import (
+	"sync"
+	"time"
+)
+
+type ttlEntry struct {
+	value     interface{}
+	expiresAt time.Time
+}
+
+// TTLCache 并发安全的带 TTL 进程内缓存。
+type TTLCache struct {
+	mu       sync.RWMutex
+	items    map[string]ttlEntry
+	maxItems int
+}
+
+// NewTTLCache 创建缓存实例。maxItems<=0 时使用默认容量 256；达到容量上限时，
+// 先淘汰过期项，若仍满则整表清空（避免内存无限增长，短 TTL 下过期项通常已占多数）。
+func NewTTLCache(maxItems int) *TTLCache {
+	if maxItems <= 0 {
+		maxItems = 256
+	}
+	return &TTLCache{
+		items:    make(map[string]ttlEntry, maxItems),
+		maxItems: maxItems,
+	}
+}
+
+// Get 读取缓存；命中且未过期返回值，否则返回 (nil, false)。
+func (c *TTLCache) Get(key string) (interface{}, bool) {
+	c.mu.RLock()
+	e, ok := c.items[key]
+	c.mu.RUnlock()
+	if !ok {
+		return nil, false
+	}
+	if time.Now().After(e.expiresAt) {
+		c.mu.Lock()
+		// 双重检查，避免并发重复删除（无影响，仅兜底）
+		if cur, still := c.items[key]; still && time.Now().After(cur.expiresAt) {
+			delete(c.items, key)
+		}
+		c.mu.Unlock()
+		return nil, false
+	}
+	return e.value, true
+}
+
+// Set 写入缓存并设定过期时间。
+func (c *TTLCache) Set(key string, value interface{}, ttl time.Duration) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if len(c.items) >= c.maxItems {
+		// 先淘汰过期项
+		now := time.Now()
+		for k, v := range c.items {
+			if now.After(v.expiresAt) {
+				delete(c.items, k)
+			}
+		}
+		// 仍满（多为短 TTL 下瞬时高频写入）：整表重建，保证写入成功且不 OOM
+		if len(c.items) >= c.maxItems {
+			c.items = make(map[string]ttlEntry, c.maxItems)
+		}
+	}
+	c.items[key] = ttlEntry{value: value, expiresAt: time.Now().Add(ttl)}
+}
+
+// Delete 删除指定键的缓存项；键不存在时静默返回。
+// 用于写穿式失效：数据变更（如新增投票提交）后立即清除对应缓存，避免结果页短暂陈旧。
+func (c *TTLCache) Delete(key string) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	delete(c.items, key)
+}
diff --git a/internal/cache/cache_test.go b/internal/cache/cache_test.go
new file mode 100644
index 0000000..35b23ee
--- /dev/null
+++ b/internal/cache/cache_test.go
@@ -0,0 +1,61 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package cache
+
+import (
+	"sync"
+	"testing"
+	"time"
+)
+
+func TestTTLCacheBasic(t *testing.T) {
+	c := NewTTLCache(8)
+	if _, ok := c.Get("missing"); ok {
+		t.Fatal("expected miss for empty cache")
+	}
+	c.Set("k", "v", time.Minute)
+	v, ok := c.Get("k")
+	if !ok || v.(string) != "v" {
+		t.Fatalf("expected hit with v, got %v %v", v, ok)
+	}
+}
+
+func TestTTLCacheExpiry(t *testing.T) {
+	c := NewTTLCache(8)
+	c.Set("k", "v", time.Nanosecond)
+	time.Sleep(2 * time.Millisecond)
+	if _, ok := c.Get("k"); ok {
+		t.Fatal("expected expired entry to miss")
+	}
+}
+
+func TestTTLCacheCapacityEviction(t *testing.T) {
+	c := NewTTLCache(4)
+	for i := 0; i < 100; i++ {
+		c.Set(string(rune('a'+i%26))+string(rune('0'+i%10)), i, time.Minute)
+	}
+	// 不 panic 且仍可读
+	if _, ok := c.Get("a0"); ok {
+		// 命中与否均可，关键是内存不失控且无 panic
+		_ = ok
+	}
+}
+
+func TestTTLCacheConcurrent(t *testing.T) {
+	c := NewTTLCache(16)
+	var wg sync.WaitGroup
+	for g := 0; g < 20; g++ {
+		wg.Add(1)
+		go func(n int) {
+			defer wg.Done()
+			for i := 0; i < 200; i++ {
+				key := string(rune('a' + (n+i)%26))
+				c.Set(key, n, time.Minute)
+				c.Get(key)
+			}
+		}(g)
+	}
+	wg.Wait()
+}
diff --git a/internal/captcha/math.go b/internal/captcha/math.go
new file mode 100644
index 0000000..d6c396c
--- /dev/null
+++ b/internal/captcha/math.go
@@ -0,0 +1,273 @@
+// Copyright 2024 TamaBox. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package captcha
+
+import (
+	"crypto/rand"
+	"crypto/subtle"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"math/big"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/flamego/flamego"
+	"github.com/flamego/recaptcha"
+	"github.com/flamego/session"
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+)
+
+const (
+	// Session key prefix for storing math captcha answers
+	sessionKeyPrefix = "math_captcha_"
+	// TTL for each captcha in session
+	captchaTTL = 5 * time.Minute
+	// maxCaptchaAttempts 同一条验证码被尝试（含模态框预校验）的最大次数，
+	// 超过即销毁该验证码，迫使刷新，防止对答案做无限轮询爆破。
+	maxCaptchaAttempts = 5
+)
+
+// MathProblem represents an arithmetic captcha problem.
+type MathProblem struct {
+	ID       string `json:"id"`
+	Question string `json:"question"`
+}
+
+// storedAnswer holds the expected answer and creation time.
+type StoredAnswer struct {
+	Answer    int
+	CreatedAt time.Time
+	// Attempts 累计校验尝试次数（含模态框预校验），用于达到上限后销毁验证码。
+	Attempts int
+}
+
+// GenerateMath creates a new arithmetic captcha problem and stores the answer in session.
+func GenerateMath(s session.Session) (*MathProblem, error) {
+	// Generate random operands
+	op1, err := rand.Int(rand.Reader, big.NewInt(90))
+	if err != nil {
+		return nil, errors.Wrap(err, "generate operand 1")
+	}
+	op2, err := rand.Int(rand.Reader, big.NewInt(90))
+	if err != nil {
+		return nil, errors.Wrap(err, "generate operand 2")
+	}
+	a := int(op1.Int64()) + 1 // 1-90
+	b := int(op2.Int64()) + 1 // 1-90
+
+	// Pick a random operator (+, -, *)
+	opIdx, err := rand.Int(rand.Reader, big.NewInt(3))
+	if err != nil {
+		return nil, errors.Wrap(err, "generate operator")
+	}
+	var operator string
+	var answer int
+	switch opIdx.Int64() {
+	case 0:
+		operator = "+"
+		answer = a + b
+	case 1:
+		operator = "-"
+		// Ensure non-negative result
+		if a < b {
+			a, b = b, a
+		}
+		answer = a - b
+	default:
+		operator = "×"
+		// Keep numbers small for multiplication
+		a = a%10 + 1
+		b = b%10 + 1
+		answer = a * b
+	}
+
+	// 生成唯一 ID
+	idBytes := make([]byte, 8)
+	if _, err := rand.Read(idBytes); err != nil {
+		return nil, errors.Wrap(err, "generate captcha id")
+	}
+	id := hex.EncodeToString(idBytes)
+
+	// 清理策略说明：flamego session 接口不支持遍历，无法主动清理过期条目。
+	// 泄漏可控：验证码一次性消费（VerifyMath 校验后立即删除），
+	// 且每个用户同一时刻只生成 1 个新 key；session 本身过期后存储层整体清理。
+
+	// Store answer in session
+	key := sessionKeyPrefix + id
+	s.Set(key, StoredAnswer{
+		Answer:    answer,
+		CreatedAt: time.Now(),
+	})
+
+	question := fmt.Sprintf("%d %s %d =", a, operator, b)
+	return &MathProblem{
+		ID:       id,
+		Question: question,
+	}, nil
+}
+
+// VerifyMath checks if the given answer matches the stored captcha.
+// Returns (true, nil) if correct, (false, nil) if incorrect, (false, error) on error.
+func VerifyMath(s session.Session, token string, lang string) (bool, error) {
+	if token == "" {
+		return false, errors.New(i18n.T(lang, "captcha.errEmpty"))
+	}
+
+	// Token format: "captcha_id:answer"
+	parts := strings.SplitN(token, ":", 2)
+	if len(parts) != 2 {
+		return false, errors.New(i18n.T(lang, "captcha.errFormat"))
+	}
+
+	id := parts[0]
+	answerStr := parts[1]
+
+	answer, err := strconv.Atoi(strings.TrimSpace(answerStr))
+	if err != nil {
+		return false, errors.New(i18n.T(lang, "captcha.errAnswerFormat"))
+	}
+
+	// Retrieve stored answer
+	key := sessionKeyPrefix + id
+	stored, ok := s.Get(key).(StoredAnswer)
+	if !ok {
+		return false, errors.New(i18n.T(lang, "captcha.errExpired"))
+	}
+
+	// Check expiry
+	if time.Since(stored.CreatedAt) > captchaTTL {
+		s.Delete(key)
+		return false, errors.New(i18n.T(lang, "captcha.errExpired"))
+	}
+
+	// Delete after verification attempt (one-time use)
+	s.Delete(key)
+
+	// 常量时间比较，避免答案比对产生可观测的时序侧信道。
+	if subtle.ConstantTimeCompare([]byte(strconv.Itoa(answer)), []byte(strconv.Itoa(stored.Answer))) != 1 {
+		return false, errors.New(i18n.T(lang, "captcha.errAnswerWrong"))
+	}
+
+	return true, nil
+}
+
+// VerifyOnly checks if the answer is correct WITHOUT consuming the captcha.
+// This is used by the modal to validate before actually submitting the form.
+// 同一验证码的答案预校验次数计入 Attempts，达到上限即销毁，防止脚本无限轮询爆破。
+func VerifyOnly(s session.Session, id string, answer int) bool {
+	key := sessionKeyPrefix + id
+	stored, ok := s.Get(key).(StoredAnswer)
+	if !ok {
+		return false
+	}
+	if time.Since(stored.CreatedAt) > captchaTTL {
+		s.Delete(key)
+		return false
+	}
+
+	// 尝试次数限制：超过上限即销毁，迫使刷新。
+	stored.Attempts++
+	if stored.Attempts > maxCaptchaAttempts {
+		s.Delete(key)
+		return false
+	}
+	s.Set(key, stored)
+
+	// 常量时间比较，避免答案比对产生可观测的时序侧信道。
+	return subtle.ConstantTimeCompare([]byte(strconv.Itoa(answer)), []byte(strconv.Itoa(stored.Answer))) == 1
+}
+
+// sessionLang 从会话读取匿名用户显式选择的语言（与 Contexter 一致，语言偏好现托管于
+// session 而非独立 lang cookie，避免被 session 中间件的 Set-Cookie 覆盖）；未设置时回退默认。
+func sessionLang(s session.Session) string {
+	if v := s.Get("lang"); v != nil {
+		if str, ok := v.(string); ok && str != "" {
+			return i18n.Resolve(str)
+		}
+	}
+	return i18n.Default
+}
+
+// VerifyHandler is an HTTP handler that checks a captcha answer without consuming it.
+// Used by the modal to validate before form submission.
+func VerifyHandler(ctx flamego.Context, s session.Session) {
+	lang := sessionLang(s)
+	var req struct {
+		ID     string `json:"id"`
+		Answer int    `json:"answer"`
+	}
+	if err := json.NewDecoder(ctx.Request().Request.Body).Decode(&req); err != nil {
+		ctx.ResponseWriter().WriteHeader(http.StatusBadRequest)
+		_ = json.NewEncoder(ctx.ResponseWriter()).Encode(map[string]interface{}{
+			"code":    40000,
+			"message": i18n.T(lang, "captcha.json.badRequest"),
+		})
+		return
+	}
+
+	if req.ID == "" {
+		ctx.ResponseWriter().WriteHeader(http.StatusBadRequest)
+		_ = json.NewEncoder(ctx.ResponseWriter()).Encode(map[string]interface{}{
+			"code":    40000,
+			"message": i18n.T(lang, "captcha.json.idRequired"),
+		})
+		return
+	}
+
+	correct := VerifyOnly(s, req.ID, req.Answer)
+
+	ctx.ResponseWriter().Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(ctx.ResponseWriter()).Encode(map[string]interface{}{
+		"code":    0,
+		"correct": correct,
+	})
+}
+
+// GenerateHandler is an HTTP handler that generates a math captcha and returns it as JSON.
+func GenerateHandler(ctx flamego.Context, s session.Session) {
+	lang := sessionLang(s)
+	problem, err := GenerateMath(s)
+	if err != nil {
+		ctx.ResponseWriter().WriteHeader(http.StatusInternalServerError)
+		_ = json.NewEncoder(ctx.ResponseWriter()).Encode(map[string]interface{}{
+			"code":    50000,
+			"message": i18n.T(lang, "captcha.json.genFailed"),
+		})
+		return
+	}
+
+	ctx.ResponseWriter().Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(ctx.ResponseWriter()).Encode(map[string]interface{}{
+		"code": 0,
+		"data": problem,
+	})
+}
+
+// Verify is a unified captcha verification function.
+// It automatically chooses between recaptcha/turnstile and math captcha based on config.
+// Returns (true, nil) if verification passes, (false, nil) if it fails, (false, error) on error.
+func Verify(token string, remoteIP string, s session.Session, r recaptcha.RecaptchaV3, lang string) (bool, error) {
+	if conf.Recaptcha.CaptchaType == "math" {
+		return VerifyMath(s, token, lang)
+	}
+
+	// reCAPTCHA / Turnstile
+	resp, err := r.Verify(token, remoteIP)
+	if err != nil {
+		logrus.WithError(err).Error("Failed to verify recaptcha/turnstile")
+		return false, errors.New(i18n.T(lang, "captcha.errService"))
+	}
+	if !resp.Success {
+		return false, errors.New(i18n.T(lang, "captcha.error"))
+	}
+	return true, nil
+}
diff --git a/internal/cmd/ban.go b/internal/cmd/ban.go
new file mode 100644
index 0000000..e59f87a
--- /dev/null
+++ b/internal/cmd/ban.go
@@ -0,0 +1,105 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package cmd
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+	"github.com/urfave/cli/v2"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/db"
+)
+
+// Ban 封禁用户并连带清理其全部数据。
+// 用法：TamaBox ban --email user@example.com   或   TamaBox ban --domain someone
+var Ban = &cli.Command{
+	Name:   "ban",
+	Usage:  "Ban a user and clean up all their questions, follow-ups and chats",
+	Action: runBan,
+	Flags: []cli.Flag{
+		&cli.StringFlag{
+			Name:  "email",
+			Usage: "Email of the user to ban",
+		},
+		&cli.StringFlag{
+			Name:  "domain",
+			Usage: "Custom domain of the user to ban",
+		},
+		&cli.BoolFlag{
+			Name:  "yes",
+			Usage: "Skip confirmation",
+		},
+	},
+}
+
+func runBan(ctx *cli.Context) error {
+	if err := conf.Init(); err != nil {
+		return errors.Wrap(err, "load configuration")
+	}
+
+	dbType := conf.Database.Type
+	if dbType == "postgres" {
+		conf.Database.DSN = conf.PostgresDsn()
+	} else {
+		conf.Database.DSN = conf.MySQLDsn()
+	}
+
+	database, err := db.Init(dbType, conf.Database.DSN)
+	if err != nil {
+		return errors.Wrap(err, "connect to database")
+	}
+
+	email := ctx.String("email")
+	domain := ctx.String("domain")
+	if email == "" && domain == "" {
+		return errors.New("must provide --email or --domain")
+	}
+
+	// 用 Unscoped 查找，支持封禁已软删除（自助停用）的账号
+	var user db.User
+	query := database.WithContext(ctx.Context).Unscoped()
+	if email != "" {
+		query = query.Where("email = ?", email)
+	} else {
+		query = query.Where("domain = ?", domain)
+	}
+	if err := query.First(&user).Error; err != nil {
+		return errors.Wrap(err, "find user to ban")
+	}
+
+	logrus.WithFields(logrus.Fields{
+		"id":     user.ID,
+		"name":   user.Name,
+		"email":  user.Email,
+		"domain": user.Domain,
+	}).Warn("准备封禁以下账号，其提问/追问/私聊将一并删除，此操作不可恢复！")
+
+	if !ctx.Bool("yes") {
+		logrus.Warn("输入大写 YES 确认执行封禁：")
+		var answer string
+		if _, err := fmtScan(&answer); err != nil {
+			return errors.Wrap(err, "read confirmation")
+		}
+		if answer != "YES" {
+			return errors.New("已取消")
+		}
+	}
+
+	if err := db.Users.BanUserAndCleanup(ctx.Context, user.ID); err != nil {
+		return errors.Wrap(err, "ban user and cleanup")
+	}
+
+	logrus.WithField("user_id", user.ID).Info("用户已封禁，关联数据已清理")
+	return nil
+}
+
+// fmtScan 从标准输入读取一行，便于交互确认（隔离以便测试）。
+var fmtScan = func(dst *string) (int, error) {
+	return fmt.Fscan(os.Stdin, dst)
+}
diff --git a/internal/cmd/censor.go b/internal/cmd/censor.go
new file mode 100644
index 0000000..75e74af
--- /dev/null
+++ b/internal/cmd/censor.go
@@ -0,0 +1,86 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package cmd
+
+import (
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+	"github.com/urfave/cli/v2"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/db"
+	"github.com/tamakyi/TamaBox/internal/security/censor"
+)
+
+var Censor = &cli.Command{
+	Name:   "censor",
+	Usage:  "Censor the questions",
+	Action: runCensor,
+}
+
+func runCensor(ctx *cli.Context) error {
+	if err := conf.Init(); err != nil {
+		return errors.Wrap(err, "load configuration")
+	}
+
+	if !conf.Security.EnableTextCensor {
+		return errors.New("text censor is disabled")
+	}
+
+	dbType := conf.Database.Type
+	if dbType == "postgres" {
+		conf.Database.DSN = conf.PostgresDsn()
+	} else {
+		conf.Database.DSN = conf.MySQLDsn()
+	}
+
+	database, err := db.Init(dbType, conf.Database.DSN)
+	if err != nil {
+		return errors.Wrap(err, "connect to database")
+	}
+
+	// Check all the unprocessed questions.
+	var questions []db.Question
+	if err := database.Raw(`SELECT * FROM questions WHERE content_censor_metadata IS NULL`).Find(&questions).Error; err != nil {
+		return errors.Wrap(err, "query questions")
+	}
+
+	logrus.WithContext(ctx.Context).WithField("count", len(questions)).Info("Found un-censor questions")
+
+	for i, question := range questions {
+		question := question
+
+		content := question.Content
+		answer := question.Answer
+		contentCensorResponse, err := censor.Text(ctx.Context, content)
+		if err != nil {
+			logrus.WithContext(ctx.Context).WithField("question_id", question.ID).WithError(err).Error("Failed to censor content")
+		} else {
+			// We don't want to update the `updated_at` field, so just execute the raw SQL.
+			if err := database.Debug().Exec(`UPDATE questions SET content_censor_metadata = ? WHERE id = ?`, contentCensorResponse.ToJSON(), question.ID).Error; err != nil {
+				logrus.WithContext(ctx.Context).WithField("question_id", question.ID).WithError(err).Error("Failed to update content censor metadata")
+			}
+		}
+
+		if answer != "" && question.AnswerCensorMetadata == nil {
+			answerCensorResponse, err := censor.Text(ctx.Context, answer)
+			if err != nil {
+				logrus.WithContext(ctx.Context).WithField("question_id", question.ID).WithError(err).Error("Failed to censor answer")
+			} else {
+				// We don't want to update the `updated_at` field, so just execute the raw SQL.
+				if err := database.Exec(`UPDATE questions SET answer_censor_metadata = ? WHERE id = ?`, answerCensorResponse.ToJSON(), question.ID).Error; err != nil {
+					logrus.WithContext(ctx.Context).WithField("question_id", question.ID).WithError(err).Error("Failed to update answer censor metadata")
+				}
+			}
+		}
+
+		if i%1000 == 0 {
+			logrus.WithContext(ctx.Context).WithField("count", i).Trace("Processed questions")
+		}
+	}
+
+	logrus.WithContext(ctx.Context).WithField("count", len(questions)).Info("Processed all questions")
+	return nil
+}
diff --git a/internal/cmd/uid.go b/internal/cmd/uid.go
new file mode 100644
index 0000000..416c02d
--- /dev/null
+++ b/internal/cmd/uid.go
@@ -0,0 +1,61 @@
+package cmd
+
+import (
+	"fmt"
+
+	"github.com/pkg/errors"
+	"github.com/rs/xid"
+	"github.com/urfave/cli/v2"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/db"
+)
+
+var Uid = &cli.Command{
+	Name:   "uid",
+	Usage:  "Create uid for user",
+	Action: runUid,
+}
+
+func runUid(ctx *cli.Context) error {
+	if err := conf.Init(); err != nil {
+		return errors.Wrap(err, "load configuration")
+	}
+
+	dbType := conf.Database.Type
+	if dbType == "postgres" {
+		conf.Database.DSN = conf.PostgresDsn()
+	} else {
+		conf.Database.DSN = conf.MySQLDsn()
+	}
+
+	database, err := db.Init(dbType, conf.Database.DSN)
+	if err != nil {
+		return errors.Wrap(err, "connect to database")
+	}
+
+	var users []*db.User
+	if err := database.WithContext(ctx.Context).Unscoped().Find(&users).Error; err != nil {
+		return errors.Wrap(err, "query users")
+	}
+
+	for idx, user := range users {
+		user := user
+		if user.UID != "" {
+			continue
+		}
+
+		if idx%1000 == 0 {
+			fmt.Printf("Processing user %d/%d\n", idx, len(users))
+		}
+
+		uid := xid.NewWithTime(user.CreatedAt).String()
+		if err := database.WithContext(ctx.Context).Unscoped().
+			Model(&db.User{}).
+			Omit("updated_at").
+			Where("id = ?", user.ID).UpdateColumn("uid", uid).Error; err != nil {
+			return errors.Wrap(err, "update uid")
+		}
+	}
+	return nil
+}
diff --git a/internal/cmd/web.go b/internal/cmd/web.go
new file mode 100644
index 0000000..bb4ef9e
--- /dev/null
+++ b/internal/cmd/web.go
@@ -0,0 +1,107 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package cmd
+
+import (
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+	"github.com/uptrace/opentelemetry-go-extra/otellogrus"
+	"github.com/uptrace/uptrace-go/uptrace"
+	"github.com/urfave/cli/v2"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/db"
+	"github.com/tamakyi/TamaBox/internal/route"
+	"github.com/tamakyi/TamaBox/internal/shared"
+	"github.com/tamakyi/TamaBox/internal/tracing"
+)
+
+var Web = &cli.Command{
+	Name:   "web",
+	Usage:  "Start web server",
+	Action: runWeb,
+}
+
+func runWeb(ctx *cli.Context) error {
+	if err := conf.Init(); err != nil {
+		return errors.Wrap(err, "load configuration")
+	}
+
+	// 解析可信代理网段（用于客户端 IP 解析，避免维护 Cloudflare 庞大 CIDR 清单）。
+	if err := shared.InitTrustedProxies(); err != nil {
+		return errors.Wrap(err, "init trusted proxies")
+	}
+
+	if conf.App.UptraceDSN != "" {
+		uptrace.ConfigureOpentelemetry(
+			uptrace.WithDSN(conf.App.UptraceDSN),
+			uptrace.WithServiceName("tamabox"),
+			uptrace.WithServiceVersion(conf.BuildCommit),
+		)
+		logrus.WithContext(ctx.Context).Debug("Tracing enabled.")
+	}
+
+	logrus.AddHook(otellogrus.NewHook(otellogrus.WithLevels(
+		logrus.PanicLevel,
+		logrus.FatalLevel,
+		logrus.ErrorLevel,
+		logrus.WarnLevel,
+	)))
+
+	dbType := conf.Database.Type
+
+	var dsn string
+	switch dbType {
+	case "mysql", "":
+		dsn = conf.MySQLDsn()
+	case "postgres":
+		dsn = conf.PostgresDsn()
+	default:
+		return errors.Errorf("unknown database type: %q", dbType)
+	}
+	conf.Database.DSN = dsn
+
+	_, err := db.Init(dbType, dsn)
+	if err != nil {
+		return errors.Wrap(err, "connect to database")
+	}
+
+	logrus.WithContext(ctx.Context).WithField("external_url", conf.App.ExternalURL).Info("Starting web server")
+
+	// 站点默认语言初始化（default_lang 配置，未配置时回退 zh-CN）
+	shared.App.SetLang(conf.App.DefaultLang)
+
+	r := route.New()
+	r.Use(tracing.Middleware("TamaBox"))
+
+	// 最外层挂载 gzip 压缩，并在 http.Server 上配置超时：
+	// - ReadHeaderTimeout 防止慢速客户端占用连接
+	// - ReadTimeout / WriteTimeout 防止读写挂死
+	// - IdleTimeout 复用 keep-alive 连接
+	// listen 留空时回退到 ":port"（监听所有网卡）；Cloudflare Tunnel 部署建议设为
+	// "127.0.0.1:<port>"，使源站端口仅对本地 cloudflared 可见，即使防火墙误配也无法被外部直连。
+	addr := conf.Server.Listen
+	if addr == "" {
+		addr = fmt.Sprintf(":%d", conf.Server.Port)
+	}
+	server := &http.Server{
+		Addr:              addr,
+		Handler:           route.GzipHandler(r),
+		ReadHeaderTimeout: 10 * time.Second,
+		ReadTimeout:       30 * time.Second,
+		WriteTimeout:      60 * time.Second,
+		IdleTimeout:       120 * time.Second,
+	}
+
+	logrus.WithContext(ctx.Context).WithField("port", conf.Server.Port).Info("Listening on")
+	if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+		return errors.Wrap(err, "start http server")
+	}
+	return nil
+}
diff --git a/internal/conf/conf.go b/internal/conf/conf.go
new file mode 100644
index 0000000..4fde3e8
--- /dev/null
+++ b/internal/conf/conf.go
@@ -0,0 +1,105 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package conf
+
+import (
+	"os"
+	"strings"
+
+	"github.com/pkg/errors"
+	"gopkg.in/ini.v1"
+)
+
+// File is the configuration object.
+var File *ini.File
+
+func Init() error {
+	configFile := os.Getenv("NEKOBOX_CONFIG_PATH")
+	if configFile == "" {
+		configFile = "conf/app.ini"
+	}
+
+	var err error
+	File, err = ini.LoadSources(ini.LoadOptions{
+		IgnoreInlineComment: true,
+	}, configFile)
+	if err != nil {
+		return errors.Wrapf(err, "parse %q", configFile)
+	}
+
+	if err := File.Section("app").MapTo(&App); err != nil {
+		return errors.Wrap(err, "map 'server'")
+	}
+
+	if App.ExternalURL == "" {
+		return errors.New("app.external_url is required")
+	}
+	App.ExternalURL = strings.TrimRight(App.ExternalURL, "/")
+
+	if err := File.Section("security").MapTo(&Security); err != nil {
+		return errors.Wrap(err, "map 'security'")
+	}
+
+	if err := File.Section("server").MapTo(&Server); err != nil {
+		return errors.Wrap(err, "map 'server'")
+	}
+
+	// XSRFKey 为空会导致 CSRF token 以空密钥生成、可被预测，
+	// 使删题/置顶/拉黑/改密等所有 POST 操作的 CSRF 防护形同虚设。启动时强制校验。
+	if Server.XSRFKey == "" {
+		return errors.New("server.xsrf_key is required (used to generate CSRF tokens, must not be empty)")
+	}
+
+	// Salt 为空会让密码哈希以空盐计算（HmacSha1(password, "")），
+	// 相同密码产生相同哈希且可被离线字典/彩虹表攻击。启动时强制校验。
+	if Server.Salt == "" {
+		return errors.New("server.salt is required (used to hash user passwords, must not be empty)")
+	}
+
+	if err := File.Section("database").MapTo(&Database); err != nil {
+		return errors.Wrap(err, "map 'database'")
+	}
+
+	if err := File.Section("redis").MapTo(&Redis); err != nil {
+		return errors.Wrap(err, "map 'redis'")
+	}
+
+	if err := File.Section("recaptcha").MapTo(&Recaptcha); err != nil {
+		return errors.Wrap(err, "map 'recaptcha'")
+	}
+
+	if err := File.Section("pixel").MapTo(&Pixel); err != nil {
+		return errors.Wrap(err, "map 'pixel'")
+	}
+
+	if err := File.Section("upload").MapTo(&Upload); err != nil {
+		return errors.Wrap(err, "map 'upload'")
+	}
+
+	if err := File.Section("limits").MapTo(&Limits); err != nil {
+		return errors.Wrap(err, "map 'limits'")
+	}
+	// ini 键留空会被 int 解析为 0；<1 的值一律回退内置默认，防止上限被静默置零。
+	sanitizeLimits(&Limits)
+
+	if err := File.Section("mail").MapTo(&Mail); err != nil {
+		return errors.Wrap(err, "map 'mail'")
+	}
+
+	serviceSections := File.Section("service").ChildSections()
+	for _, serviceSection := range serviceSections {
+		serviceSection := serviceSection
+		var backend struct {
+			Prefix     string `ini:"prefix"`
+			ForwardURL string `ini:"forward_url"`
+		}
+		if err := serviceSection.MapTo(&backend); err != nil {
+			return errors.Wrapf(err, "map 'service.%s'", serviceSection.Name())
+		}
+		Service.Backends = append(Service.Backends, backend)
+	}
+
+	return nil
+}
diff --git a/internal/conf/db.go b/internal/conf/db.go
new file mode 100644
index 0000000..c50e297
--- /dev/null
+++ b/internal/conf/db.go
@@ -0,0 +1,27 @@
+package conf
+
+import "fmt"
+
+func MySQLDsn() string {
+	return fmt.Sprintf("%s:%s@tcp(%s:%d)/%s?charset=utf8mb4&parseTime=True&loc=Local",
+		Database.User,
+		Database.Password,
+		Database.Host,
+		Database.Port,
+		Database.Name,
+	)
+}
+
+func PostgresDsn() string {
+	dsn := fmt.Sprintf("host=%s port=%d user=%s password=%s dbname=%s sslmode=disable TimeZone=Asia/Shanghai",
+		Database.Host,
+		Database.Port,
+		Database.User,
+		Database.Password,
+		Database.Name,
+	)
+	if Database.Schema != "" {
+		dsn += fmt.Sprintf(" search_path=%s", Database.Schema)
+	}
+	return dsn
+}
diff --git a/internal/conf/limits.go b/internal/conf/limits.go
new file mode 100644
index 0000000..8c089a2
--- /dev/null
+++ b/internal/conf/limits.go
@@ -0,0 +1,119 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package conf
+
+// 各项上限的内置默认值（与旧版硬编码一致）。既是未配置 [limits] 段时的兜底，
+// 也是 conf.Init 后归一化（sanitizeLimits）的回退基准。
+const (
+	defaultMaxTags              = 5
+	defaultMaxTagLen            = 5
+	defaultMaxBlockWords        = 10
+	defaultMaxBlockWordLen      = 10
+	defaultCustomAnswerLen      = 200
+	defaultVoteOptionLen        = 300
+	defaultQuestionContentLen   = 1000
+	defaultAnswerContentLen     = 2000
+	defaultFollowUpContentLen   = 2000
+	defaultChatMessageLen       = 2000
+	defaultChatMaxMessages      = 200
+	defaultDailyMessageLimitMax = 999
+)
+
+// LimitsConfig 全站内容 / 数量上限（[limits] 配置段）的字段集合。
+//
+// 过去这些上限以常量形式散落在 internal/db（MaxTags / MaxCustomTextLen 等）与
+// 路由层硬编码（私聊单条 2000 字、会话条数 clamp 5~200 等）中，调整需改代码重编译，
+// 且前后端、i18n 文案各自携带一份数值容易漂移。统一收口到 [limits] 段后：
+//   - 后端校验、模板注入、前端提示全部引用 conf.Limits 的同一份值；
+//   - 调整仅需修改 conf/app.ini 并重启进程，无需改代码；
+//   - 长度类上限统一按字符（rune / Unicode 码点）计数。
+type LimitsConfig struct {
+	// ── 标签与屏蔽词（账号设置页）──
+
+	// 标签个数上限
+	MaxTags int `ini:"max_tags"`
+	// 单个标签最大字符数
+	MaxTagLen int `ini:"max_tag_len"`
+	// 屏蔽词个数上限
+	MaxBlockWords int `ini:"max_block_words"`
+	// 单个屏蔽词最大字符数
+	MaxBlockWordLen int `ini:"max_block_word_len"`
+
+	// ── 投票 ──
+
+	// 参与者填写的「自定义补充选项」文本最大字符数。
+	// 覆盖两类入口：单选/多选/排序的全局补充选项，以及表单收集字段的
+	// 「其他/自定义选项」（field_{id}_custom）。
+	CustomAnswerLen int `ini:"custom_answer_len"`
+	// 站长创建投票时单个「选项」文本的最大字符数。
+	// 覆盖单选/多选/排序的预设选项，以及表单收集字段（select/radio/checkbox/rank）
+	// 的预置选项。与 CustomAnswerLen 是两条独立规则（站长侧预设刻意放宽），可各自调参。
+	VoteOptionLen int `ini:"vote_option_len"`
+
+	// ── 提问 / 回答 / 追问 ──
+
+	// 提问正文最大字符数（访客向提问箱提交的问题内容）。
+	// 旧实现依赖 govalid 的 maxlen 标签（编译期写死 2000），无法随配置调整，
+	// 且与前端 maxlength=1000 不一致，现已移到路由层按本值做 rune 校验。
+	QuestionContentLen int `ini:"question_content_len"`
+	// 回答正文最大字符数：箱主对提问的正式回答，以及箱主对追问的回复（共用）。
+	AnswerContentLen int `ini:"answer_content_len"`
+	// 追问正文最大字符数（提问者在问题被回答后继续追问的内容）。
+	FollowUpContentLen int `ini:"followup_content_len"`
+
+	// ── 私聊 ──
+
+	// 单条消息（发送 / 回复共用）最大字符数
+	ChatMessageLen int `ini:"chat_message_len"`
+	// 每个私聊会话的消息条数上限（系统硬顶）。用户只能在 1..该值 之间设置自己的
+	// chat_max_messages；新注册用户的默认值即该硬顶（而非固定 20）。
+	ChatMaxMessages int `ini:"chat_max_messages"`
+	// 单用户每日私信条数上限（用户可设范围 0..该值；0 表示不限制每日条数）。
+	// 该值只是「用户可设置的上限」，不是站点强制的每日配额。
+	DailyMessageLimitMax int `ini:"daily_message_limit_max"`
+}
+
+// Limits 保存运行时的全部上限配置。conf.Init 中会先 MapTo [limits] 段覆盖显式键，
+// 再调用 sanitizeLimits 把 <1 的值回退到内置默认，因此：
+//   - 缺失 [limits] 段或个别键 → 使用内置默认；
+//   - ini 键留空（int 解析为 0）或误填 0/负数 → 自动回退默认，不会把上限静默置零。
+var Limits = LimitsConfig{
+	MaxTags:              defaultMaxTags,
+	MaxTagLen:            defaultMaxTagLen,
+	MaxBlockWords:        defaultMaxBlockWords,
+	MaxBlockWordLen:      defaultMaxBlockWordLen,
+	CustomAnswerLen:      defaultCustomAnswerLen,
+	VoteOptionLen:        defaultVoteOptionLen,
+	QuestionContentLen:   defaultQuestionContentLen,
+	AnswerContentLen:     defaultAnswerContentLen,
+	FollowUpContentLen:   defaultFollowUpContentLen,
+	ChatMessageLen:       defaultChatMessageLen,
+	ChatMaxMessages:      defaultChatMaxMessages,
+	DailyMessageLimitMax: defaultDailyMessageLimitMax,
+}
+
+// sanitizeLimits 归一化 [limits] 配置：所有上限最小为 1（0 / 负数说明未配置或手滑，
+// 一律回退内置默认，避免「留空=0」把标签全拒、消息全超长等隐性灾难）。
+// 注意 DailyMessageLimitMax 同样要求 >=1：0 会让用户侧永远只能设为 0（=不限制），
+// 语义上等于关闭每日配额功能，需显式使用该字段其余语义时请另行设计。
+func sanitizeLimits(l *LimitsConfig) {
+	clamp1 := func(p *int, def int) {
+		if *p < 1 {
+			*p = def
+		}
+	}
+	clamp1(&l.MaxTags, defaultMaxTags)
+	clamp1(&l.MaxTagLen, defaultMaxTagLen)
+	clamp1(&l.MaxBlockWords, defaultMaxBlockWords)
+	clamp1(&l.MaxBlockWordLen, defaultMaxBlockWordLen)
+	clamp1(&l.CustomAnswerLen, defaultCustomAnswerLen)
+	clamp1(&l.VoteOptionLen, defaultVoteOptionLen)
+	clamp1(&l.QuestionContentLen, defaultQuestionContentLen)
+	clamp1(&l.AnswerContentLen, defaultAnswerContentLen)
+	clamp1(&l.FollowUpContentLen, defaultFollowUpContentLen)
+	clamp1(&l.ChatMessageLen, defaultChatMessageLen)
+	clamp1(&l.ChatMaxMessages, defaultChatMaxMessages)
+	clamp1(&l.DailyMessageLimitMax, defaultDailyMessageLimitMax)
+}
diff --git a/internal/conf/limits_test.go b/internal/conf/limits_test.go
new file mode 100644
index 0000000..af3ce53
--- /dev/null
+++ b/internal/conf/limits_test.go
@@ -0,0 +1,127 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package conf
+
+import (
+	"testing"
+
+	"gopkg.in/ini.v1"
+)
+
+// TestLimitsDefaults 保证内置默认值与旧版硬编码一致：未配置 [limits] 段（或 conf.Init
+// 尚未调用）时，程序按这些默认值运行。
+func TestLimitsDefaults(t *testing.T) {
+	cases := []struct {
+		name string
+		got  int
+		want int
+	}{
+		{"MaxTags", Limits.MaxTags, 5},
+		{"MaxTagLen", Limits.MaxTagLen, 5},
+		{"MaxBlockWords", Limits.MaxBlockWords, 10},
+		{"MaxBlockWordLen", Limits.MaxBlockWordLen, 10},
+		{"CustomAnswerLen", Limits.CustomAnswerLen, 200},
+		{"VoteOptionLen", Limits.VoteOptionLen, 300},
+		{"QuestionContentLen", Limits.QuestionContentLen, 1000},
+		{"AnswerContentLen", Limits.AnswerContentLen, 2000},
+		{"FollowUpContentLen", Limits.FollowUpContentLen, 2000},
+		{"ChatMessageLen", Limits.ChatMessageLen, 2000},
+		{"ChatMaxMessages", Limits.ChatMaxMessages, 200},
+		{"DailyMessageLimitMax", Limits.DailyMessageLimitMax, 999},
+	}
+	for _, c := range cases {
+		if c.got != c.want {
+			t.Errorf("%s = %d, want %d", c.name, c.got, c.want)
+		}
+	}
+}
+
+// TestLimitsMapTo 模拟 conf.Init 的映射行为：显式键被覆盖，缺失键保留默认。
+// 启动逻辑是 File.Section("limits").MapTo(&Limits)，与这里同一路径。
+func TestLimitsMapTo(t *testing.T) {
+	src := `
+[limits]
+max_tags = 7
+chat_message_len = 500
+answer_content_len = 300
+daily_message_limit_max = 0
+`
+	f, err := ini.LoadSources(ini.LoadOptions{IgnoreInlineComment: true}, []byte(src))
+	if err != nil {
+		t.Fatalf("parse ini: %v", err)
+	}
+	l := Limits // 拷贝默认值，等价于启动前状态
+	if err := f.Section("limits").MapTo(&l); err != nil {
+		t.Fatalf("map [limits]: %v", err)
+	}
+	if l.MaxTags != 7 {
+		t.Errorf("MaxTags = %d, want 7 (ini 覆盖失败)", l.MaxTags)
+	}
+	if l.ChatMessageLen != 500 {
+		t.Errorf("ChatMessageLen = %d, want 500", l.ChatMessageLen)
+	}
+	if l.AnswerContentLen != 300 {
+		t.Errorf("AnswerContentLen = %d, want 300（ini 覆盖失败）", l.AnswerContentLen)
+	}
+	if l.DailyMessageLimitMax != 0 {
+		t.Errorf("DailyMessageLimitMax = %d, want 0（配置为 0 应生效）", l.DailyMessageLimitMax)
+	}
+	// 未显式出现的键保留内置默认
+	if l.MaxTagLen != 5 {
+		t.Errorf("MaxTagLen = %d, want 5（缺失键应保留默认）", l.MaxTagLen)
+	}
+	if l.VoteOptionLen != 300 {
+		t.Errorf("VoteOptionLen = %d, want 300", l.VoteOptionLen)
+	}
+	if l.QuestionContentLen != 1000 || l.FollowUpContentLen != 2000 {
+		t.Errorf("QuestionContentLen/FollowUpContentLen = %d/%d, want 1000/2000（缺失键应保留默认）",
+			l.QuestionContentLen, l.FollowUpContentLen)
+	}
+}
+
+// TestLimitsEmptyValueSanitized 验证「键留空」的防护：ini 会把空 int 解析为 0，
+// sanitizeLimits 随后将其回退到内置默认 —— 防止留空把上限静默置零（标签全拒等）。
+func TestLimitsEmptyValueSanitized(t *testing.T) {
+	src := `
+[limits]
+max_tags =
+chat_message_len = 0
+followup_content_len = -1
+daily_message_limit_max = -3
+`
+	f, err := ini.LoadSources(ini.LoadOptions{IgnoreInlineComment: true}, []byte(src))
+	if err != nil {
+		t.Fatalf("parse ini: %v", err)
+	}
+	l := Limits
+	if err := f.Section("limits").MapTo(&l); err != nil {
+		t.Fatalf("map [limits]: %v", err)
+	}
+	// 前提确认：空串对 int 是「保留原值」而非 0（gopkg.in/ini 行为）；
+	// 显式 0 / 负数则照常映射。真正的 0 陷阱来自显式填 0 / 负数，由 sanitize 兜底。
+	if l.MaxTags != defaultMaxTags {
+		t.Fatalf("precondition broken: 空值 max_tags 应保留默认, got %d", l.MaxTags)
+	}
+	if l.ChatMessageLen != 0 || l.DailyMessageLimitMax != -3 {
+		t.Fatalf("precondition broken: got %d/%d, want 0/-3",
+			l.ChatMessageLen, l.DailyMessageLimitMax)
+	}
+	sanitizeLimits(&l)
+	if l.MaxTags != defaultMaxTags {
+		t.Errorf("MaxTags = %d, want 默认 %d", l.MaxTags, defaultMaxTags)
+	}
+	if l.ChatMessageLen != defaultChatMessageLen {
+		t.Errorf("ChatMessageLen = %d, want 默认 %d（0 应回退默认）", l.ChatMessageLen, defaultChatMessageLen)
+	}
+	if l.FollowUpContentLen != defaultFollowUpContentLen {
+		t.Errorf("FollowUpContentLen = %d, want 默认 %d（负数应回退默认）", l.FollowUpContentLen, defaultFollowUpContentLen)
+	}
+	if l.DailyMessageLimitMax != defaultDailyMessageLimitMax {
+		t.Errorf("DailyMessageLimitMax = %d, want 默认 %d（负数应回退默认）", l.DailyMessageLimitMax, defaultDailyMessageLimitMax)
+	}
+	if l.ChatMaxMessages != defaultChatMaxMessages {
+		t.Errorf("ChatMaxMessages = %d, want 默认 %d（缺失键不受影响）", l.ChatMaxMessages, defaultChatMaxMessages)
+	}
+}
diff --git a/internal/conf/static.go b/internal/conf/static.go
new file mode 100644
index 0000000..ecf617e
--- /dev/null
+++ b/internal/conf/static.go
@@ -0,0 +1,133 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package conf
+
+// Build time and commit information.
+//
+// ⚠️ WARNING: should only be set by "-ldflags".
+var (
+	BuildTime   string
+	BuildCommit = "dev"
+)
+
+var (
+	App struct {
+		Production            bool   `ini:"production"`
+		ExternalURL           string `ini:"external_url"`
+		ICP                   string `ini:"icp"`
+		DefaultLang           string `ini:"default_lang"` // 站点默认语言（zh-CN/zh-TW/en/ja），留空回退简体中文
+		UptraceDSN            string `ini:"uptrace_dsn"`
+		QiniuAccessKey        string `ini:"qiniu_access_key"`
+		QiniuAccessSecret     string `ini:"qiniu_access_secret"`
+		AliyunAccessKey       string `ini:"aliyun_access_key"`
+		AliyunAccessKeySecret string `ini:"aliyun_access_key_secret"`
+		SentryDSN             string `ini:"sentry_dsn"`
+		MaintenanceMode       bool   `ini:"maintenance_mode"`
+		ShareBackground       string `ini:"share_background"`
+		FontPath              string `ini:"font_path"`
+	}
+
+	Security struct {
+		EnableTextCensor       bool   `ini:"enable_text_censor"`
+		IPBlacklist            string `ini:"ip_blacklist"`
+		IPBlacklistRedirectURL string `ini:"ip_blacklist_redirect_url"`
+		// TrustProxy 为 true 时信任 CDN 权威客户端头 CF-Connecting-IP / EO-Client-IP
+		// （以及受信代理设置的 X-Real-IP / X-Forwarded-For）；否则一律使用 RemoteAddr，
+		// 防止客户端伪造 header 绕过速率限制与 IP 黑名单。
+		TrustProxy bool `ini:"trust_proxy"`
+		// TrustedProxies 逗号分隔的 IP / CIDR 列表，仅限“你自己的”反向代理/负载均衡基础设施
+		// （例如本机 nginx 的 127.0.0.1、私有网络 LB）。仅当 TCP 对端落在该清单内时才会解析
+		// X-Forwarded-For / X-Real-IP。留空则这两个头永不被信任（CDN 权威头 CF-Connecting-IP /
+		// EO-Client-IP 仍会被采用，前提是源站已被对应 CDN 锁定）。
+		// 目的：避免维护 Cloudflare / EdgeOne 等上游 CDN 的庞大 CIDR 清单——源站应配合
+		// Cloudflare Tunnel / Authenticated Origin Pull / 防火墙仅放行 CDN 回源网段锁定，
+		// 使 CF-Connecting-IP / EO-Client-IP 成为权威客户端 IP。
+		TrustedProxies string `ini:"trusted_proxies"`
+		// 自动封禁（fail2ban 风格）：检测批量扫描/探测特征后临时封禁来源 IP。
+		EnableAutoBan bool `ini:"enable_auto_ban"`
+		// BanTrackNotFound 是否把「未注册路径的 404」计入封禁统计。默认 false：正常业务
+		// （域名/题目不存在等均走 302 业务跳转，不产生计数）一律放行，仅命中后台扫描特征
+		// 路径（KindSensitive）才参与统计封禁。避免共享出口（CDN 边缘 / CGNAT NAT444）下
+		// 正常用户被 404 探测流量连坐误伤。如需恢复对纯 404 字典扫描的封禁再置 true。
+		BanTrackNotFound      bool   `ini:"ban_track_notfound"`
+		BanThresholdSensitive int    `ini:"ban_threshold_sensitive"` // 窗口内敏感路径命中次数
+		BanThreshold404       int    `ini:"ban_threshold_404"`       // 窗口内 404 次数
+		BanWindowSeconds      int    `ini:"ban_window_seconds"`      // 统计窗口（秒）
+		BanDurationMinutes    int    `ini:"ban_duration_minutes"`    // 封禁时长（分钟）
+		SecurityAlertEmail    string `ini:"security_alert_email"`    // 触发封禁时告警收件人（留空不发送）
+	}
+
+	Server struct {
+		Port    int    `ini:"port"`
+		Listen  string `ini:"listen"` // 绑定监听地址（含端口）。留空则默认 ":port"（监听所有网卡）。
+		Salt    string `ini:"salt"`
+		XSRFKey string `ini:"xsrf_key"`
+	}
+
+	Database struct {
+		DSN string
+
+		Type               string `ini:"type"`
+		User               string `ini:"user"`
+		Password           string `ini:"password"`
+		Host               string `ini:"host"`
+		Port               uint   `ini:"port"`
+		Name               string `ini:"name"`
+		Schema             string `ini:"schema"`
+		DedupeUniqueFields bool   `ini:"dedupe_unique_fields"`
+	}
+
+	Redis struct {
+		Addr     string `ini:"addr"`
+		Password string `ini:"password"`
+	}
+
+	Recaptcha struct {
+		CaptchaType    string `ini:"captcha_type"`
+		Domain         string `ini:"domain"`
+		SiteKey        string `ini:"site_key"`
+		ServerKey      string `ini:"server_key"`
+		TurnstileStyle bool   `ini:"turnstile_style"`
+	}
+
+	Pixel struct {
+		Host string `ini:"host"`
+	}
+
+	Upload struct {
+		DefaultAvatarURL          string `ini:"default_avatar"`
+		DefaultBackground         string `ini:"default_background"`
+		DefaultBackgroundImageURL string `ini:"default_qrbackgroundimage"`
+		AliyunEndpoint            string `ini:"aliyun_endpoint"`
+		AliyunAccessID            string `ini:"aliyun_access_id"`
+		AliyunAccessSecret        string `ini:"aliyun_access_secret"`
+		AliyunBucket              string `ini:"aliyun_bucket"`
+		AliyunBucketCDNHost       string `ini:"aliyun_bucket_cdn_host"`
+		ImageEndpoint             string `ini:"image_endpoint"`
+		ImageAccessID             string `ini:"image_access_id"`
+		ImageAccessSecret         string `ini:"image_access_secret"`
+		ImageBucket               string `ini:"image_bucket"`
+		ImageBucketCDNHost        string `ini:"image_bucket_cdn_host"`
+	}
+
+	Mail struct {
+		Account  string `ini:"account"`
+		Password string `ini:"password"`
+		Port     int    `ini:"port"`
+		SMTP     string `ini:"smtp"`
+		// SkipTLSVerify 跳过 SMTP TLS 证书校验（仅自签名/内网 SMTP 需要，默认 false 校验证书）
+		SkipTLSVerify bool `ini:"skip_tls_verify"`
+	}
+
+	Service struct {
+		Backends []struct {
+			Prefix     string `ini:"prefix"`
+			ForwardURL string `ini:"forward_url"`
+		}
+		// TLSInsecureSkipVerify 跳过反向代理到后端服务的 TLS 证书校验
+		// （仅内网后端使用自签名证书时需要，默认 false 校验证书）
+		TLSInsecureSkipVerify bool `ini:"tls_insecure_skip_verify"`
+	}
+)
diff --git a/internal/context/auth.go b/internal/context/auth.go
new file mode 100644
index 0000000..bd33051
--- /dev/null
+++ b/internal/context/auth.go
@@ -0,0 +1,57 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package context
+
+import (
+	"github.com/flamego/flamego"
+	"github.com/flamego/session"
+
+	"github.com/tamakyi/TamaBox/internal/db"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+)
+
+// authenticatedUser returns the user object of the authenticated user.
+func authenticatedUser(ctx flamego.Context, sess session.Session) *db.User {
+	uid, ok := sess.Get("uid").(uint)
+	if !ok {
+		return nil
+	}
+
+	user, err := db.Users.GetByID(ctx.Request().Context(), uid)
+	if err != nil || user == nil {
+		return nil
+	}
+
+	// 密码变更后，旧会话保存的版本号不匹配，强制重新登录。
+	ver, _ := sess.Get("pwd_ver").(uint)
+	if user.PasswordVersion != ver {
+		return nil
+	}
+	return user
+}
+
+type ToggleOptions struct {
+	UserSignInRequired  bool
+	UserSignOutRequired bool
+}
+
+func Toggle(options *ToggleOptions) flamego.Handler {
+	return func(ctx Context, endpoint EndpointType) error {
+		if options.UserSignOutRequired && ctx.IsLogged {
+			ctx.Redirect("/")
+			return nil
+		}
+
+		if options.UserSignInRequired && !ctx.IsLogged {
+			if endpoint.IsAPI() {
+				return ctx.JSONError(40100, i18n.T(ctx.Lang(), "auth.errLoginRequired"))
+			}
+			ctx.SetErrorFlash(i18n.T(ctx.Lang(), "auth.errLoginRequired"))
+			ctx.Redirect("/login")
+			return nil
+		}
+		return nil
+	}
+}
diff --git a/internal/context/context.go b/internal/context/context.go
new file mode 100644
index 0000000..8330987
--- /dev/null
+++ b/internal/context/context.go
@@ -0,0 +1,327 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package context
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"reflect"
+	"strings"
+
+	"github.com/flamego/csrf"
+	"github.com/flamego/flamego"
+	"github.com/flamego/session"
+	"github.com/flamego/template"
+	"github.com/pkg/errors"
+	"github.com/unknwon/com"
+	"github.com/wuhan005/govalid"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/db"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+	"github.com/tamakyi/TamaBox/internal/shared"
+	templatepkg "github.com/tamakyi/TamaBox/internal/template"
+)
+
+type EndpointType string
+
+const (
+	EndpointAPI EndpointType = "api"
+	EndpointWeb EndpointType = "web"
+)
+
+func (e EndpointType) IsAPI() bool {
+	return e == EndpointAPI
+}
+
+func (e EndpointType) IsWeb() bool {
+	return e == EndpointWeb
+}
+
+func APIEndpoint(ctx Context) {
+	ctx.Map(EndpointAPI)
+}
+
+// Context represents context of a request.
+type Context struct {
+	flamego.Context
+
+	Data     template.Data
+	Session  session.Session
+	Template template.Template
+
+	User     *db.User
+	IsLogged bool
+}
+
+// HasError returns true if error occurs in form validation.
+func (c *Context) HasError() bool {
+	hasErr, ok := c.Data["HasError"]
+	if !ok {
+		return false
+	}
+	return hasErr.(bool)
+}
+
+func (c *Context) SetError(err error, f ...interface{}) {
+	// 防御性兜底：调用方可能传入 nil error（如从某个可能返回 nil 的函数直接透传），
+	// 此时下方 err.Error() 会触发 nil 指针 panic。统一兜底为「未知错误」，避免整页崩溃。
+	if err == nil {
+		err = errors.New("发生未知错误")
+	}
+
+	c.Data["HasError"] = true
+
+	// 表单校验（govalid）错误：其 Error() 在字段带 msg 标签时为 i18n 键，
+	// 在此按当前界面语言翻译；其余业务错误（errors.New(i18n.T(...)) 等）原样保留。
+	if ge, ok := err.(*govalid.ErrContext); ok {
+		c.Data["Error"] = i18n.T(c.Lang(), ge.Error())
+	} else {
+		c.Data["Error"] = err.Error()
+	}
+
+	// Set back the form data.
+	if len(f) > 0 {
+		form := f[0]
+		typ := reflect.TypeOf(form)
+		val := reflect.ValueOf(form)
+
+		if typ.Kind() == reflect.Ptr {
+			typ = typ.Elem()
+			val = val.Elem()
+		}
+
+		for i := 0; i < typ.NumField(); i++ {
+			field := typ.Field(i)
+			fieldName := com.ToSnakeCase(field.Name)
+
+			c.Data[fieldName] = val.Field(i).Interface()
+		}
+	}
+
+	span := trace.SpanFromContext(c.Request().Context())
+	if span.IsRecording() {
+		span.SetAttributes(
+			attribute.String("tamabox.error", err.Error()),
+		)
+	}
+}
+
+func (c *Context) SetInternalError(f ...interface{}) {
+	span := trace.SpanFromContext(c.Request().Context())
+	traceID := span.SpanContext().TraceID()
+
+	c.Data["FlashTip"] = fmt.Sprintf("若问题一直出现，请带上该段字符 %s 提交反馈。", traceID.String())
+	c.SetError(errors.New(i18n.T(c.Lang(), "internal.errFlash")), f...)
+}
+
+// Success renders HTML template with given name with 200 OK status code.
+func (c *Context) Success(templateName string) {
+	c.Template.HTML(http.StatusOK, templateName)
+}
+
+func (c *Context) SetTitle(title string) {
+	c.Data["Title"] = title
+}
+
+func (c *Context) Refresh() {
+	c.Redirect(c.Request().URL.Path)
+}
+
+func (c *Context) JSON(data interface{}) error {
+	resp := map[string]interface{}{
+		"code":    0,
+		"data":    data,
+		"message": "success",
+	}
+
+	return json.NewEncoder(c.ResponseWriter()).Encode(resp)
+}
+
+func (c *Context) ServerError() error {
+	return c.JSONError(50000, i18n.T(c.Lang(), "internal.errServer"))
+}
+
+func (c *Context) JSONError(errorCode int, message string) error {
+	span := trace.SpanFromContext(c.Request().Context())
+
+	resp := map[string]interface{}{
+		"code":     errorCode,
+		"message":  message,
+		"trace_id": span.SpanContext().TraceID().String(),
+	}
+
+	statusCode := errorCode / 100
+	if statusCode < 100 || statusCode > 999 {
+		statusCode = http.StatusInternalServerError
+	}
+	c.ResponseWriter().WriteHeader(statusCode)
+
+	return json.NewEncoder(c.ResponseWriter()).Encode(resp)
+}
+
+// Contexter initializes a classic context for a request.
+func Contexter() flamego.Handler {
+	return func(ctx flamego.Context, data template.Data, session session.Session, x csrf.CSRF, t template.Template, flash session.Flash) {
+		c := Context{
+			Context:  ctx,
+			Data:     data,
+			Session:  session,
+			Template: t,
+		}
+
+		// POST 类请求统一校验 CSRF（像素追踪代理已改为 GET 且仅转发只读请求，
+		// 不再需要 CSRF 豁免，故此处不再对 /api/v1/pixel/ 做例外）。
+		if ctx.Request().Method == http.MethodPost {
+			x.Validate(ctx)
+		}
+
+		// Get user from session or header when possible
+		c.User = authenticatedUser(c.Context, c.Session)
+
+		var userID uint
+		if c.User != nil {
+			c.IsLogged = true
+			c.Data["IsLogged"] = c.IsLogged
+			c.Data["LoggedUser"] = c.User
+			c.Data["LoggedUserID"] = c.User.ID
+			c.Data["LoggedUserName"] = c.User.Name
+
+			userID = c.User.ID
+		} else {
+			c.Data["LoggedUserID"] = 0
+			c.Data["LoggedUserName"] = ""
+		}
+
+		c.Data["IsPixel"] = ctx.Request().URL.Path == "/pixel"
+
+		span := trace.SpanFromContext(ctx.Request().Context())
+		if span.IsRecording() {
+			span.SetAttributes(
+				attribute.Bool("tamabox.user.is-login", c.IsLogged),
+				attribute.Int("tamabox.user.id", int(userID)),
+			)
+		}
+		c.ResponseWriter().Header().Set("Trace-ID", span.SpanContext().TraceID().String())
+
+		if flash != nil {
+			flash, ok := flash.(Flash)
+			if ok {
+				switch flash.Type {
+				case "success":
+					c.Data["Success"] = flash.Message
+				case "error":
+					c.Data["HasError"] = true
+					c.Data["Error"] = flash.Message
+				case "info":
+					c.Data["Info"] = flash.Message
+				case "warning":
+					c.Data["Warning"] = flash.Message
+				}
+
+				c.Data["FlashTip"] = flash.FlashTip
+			}
+		}
+
+		// ---- i18n 语言注入 ----
+		// 解析优先级（按页面类型）：
+		//  - 个人页（/user 后台、/_/{domain} 提问箱）：永远跟随主人 profile 语言，忽略访客 cookie。
+		//      /user 后台即登录用户本人的配置，直接采用 c.User.Language；
+		//      /_/{domain} 提问箱页由 question.Pager 中间件按 pageUser.Language 覆盖（见 route/question/page.go）。
+		//  - 公开页（首页/探索/登录等）：访客 lang cookie 优先；未设置 cookie 时登录用户资料语言次之；
+		//      再回退站点默认语言（shared.App）> i18n.Default。
+		path := ctx.Request().URL.Path
+		isUserPage := strings.HasPrefix(path, "/user") || strings.HasPrefix(path, "/_/")
+		c.Data["IsUserPage"] = isUserPage
+
+		// SEO：仅公开页（首页/注册/登录/explore）允许被搜索引擎收录；
+		// 提问内容（提问箱页、单题页）、密码页、私信、用户后台等隐私页一律 noindex。
+		isPublicPage := path == "/" || path == "/register" || path == "/login" || strings.HasPrefix(path, "/explore")
+		if !isPublicPage {
+			c.Data["NoIndex"] = true
+		}
+
+		lang := ""
+		if isUserPage {
+			// 个人页：永远跟随 profile，忽略 cookie（/user 直接采用本人配置；
+			// /_/{domain} 由 question.Pager 覆盖，此处留空交由其处理）。
+			if strings.HasPrefix(path, "/user") && c.IsLogged && c.User.Language != "" {
+				lang = i18n.Resolve(c.User.Language)
+			}
+		} else {
+			// 公开页：会话内显式选择的语言优先，其次登录用户资料语言，最后回退站点默认。
+			// 语言偏好存于 session（由 session 中间件托管 cookie）；此前独立 lang cookie 会被
+			// session 中间件的 Set-Cookie 整体覆盖而失效，故此处改读 session。
+			if v := c.Session.Get("lang"); v != nil {
+				if s, ok := v.(string); ok && s != "" {
+					lang = i18n.Resolve(s)
+				}
+			}
+			if lang == "" && c.IsLogged && c.User.Language != "" {
+				lang = i18n.Resolve(c.User.Language)
+			}
+		}
+		if lang == "" {
+			lang = shared.App.Lang()
+		}
+		c.Data["Lang"] = lang
+		c.Data["LangCode"] = lang
+		c.Data["SupportedLangs"] = i18n.Supported()
+
+		c.SetTitle(i18n.T(lang, "site.title"))
+		c.Data["CSRFToken"] = x.Token()
+		c.Data["CSRFTokenHTML"] = templatepkg.Safe(`<input type="hidden" name="_csrf" value="` + x.Token() + `">`)
+
+		c.Data["RecaptchaDomain"] = conf.Recaptcha.Domain
+		c.Data["RecaptchaSiteKey"] = conf.Recaptcha.SiteKey
+		c.Data["RecaptchaTurnstileStyle"] = conf.Recaptcha.TurnstileStyle
+		c.Data["CaptchaType"] = conf.Recaptcha.CaptchaType
+
+		c.Data["CurrentURI"] = ctx.Request().Request.RequestURI
+		c.Data["ExternalURL"] = conf.App.ExternalURL
+
+		// 默认头像/背景图兜底：未设置自定义头像的箱主，其二维码 logo 应与页面头像一致回退到 default_avatar。
+		// 模板按原始 URL 直连（easy.qrcode 以 crossOrigin:'anonymous' 加载，配合对象存储桶 CORS
+		// 返回 Access-Control-Allow-Origin，保证 canvas 不被污染、可正常导出）。
+		c.Data["DefaultAvatar"] = conf.Upload.DefaultAvatarURL
+		c.Data["DefaultBackgroundImage"] = conf.Upload.DefaultBackgroundImageURL
+
+		// [limits] 段全站上限的模板同源入口：所有页面可直接引用
+		// {{.Limits.QuestionContentLen}} / {{.Limits.AnswerContentLen}} /
+		// {{.Limits.FollowUpContentLen}} / {{.Limits.ChatMessageLen}} 等，
+		// 作为输入框 maxlength 等与后端校验的同一数据源，避免各处写死数字漂移。
+		c.Data["Limits"] = conf.Limits
+
+		// ⚠️ VConsole can only be enabled for the first user for security reasons.
+		c.Data["VConsole"] = ctx.Query("debug") == "on" && c.IsLogged && c.User.ID == 1
+
+		// 🚨 SECURITY: Prevent MIME type sniffing in some browsers,
+		c.ResponseWriter().Header().Set("X-Content-Type-Options", "nosniff")
+		c.ResponseWriter().Header().Set("X-Frame-Options", "DENY")
+
+		ctx.Map(c)
+		ctx.Map(EndpointWeb)
+
+		if conf.App.MaintenanceMode {
+			c.ResponseWriter().Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
+			c.Success("maintenance-mode")
+			return
+		}
+	}
+}
+
+// Lang 返回当前请求解析出的界面语言代码（已规范化，必定是字典可查的规范代码）。
+// 解析优先级见上方 Data["Lang"] 注入逻辑（个人页跟随箱主语言；公开页跟随 lang cookie /
+// 登录用户资料语言 / 站点默认语言）。若中间件尚未注入（极少数非标准路径），回退 i18n.Default。
+// 用于后端 flash / 错误信息按访客当前语言本地化，避免硬编码中文绕过 i18n。
+func (c *Context) Lang() string {
+	if l, ok := c.Data["Lang"].(string); ok && l != "" {
+		return l
+	}
+	return i18n.Default
+}
diff --git a/internal/context/flash.go b/internal/context/flash.go
new file mode 100644
index 0000000..1a7d253
--- /dev/null
+++ b/internal/context/flash.go
@@ -0,0 +1,52 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package context
+
+import (
+	"fmt"
+	"strings"
+
+	"go.opentelemetry.io/otel/trace"
+
+	"github.com/tamakyi/TamaBox/internal/i18n"
+)
+
+type FlashType string
+
+const (
+	Info    = "info"
+	Success = "success"
+	Warning = "warning"
+	Error   = "error"
+)
+
+type Flash struct {
+	Type     FlashType
+	Message  string
+	FlashTip string
+}
+
+func (c Context) SetInfoFlash(message string, tip ...string) {
+	c.Session.SetFlash(Flash{Type: Info, Message: message, FlashTip: strings.Join(tip, "")})
+}
+
+func (c Context) SetSuccessFlash(message string, tip ...string) {
+	c.Session.SetFlash(Flash{Type: Success, Message: message, FlashTip: strings.Join(tip, "")})
+}
+
+func (c Context) SetWarningFlash(message string, tip ...string) {
+	c.Session.SetFlash(Flash{Type: Warning, Message: message, FlashTip: strings.Join(tip, "")})
+}
+
+func (c Context) SetErrorFlash(message string, tip ...string) {
+	c.Session.SetFlash(Flash{Type: Error, Message: message, FlashTip: strings.Join(tip, "")})
+}
+
+func (c Context) SetInternalErrorFlash() {
+	span := trace.SpanFromContext(c.Request().Context())
+	traceID := span.SpanContext().TraceID()
+
+	c.Session.SetFlash(Flash{Type: Error, Message: i18n.T(c.Lang(), "internal.errFlash"), FlashTip: fmt.Sprintf("若问题一直出现，请带上该段字符 %s 提交反馈。", traceID.String())})
+}
diff --git a/internal/db/censor_log.go b/internal/db/censor_log.go
new file mode 100644
index 0000000..d3c5713
--- /dev/null
+++ b/internal/db/censor_log.go
@@ -0,0 +1,81 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package db
+
+import (
+	"context"
+	"encoding/json"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/wuhan005/gadget"
+	"gorm.io/gorm"
+)
+
+var CensorLogs CensorLogsStore
+
+type CensorLogsStore interface {
+	GetByText(ctx context.Context, sourceName, text string, noLongerThan ...time.Time) (*CensorLog, error)
+	Create(ctx context.Context, options CreateCensorLogOptions) error
+}
+
+func NewCensorLogsStore(db *gorm.DB) CensorLogsStore {
+	return &censorLogs{db}
+}
+
+type censorLogs struct {
+	*gorm.DB
+}
+
+type CensorLog struct {
+	gorm.Model
+	SourceName  string
+	Input       string
+	InputHash   string `gorm:"index"`
+	Pass        bool
+	RawResponse json.RawMessage
+}
+
+var ErrCensorLogsNotFound = errors.New("censor logs dose not exist")
+
+func (db *censorLogs) GetByText(ctx context.Context, sourceName, text string, noLongerThan ...time.Time) (*CensorLog, error) {
+	hash := hashText(text)
+
+	var censorLog CensorLog
+	q := db.WithContext(ctx).Where("source_name = ? AND input_hash = ?", sourceName, hash)
+	if len(noLongerThan) > 0 && !noLongerThan[0].IsZero() {
+		q = q.Where("created_at > ?", noLongerThan[0])
+	}
+
+	if err := q.First(&censorLog).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, ErrCensorLogsNotFound
+		}
+		return nil, err
+	}
+	return &censorLog, nil
+}
+
+type CreateCensorLogOptions struct {
+	SourceName  string
+	Input       string
+	Pass        bool
+	RawResponse json.RawMessage
+}
+
+func (db *censorLogs) Create(ctx context.Context, options CreateCensorLogOptions) error {
+	censorLog := CensorLog{
+		SourceName:  options.SourceName,
+		Input:       options.Input,
+		InputHash:   hashText(options.Input),
+		Pass:        options.Pass,
+		RawResponse: options.RawResponse,
+	}
+	return db.WithContext(ctx).Create(&censorLog).Error
+}
+
+func hashText(text string) string {
+	return gadget.Md5(text)
+}
diff --git a/internal/db/censor_log_test.go b/internal/db/censor_log_test.go
new file mode 100644
index 0000000..bca58b6
--- /dev/null
+++ b/internal/db/censor_log_test.go
@@ -0,0 +1,85 @@
+// Copyright 2023 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package db
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
+)
+
+func TestCensorLogs(t *testing.T) {
+	t.Parallel()
+
+	db, cleanup := newTestDB(t)
+	ctx := context.Background()
+
+	censorLogsStore := NewCensorLogsStore(db)
+
+	for _, tc := range []struct {
+		name string
+		test func(t *testing.T, ctx context.Context, db *censorLogs)
+	}{
+		{"Create", testCensorLogsCreate},
+		{"GetByText", testCensorLogsGetByText},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Cleanup(func() {
+				if err := cleanup("censor_logs"); err != nil {
+					t.Fatal(err)
+				}
+			})
+			tc.test(t, ctx, censorLogsStore.(*censorLogs))
+		})
+	}
+}
+
+func testCensorLogsCreate(t *testing.T, ctx context.Context, db *censorLogs) {
+	err := db.Create(ctx, CreateCensorLogOptions{
+		SourceName:  "aliyun",
+		Input:       "hello world",
+		Pass:        true,
+		RawResponse: []byte(`{}`),
+	})
+	require.Nil(t, err)
+}
+
+func testCensorLogsGetByText(t *testing.T, ctx context.Context, db *censorLogs) {
+	err := db.Create(ctx, CreateCensorLogOptions{
+		SourceName:  "aliyun",
+		Input:       "hello world",
+		Pass:        true,
+		RawResponse: []byte(`{}`),
+	})
+	require.Nil(t, err)
+
+	t.Run("normal by cache", func(t *testing.T) {
+		got, err := db.GetByText(ctx, "aliyun", "hello world")
+		require.Nil(t, err)
+
+		got.CreatedAt = time.Time{}
+		got.UpdatedAt = time.Time{}
+
+		want := &CensorLog{
+			Model: gorm.Model{
+				ID: 1,
+			},
+			SourceName:  "aliyun",
+			Input:       "hello world",
+			InputHash:   hashText("hello world"),
+			Pass:        true,
+			RawResponse: []byte(`{}`),
+		}
+		require.Equal(t, want, got)
+	})
+
+	t.Run("no longer than", func(t *testing.T) {
+		_, err := db.GetByText(ctx, "aliyun", "hello world", time.Now())
+		require.Equal(t, ErrCensorLogsNotFound, err)
+	})
+}
diff --git a/internal/db/conversation.go b/internal/db/conversation.go
new file mode 100644
index 0000000..a2b4fe2
--- /dev/null
+++ b/internal/db/conversation.go
@@ -0,0 +1,231 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package db
+
+import (
+	"context"
+
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+	"github.com/thanhpk/randstr"
+	"gorm.io/gorm"
+
+	"github.com/tamakyi/TamaBox/internal/dbutil"
+)
+
+var Conversations ConversationStore
+
+type ConversationStore interface {
+	Create(ctx context.Context, opts CreateConversationOptions) (*Conversation, error)
+	GetByID(ctx context.Context, id uint) (*Conversation, error)
+	GetByToken(ctx context.Context, token string) (*Conversation, error)
+	GetByIDAndOwner(ctx context.Context, id, ownerID uint) (*Conversation, error)
+	GetByIDAndAsker(ctx context.Context, id, askerID uint) (*Conversation, error)
+	IncrementMessageCount(ctx context.Context, id uint) error
+	IncrementMessageCountIfBelow(ctx context.Context, id uint, max int) (bool, error)
+	DecrementMessageCount(ctx context.Context, id uint) error
+	MaybeClose(ctx context.Context, id uint, max int) error
+	Close(ctx context.Context, id uint) error
+	// ListByOwner 返回某箱主拥有的会话。limit>0 时启用分页（取 limit 条、跳过 offset 条），
+	// 用于私聊列表分页；导出场景传 limit=0 取全量，行为与改造前一致。
+	ListByOwner(ctx context.Context, ownerID uint, limit, offset int) ([]*Conversation, error)
+	// CountByOwner 统计某箱主拥有的会话总数（分页看板与"加载更多"判定用）。
+	CountByOwner(ctx context.Context, ownerID uint) (int64, error)
+	// ListByAsker 返回某提问者发起的会话；分页语义同 ListByOwner。
+	ListByAsker(ctx context.Context, askerID uint, limit, offset int) ([]*Conversation, error)
+	// CountByAsker 统计某提问者发起的会话总数。
+	CountByAsker(ctx context.Context, askerID uint) (int64, error)
+	MarkDeletedByOwner(ctx context.Context, id uint) error
+}
+
+func NewConversationStore(db *gorm.DB) ConversationStore {
+	return &conversations{db}
+}
+
+type conversations struct {
+	*gorm.DB
+}
+
+type Conversation struct {
+	dbutil.Model
+	OwnerID          uint   `gorm:"index:idx_conversation_owner" json:"owner_id"`
+	AskerID          uint   `gorm:"index:idx_conversation_asker" json:"asker_id"`
+	Token            string `gorm:"size:6;uniqueIndex" json:"token"`
+	MaxMessages      int    `gorm:"default:20" json:"max_messages"`
+	MessageCount     int    `gorm:"default:0" json:"message_count"`
+	IsClosed         bool   `gorm:"default:false" json:"is_closed"`
+	IsDeletedByOwner bool   `gorm:"default:false" json:"is_deleted_by_owner"` // 新增
+}
+
+func (c *Conversation) BeforeCreate(tx *gorm.DB) error {
+	c.MessageCount = 0
+	c.Token = randstr.String(6)
+	return nil
+}
+
+type CreateConversationOptions struct {
+	OwnerID     uint
+	AskerID     uint
+	MaxMessages int
+}
+
+func (db *conversations) Create(ctx context.Context, opts CreateConversationOptions) (*Conversation, error) {
+	conversation := &Conversation{
+		OwnerID:     opts.OwnerID,
+		AskerID:     opts.AskerID,
+		MaxMessages: opts.MaxMessages,
+	}
+	if err := db.WithContext(ctx).Create(conversation).Error; err != nil {
+		return nil, errors.Wrap(err, "create conversation")
+	}
+	return conversation, nil
+}
+
+func (db *conversations) GetByID(ctx context.Context, id uint) (*Conversation, error) {
+	var conv Conversation
+	if err := db.WithContext(ctx).First(&conv, id).Error; err != nil {
+		return nil, errors.Wrap(err, "get conversation")
+	}
+	return &conv, nil
+}
+
+func (db *conversations) GetByToken(ctx context.Context, token string) (*Conversation, error) {
+	var conv Conversation
+	if err := db.WithContext(ctx).Where("token = ?", token).First(&conv).Error; err != nil {
+		return nil, errors.Wrap(err, "get conversation by token")
+	}
+	return &conv, nil
+}
+
+func (db *conversations) GetByIDAndOwner(ctx context.Context, id, ownerID uint) (*Conversation, error) {
+	var conv Conversation
+	if err := db.WithContext(ctx).Where("id = ? AND owner_id = ?", id, ownerID).First(&conv).Error; err != nil {
+		return nil, errors.Wrap(err, "get by owner")
+	}
+	return &conv, nil
+}
+
+func (db *conversations) GetByIDAndAsker(ctx context.Context, id, askerID uint) (*Conversation, error) {
+	var conv Conversation
+	if err := db.WithContext(ctx).Where("id = ? AND asker_id = ?", id, askerID).First(&conv).Error; err != nil {
+		return nil, errors.Wrap(err, "get by asker")
+	}
+	return &conv, nil
+}
+
+func (db *conversations) IncrementMessageCount(ctx context.Context, id uint) error {
+	return db.WithContext(ctx).Model(&Conversation{}).Where("id = ?", id).UpdateColumn("message_count", gorm.Expr("message_count + 1")).Error
+}
+
+// IncrementMessageCountIfBelow 原子地检查并递增消息计数：
+// 仅当 message_count < max 且未关闭时才 +1，返回 true。
+// 并发场景下（同一对话两端同时发送）可防止消息数超出上限。
+func (db *conversations) IncrementMessageCountIfBelow(ctx context.Context, id uint, max int) (bool, error) {
+	res := db.WithContext(ctx).Model(&Conversation{}).
+		Where("id = ? AND message_count < ? AND is_closed = ?", id, max, false).
+		UpdateColumn("message_count", gorm.Expr("message_count + 1"))
+	if res.Error != nil {
+		return false, errors.Wrap(res.Error, "increment message count if below")
+	}
+	return res.RowsAffected > 0, nil
+}
+
+// DecrementMessageCount 回滚一次消息计数（计数已递增但消息落库失败时调用）。
+func (db *conversations) DecrementMessageCount(ctx context.Context, id uint) error {
+	return db.WithContext(ctx).Model(&Conversation{}).
+		Where("id = ? AND message_count > 0", id).
+		UpdateColumn("message_count", gorm.Expr("message_count - 1")).Error
+}
+
+// MaybeClose 当消息数达到上限时关闭对话（幂等，供发送消息后调用）。
+func (db *conversations) MaybeClose(ctx context.Context, id uint, max int) error {
+	return db.WithContext(ctx).Model(&Conversation{}).
+		Where("id = ? AND message_count >= ? AND is_closed = ?", id, max, false).
+		Update("is_closed", true).Error
+}
+
+func (db *conversations) Close(ctx context.Context, id uint) error {
+	return db.WithContext(ctx).Model(&Conversation{}).Where("id = ?", id).Update("is_closed", true).Error
+}
+
+func (db *conversations) ListByOwner(ctx context.Context, ownerID uint, limit, offset int) ([]*Conversation, error) {
+	var convs []*Conversation
+	q := db.WithContext(ctx).Where("owner_id = ? AND is_deleted_by_owner = ? AND token != ''", ownerID, false).
+		Order("created_at DESC")
+	if limit > 0 {
+		q = q.Limit(limit)
+		if offset > 0 {
+			q = q.Offset(offset)
+		}
+	}
+	if err := q.Find(&convs).Error; err != nil {
+		return nil, errors.Wrap(err, "list by owner")
+	}
+	return convs, nil
+}
+
+func (db *conversations) CountByOwner(ctx context.Context, ownerID uint) (int64, error) {
+	var count int64
+	if err := db.WithContext(ctx).Model(&Conversation{}).
+		Where("owner_id = ? AND is_deleted_by_owner = ? AND token != ''", ownerID, false).
+		Count(&count).Error; err != nil {
+		return 0, errors.Wrap(err, "count by owner")
+	}
+	return count, nil
+}
+
+func (db *conversations) ListByAsker(ctx context.Context, askerID uint, limit, offset int) ([]*Conversation, error) {
+	var convs []*Conversation
+	q := db.WithContext(ctx).Where("asker_id = ? AND is_deleted_by_owner = ? AND token != ''", askerID, false).
+		Order("created_at DESC")
+	if limit > 0 {
+		q = q.Limit(limit)
+		if offset > 0 {
+			q = q.Offset(offset)
+		}
+	}
+	if err := q.Find(&convs).Error; err != nil {
+		return nil, errors.Wrap(err, "list by asker")
+	}
+	return convs, nil
+}
+
+func (db *conversations) CountByAsker(ctx context.Context, askerID uint) (int64, error) {
+	var count int64
+	if err := db.WithContext(ctx).Model(&Conversation{}).
+		Where("asker_id = ? AND is_deleted_by_owner = ? AND token != ''", askerID, false).
+		Count(&count).Error; err != nil {
+		return 0, errors.Wrap(err, "count by asker")
+	}
+	return count, nil
+}
+
+func (db *conversations) MarkDeletedByOwner(ctx context.Context, id uint) error {
+	var conv Conversation
+	if err := db.WithContext(ctx).First(&conv, id).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			// 已删除或不存在：幂等，不影响调用方。
+			return nil
+		}
+		return errors.Wrap(err, "get conversation for delete")
+	}
+	if conv.IsDeletedByOwner {
+		// 已经是删除状态：幂等返回，避免重复请求多次回退配额计数。
+		return nil
+	}
+
+	if err := db.WithContext(ctx).Model(&Conversation{}).Where("id = ?", id).Update("is_deleted_by_owner", true).Error; err != nil {
+		return errors.Wrap(err, "mark conversation deleted by owner")
+	}
+
+	// 回退定量收集计数：删除私聊会话等价于少一条已收集内容，
+	// 否则达上限后即便删掉旧会话，功能仍会显示 quota_reached 关闭，须手动重置计数。
+	if conv.OwnerID != 0 {
+		if err := FeatureControls.IncrementQuota(ctx, conv.OwnerID, FeatureChat, -1); err != nil {
+			logrus.WithContext(ctx).WithError(err).Errorf("Failed to decrement chat quota for user %d", conv.OwnerID)
+		}
+	}
+	return nil
+}
diff --git a/internal/db/db.go b/internal/db/db.go
new file mode 100644
index 0000000..4b2b955
--- /dev/null
+++ b/internal/db/db.go
@@ -0,0 +1,234 @@
+package db
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+	"github.com/uptrace/opentelemetry-go-extra/otelgorm"
+	"gorm.io/driver/mysql"
+	"gorm.io/driver/postgres"
+	"gorm.io/gorm"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+)
+
+var AllTables = []interface{}{
+	&User{}, &Question{}, &FollowUp{}, &CensorLog{}, &UploadImage{}, &UploadImageQuestion{},
+	&Conversation{}, &Message{}, &MessageImage{}, &UserBlock{},
+	// 匿名投票
+	&Vote{}, &VoteOption{}, &VoteFormField{}, &VoteSubmission{},
+	// 功能开关（提问 / 私聊 / 投票 的开关、定时、定量收集）
+	&FeatureControl{},
+}
+
+func Init(typ, dsn string) (*gorm.DB, error) {
+	var dialector gorm.Dialector
+
+	switch typ {
+	case "mysql", "":
+		dialector = mysql.Open(dsn)
+	case "postgres":
+		dialector = postgres.Open(dsn)
+	default:
+		return nil, errors.Errorf("unknown database type: %q", typ)
+	}
+
+	db, err := gorm.Open(dialector, &gorm.Config{
+		SkipDefaultTransaction: true,
+	})
+	if err != nil {
+		return nil, errors.Wrap(err, "connect to database")
+	}
+
+	// 配置连接池
+	sqlDB, err := db.DB()
+	if err != nil {
+		return nil, errors.Wrap(err, "get sql.DB from gorm")
+	}
+
+	// 1C1G 低配环境：调低连接池，避免每个 DB 连接占用过多内存。
+	// 提问箱是低并发场景，10 个打开连接绰绰有余。
+	// 最大打开连接数
+	sqlDB.SetMaxOpenConns(10)
+	// 最大空闲连接数
+	sqlDB.SetMaxIdleConns(4)
+	// 连接最大存活时间（避免长连接被数据库服务端断开）
+	sqlDB.SetConnMaxLifetime(5 * time.Minute)
+	// 空闲连接最大存活时间
+	sqlDB.SetConnMaxIdleTime(3 * time.Minute)
+
+	// 仅在明确开启迁移清理开关时处理 users 表历史重复值，避免服务启动时静默改写账号数据。
+	// 正常部署应先离线检查并清理重复 email/domain，再执行 AutoMigrate。
+	if conf.Database.DedupeUniqueFields {
+		if err := dedupeUniqueFields(db); err != nil {
+			return nil, errors.Wrap(err, "dedupe unique fields before migrate")
+		}
+	}
+
+	if err := db.AutoMigrate(AllTables...); err != nil {
+		return nil, errors.Wrap(err, "auto migrate")
+	}
+
+	// 功能开关初始化：为历史账号补齐 feature_controls 行（私聊沿用 users.allow_chat）。
+	// 幂等，已初始化的账号不会重复写入；失败不阻断启动，仅告警，避免依赖表抖动导致服务起不来。
+	if err := backfillFeatureControls(db); err != nil {
+		logrus.WithError(err).Warn("初始化功能开关配置时异常（可在功能管理页手动保存一次以生成配置）")
+	}
+
+	// 私聊开关纠偏：旧版 backfill 曾把未开启私聊的账号写为开启（GORM 零值陷阱），
+	// 启动期幂等复位；同样不阻断启动，失败仅告警。
+	if err := reconcileLegacyChatEnabled(db); err != nil {
+		logrus.WithError(err).Warn("私聊开关历史数据纠偏时异常（可在功能管理页手动调整私聊开关）")
+	}
+
+	// 私聊收集上限下线：私聊不再支持收集上限（UI 已隐藏，保存时强制清零），
+	// 启动期把历史残留的上限/计数一并清零，避免私聊「莫名关闭」。幂等，失败仅告警。
+	if err := normalizeChatQuota(db); err != nil {
+		logrus.WithError(err).Warn("私聊收集上限历史数据清理时异常（可在功能管理页保存一次私聊设置）")
+	}
+
+	// 启动期补充高频查询复合索引（幂等，适合既有库）。
+	// 仅 PostgreSQL 需要：这些索引针对服务端真实查询模式（按归属用户+私密+时间、
+	// 按 asker、按展示/投票状态+可见性+时间、按会话/发送者+时间）。
+	// 本项目实际使用 PostgreSQL（详见 code-review-2026-08-28.md P1-4）。
+	if typ == "postgres" {
+		if err := ensureFrequentlyUsedIndexes(db); err != nil {
+			// 索引创建失败不应阻断启动，仅告警，便于在运维侧排查。
+			logrus.WithError(err).Warn("创建高频查询复合索引时异常（可能部分索引未建立，不影响服务启动）")
+		}
+	}
+
+	Users = NewUsersStore(db)
+	Questions = NewQuestionsStore(db)
+	FollowUps = NewFollowUpsStore(db)
+	CensorLogs = NewCensorLogsStore(db)
+	UploadImages = NewUploadImagesStore(db)
+	Conversations = NewConversationStore(db)
+	Messages = NewMessageStore(db)
+	MessageImages = NewMessageImageStore(db)
+	Votes = NewVotesStore(db)
+	VoteOptions = NewVoteOptionsStore(db)
+	VoteFormFields = NewVoteFormFieldsStore(db)
+	VoteSubmissions = NewVoteSubmissionsStore(db)
+	FeatureControls = NewFeatureControlsStore(db)
+
+	if err := db.Use(otelgorm.NewPlugin(
+		otelgorm.WithDBName(conf.Database.Name),
+	)); err != nil {
+		return nil, errors.Wrap(err, "register otelgorm plugin")
+	}
+
+	if typ == "postgres" {
+		if err := fixPostgresSequences(db); err != nil {
+			return nil, errors.Wrap(err, "fix postgres sequences")
+		}
+	}
+
+	return db, nil
+}
+
+// dedupeUniqueFields 在 AutoMigrate 之前清理 users 表中重复的 email / domain：
+// 每个重复值仅保留 id 最小（最早注册）的一行，其余行该字段置为 NULL。
+// NULL 在 MySQL / PostgreSQL / SQLite 的唯一索引中互不冲突，因此置空即可让唯一索引成功建立。
+// 幂等：重复数据被清理后再次启动时无任何操作。跨数据库兼容（仅使用标准 SQL，无目标表子查询）。
+func dedupeUniqueFields(db *gorm.DB) error {
+	for _, field := range []string{"email", "domain"} {
+		var keepIDs []uint
+		var dupVals []string
+
+		rows, err := db.Table("users").
+			Select("MIN(id) AS keep_id, " + field + " AS val").
+			Where(field + " IS NOT NULL").
+			Group(field).
+			Having("COUNT(*) > 1").
+			Rows()
+		if err != nil {
+			return errors.Wrapf(err, "query duplicate %s", field)
+		}
+		for rows.Next() {
+			var keepID uint
+			var val string
+			if err := rows.Scan(&keepID, &val); err != nil {
+				rows.Close()
+				return errors.Wrapf(err, "scan duplicate %s", field)
+			}
+			keepIDs = append(keepIDs, keepID)
+			dupVals = append(dupVals, val)
+		}
+		if err := rows.Close(); err != nil {
+			return errors.Wrapf(err, "close rows for %s", field)
+		}
+		if rows.Err() != nil {
+			return errors.Wrapf(rows.Err(), "iterate duplicate %s", field)
+		}
+		if len(keepIDs) == 0 {
+			continue
+		}
+
+		res := db.Table("users").
+			Where(field+" IS NOT NULL").
+			Where(field+" IN ?", dupVals).
+			Where("id NOT IN ?", keepIDs).
+			Update(field, nil)
+		if res.Error != nil {
+			return errors.Wrapf(res.Error, "clean duplicate %s", field)
+		}
+		if res.RowsAffected > 0 {
+			logrus.WithField("field", field).
+				Warnf("迁移前置清理：%d 行重复的 %s 已置空（保留最早注册的账号）", res.RowsAffected, field)
+		}
+	}
+	return nil
+}
+
+// ensureFrequentlyUsedIndexes 在 AutoMigrate 之后创建高频查询所需的复合索引。
+// 全部使用 CREATE INDEX IF NOT EXISTS，幂等、可在既有库上安全运行，重复执行无副作用。
+// 索引设计依据服务端真实查询模式（详见 code-review-2026-08-28.md P1-4）：
+//   - questions: 按 user_id + is_private + created_at 过滤排序（提问箱列表）；
+//     按 asker_user_id 查询（我发起的提问）。
+//   - users: 按 show_in_home + created_at（首页展示箱列表）。
+//   - votes: 按 status + visibility + created_at（探索页/提问箱页公开投票）。
+//   - messages: 按 conversation_id + created_at、sender_id + created_at（私信列表/会话消息）。
+func ensureFrequentlyUsedIndexes(db *gorm.DB) error {
+	indexes := []string{
+		`CREATE INDEX IF NOT EXISTS idx_questions_asker_user_id ON questions(asker_user_id)`,
+		`CREATE INDEX IF NOT EXISTS idx_questions_user_private_created ON questions(user_id, is_private, created_at)`,
+		`CREATE INDEX IF NOT EXISTS idx_users_show_in_home_created ON users(show_in_home, created_at)`,
+		`CREATE INDEX IF NOT EXISTS idx_votes_status_visibility_created ON votes(status, visibility, created_at)`,
+		`CREATE INDEX IF NOT EXISTS idx_messages_sender_created ON messages(sender_id, created_at)`,
+		`CREATE INDEX IF NOT EXISTS idx_messages_conversation_created ON messages(conversation_id, created_at)`,
+	}
+	for _, ddl := range indexes {
+		if err := db.Exec(ddl).Error; err != nil {
+			return errors.Wrapf(err, "create index: %s", ddl)
+		}
+	}
+	return nil
+}
+
+func fixPostgresSequences(db *gorm.DB) error {
+	// 使用配置的 schema（未配置时回退 public），避免硬编码 nekobox。
+	schema := conf.Database.Schema
+	if schema == "" {
+		schema = "public"
+	}
+
+	tablesWithID := []string{"users", "questions", "follow_ups", "censor_logs", "upload_images", "conversations", "messages", "message_images", "votes", "vote_options", "vote_form_fields", "vote_submissions", "feature_controls"}
+	for _, table := range tablesWithID {
+		seqName := table + "_id_seq"
+		resetQuery := fmt.Sprintf(`
+			CREATE SEQUENCE IF NOT EXISTS %s.%s;
+			ALTER TABLE %s.%s 
+			ALTER COLUMN id SET DEFAULT nextval('%s.%s');
+			SELECT setval('%s.%s', 
+						 COALESCE((SELECT MAX(id) FROM %s.%s), 1)::bigint, 
+						 true);
+		`, schema, seqName, schema, table, schema, seqName, schema, seqName, schema, table)
+		if err := db.Exec(resetQuery).Error; err != nil {
+			return fmt.Errorf("修复表 %s 序列时出错: %w", table, err)
+		}
+	}
+	return nil
+}
diff --git a/internal/db/feature_control.go b/internal/db/feature_control.go
new file mode 100644
index 0000000..cde98a1
--- /dev/null
+++ b/internal/db/feature_control.go
@@ -0,0 +1,723 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package db
+
+import (
+	"context"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	"github.com/tamakyi/TamaBox/internal/dbutil"
+)
+
+var FeatureControls FeatureControlsStore
+
+var _ FeatureControlsStore = (*featureControls)(nil)
+
+// 受控功能标识（feature_controls.feature 取值）。
+const (
+	FeatureQuestion = "question" // 提问
+	FeatureChat     = "chat"     // 私聊
+	FeatureVote     = "vote"     // 投票
+)
+
+// FeatureKeys 全部受控功能，顺序即功能管理页的展示顺序。
+var FeatureKeys = []string{FeatureQuestion, FeatureChat, FeatureVote}
+
+// 功能不可用原因（空串表示可用）。
+const (
+	FeatureReasonDisabled     = "disabled"      // 手动关闭
+	FeatureReasonNotStarted   = "not_started"   // 未到开放时间
+	FeatureReasonEnded        = "ended"         // 已过关闭时间
+	FeatureReasonQuotaReached = "quota_reached" // 已达定量收集上限
+)
+
+// QuotaLimitMax 单个功能的收集上限最大值，防止误填极大值。
+const QuotaLimitMax = 1_000_000
+
+type FeatureControlsStore interface {
+	// Get 读取某功能的配置；无记录时返回该功能的默认配置（不落库）。
+	Get(ctx context.Context, userID uint, feature string) (*FeatureControl, error)
+	// ListByUserID 读取某用户全部功能的配置（无记录的功能不出现在结果中）。
+	ListByUserID(ctx context.Context, userID uint) ([]*FeatureControl, error)
+	// ListByUserIDs 批量读取多个用户同一功能的配置（探索页等批量场景用，避免 N+1）。
+	ListByUserIDs(ctx context.Context, userIDs []uint, feature string) (map[uint]*FeatureControl, error)
+	// Save 写入配置（不存在则创建，存在则更新开关/时间窗/上限，不影响已收集计数）。
+	Save(ctx context.Context, userID uint, feature string, opts UpdateFeatureControlOptions) error
+	// ResetQuota 清零收集计数，重新开始一轮定量收集。
+	ResetQuota(ctx context.Context, userID uint, feature string) error
+	// IncrementQuota 累加收集计数；无记录时按 delta 创建。
+	IncrementQuota(ctx context.Context, userID uint, feature string, delta int64) error
+}
+
+func NewFeatureControlsStore(db *gorm.DB) FeatureControlsStore {
+	return &featureControls{db}
+}
+
+type featureControls struct {
+	*gorm.DB
+}
+
+// FeatureControl 提问箱单个功能（提问 / 私聊 / 投票）的开关、定时与定量收集配置。
+//
+// 三类控制互不覆盖，最终可用状态由 Evaluate 综合计算：
+//   - Enabled：手动总开关；
+//   - OpenAt / CloseAt：定时开放与定时关闭（nil 表示不限制该侧）；
+//   - QuotaLimit / QuotaCount：定量收集，累计收集数达到上限后自动关闭（0 表示不限制）。
+//
+// 计数不做定时重置：一轮收集结束后由箱主在功能管理页手动「重置计数」开启下一轮，
+// 避免与定时开关叠加产生难以预期的自动恢复行为。
+type FeatureControl struct {
+	dbutil.Model
+	UserID  uint   `gorm:"uniqueIndex:idx_feature_control_user_feature;not null" json:"-"`
+	Feature string `gorm:"size:20;uniqueIndex:idx_feature_control_user_feature;not null" json:"feature"`
+	// ⚠️ 不要给 Enabled 加 gorm:"default:true" 标签：
+	// GORM 在 Create 时会把零值 false 替换为字段默认值（true），导致「取消勾选保存」后
+	// 数据库里仍是 true、复选框自动恢复为勾选。去掉标签后 GORM 会原样写入显式设置的值。
+	Enabled bool `json:"enabled"`
+	// OpenAt / CloseAt：一次性定时开放 / 关闭（nil 表示不限制该侧）。
+	OpenAt  *time.Time `json:"open_at"`
+	CloseAt *time.Time `json:"close_at"`
+	// 循环定时（每周循环）：ScheduleDays 为逗号分隔的周几（0=周日…6=周六，与 time.Weekday 一致），
+	// 空表示每天都开放；ScheduleStart/ScheduleEnd 为每日时间段 "HH:MM"（留空表示该日全天）。
+	// 两者都为空时表示未启用循环定时。
+	ScheduleDays  string     `gorm:"size:31" json:"schedule_days"`
+	ScheduleStart string     `gorm:"size:5" json:"schedule_start"`
+	ScheduleEnd   string     `gorm:"size:5" json:"schedule_end"`
+	QuotaLimit    int64      `gorm:"default:0" json:"quota_limit"`
+	QuotaCount    int64      `gorm:"default:0" json:"quota_count"`
+	QuotaResetAt  *time.Time `json:"quota_reset_at"`
+}
+
+// FeatureState 某功能在某一时刻的综合状态。
+type FeatureState struct {
+	Enabled     bool       // 手动开关
+	Open        bool       // 综合（开关 + 定时 + 定量）后的最终可用状态
+	Reason      string     // 不可用原因，空串表示可用（取值见 FeatureReason*）
+	QuotaLimit  int64      // 收集上限（0 = 不限制）
+	QuotaCount  int64      // 已收集数量
+	OpenAt      *time.Time // 一次性定时开放时间
+	CloseAt     *time.Time // 一次性定时关闭时间
+	NextOpenAt  *time.Time // 下一次开放时间（可能来自一次性窗口或循环定时；永久关闭时为 nil）
+	LastCloseAt *time.Time // 最近一次关闭时间（从未开放过时为 nil）
+}
+
+// Evaluate 计算该功能在 now 时刻的综合状态。
+// 判定优先级：手动关闭 > 未到一次性开放时间 > 已过一次性关闭时间 > 不在循环定时窗口内 > 达到收集上限。
+func (fc *FeatureControl) Evaluate(now time.Time) FeatureState {
+	st := FeatureState{
+		Enabled:    fc.Enabled,
+		QuotaLimit: fc.QuotaLimit,
+		QuotaCount: fc.QuotaCount,
+		OpenAt:     fc.OpenAt,
+		CloseAt:    fc.CloseAt,
+	}
+	// 先算好下次开放 / 最近关闭，供 reason 判定与展示复用。
+	st.NextOpenAt = fc.nextOpenAt(now)
+	st.LastCloseAt = fc.lastCloseAt(now)
+
+	switch {
+	case !fc.Enabled:
+		st.Reason = FeatureReasonDisabled
+		// 手动关闭与时间无关，不展示开放/关闭时间
+		st.NextOpenAt, st.LastCloseAt = nil, nil
+	case fc.OpenAt != nil && now.Before(*fc.OpenAt):
+		st.Reason = FeatureReasonNotStarted
+	case fc.CloseAt != nil && !now.Before(*fc.CloseAt):
+		// 已过一次性关闭时间：一次性窗口是硬性外边界，循环定时仅在窗口内生效，
+		// 因此之后不会再开放（nextOpenAt 已按 CloseAt 约束计算，返回 nil）。
+		st.Reason = FeatureReasonEnded
+		st.NextOpenAt = nil
+	default:
+		switch fc.scheduleSlotStatus(now) {
+		case scheduleBeforeStart:
+			st.Reason = FeatureReasonNotStarted
+		case scheduleAfterEnd:
+			if st.NextOpenAt != nil {
+				st.Reason = FeatureReasonNotStarted
+			} else {
+				st.Reason = FeatureReasonEnded
+			}
+		}
+		if st.Reason == "" && fc.QuotaLimit > 0 && fc.QuotaCount >= fc.QuotaLimit {
+			st.Reason = FeatureReasonQuotaReached
+			// 定量上限与时间无关，不展示开放/关闭时间
+			st.NextOpenAt, st.LastCloseAt = nil, nil
+		}
+	}
+	st.Open = st.Reason == ""
+	return st
+}
+
+// scheduleSlotStatus 表示 now 相对循环定时窗口的位置。
+type scheduleSlotStatus int
+
+const (
+	scheduleInWindow    scheduleSlotStatus = iota // 在开放窗口内
+	scheduleBeforeStart                           // 今天开放，但未到开始时间
+	scheduleAfterEnd                              // 已过结束时间，或今天不在开放日
+)
+
+// scheduleActive 判断是否启用了循环定时。
+// 规则：设置了开放日，或同时设置了开始/结束时间，即视为启用；
+// 只设置单侧时间视为配置异常，由路由层校验拦截。
+func (fc *FeatureControl) scheduleActive() bool {
+	return fc.ScheduleDays != "" || (fc.ScheduleStart != "" && fc.ScheduleEnd != "")
+}
+
+// scheduleDayOpen 判断某天是否为开放日（ScheduleDays 为空 = 每天都开放）。
+func (fc *FeatureControl) scheduleDayOpen(day time.Time) bool {
+	return fc.ScheduleDays == "" || containsWeekday(fc.ScheduleDays, int(day.Weekday()))
+}
+
+// scheduleWindow 返回单日开放窗口的分钟数 [startM, endM)。
+// 未设置时间段时视为全天 [0, 1440)。配置非法时返回错误（调用方按"不限制"处理）。
+func (fc *FeatureControl) scheduleWindow() (startM, endM int, err error) {
+	if fc.ScheduleStart == "" && fc.ScheduleEnd == "" {
+		return 0, 24 * 60, nil
+	}
+	if startM, err = parseHHMM(fc.ScheduleStart); err != nil {
+		return 0, 0, errors.Wrap(err, "parse schedule start")
+	}
+	if endM, err = parseHHMM(fc.ScheduleEnd); err != nil {
+		return 0, 0, errors.Wrap(err, "parse schedule end")
+	}
+	if endM <= startM {
+		return 0, 0, errors.New("schedule end must be after start")
+	}
+	return startM, endM, nil
+}
+
+// scheduleSlotStatus 返回 now 相对循环定时窗口的位置；未启用循环定时时恒为"在窗口内"。
+func (fc *FeatureControl) scheduleSlotStatus(now time.Time) scheduleSlotStatus {
+	if !fc.scheduleActive() {
+		return scheduleInWindow
+	}
+	if !fc.scheduleDayOpen(now) {
+		return scheduleAfterEnd
+	}
+	startM, endM, err := fc.scheduleWindow()
+	if err != nil {
+		return scheduleInWindow // 配置异常按不限制处理（路由层已校验，此处兜底）
+	}
+	mins := now.Hour()*60 + now.Minute()
+	switch {
+	case mins < startM:
+		return scheduleBeforeStart
+	case mins >= endM:
+		return scheduleAfterEnd
+	}
+	return scheduleInWindow
+}
+
+// nextOpenAt 计算下一次可开放的时间（严格晚于 now）。
+// 同时考虑一次性窗口与循环定时，返回二者中最早的下一次开放时刻；永久关闭时返回 nil。
+func (fc *FeatureControl) nextOpenAt(now time.Time) *time.Time {
+	var earliest *time.Time
+
+	// 未启用循环定时时，一次性开放时间即为下一次开放。
+	// 启用后由下方按日扫描统一处理（一次性开放时间也必须落在循环窗口内）。
+	if fc.OpenAt != nil && fc.OpenAt.After(now) && !fc.scheduleActive() {
+		t := *fc.OpenAt
+		earliest = &t
+	}
+
+	if fc.scheduleActive() {
+		startM, endM, err := fc.scheduleWindow()
+		if err == nil {
+			day := startOfDay(now)
+			// 扫描今天起的 8 天：7 天覆盖全部周几组合，多 1 天兜底边界。
+			for i := 0; i < 8; i++ {
+				d := day.AddDate(0, 0, i)
+				if !fc.scheduleDayOpen(d) {
+					continue
+				}
+				slotStart := d.Add(time.Duration(startM) * time.Minute)
+				slotEnd := d.Add(time.Duration(endM) * time.Minute)
+				// 与一次性窗口求交集：有效开放起点 = max(时段起点, 一次性开放时间)，且须在时段与一次性关闭时间之前
+				effStart := slotStart
+				if fc.OpenAt != nil && fc.OpenAt.After(effStart) {
+					effStart = *fc.OpenAt
+				}
+				if !effStart.Before(slotEnd) {
+					continue // 有效开放起点晚于该日时段结束，该日无有效窗口
+				}
+				if fc.CloseAt != nil && !effStart.Before(*fc.CloseAt) {
+					continue // 有效开放起点已过一次性关闭时间
+				}
+				if effStart.After(now) {
+					if earliest == nil || effStart.Before(*earliest) {
+						t := effStart
+						earliest = &t
+					}
+					break // 该日找到最早有效开放点即可（同一日只有一个窗口）
+				}
+			}
+		}
+	}
+
+	return earliest
+}
+
+// lastCloseAt 计算最近一次关闭的时间（严格早于 now）；从未开放过时返回 nil。
+func (fc *FeatureControl) lastCloseAt(now time.Time) *time.Time {
+	var latest *time.Time
+
+	// 未启用循环定时时，一次性关闭时间即为最近一次关闭。
+	// 启用后由下方按日扫描统一处理（与时段结束取较早者）。
+	if fc.CloseAt != nil && fc.CloseAt.Before(now) && !fc.scheduleActive() {
+		t := *fc.CloseAt
+		latest = &t
+	}
+
+	if fc.scheduleActive() {
+		startM, endM, err := fc.scheduleWindow()
+		if err == nil {
+			day := startOfDay(now)
+			// 从今天向前扫描 8 天，找最近一次已结束的窗口。
+			for i := 0; i < 8; i++ {
+				d := day.AddDate(0, 0, -i)
+				if !fc.scheduleDayOpen(d) {
+					continue
+				}
+				slotStart := d.Add(time.Duration(startM) * time.Minute)
+				slotEnd := d.Add(time.Duration(endM) * time.Minute)
+				// 与一次性窗口求交集：有效关闭点 = min(时段结束, 一次性关闭时间)
+				effEnd := slotEnd
+				if fc.CloseAt != nil && fc.CloseAt.Before(effEnd) {
+					effEnd = *fc.CloseAt
+				}
+				if effEnd.Before(slotStart) {
+					continue // 一次性关闭时间早于该日时段起点，该日无有效窗口
+				}
+				if effEnd.Before(now) {
+					if latest == nil || effEnd.After(*latest) {
+						t := effEnd
+						latest = &t
+					}
+					break // 已找到最近一次关闭
+				}
+			}
+		}
+	}
+
+	return latest
+}
+
+// parseHHMM 解析 "HH:MM" 为当天第几分钟。
+func parseHHMM(s string) (int, error) {
+	t, err := time.Parse("15:04", s)
+	if err != nil {
+		return 0, errors.Wrap(err, "parse HH:MM")
+	}
+	return t.Hour()*60 + t.Minute(), nil
+}
+
+// containsWeekday 判断逗号分隔的周几列表（0=周日…6=周六）是否包含 wd。
+func containsWeekday(days string, wd int) bool {
+	for _, part := range strings.Split(days, ",") {
+		part = strings.TrimSpace(part)
+		if part == "" {
+			continue
+		}
+		n, err := strconv.Atoi(part)
+		if err == nil && n == wd {
+			return true
+		}
+	}
+	return false
+}
+
+// startOfDay 返回 t 所在日历日的零点（保持时区一致）。
+func startOfDay(t time.Time) time.Time {
+	y, m, d := t.Date()
+	return time.Date(y, m, d, 0, 0, 0, 0, t.Location())
+}
+
+// DefaultFeatureControl 返回某功能的默认配置（尚未落库时的行为）。
+// 提问与投票默认开启（与历史行为一致）；私聊默认关闭，沿用 users.allow_chat 的默认值，
+// 避免历史账号在功能上线后被动开启私聊。
+func DefaultFeatureControl(userID uint, feature string) *FeatureControl {
+	return &FeatureControl{
+		UserID:  userID,
+		Feature: feature,
+		Enabled: feature != FeatureChat,
+	}
+}
+
+// FeatureStateOf 便捷入口：读取某用户某功能在当前的综合状态。
+// 查询失败或无存储时回退到默认配置，保证单个依赖表异常不会让整站功能不可用。
+func FeatureStateOf(ctx context.Context, userID uint, feature string) FeatureState {
+	if FeatureControls == nil {
+		return DefaultFeatureControl(userID, feature).Evaluate(time.Now())
+	}
+	fc, err := FeatureControls.Get(ctx, userID, feature)
+	if err != nil {
+		logrus.WithContext(ctx).WithError(err).Errorf("Failed to get feature control %q of user %d", feature, userID)
+		return DefaultFeatureControl(userID, feature).Evaluate(time.Now())
+	}
+	return fc.Evaluate(time.Now())
+}
+
+// FeatureOpen 便捷入口：某用户某功能当前是否可用。
+func FeatureOpen(ctx context.Context, userID uint, feature string) bool {
+	return FeatureStateOf(ctx, userID, feature).Open
+}
+
+// IsValidFeature 判断功能标识是否合法（防越权写入未知功能）。
+func IsValidFeature(feature string) bool {
+	for _, k := range FeatureKeys {
+		if k == feature {
+			return true
+		}
+	}
+	return false
+}
+
+func (db *featureControls) Get(ctx context.Context, userID uint, feature string) (*FeatureControl, error) {
+	var fc FeatureControl
+	err := db.WithContext(ctx).Where("user_id = ? AND feature = ?", userID, feature).First(&fc).Error
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return DefaultFeatureControl(userID, feature), nil
+		}
+		return nil, errors.Wrap(err, "get feature control")
+	}
+	return &fc, nil
+}
+
+func (db *featureControls) ListByUserID(ctx context.Context, userID uint) ([]*FeatureControl, error) {
+	var list []*FeatureControl
+	err := db.WithContext(ctx).
+		Where("user_id = ?", userID).
+		Order("feature ASC").
+		Find(&list).Error
+	if err != nil {
+		return nil, errors.Wrap(err, "list feature controls by user id")
+	}
+	return list, nil
+}
+
+func (db *featureControls) ListByUserIDs(ctx context.Context, userIDs []uint, feature string) (map[uint]*FeatureControl, error) {
+	result := make(map[uint]*FeatureControl, len(userIDs))
+	if len(userIDs) == 0 {
+		return result, nil
+	}
+	var list []*FeatureControl
+	if err := db.WithContext(ctx).
+		Where("user_id IN ? AND feature = ?", userIDs, feature).
+		Find(&list).Error; err != nil {
+		return nil, errors.Wrap(err, "list feature controls by user ids")
+	}
+	for _, fc := range list {
+		result[fc.UserID] = fc
+	}
+	return result, nil
+}
+
+type UpdateFeatureControlOptions struct {
+	Enabled       bool
+	OpenAt        *time.Time
+	CloseAt       *time.Time
+	ScheduleDays  string
+	ScheduleStart string
+	ScheduleEnd   string
+	QuotaLimit    int64
+}
+
+// Save 写入功能配置。使用 ON CONFLICT 幂等写入，并显式列出更新列，
+// 避免把 quota_count（已收集数量）误重置为 0。
+func (db *featureControls) Save(ctx context.Context, userID uint, feature string, opts UpdateFeatureControlOptions) error {
+	now := time.Now()
+	fc := &FeatureControl{
+		// UpdatedAt 显式写入（gorm 的 on-conflict 更新列会用到）；CreatedAt 留零值由 gorm 自动填充
+		Model:         dbutil.Model{UpdatedAt: now},
+		UserID:        userID,
+		Feature:       feature,
+		Enabled:       opts.Enabled,
+		OpenAt:        opts.OpenAt,
+		CloseAt:       opts.CloseAt,
+		ScheduleDays:  opts.ScheduleDays,
+		ScheduleStart: opts.ScheduleStart,
+		ScheduleEnd:   opts.ScheduleEnd,
+		QuotaLimit:    opts.QuotaLimit,
+	}
+	err := db.WithContext(ctx).Clauses(clause.OnConflict{
+		Columns: []clause.Column{{Name: "user_id"}, {Name: "feature"}},
+		DoUpdates: clause.AssignmentColumns([]string{
+			"enabled", "open_at", "close_at",
+			"schedule_days", "schedule_start", "schedule_end",
+			"quota_limit", "updated_at",
+		}),
+	}).Create(fc).Error
+	if err != nil {
+		return errors.Wrap(err, "save feature control")
+	}
+	return nil
+}
+
+// ResetQuota 清零收集计数并记录重置时间。无记录时创建一条（沿用该功能的默认开关值）。
+func (db *featureControls) ResetQuota(ctx context.Context, userID uint, feature string) error {
+	now := time.Now()
+	res := db.WithContext(ctx).Model(&FeatureControl{}).
+		Where("user_id = ? AND feature = ?", userID, feature).
+		Updates(map[string]interface{}{
+			"quota_count":    0,
+			"quota_reset_at": now,
+			"updated_at":     now,
+		})
+	if res.Error != nil {
+		return errors.Wrap(res.Error, "reset feature quota")
+	}
+	if res.RowsAffected > 0 {
+		return nil
+	}
+	// 尚无记录：按默认配置创建（提问/投票默认开启，私聊默认关闭）
+	fc := DefaultFeatureControl(userID, feature)
+	fc.QuotaResetAt = &now
+	if err := db.WithContext(ctx).
+		Clauses(clause.OnConflict{DoNothing: true}).
+		Create(fc).Error; err != nil {
+		return errors.Wrap(err, "create feature control on reset quota")
+	}
+	return nil
+}
+
+// IncrementQuota 累加收集计数（delta 可为负，用于删除内容时回退计数）。
+// 负 delta 不会把计数减到 0 以下（WHERE quota_count > 0），避免误删历史内容导致负计数。
+func (db *featureControls) IncrementQuota(ctx context.Context, userID uint, feature string, delta int64) error {
+	if delta == 0 {
+		return nil
+	}
+	now := time.Now()
+	q := db.WithContext(ctx).Model(&FeatureControl{}).
+		Where("user_id = ? AND feature = ?", userID, feature)
+	if delta < 0 {
+		q = q.Where("quota_count > 0")
+	}
+	res := q.Updates(map[string]interface{}{
+		"quota_count": gorm.Expr("quota_count + ?", delta),
+		"updated_at":  now,
+	})
+	if res.Error != nil {
+		return errors.Wrap(res.Error, "increment feature quota")
+	}
+	if res.RowsAffected > 0 {
+		return nil
+	}
+
+	// 尚无配置行：建一条并把计数初始化为本条（负数按 0 起步，不产生负计数）。
+	fc := DefaultFeatureControl(userID, feature)
+	if delta > 0 {
+		fc.QuotaCount = delta
+	}
+	fc.QuotaResetAt = &now
+	created := db.WithContext(ctx).
+		Clauses(clause.OnConflict{DoNothing: true}).
+		Create(fc)
+	if created.Error != nil {
+		return errors.Wrap(created.Error, "create feature control on increment quota")
+	}
+	if created.RowsAffected > 0 || delta <= 0 {
+		return nil
+	}
+	// 并发下配置行可能刚被其它请求创建：补一次累加，保证计数不丢。
+	retry := db.WithContext(ctx).Model(&FeatureControl{}).
+		Where("user_id = ? AND feature = ?", userID, feature).
+		Updates(map[string]interface{}{
+			"quota_count": gorm.Expr("quota_count + ?", delta),
+			"updated_at":  time.Now(),
+		})
+	if retry.Error != nil {
+		return errors.Wrap(retry.Error, "increment feature quota (retry)")
+	}
+	return nil
+}
+
+// backfillFeatureControls 为尚未初始化的历史账号补齐功能配置行。
+//
+// 背景：私聊开关此前落在 users.allow_chat，提问/投票则一直默认开启。功能上线后若没有
+// 对应的配置行，Get 会回退到默认值（私聊默认关闭），导致已开启私聊的历史账号被静默关闭。
+// 因此在 AutoMigrate 之后按 users.allow_chat 回填私聊开关，其余功能按"开启"回填。
+//
+// 幂等：每轮只挑出仍缺配置行的账号，写完后进入下一轮，直到没有遗漏。
+// 分批 + ON CONFLICT DO NOTHING，避免"边插入边查同一张表"在不同数据库上的差异行为，
+// 并保证并发启动（多实例同时启动）时不会重复插入。
+func backfillFeatureControls(db *gorm.DB) error {
+	// backfillBatchSize 每轮处理的账号数，控制单次事务体积与内存占用。
+	const backfillBatchSize = 500
+
+	type backfillRow struct {
+		UserID    uint
+		AllowChat bool
+	}
+
+	for _, feature := range FeatureKeys {
+		defaultEnabled := feature != FeatureChat
+		created := int64(0)
+
+		for {
+			var rows []backfillRow
+			err := db.Table("users").
+				Select("users.id AS user_id, users.allow_chat AS allow_chat").
+				Joins("LEFT JOIN feature_controls fc ON fc.user_id = users.id AND fc.feature = ?", feature).
+				Where("users.deleted_at IS NULL AND fc.id IS NULL").
+				Limit(backfillBatchSize).
+				Scan(&rows).Error
+			if err != nil {
+				return errors.Wrapf(err, "query users without feature control %s", feature)
+			}
+			if len(rows) == 0 {
+				break
+			}
+
+			batch := make([]FeatureControl, 0, len(rows))
+			for _, r := range rows {
+				enabled := defaultEnabled
+				if feature == FeatureChat {
+					enabled = r.AllowChat
+				}
+				batch = append(batch, FeatureControl{
+					UserID:  r.UserID,
+					Feature: feature,
+					Enabled: enabled,
+				})
+			}
+
+			res := db.Clauses(clause.OnConflict{DoNothing: true}).Create(&batch)
+			if res.Error != nil {
+				return errors.Wrapf(res.Error, "backfill feature controls: %s", feature)
+			}
+			// 本轮没有任何新行落库：说明并发实例已写完或数据异常，停止循环避免死循环。
+			if res.RowsAffected == 0 {
+				break
+			}
+			created += res.RowsAffected
+			if len(rows) < backfillBatchSize {
+				break
+			}
+		}
+
+		if created > 0 {
+			logrus.WithField("feature", feature).
+				Infof("功能开关初始化：为 %d 个历史账号补齐配置", created)
+		}
+	}
+	return nil
+}
+
+// reconcileLegacyChatEnabled 修复旧版 backfill 写入的私聊错误开关。
+//
+// 背景：早期版本 FeatureControl.Enabled 带 gorm:"default:true" 标签，backfill 为
+// allow_chat=false 的用户补私聊行时，false 被 GORM 替换为默认值 true，导致私聊被被动开启；
+// 且 UpdateChatSettings 会把 users.allow_chat 反向同步为 true，形成持久化。
+//
+// 纠偏条件（必须同时满足，只命中"纯 backfill 默认行"，绝不碰箱主配置过的行）：
+//   - feature = 'chat' 且 enabled = true；
+//   - 对应 users.allow_chat = false（箱主从未在面板开启私聊——面板开启会同步 allow_chat=true）；
+//   - 该行无任何自定义配置（open_at / close_at 为空、quota_limit = 0、循环定时为空）；
+//   - updated_at <= created_at（从未被面板保存过，updated_at 未变化）。
+//
+// 满足条件即复位 feature_controls.enabled = false，并同步 users.allow_chat = false。
+// 幂等：每轮只处理仍满足条件的行，直到没有遗漏；已复位/已配置的行不会重复命中。
+func reconcileLegacyChatEnabled(db *gorm.DB) error {
+	// reconcileBatchSize 每轮处理的账号数，控制单次事务体积。
+	const reconcileBatchSize = 500
+
+	// pureDefaultFilterFC / pureDefaultFilterPlain 只匹配纯默认配置的私聊行
+	// （无一次性窗口/循环定时/定量上限）。两者仅列前缀不同：
+	//   - FC 版带 "fc." 前缀，用于 SELECT（feature_controls fc 别名场景）；
+	//   - 纯版不带前缀，用于 UPDATE（GORM 不会为 UPDATE 自动加别名，带前缀会报
+	//     missing FROM-clause entry for table "fc"）。
+	// 同时兼容旧行 schedule 列为 NULL 与新行空串两种情况。
+	pureDefaultFilterFC := "fc.open_at IS NULL AND fc.close_at IS NULL AND fc.quota_limit = 0" +
+		" AND (fc.schedule_days IS NULL OR fc.schedule_days = '')" +
+		" AND (fc.schedule_start IS NULL OR fc.schedule_start = '')" +
+		" AND (fc.schedule_end IS NULL OR fc.schedule_end = '')"
+	pureDefaultFilterPlain := "open_at IS NULL AND close_at IS NULL AND quota_limit = 0" +
+		" AND (schedule_days IS NULL OR schedule_days = '')" +
+		" AND (schedule_start IS NULL OR schedule_start = '')" +
+		" AND (schedule_end IS NULL OR schedule_end = '')"
+
+	fixed := int64(0)
+	for {
+		var rows []struct{ UserID uint }
+		err := db.Table("feature_controls fc").
+			Select("fc.user_id").
+			Joins("JOIN users u ON u.id = fc.user_id AND u.allow_chat = false").
+			Where("fc.feature = ? AND fc.enabled = true", FeatureChat).
+			Where(pureDefaultFilterFC).
+			Where("fc.updated_at <= fc.created_at").
+			Where("fc.deleted_at IS NULL AND u.deleted_at IS NULL").
+			Limit(reconcileBatchSize).
+			Scan(&rows).Error
+		if err != nil {
+			return errors.Wrap(err, "query legacy chat rows to reconcile")
+		}
+		if len(rows) == 0 {
+			break
+		}
+
+		userIDs := make([]uint, 0, len(rows))
+		for _, r := range rows {
+			userIDs = append(userIDs, r.UserID)
+		}
+
+		// 复位 feature_controls.enabled（同一批用户 + 同样的纯默认条件，避免误伤并发新增配置）。
+		res := db.Table("feature_controls").
+			Where("user_id IN ? AND feature = ? AND enabled = true", userIDs, FeatureChat).
+			Where(pureDefaultFilterPlain).
+			Where("deleted_at IS NULL").
+			Update("enabled", false)
+		if res.Error != nil {
+			return errors.Wrap(res.Error, "reset legacy chat enabled")
+		}
+		fixed += res.RowsAffected
+
+		// 同步 users.allow_chat，保证两处一致。
+		if err := db.Table("users").
+			Where("id IN ? AND allow_chat = true", userIDs).
+			Where("deleted_at IS NULL").
+			Update("allow_chat", false).Error; err != nil {
+			return errors.Wrap(err, "sync legacy users.allow_chat")
+		}
+
+		if int64(len(rows)) < reconcileBatchSize {
+			break
+		}
+	}
+
+	if fixed > 0 {
+		logrus.WithField("count", fixed).
+			Warn("私聊开关纠偏：旧版数据把未开启私聊的账号置为开启，已复位为关闭")
+	}
+	return nil
+}
+
+// normalizeChatQuota 清零私聊行上历史残留的收集上限与计数。
+//
+// 背景：私聊不提供收集上限能力（会话是双向对话，限制「新建会话数」意义不大），
+// UI 已隐藏该字段、保存时强制清零；此处在启动期做一次性兜底，把旧版本
+// 设置过的私聊上限/计数统一清零，避免达到残留上限后私聊「莫名关闭」。
+// 幂等：重复执行不产生任何变更，失败由调用方告警（不阻断启动）。
+func normalizeChatQuota(db *gorm.DB) error {
+	res := db.Model(&FeatureControl{}).
+		Where("feature = ? AND (quota_limit > 0 OR quota_count > 0)", FeatureChat).
+		Updates(map[string]interface{}{"quota_limit": 0, "quota_count": 0})
+	if res.Error != nil {
+		return errors.Wrap(res.Error, "normalize chat feature quota")
+	}
+	if res.RowsAffected > 0 {
+		logrus.WithField("count", res.RowsAffected).
+			Info("私聊收集上限已下线：已清零历史残留的私聊收集上限与计数")
+	}
+	return nil
+}
diff --git a/internal/db/feature_control_test.go b/internal/db/feature_control_test.go
new file mode 100644
index 0000000..5d97ae0
--- /dev/null
+++ b/internal/db/feature_control_test.go
@@ -0,0 +1,341 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package db
+
+import (
+	"testing"
+	"time"
+)
+
+// TestFeatureControlEvaluate 覆盖开关 / 定时 / 定量三类控制的组合与优先级。
+// 纯逻辑测试，不依赖外部数据库。
+func TestFeatureControlEvaluate(t *testing.T) {
+	now := time.Date(2026, 8, 31, 12, 0, 0, 0, time.UTC)
+	past := now.Add(-time.Hour)
+	future := now.Add(time.Hour)
+
+	tests := []struct {
+		name   string
+		fc     FeatureControl
+		wantOk bool
+		want   string
+	}{
+		{
+			name:   "开启且无限制",
+			fc:     FeatureControl{Enabled: true},
+			wantOk: true, want: "",
+		},
+		{
+			name:   "手动关闭优先于其它条件",
+			fc:     FeatureControl{Enabled: false, OpenAt: &past, CloseAt: &future, QuotaLimit: 1},
+			wantOk: false, want: FeatureReasonDisabled,
+		},
+		{
+			name:   "未到开放时间",
+			fc:     FeatureControl{Enabled: true, OpenAt: &future},
+			wantOk: false, want: FeatureReasonNotStarted,
+		},
+		{
+			name:   "开放时间已过但功能仍开启",
+			fc:     FeatureControl{Enabled: true, OpenAt: &past},
+			wantOk: true, want: "",
+		},
+		{
+			name:   "已过关闭时间",
+			fc:     FeatureControl{Enabled: true, OpenAt: &past, CloseAt: &past},
+			wantOk: false, want: FeatureReasonEnded,
+		},
+		{
+			name:   "刚好到达关闭时间即关闭",
+			fc:     FeatureControl{Enabled: true, CloseAt: &now},
+			wantOk: false, want: FeatureReasonEnded,
+		},
+		{
+			name:   "未到收集上限",
+			fc:     FeatureControl{Enabled: true, QuotaLimit: 10, QuotaCount: 9},
+			wantOk: true, want: "",
+		},
+		{
+			name:   "恰好达到收集上限",
+			fc:     FeatureControl{Enabled: true, QuotaLimit: 10, QuotaCount: 10},
+			wantOk: false, want: FeatureReasonQuotaReached,
+		},
+		{
+			name:   "超过收集上限",
+			fc:     FeatureControl{Enabled: true, QuotaLimit: 10, QuotaCount: 12},
+			wantOk: false, want: FeatureReasonQuotaReached,
+		},
+		{
+			name:   "上限为 0 表示不限制",
+			fc:     FeatureControl{Enabled: true, QuotaLimit: 0, QuotaCount: 9999},
+			wantOk: true, want: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			st := tt.fc.Evaluate(now)
+			if st.Open != tt.wantOk || st.Reason != tt.want {
+				t.Fatalf("Evaluate() = (open=%v, reason=%q), want (open=%v, reason=%q)",
+					st.Open, st.Reason, tt.wantOk, tt.want)
+			}
+		})
+	}
+}
+
+// TestDefaultFeatureControl 私聊默认关闭（沿用 users.allow_chat 的历史默认），
+// 提问与投票默认开启，保证功能上线不改变既有行为。
+func TestDefaultFeatureControl(t *testing.T) {
+	cases := map[string]bool{
+		FeatureQuestion: true,
+		FeatureChat:     false,
+		FeatureVote:     true,
+	}
+	for feature, want := range cases {
+		if got := DefaultFeatureControl(1, feature).Enabled; got != want {
+			t.Fatalf("DefaultFeatureControl(%q).Enabled = %v, want %v", feature, got, want)
+		}
+	}
+}
+
+func TestIsValidFeature(t *testing.T) {
+	for _, k := range FeatureKeys {
+		if !IsValidFeature(k) {
+			t.Fatalf("IsValidFeature(%q) = false, want true", k)
+		}
+	}
+	for _, k := range []string{"", "chat ", "CHAT", "poll", "messages"} {
+		if IsValidFeature(k) {
+			t.Fatalf("IsValidFeature(%q) = true, want false", k)
+		}
+	}
+}
+
+// TestFeatureControlSchedule 覆盖循环定时（每周开放日 + 每日时间段）的 Evaluate 判定。
+func TestFeatureControlSchedule(t *testing.T) {
+	// 固定在一个周四 12:00（time.Weekday: 0=周日…4=周四…6=周六）
+	now := time.Date(2026, 9, 3, 12, 0, 0, 0, time.UTC) // 2026-09-03 是周四
+	thursday := int(now.Weekday())
+	if thursday != 4 {
+		t.Fatalf("test precondition: 2026-09-03 should be Thursday, got %d", thursday)
+	}
+
+	tests := []struct {
+		name   string
+		fc     FeatureControl
+		wantOk bool
+		want   string
+	}{
+		{
+			name:   "无循环定时不影响判定",
+			fc:     FeatureControl{Enabled: true},
+			wantOk: true, want: "",
+		},
+		{
+			name:   "每日时间段内开放",
+			fc:     FeatureControl{Enabled: true, ScheduleStart: "09:00", ScheduleEnd: "18:00"},
+			wantOk: true, want: "",
+		},
+		{
+			name:   "每日时间段开始前关闭",
+			fc:     FeatureControl{Enabled: true, ScheduleStart: "13:00", ScheduleEnd: "18:00"},
+			wantOk: false, want: FeatureReasonNotStarted,
+		},
+		{
+			name:   "每日时间段结束后关闭（次日会再开）",
+			fc:     FeatureControl{Enabled: true, ScheduleStart: "09:00", ScheduleEnd: "11:00"},
+			wantOk: false, want: FeatureReasonNotStarted,
+		},
+		{
+			name:   "当天不在开放日关闭（未来还会再开）",
+			fc:     FeatureControl{Enabled: true, ScheduleDays: "0", ScheduleStart: "09:00", ScheduleEnd: "18:00"},
+			wantOk: false, want: FeatureReasonNotStarted,
+		},
+		{
+			name:   "只设开放日（不设时间）表示全天",
+			fc:     FeatureControl{Enabled: true, ScheduleDays: "4"},
+			wantOk: true, want: "",
+		},
+		{
+			name:   "只设时间（不设开放日）表示每天该时段",
+			fc:     FeatureControl{Enabled: true, ScheduleStart: "09:00", ScheduleEnd: "18:00"},
+			wantOk: true, want: "",
+		},
+		{
+			name:   "开放日与时间段组合：非开放日关闭",
+			fc:     FeatureControl{Enabled: true, ScheduleDays: "1,3,5", ScheduleStart: "09:00", ScheduleEnd: "18:00"},
+			wantOk: false, want: FeatureReasonNotStarted, // 周四不在 1,3,5 中
+		},
+		{
+			name:   "开放日与时间段组合：开放日+时段内开放",
+			fc:     FeatureControl{Enabled: true, ScheduleDays: "2,4", ScheduleStart: "09:00", ScheduleEnd: "18:00"},
+			wantOk: true, want: "",
+		},
+		{
+			name:   "循环定时达到收集上限",
+			fc:     FeatureControl{Enabled: true, ScheduleDays: "4", ScheduleStart: "09:00", ScheduleEnd: "18:00", QuotaLimit: 5, QuotaCount: 5},
+			wantOk: false, want: FeatureReasonQuotaReached,
+		},
+		{
+			name:   "手动关闭优先于循环定时",
+			fc:     FeatureControl{Enabled: false, ScheduleDays: "4", ScheduleStart: "09:00", ScheduleEnd: "18:00"},
+			wantOk: false, want: FeatureReasonDisabled,
+		},
+		{
+			name:   "一次性窗口与循环定时叠加：窗口内+时段内开放",
+			fc:     FeatureControl{Enabled: true, OpenAt: &[]time.Time{now.Add(-time.Hour)}[0], CloseAt: &[]time.Time{now.Add(24 * time.Hour)}[0], ScheduleStart: "09:00", ScheduleEnd: "18:00"},
+			wantOk: true, want: "",
+		},
+		{
+			name:   "一次性窗口已关闭后循环定时不再生效（硬边界）",
+			fc:     FeatureControl{Enabled: true, OpenAt: &[]time.Time{now.Add(-48 * time.Hour)}[0], CloseAt: &[]time.Time{now.Add(-24 * time.Hour)}[0], ScheduleDays: "4", ScheduleStart: "09:00", ScheduleEnd: "18:00"},
+			wantOk: false, want: FeatureReasonEnded,
+		},
+		{
+			name:   "一次性窗口已关闭且无循环定时",
+			fc:     FeatureControl{Enabled: true, OpenAt: &[]time.Time{now.Add(-48 * time.Hour)}[0], CloseAt: &[]time.Time{now.Add(-24 * time.Hour)}[0]},
+			wantOk: false, want: FeatureReasonEnded,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			st := tt.fc.Evaluate(now)
+			if st.Open != tt.wantOk || st.Reason != tt.want {
+				t.Fatalf("Evaluate() = (open=%v, reason=%q), want (open=%v, reason=%q)",
+					st.Open, st.Reason, tt.wantOk, tt.want)
+			}
+		})
+	}
+}
+
+// TestFeatureControlNextOpenAtLastCloseAt 覆盖「下次开放时间 / 上次关闭时间」的计算。
+func TestFeatureControlNextOpenAtLastCloseAt(t *testing.T) {
+	// 2026-09-03 12:00 UTC（周四）
+	now := time.Date(2026, 9, 3, 12, 0, 0, 0, time.UTC)
+
+	t.Run("循环定时与一次性窗口交集：当天时段内更晚开放", func(t *testing.T) {
+		// now=周四 12:00，循环每天 09:00-18:00；一次性开放时间 = 今天 14:00 → 今天 14:00 开放
+		openAt := time.Date(2026, 9, 3, 14, 0, 0, 0, time.UTC)
+		closeAt := time.Date(2026, 9, 3, 20, 0, 0, 0, time.UTC)
+		fc := FeatureControl{Enabled: true, OpenAt: &openAt, CloseAt: &closeAt,
+			ScheduleStart: "09:00", ScheduleEnd: "18:00"}
+		st := fc.Evaluate(now)
+		if st.Reason != FeatureReasonNotStarted {
+			t.Fatalf("reason = %q, want not_started", st.Reason)
+		}
+		if st.NextOpenAt == nil || !st.NextOpenAt.Equal(openAt) {
+			t.Fatalf("NextOpenAt = %v, want %v（今天 14:00）", st.NextOpenAt, openAt)
+		}
+	})
+
+	t.Run("一次性窗口在循环时段结束后才开放则当天不开放", func(t *testing.T) {
+		// 一次性开放时间 20:00 晚于循环时段结束 18:00 → 今天无有效窗口，下次开放 = 明天 09:00
+		openAt := time.Date(2026, 9, 3, 20, 0, 0, 0, time.UTC)
+		closeAt := time.Date(2026, 9, 5, 20, 0, 0, 0, time.UTC)
+		fc := FeatureControl{Enabled: true, OpenAt: &openAt, CloseAt: &closeAt,
+			ScheduleStart: "09:00", ScheduleEnd: "18:00"}
+		st := fc.Evaluate(now)
+		if st.Reason != FeatureReasonNotStarted {
+			t.Fatalf("reason = %q, want not_started", st.Reason)
+		}
+		wantNext := time.Date(2026, 9, 4, 9, 0, 0, 0, time.UTC)
+		if st.NextOpenAt == nil || !st.NextOpenAt.Equal(wantNext) {
+			t.Fatalf("NextOpenAt = %v, want %v（明天 09:00）", st.NextOpenAt, wantNext)
+		}
+	})
+
+	t.Run("手动关闭与定量上限不展示时间信息", func(t *testing.T) {
+		disabled := FeatureControl{Enabled: false, ScheduleStart: "09:00", ScheduleEnd: "18:00"}
+		st := disabled.Evaluate(now)
+		if st.Reason != FeatureReasonDisabled || st.NextOpenAt != nil || st.LastCloseAt != nil {
+			t.Fatalf("disabled state = (reason=%q, next=%v, last=%v), want nil times",
+				st.Reason, st.NextOpenAt, st.LastCloseAt)
+		}
+		quota := FeatureControl{Enabled: true, ScheduleStart: "09:00", ScheduleEnd: "18:00", QuotaLimit: 1, QuotaCount: 1}
+		st = quota.Evaluate(now)
+		if st.Reason != FeatureReasonQuotaReached || st.NextOpenAt != nil || st.LastCloseAt != nil {
+			t.Fatalf("quota state = (reason=%q, next=%v, last=%v), want nil times",
+				st.Reason, st.NextOpenAt, st.LastCloseAt)
+		}
+	})
+
+	t.Run("一次性窗口未到开放时间", func(t *testing.T) {
+		openAt := now.Add(2 * time.Hour)
+		closeAt := now.Add(24 * time.Hour)
+		fc := FeatureControl{Enabled: true, OpenAt: &openAt, CloseAt: &closeAt}
+		st := fc.Evaluate(now)
+		if st.NextOpenAt == nil || !st.NextOpenAt.Equal(openAt) {
+			t.Fatalf("NextOpenAt = %v, want %v", st.NextOpenAt, openAt)
+		}
+		if st.LastCloseAt != nil {
+			t.Fatalf("LastCloseAt = %v, want nil（从未开放过）", st.LastCloseAt)
+		}
+	})
+
+	t.Run("一次性窗口已结束", func(t *testing.T) {
+		openAt := now.Add(-48 * time.Hour)
+		closeAt := now.Add(-24 * time.Hour)
+		fc := FeatureControl{Enabled: true, OpenAt: &openAt, CloseAt: &closeAt}
+		st := fc.Evaluate(now)
+		if st.NextOpenAt != nil {
+			t.Fatalf("NextOpenAt = %v, want nil（无循环定时，永久关闭）", st.NextOpenAt)
+		}
+		if st.LastCloseAt == nil || !st.LastCloseAt.Equal(closeAt) {
+			t.Fatalf("LastCloseAt = %v, want %v", st.LastCloseAt, closeAt)
+		}
+	})
+
+	t.Run("循环定时：每天 09:00-18:00", func(t *testing.T) {
+		fc := FeatureControl{Enabled: true, ScheduleStart: "09:00", ScheduleEnd: "18:00"}
+		// 12:00 在窗口内：下次开放 = 明天 09:00；上次关闭 = 今天 18:00 尚未结束 → 昨天 18:00
+		st := fc.Evaluate(now)
+		if st.Open != true {
+			t.Fatalf("should be open, got reason=%q", st.Reason)
+		}
+		wantNext := time.Date(2026, 9, 4, 9, 0, 0, 0, time.UTC)
+		if st.NextOpenAt == nil || !st.NextOpenAt.Equal(wantNext) {
+			t.Fatalf("NextOpenAt = %v, want %v", st.NextOpenAt, wantNext)
+		}
+		wantLast := time.Date(2026, 9, 2, 18, 0, 0, 0, time.UTC)
+		if st.LastCloseAt == nil || !st.LastCloseAt.Equal(wantLast) {
+			t.Fatalf("LastCloseAt = %v, want %v", st.LastCloseAt, wantLast)
+		}
+	})
+
+	t.Run("循环定时：18:00 已过", func(t *testing.T) {
+		evening := time.Date(2026, 9, 3, 20, 0, 0, 0, time.UTC)
+		fc := FeatureControl{Enabled: true, ScheduleStart: "09:00", ScheduleEnd: "18:00"}
+		st := fc.Evaluate(evening)
+		if st.Open {
+			t.Fatal("should be closed after daily end")
+		}
+		wantNext := time.Date(2026, 9, 4, 9, 0, 0, 0, time.UTC)
+		if st.NextOpenAt == nil || !st.NextOpenAt.Equal(wantNext) {
+			t.Fatalf("NextOpenAt = %v, want %v", st.NextOpenAt, wantNext)
+		}
+		wantLast := time.Date(2026, 9, 3, 18, 0, 0, 0, time.UTC)
+		if st.LastCloseAt == nil || !st.LastCloseAt.Equal(wantLast) {
+			t.Fatalf("LastCloseAt = %v, want %v", st.LastCloseAt, wantLast)
+		}
+	})
+
+	t.Run("循环定时：仅周五开放（今天周四）", func(t *testing.T) {
+		fc := FeatureControl{Enabled: true, ScheduleDays: "5"} // 周五全天
+		st := fc.Evaluate(now)
+		if st.Open {
+			t.Fatal("should be closed on non-scheduled day")
+		}
+		wantNext := time.Date(2026, 9, 4, 0, 0, 0, 0, time.UTC) // 周五零点
+		if st.NextOpenAt == nil || !st.NextOpenAt.Equal(wantNext) {
+			t.Fatalf("NextOpenAt = %v, want %v", st.NextOpenAt, wantNext)
+		}
+		// 全天窗口 [周五 00:00, 周六 00:00)，最近一次关闭 = 上周六零点
+		wantLast := time.Date(2026, 8, 29, 0, 0, 0, 0, time.UTC)
+		if st.LastCloseAt == nil || !st.LastCloseAt.Equal(wantLast) {
+			t.Fatalf("LastCloseAt = %v, want %v", st.LastCloseAt, wantLast)
+		}
+	})
+}
diff --git a/internal/db/follow_ups.go b/internal/db/follow_ups.go
new file mode 100644
index 0000000..6e88455
--- /dev/null
+++ b/internal/db/follow_ups.go
@@ -0,0 +1,221 @@
+package db
+
+import (
+	"context"
+
+	"github.com/pkg/errors"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	"github.com/tamakyi/TamaBox/internal/dbutil"
+)
+
+// MaxFollowUpCount 每条提问允许的最大追问次数（防滥用）。
+// 提问者被回答后，用 token（或登录账号）继续追问，达到上限后不可再追问。
+const MaxFollowUpCount = 3
+
+// 追问相关错误（供 handler 区分处理，避免把业务错误当 500）
+var (
+	// ErrFollowUpLimitReached 追问次数已达上限
+	ErrFollowUpLimitReached = errors.New("follow up limit reached")
+	// ErrFollowUpNotFound 追问不存在或不属于该问题
+	ErrFollowUpNotFound = errors.New("follow up not found")
+	// ErrFollowUpAlreadyAnswered 追问已被回答（禁止覆盖）
+	ErrFollowUpAlreadyAnswered = errors.New("follow up already answered")
+)
+
+var FollowUps FollowUpsStore
+
+type FollowUpsStore interface {
+	// CreateIfBelowLimit 原子创建追问：仅当该问题追问次数未达上限时创建。
+	// 返回 created=false 且 err==ErrFollowUpLimitReached 表示已达上限。
+	// 通过事务内锁定问题行，串行化同一问题的并发追问，消除 count-then-create 竞态。
+	CreateIfBelowLimit(ctx context.Context, opts CreateFollowUpOptions) (created bool, err error)
+	GetByQuestionID(ctx context.Context, questionID uint) ([]*FollowUp, error)
+	// GetLatestByQuestionID 返回某条提问最新的一条追问；无追问时返回 (nil, nil)。
+	GetLatestByQuestionID(ctx context.Context, questionID uint) (*FollowUp, error)
+	// GetByQuestionIDs 批量获取多个提问的追问，按 question_id 分组返回。
+	// 用于账号导出等场景，将 N 次单题查询合并为 1 次 IN 查询，避免 N+1。
+	GetByQuestionIDs(ctx context.Context, questionIDs []uint) (map[uint][]*FollowUp, error)
+	CountByQuestionID(ctx context.Context, questionID uint) (int64, error)
+	// AnswerByID 回答某条追问；questionID 用于防止越权（必须属于该问题）。
+	// 仅允许回答尚未回答的追问（answer 为空），已回答的返回 ErrFollowUpAlreadyAnswered，
+	// 不存在/不属于该问题返回 ErrFollowUpNotFound。
+	AnswerByID(ctx context.Context, questionID uint, id uint, answer string) error
+	// UpdateAnswerByID 修改某条追问的回答内容（带 question_id 条件防止越权），
+	// 与 AnswerByID 不同，此处允许覆盖已回答的追问（供主人修改回复使用）。
+	// 不存在/不属于该问题返回 ErrFollowUpNotFound。
+	UpdateAnswerByID(ctx context.Context, questionID uint, id uint, answer string) error
+	// DeleteByQuestionID 删除某条提问时级联清理其全部追问（软删除，与提问保持一致）。
+	DeleteByQuestionID(ctx context.Context, questionID uint) error
+}
+
+func NewFollowUpsStore(db *gorm.DB) FollowUpsStore {
+	return &followUps{db}
+}
+
+type followUps struct {
+	*gorm.DB
+}
+
+// FollowUp 表示对某条提问的一轮追问。
+type FollowUp struct {
+	dbutil.Model
+	QuestionID uint   `gorm:"index:idx_follow_up_question" json:"question_id"`
+	Content    string `gorm:"type:text" json:"content"`
+	Answer     string `gorm:"type:text" json:"answer"`
+}
+
+type CreateFollowUpOptions struct {
+	QuestionID uint
+	Content    string
+}
+
+func (db *followUps) CreateIfBelowLimit(ctx context.Context, opts CreateFollowUpOptions) (bool, error) {
+	created := false
+	err := db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		// 锁定问题行，串行化同一问题的并发追问（MySQL/Postgres 均支持 FOR UPDATE）。
+		var q Question
+		if err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).
+			Select("id").
+			First(&q, opts.QuestionID).Error; err != nil {
+			return errors.Wrap(err, "lock question for follow up")
+		}
+
+		var count int64
+		if err := tx.Model(&FollowUp{}).
+			Where("question_id = ?", opts.QuestionID).
+			Count(&count).Error; err != nil {
+			return errors.Wrap(err, "count follow ups by question id")
+		}
+		if count >= MaxFollowUpCount {
+			return ErrFollowUpLimitReached
+		}
+
+		f := &FollowUp{
+			QuestionID: opts.QuestionID,
+			Content:    opts.Content,
+		}
+		if err := tx.Create(f).Error; err != nil {
+			return errors.Wrap(err, "create follow up")
+		}
+		created = true
+		return nil
+	})
+	if err != nil {
+		return false, err
+	}
+	return created, nil
+}
+
+// GetByQuestionID 按时间正序返回某条提问的所有追问。
+func (db *followUps) GetByQuestionID(ctx context.Context, questionID uint) ([]*FollowUp, error) {
+	var followUps []*FollowUp
+	if err := db.WithContext(ctx).
+		Where("question_id = ?", questionID).
+		Order("created_at ASC").
+		Find(&followUps).Error; err != nil {
+		return nil, errors.Wrap(err, "get follow ups by question id")
+	}
+	return followUps, nil
+}
+
+// GetLatestByQuestionID 返回某条提问最新的一条追问（created_at 倒序取首条）；
+// 无追问时返回 (nil, nil)。供发布追问前校验"上一条是否已回复"。
+func (db *followUps) GetLatestByQuestionID(ctx context.Context, questionID uint) (*FollowUp, error) {
+	var fu FollowUp
+	err := db.WithContext(ctx).
+		Where("question_id = ?", questionID).
+		Order("created_at DESC").
+		Limit(1).
+		First(&fu).Error
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, nil
+		}
+		return nil, errors.Wrap(err, "get latest follow up by question id")
+	}
+	return &fu, nil
+}
+
+// GetByQuestionIDs 批量获取多个提问的追问，按 question_id 分组返回（解决导出 N+1）。
+func (db *followUps) GetByQuestionIDs(ctx context.Context, questionIDs []uint) (map[uint][]*FollowUp, error) {
+	result := make(map[uint][]*FollowUp)
+	if len(questionIDs) == 0 {
+		return result, nil
+	}
+	var items []*FollowUp
+	if err := db.WithContext(ctx).
+		Where("question_id IN ?", questionIDs).
+		Order("question_id ASC, created_at ASC").
+		Find(&items).Error; err != nil {
+		return nil, errors.Wrap(err, "get follow ups by question ids")
+	}
+	for _, fu := range items {
+		result[fu.QuestionID] = append(result[fu.QuestionID], fu)
+	}
+	return result, nil
+}
+
+// CountByQuestionID 统计某条提问的追问次数，用于限制追问上限。
+func (db *followUps) CountByQuestionID(ctx context.Context, questionID uint) (int64, error) {
+	var count int64
+	if err := db.WithContext(ctx).
+		Model(&FollowUp{}).
+		Where("question_id = ?", questionID).
+		Count(&count).Error; err != nil {
+		return 0, errors.Wrap(err, "count follow ups by question id")
+	}
+	return count, nil
+}
+
+// AnswerByID 更新某条追问的回答内容（带 question_id 条件防止越权）。
+// 原子更新条件含 answer=”：已回答的追问不会被覆盖（避免重复提交时邮件/回答被二次写入）。
+// RowsAffected==0 时再查一次以区分"不存在"与"已回答"，返回对应错误。
+func (db *followUps) AnswerByID(ctx context.Context, questionID uint, id uint, answer string) error {
+	res := db.WithContext(ctx).
+		Model(&FollowUp{}).
+		Where("id = ? AND question_id = ? AND answer = ''", id, questionID).
+		Update("answer", answer)
+	if res.Error != nil {
+		return errors.Wrap(res.Error, "answer follow up")
+	}
+	if res.RowsAffected == 0 {
+		var cnt int64
+		if err := db.WithContext(ctx).
+			Model(&FollowUp{}).
+			Where("id = ? AND question_id = ?", id, questionID).
+			Count(&cnt).Error; err != nil {
+			return errors.Wrap(err, "check follow up existence")
+		}
+		if cnt == 0 {
+			return ErrFollowUpNotFound
+		}
+		return ErrFollowUpAlreadyAnswered
+	}
+	return nil
+}
+
+// UpdateAnswerByID 修改某条追问的回答内容（带 question_id 条件防止越权），
+// 允许覆盖已回答的追问（用于主人修改回复）。不存在/不属于该问题返回 ErrFollowUpNotFound。
+func (db *followUps) UpdateAnswerByID(ctx context.Context, questionID uint, id uint, answer string) error {
+	res := db.WithContext(ctx).
+		Model(&FollowUp{}).
+		Where("id = ? AND question_id = ?", id, questionID).
+		Update("answer", answer)
+	if res.Error != nil {
+		return errors.Wrap(res.Error, "update follow up answer")
+	}
+	if res.RowsAffected == 0 {
+		return ErrFollowUpNotFound
+	}
+	return nil
+}
+
+// DeleteByQuestionID 删除某条提问时级联清理其全部追问（软删除，与提问保持一致）。
+func (db *followUps) DeleteByQuestionID(ctx context.Context, questionID uint) error {
+	if err := db.WithContext(ctx).Where("question_id = ?", questionID).Delete(&FollowUp{}).Error; err != nil {
+		return errors.Wrap(err, "delete follow ups by question id")
+	}
+	return nil
+}
diff --git a/internal/db/main_test.go b/internal/db/main_test.go
new file mode 100644
index 0000000..0aaba55
--- /dev/null
+++ b/internal/db/main_test.go
@@ -0,0 +1,18 @@
+// Copyright 2023 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package db
+
+import (
+	"testing"
+
+	"gorm.io/gorm"
+
+	"github.com/tamakyi/TamaBox/internal/dbutil"
+)
+
+// newTestDB returns a test database instance with the cleanup function.
+func newTestDB(t *testing.T) (*gorm.DB, func(...string) error) {
+	return dbutil.NewTestDB(t, AllTables...)
+}
diff --git a/internal/db/message.go b/internal/db/message.go
new file mode 100644
index 0000000..f9fe79c
--- /dev/null
+++ b/internal/db/message.go
@@ -0,0 +1,132 @@
+package db
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/pkg/errors"
+	"gorm.io/gorm"
+
+	"github.com/tamakyi/TamaBox/internal/dbutil"
+)
+
+var Messages MessageStore
+
+type MessageStore interface {
+	Create(ctx context.Context, opts CreateMessageOptions) (*Message, error)
+	GetByConversationID(ctx context.Context, conversationID uint, cursor *dbutil.Cursor) ([]*Message, error)
+	// GetFirstMessagesByConversationIDs 批量获取多个会话的第一条消息（解决 N+1 查询）
+	GetFirstMessagesByConversationIDs(ctx context.Context, conversationIDs []uint) (map[uint]string, error)
+	// GetAllByConversationIDs 批量获取多个会话的全部消息（导出用，不分页），按 conversation_id 分组。
+	// 将每个会话原本的 1 次查询合并为 1 次 IN 查询，避免 N+1。
+	GetAllByConversationIDs(ctx context.Context, conversationIDs []uint) (map[uint][]*Message, error)
+}
+
+func NewMessageStore(db *gorm.DB) MessageStore {
+	return &messages{db}
+}
+
+type messages struct {
+	*gorm.DB
+}
+
+type Message struct {
+	dbutil.Model
+	ConversationID uint   `gorm:"index:idx_message_conversation" json:"conversation_id"`
+	SenderID       uint   `json:"sender_id"`
+	Content        string `gorm:"type:text" json:"content"`
+	Read           bool   `gorm:"default:false" json:"read"`
+}
+
+type CreateMessageOptions struct {
+	ConversationID uint
+	SenderID       uint
+	Content        string
+}
+
+func (db *messages) Create(ctx context.Context, opts CreateMessageOptions) (*Message, error) {
+	msg := &Message{
+		ConversationID: opts.ConversationID,
+		SenderID:       opts.SenderID,
+		Content:        opts.Content,
+	}
+	if err := db.WithContext(ctx).Create(msg).Error; err != nil {
+		return nil, errors.Wrap(err, "create message")
+	}
+	return msg, nil
+}
+
+func (db *messages) GetByConversationID(ctx context.Context, conversationID uint, cursor *dbutil.Cursor) ([]*Message, error) {
+	var messages []*Message
+	q := db.WithContext(ctx).Where("conversation_id = ?", conversationID)
+
+	limit := 50
+	if cursor != nil {
+		if cursor.Value != nil && fmt.Sprintf("%v", cursor.Value) != "" {
+			q = q.Where("id < ?", cursor.Value)
+		}
+		limit = cursor.Limit()
+	}
+
+	q = q.Order("created_at ASC")
+	q = q.Limit(limit)
+
+	if err := q.Find(&messages).Error; err != nil {
+		return nil, errors.Wrap(err, "get messages")
+	}
+	return messages, nil
+}
+
+// GetFirstMessagesByConversationIDs 批量获取多个会话的第一条消息内容。
+// 使用窗口函数 ROW_NUMBER() 选出每个会话最早的消息，避免 N+1 查询。
+func (db *messages) GetFirstMessagesByConversationIDs(ctx context.Context, conversationIDs []uint) (map[uint]string, error) {
+	if len(conversationIDs) == 0 {
+		return make(map[uint]string), nil
+	}
+
+	// 使用子查询 + ROW_NUMBER 窗口函数获取每个 conversation 的第一条消息
+	// 兼容 MySQL 8+ / PostgreSQL / SQLite 3.25+
+	var results []struct {
+		ConversationID uint   `gorm:"column:conversation_id"`
+		Content        string `gorm:"column:content"`
+	}
+
+	err := db.WithContext(ctx).Raw(`
+		SELECT conversation_id, content FROM (
+			SELECT conversation_id, content,
+				ROW_NUMBER() OVER (PARTITION BY conversation_id ORDER BY created_at ASC) AS rn
+			FROM messages
+			WHERE conversation_id IN ?
+		) sub WHERE rn = 1
+	`, conversationIDs).Scan(&results).Error
+
+	if err != nil {
+		return nil, errors.Wrap(err, "get first messages batch")
+	}
+
+	resultMap := make(map[uint]string, len(results))
+	for _, r := range results {
+		resultMap[r.ConversationID] = r.Content
+	}
+	return resultMap, nil
+}
+
+// GetAllByConversationIDs 批量获取多个会话的全部消息（导出用，不分页），按 conversation_id 分组。
+// 用于账号导出：将每个会话原本的 1 次查询合并为 1 次 IN 查询，避免 N+1。
+func (db *messages) GetAllByConversationIDs(ctx context.Context, conversationIDs []uint) (map[uint][]*Message, error) {
+	result := make(map[uint][]*Message)
+	if len(conversationIDs) == 0 {
+		return result, nil
+	}
+	var items []*Message
+	if err := db.WithContext(ctx).
+		Where("conversation_id IN ?", conversationIDs).
+		Order("conversation_id ASC, created_at ASC").
+		Find(&items).Error; err != nil {
+		return nil, errors.Wrap(err, "get messages by conversation ids")
+	}
+	for _, m := range items {
+		result[m.ConversationID] = append(result[m.ConversationID], m)
+	}
+	return result, nil
+}
diff --git a/internal/db/message_image.go b/internal/db/message_image.go
new file mode 100644
index 0000000..ab3e8bd
--- /dev/null
+++ b/internal/db/message_image.go
@@ -0,0 +1,63 @@
+package db
+
+import (
+	"context"
+
+	"github.com/pkg/errors"
+	"gorm.io/gorm"
+)
+
+var MessageImages MessageImageStore
+
+type MessageImageStore interface {
+	Create(ctx context.Context, opts CreateMessageImageOptions) (*MessageImage, error)
+	GetByMessageIDs(ctx context.Context, messageIDs []uint) (map[uint][]*MessageImage, error)
+}
+
+func NewMessageImageStore(db *gorm.DB) MessageImageStore {
+	return &messageImages{db}
+}
+
+type messageImages struct {
+	*gorm.DB
+}
+
+type MessageImage struct {
+	gorm.Model
+	MessageID uint   `gorm:"index" json:"message_id"`
+	URL       string `gorm:"size:500" json:"url"`
+	FileName  string `gorm:"size:200" json:"file_name"`
+	FileSize  int64  `json:"file_size"`
+}
+
+type CreateMessageImageOptions struct {
+	MessageID uint
+	URL       string
+	FileName  string
+	FileSize  int64
+}
+
+func (db *messageImages) Create(ctx context.Context, opts CreateMessageImageOptions) (*MessageImage, error) {
+	img := &MessageImage{
+		MessageID: opts.MessageID,
+		URL:       opts.URL,
+		FileName:  opts.FileName,
+		FileSize:  opts.FileSize,
+	}
+	if err := db.WithContext(ctx).Create(img).Error; err != nil {
+		return nil, errors.Wrap(err, "create message image")
+	}
+	return img, nil
+}
+
+func (db *messageImages) GetByMessageIDs(ctx context.Context, messageIDs []uint) (map[uint][]*MessageImage, error) {
+	var images []*MessageImage
+	if err := db.WithContext(ctx).Where("message_id IN ?", messageIDs).Find(&images).Error; err != nil {
+		return nil, errors.Wrap(err, "get message images")
+	}
+	result := make(map[uint][]*MessageImage)
+	for _, img := range images {
+		result[img.MessageID] = append(result[img.MessageID], img)
+	}
+	return result, nil
+}
\ No newline at end of file
diff --git a/internal/db/password.go b/internal/db/password.go
new file mode 100644
index 0000000..7f23a8c
--- /dev/null
+++ b/internal/db/password.go
@@ -0,0 +1,85 @@
+package db
+
+import (
+	"crypto/subtle"
+	"encoding/hex"
+	"strings"
+
+	"github.com/sirupsen/logrus"
+	"github.com/wuhan005/gadget"
+	"golang.org/x/crypto/bcrypt"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+)
+
+// bcryptCost is the cost parameter for bcrypt (10 is a good default, 12 for higher security).
+const bcryptCost = 10
+
+// bcryptMaxPasswordLen is the effective input length of bcrypt (72 bytes).
+// bcrypt 只使用前 72 字节；新版 x/crypto 对超长密码直接返回错误，
+// 这里统一截断到 72 字节（与 bcrypt 原生语义一致），避免走错误分支。
+const bcryptMaxPasswordLen = 72
+
+// encodePasswordBcrypt hashes a password with bcrypt.
+// 注意：失败时绝不能静默降级为 HMAC-SHA1 弱哈希（此前行为），
+// 返回空串会让该账号所有密码校验失败并留下错误日志，比弱哈希更安全。
+func encodePasswordBcrypt(password string) string {
+	if len(password) > bcryptMaxPasswordLen {
+		password = password[:bcryptMaxPasswordLen]
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcryptCost)
+	if err != nil {
+		// cost 为常量 10，正常不会到这里；防御性记录，不降级为弱哈希。
+		logrus.WithError(err).Error("bcrypt generate failed")
+		return ""
+	}
+	return string(hash)
+}
+
+// isBcryptHash checks if the given string is a bcrypt hash.
+func isBcryptHash(hash string) bool {
+	return strings.HasPrefix(hash, "$2a$") || strings.HasPrefix(hash, "$2b$") || strings.HasPrefix(hash, "$2y$")
+}
+
+// IsBcryptHash exported for use in other packages.
+func IsBcryptHash(hash string) bool {
+	return isBcryptHash(hash)
+}
+
+// authenticatePassword verifies a password against either bcrypt or legacy HMAC-SHA1 hash.
+// Returns (true, newHash) if the password matches. If the old HMAC-SHA1 format was used,
+// newHash contains the upgraded bcrypt hash — caller should persist it.
+func authenticatePassword(storedHash, password string) (bool, string) {
+	if storedHash == "" {
+		return false, ""
+	}
+
+	// Try bcrypt first (new format).
+	if isBcryptHash(storedHash) {
+		err := bcrypt.CompareHashAndPassword([]byte(storedHash), []byte(password))
+		return err == nil, ""
+	}
+
+	// Fall back to legacy HMAC-SHA1（常量时间比较，防时序侧信道）。
+	legacyHash := gadget.HmacSha1(password, conf.Server.Salt)
+	if subtle.ConstantTimeCompare([]byte(legacyHash), []byte(storedHash)) == 1 {
+		// Password matches legacy format — upgrade to bcrypt.
+		return true, encodePasswordBcrypt(password)
+	}
+
+	return false, ""
+}
+
+// needsRehash checks if a bcrypt hash should be rehashed (e.g., cost changed).
+func needsRehash(hash string) bool {
+	cost, err := bcrypt.Cost([]byte(hash))
+	if err != nil {
+		return true
+	}
+	return cost != bcryptCost
+}
+
+// HexEncodeToString is a helper to encode bytes as hex for legacy hash comparison.
+func HexEncodeToString(src []byte) string {
+	return hex.EncodeToString(src)
+}
diff --git a/internal/db/questions.go b/internal/db/questions.go
new file mode 100644
index 0000000..f02a255
--- /dev/null
+++ b/internal/db/questions.go
@@ -0,0 +1,546 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package db
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+	"github.com/thanhpk/randstr"
+	"gorm.io/datatypes"
+	"gorm.io/gorm"
+
+	"github.com/tamakyi/TamaBox/internal/dbutil"
+)
+
+var Questions QuestionsStore
+
+type QuestionsStore interface {
+	Create(ctx context.Context, opts CreateQuestionOptions) (*Question, error)
+	GetByID(ctx context.Context, id uint) (*Question, error)
+	GetByUserID(ctx context.Context, userID uint, opts GetQuestionsByUserIDOptions) ([]*Question, error)
+	GetByAskUserID(ctx context.Context, userID uint, opts GetQuestionsByAskUserIDOptions) ([]*Question, error)
+	AnswerByID(ctx context.Context, id uint, answer string) error
+	DeleteByID(ctx context.Context, id uint) error
+	UpdateCensor(ctx context.Context, id uint, opts UpdateQuestionCensorOptions) error
+	Count(ctx context.Context, userID uint, opts GetQuestionsCountOptions) (int64, error)
+	SetPrivate(ctx context.Context, id uint) error
+	SetPublic(ctx context.Context, id uint) error
+	SetPinned(ctx context.Context, id uint, pinned bool) error
+	SetRead(ctx context.Context, id uint) error
+	SetUnread(ctx context.Context, id uint) error
+	SearchByUserID(ctx context.Context, userID uint, keyword string) ([]*Question, error)
+	GetHotQuestions(ctx context.Context, limit int) ([]*Question, error)
+
+	// 全站统计
+	QuestionStats(ctx context.Context) (*QuestionStats, error)
+}
+
+// QuestionStats 全站提问聚合统计（不按单个用户过滤，供首页"提问箱信息统计"使用）。
+type QuestionStats struct {
+	TotalQuestions    int64
+	AnsweredQuestions int64
+	LastQuestionAt    *time.Time // 最后一个提问发生时间（questions.created_at 最大值）
+	LastAnswerAt      *time.Time // 最后一个回答发生时间（已回答问题的 updated_at 最大值）
+}
+
+func NewQuestionsStore(db *gorm.DB) QuestionsStore {
+	return &questions{db}
+}
+
+type questions struct {
+	*gorm.DB
+}
+
+type Question struct {
+	dbutil.Model
+	FromIP                string         `json:"-"`
+	UserID                uint           `gorm:"index:idx_question_user_id" json:"-"`
+	Content               string         `json:"content"`
+	ContentCensorMetadata datatypes.JSON `json:"-"`
+	Token                 string         `json:"-"`
+	Answer                string         `json:"answer"`
+	AnswerCensorMetadata  datatypes.JSON `json:"-"`
+	ReceiveReplyEmail     string         `json:"-"`
+	AskerUserID           uint           `json:"-"`
+	IsPrivate             bool           `gorm:"default: FALSE; NOT NULL" json:"-"`
+	IsPinned              bool           `gorm:"default: FALSE; NOT NULL" json:"is_pinned"`
+	// IsRead 标记箱主是否已读/处理过该提问。有效"已读" = IsRead=true 或 已有回答(answer != "")。
+	// 已回答的问题恒为已读且锁定，不可改回未读（见 SetUnread 的 answer='' 条件与上层校验）。
+	IsRead bool `gorm:"default: FALSE; NOT NULL" json:"is_read"`
+}
+
+type CreateQuestionOptions struct {
+	FromIP            string
+	UserID            uint
+	Content           string
+	ReceiveReplyEmail string
+	AskerUserID       uint
+	IsPrivate         bool
+}
+
+func (db *questions) Create(ctx context.Context, opts CreateQuestionOptions) (*Question, error) {
+	question := Question{
+		FromIP:            opts.FromIP,
+		UserID:            opts.UserID,
+		Token:             randstr.String(6),
+		Content:           opts.Content,
+		ReceiveReplyEmail: opts.ReceiveReplyEmail,
+		AskerUserID:       opts.AskerUserID,
+		IsPrivate:         opts.IsPrivate,
+	}
+	return &question, db.WithContext(ctx).Create(&question).Error
+}
+
+type UpdateQuestionCensorOptions struct {
+	ContentCensorMetadata json.RawMessage
+	AnswerCensorMetadata  json.RawMessage
+}
+
+func (db *questions) UpdateCensor(ctx context.Context, id uint, opts UpdateQuestionCensorOptions) error {
+	question, err := db.GetByID(ctx, id)
+	if err != nil {
+		return errors.Wrap(err, "get by ID")
+	}
+
+	contentCensorMetadata := question.ContentCensorMetadata
+	if checkTextCensorResponseValid(opts.ContentCensorMetadata) {
+		contentCensorMetadata = datatypes.JSON(opts.ContentCensorMetadata)
+	}
+	answerCensorMetadata := question.AnswerCensorMetadata
+	if checkTextCensorResponseValid(opts.AnswerCensorMetadata) {
+		answerCensorMetadata = datatypes.JSON(opts.AnswerCensorMetadata)
+	}
+
+	return db.WithContext(ctx).Model(&Question{}).Where("id = ?", id).Updates(&Question{
+		ContentCensorMetadata: contentCensorMetadata,
+		AnswerCensorMetadata:  answerCensorMetadata,
+	}).Error
+}
+
+func checkTextCensorResponseValid(raw json.RawMessage) bool {
+	if len(raw) == 0 {
+		return false
+	}
+
+	if bytes.EqualFold(raw, []byte("null")) {
+		return false
+	}
+
+	var response struct {
+		SourceName string `json:"source_name"`
+	}
+	if err := json.Unmarshal(raw, &response); err != nil {
+		return false
+	}
+	return response.SourceName != ""
+}
+
+var ErrQuestionNotExist = errors.New("提问不存在")
+
+func (db *questions) GetByID(ctx context.Context, id uint) (*Question, error) {
+	var question Question
+	if err := db.WithContext(ctx).First(&question, id).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, ErrQuestionNotExist
+		}
+		return nil, errors.Wrap(err, "get question by ID")
+	}
+	return &question, nil
+}
+
+type GetQuestionsByUserIDOptions struct {
+	*dbutil.Cursor
+	FilterAnswered bool   // 已废弃，推荐使用 AnsweredStatus
+	ShowPrivate    bool   // 已废弃，推荐使用 PrivateStatus
+	AnsweredStatus int    // 0: 全部, 1: 已回答, 2: 未回答
+	PrivateStatus  int    // 0: 全部, 1: 仅公开(is_private=false), 2: 仅私密(is_private=true)
+	ReadStatus     int    // 0: 全部, 1: 已读(is_read=true 或已回答), 2: 未读
+	SortOrder      string // "ASC" 或 "DESC"，默认 "DESC"
+	PinFirst       bool   // 置顶优先：is_pinned 的提问排在最前（公开主页使用）
+}
+
+// GetByUserID 根据用户 ID 获取提问列表，支持游标分页
+func (db *questions) GetByUserID(ctx context.Context, userID uint, opts GetQuestionsByUserIDOptions) ([]*Question, error) {
+	q := db.WithContext(ctx).Model(&Question{}).Where("user_id = ?", userID)
+
+	// 回答状态筛选
+	if opts.AnsweredStatus == 1 {
+		q = q.Where("answer != ''")
+	} else if opts.AnsweredStatus == 2 {
+		q = q.Where("answer = ''")
+	} else if opts.FilterAnswered {
+		// 兼容旧调用
+		q = q.Where("answer != ''")
+	}
+
+	// 私密状态筛选
+	if opts.PrivateStatus == 1 {
+		q = q.Where("is_private = false")
+	} else if opts.PrivateStatus == 2 {
+		q = q.Where("is_private = true")
+	} else if !opts.ShowPrivate && opts.PrivateStatus == 0 {
+		// 兼容旧调用：如果 ShowPrivate=false 且未指定 PrivateStatus，则过滤私密
+		q = q.Where("is_private = false")
+	}
+
+	// 阅读状态筛选：已读 = is_read=true 或已回答；未读 = is_read=false 且未回答。
+	// 使用括号包裹 OR 条件，避免与前面的 user_id 等条件产生 AND/OR 优先级问题。
+	if opts.ReadStatus == 1 {
+		q = q.Where("(is_read = ? OR answer != '')", true)
+	} else if opts.ReadStatus == 2 {
+		q = q.Where("(is_read = ? AND answer = '')", false)
+	}
+
+	// 排序方向先规范化，游标方向依赖它（ASC=下一页 id 更大，DESC=下一页 id 更小）。
+	sortOrder := opts.SortOrder
+	if sortOrder == "" {
+		sortOrder = "DESC"
+	}
+	if sortOrder != "ASC" && sortOrder != "DESC" {
+		sortOrder = "DESC"
+	}
+
+	// 游标分页
+	// 关键语义：携带游标却无法解析时，不再“忽略游标、从首页重新开始”。
+	// 旧行为会导致「加载更多」重复返回第一页内容、按钮永不消失（内容重复的
+	// 直接根因之一，见 history-template 的复合游标改造历史）。改为直接返回
+	// 空列表：上层（ListAPI/Pager 等）据此判定 has_more=false，前端按钮收敛。
+	if opts.Cursor != nil && opts.Cursor.Value != nil {
+		cursorStr := fmt.Sprintf("%v", opts.Cursor.Value)
+		if cursorStr != "" {
+			if opts.PinFirst {
+				// 置顶优先场景下，排序为 (is_pinned DESC, created_at, id)，
+				// 必须用"复合键集"（keyset）游标，否则置顶项与非置顶项 id 交错时
+				// 单纯 id < 游标会漏掉介于置顶项 id 之间、但排在更后面的非置顶项。
+				// 游标格式："<isPinned>.<createdAtUnixNano>.<id>"。
+				isPinned, createdAt, idVal, ok := parsePinCursor(cursorStr)
+				if !ok {
+					return []*Question{}, nil
+				}
+				// 排序为 (is_pinned DESC, created_at DESC, id DESC)，下一页 = 排序序位严格在游标之后的行。
+				// 注意：is_pinned 在 PG 下是 boolean，与整型比较（boolean < integer）无操作符会直接报错，
+				// 因此必须传 Go bool 而非 0/1 整型（MySQL 下 bool 亦兼容 tinyint）。
+				// 游标位于置顶段时，后续行 = 置顶段内 (created_at,id) 更小 + 全部非置顶段；
+				// 游标位于非置顶段时，后续行 = 非置顶段内 (created_at,id) 更小。
+				if isPinned == 1 {
+					q = q.Where(
+						"(is_pinned = ? AND created_at < ?) OR (is_pinned = ? AND created_at = ? AND id < ?) OR (is_pinned = ?)",
+						true, createdAt, true, createdAt, idVal, false,
+					)
+				} else {
+					q = q.Where(
+						"(is_pinned = ? AND created_at < ?) OR (is_pinned = ? AND created_at = ? AND id < ?)",
+						false, createdAt, false, createdAt, idVal,
+					)
+				}
+			} else {
+				// 游标必须为纯数字 id：直接传 string 在 PG 下会因 integer < text 无操作符而报错。
+				// 且 ASC（旧在前）时下一页 id 更大，DESC（新在前）时下一页 id 更小。
+				idVal, err := strconv.ParseUint(cursorStr, 10, 64)
+				if err != nil {
+					// 同上：游标非法不再回退首页，直接收敛为空列表。
+					return []*Question{}, nil
+				}
+				if sortOrder == "ASC" {
+					q = q.Where("id > ?", idVal)
+				} else {
+					q = q.Where("id < ?", idVal)
+				}
+			}
+		}
+	}
+	if opts.Cursor != nil {
+		limit := opts.Cursor.Limit()
+		q = q.Limit(limit)
+	}
+
+	if opts.PinFirst {
+		// 公开主页：置顶优先；用 id 作为稳定 tiebreaker 保证排序完全确定。
+		q = q.Order("is_pinned DESC, created_at " + sortOrder + ", id " + sortOrder)
+	} else {
+		q = q.Order("created_at " + sortOrder + ", id " + sortOrder)
+	}
+
+	var questions []*Question
+	if err := q.Find(&questions).Error; err != nil {
+		return nil, errors.Wrap(err, "get questions by user id")
+	}
+	return questions, nil
+}
+
+// parsePinCursor 解析 PinFirst 分页的复合键集游标，格式 "<isPinned>.<createdAtUnixNano>.<id>"。
+// 返回 (isPinned, createdAt, id, ok)；格式非法时 ok=false，调用方应忽略该游标（从首页重新开始）。
+//
+// 时区约定（务必保持，否则线上翻页会退化为首页死循环）：
+// EncodePinCursor 的 nano 取自 DB 读回的 CreatedAt.UnixNano()，生产列是
+// timestamp WITHOUT time zone，读写按「墙钟即 UTC」对称，因此 Parse 侧必须把 nano
+// 还原成 UTC 墙钟的 time.Time（time.Unix(0,nano).UTC()），再交给 GORM 与无时区列比较。
+// 若直接返回 time.Unix(0, nano)（Location=服务器本地时区），当进程 TZ 非 UTC 时
+// （如 Asia/Shanghai）墙钟会偏移 +8h，导致 keyset 条件 created_at < 偏移时间恒为真，
+// 游标形同虚设，每次请求都退回第一页 → 「加载更多」无限重复且按钮永不消失。
+func parsePinCursor(s string) (int, time.Time, uint, bool) {
+	parts := strings.Split(s, ".")
+	if len(parts) != 3 {
+		return 0, time.Time{}, 0, false
+	}
+	isPinned, err := strconv.Atoi(parts[0])
+	if err != nil {
+		return 0, time.Time{}, 0, false
+	}
+	nano, err := strconv.ParseInt(parts[1], 10, 64)
+	if err != nil {
+		return 0, time.Time{}, 0, false
+	}
+	idVal, err := strconv.ParseUint(parts[2], 10, 64)
+	if err != nil {
+		return 0, time.Time{}, 0, false
+	}
+	return isPinned, time.Unix(0, nano).UTC(), uint(idVal), true
+}
+
+// EncodePinCursor 生成 PinFirst 分页游标（供路由层把末条记录编码进下一页游标）。
+func EncodePinCursor(isPinned bool, createdAt time.Time, id uint) string {
+	v := 0
+	if isPinned {
+		v = 1
+	}
+	return fmt.Sprintf("%d.%d.%d", v, createdAt.UnixNano(), id)
+}
+
+type GetQuestionsByAskUserIDOptions struct {
+	*dbutil.Cursor
+	FilterAnswered bool
+	ShowPrivate    bool
+}
+
+func (db *questions) GetByAskUserID(ctx context.Context, userID uint, opts GetQuestionsByAskUserIDOptions) ([]*Question, error) {
+	where := `asker_user_id = ?`
+	args := userID
+
+	if opts.FilterAnswered {
+		where = `asker_user_id = ? AND answer != ''`
+	}
+	if !opts.ShowPrivate {
+		where += ` AND is_private = false`
+	}
+
+	questions, err := db.getBy(ctx, opts.Cursor, where, args)
+	if err != nil {
+		return nil, errors.Wrap(err, "get by")
+	}
+	return questions, nil
+}
+
+// getBy 保留用于 GetByAskUserID 等旧逻辑
+func (db *questions) getBy(ctx context.Context, cursor *dbutil.Cursor, whereQuery string, args ...interface{}) ([]*Question, error) {
+	var questions []*Question
+	q := db.WithContext(ctx).Where(whereQuery, args...)
+
+	if cursor != nil {
+		cursorID := cursor.Value
+		if cursorID != nil && fmt.Sprintf("%v", cursorID) != "" {
+			// 游标必须为纯数字 id：直接传 string 在 PG 下会因 integer < text 无操作符而报错。
+			// 解析失败不再忽略游标回退首页（会导致「加载更多」重复首页内容），
+			// 直接收敛为空列表，令调用方按“无更多”处理。
+			idVal, err := strconv.ParseUint(fmt.Sprintf("%v", cursorID), 10, 64)
+			if err != nil {
+				return []*Question{}, nil
+			}
+			if idVal > 0 {
+				q = q.Where(`id < ?`, idVal)
+			}
+		}
+		limit := cursor.Limit()
+		q = q.Limit(limit)
+	}
+
+	q = q.Order("created_at DESC")
+	if err := q.Find(&questions).Error; err != nil {
+		return nil, errors.Wrap(err, "get questions by page ID")
+	}
+	return questions, nil
+}
+
+func (db *questions) AnswerByID(ctx context.Context, id uint, answer string) error {
+	var question Question
+	if err := db.WithContext(ctx).First(&question, id).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return ErrQuestionNotExist
+		}
+		return errors.Wrap(err, "get question by ID")
+	}
+
+	if err := db.WithContext(ctx).Model(&question).Where("id = ?", id).
+		Updates(map[string]interface{}{"answer": answer, "is_read": true}).Error; err != nil {
+		return errors.Wrap(err, "update question answer")
+	}
+	return nil
+}
+
+func (db *questions) DeleteByID(ctx context.Context, id uint) error {
+	var question Question
+	if err := db.WithContext(ctx).First(&question, id).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return ErrQuestionNotExist
+		}
+		return errors.Wrap(err, "get question by ID")
+	}
+
+	if err := db.WithContext(ctx).Delete(&Question{}, id).Error; err != nil {
+		return errors.Wrap(err, "delete question")
+	}
+
+	// 级联清理子表：追问与上传图片，避免删除提问后残留孤儿记录。
+	if err := FollowUps.DeleteByQuestionID(ctx, id); err != nil {
+		logrus.WithContext(ctx).WithError(err).Errorf("Failed to cascade delete follow ups for question %d", id)
+	}
+	if err := UploadImages.DeleteByQuestionID(ctx, id); err != nil {
+		logrus.WithContext(ctx).WithError(err).Errorf("Failed to cascade delete upload images for question %d", id)
+	}
+
+	// 回退定量收集计数：删除提问等价于少一条已收集内容，
+	// 否则达上限后即便删掉旧提问，功能仍会显示 quota_reached 关闭，须手动重置计数。
+	if question.UserID != 0 {
+		if err := FeatureControls.IncrementQuota(ctx, question.UserID, FeatureQuestion, -1); err != nil {
+			logrus.WithContext(ctx).WithError(err).Errorf("Failed to decrement question quota for user %d", question.UserID)
+		}
+	}
+	return nil
+}
+
+type GetQuestionsCountOptions struct {
+	FilterAnswered bool
+	ShowPrivate    bool
+	IsPrivate      *bool // 非 nil 时按该值过滤 is_private
+	IsPinned       *bool // 非 nil 时按该值过滤 is_pinned
+	ReadStatus     int   // 0: 全部, 1: 已读(is_read=true 或已回答), 2: 未读
+}
+
+func (db *questions) Count(ctx context.Context, userID uint, opts GetQuestionsCountOptions) (int64, error) {
+	q := db.WithContext(ctx).Model(&Question{})
+	if opts.FilterAnswered {
+		q = q.Where(`user_id = ? AND answer != ''`, userID)
+	} else {
+		q = q.Where(`user_id = ?`, userID)
+	}
+	if !opts.ShowPrivate {
+		q = q.Where(`is_private = ?`, false)
+	}
+	if opts.IsPrivate != nil {
+		q = q.Where(`is_private = ?`, *opts.IsPrivate)
+	}
+	if opts.IsPinned != nil {
+		q = q.Where(`is_pinned = ?`, *opts.IsPinned)
+	}
+	// 阅读状态筛选：已读 = is_read=true 或已回答；未读 = is_read=false 且未回答。
+	if opts.ReadStatus == 1 {
+		q = q.Where("(is_read = ? OR answer != '')", true)
+	} else if opts.ReadStatus == 2 {
+		q = q.Where("(is_read = ? AND answer = '')", false)
+	}
+
+	var count int64
+	return count, q.Count(&count).Error
+}
+
+func (db *questions) SetPrivate(ctx context.Context, id uint) error {
+	return db.WithContext(ctx).Model(&Question{}).Where("id = ?", id).Update("is_private", true).Error
+}
+
+// SetPinned 设置/取消问题的置顶状态。
+func (db *questions) SetPinned(ctx context.Context, id uint, pinned bool) error {
+	return db.WithContext(ctx).Model(&Question{}).Where("id = ?", id).Update("is_pinned", pinned).Error
+}
+
+func (db *questions) SetPublic(ctx context.Context, id uint) error {
+	return db.WithContext(ctx).Model(&Question{}).Where("id = ?", id).Update("is_private", false).Error
+}
+
+// SetRead 标记提问为已读（箱主侧手动标记，或作为其他语义化操作的前置状态）。
+func (db *questions) SetRead(ctx context.Context, id uint) error {
+	return db.WithContext(ctx).Model(&Question{}).Where("id = ?", id).Update("is_read", true).Error
+}
+
+// SetUnread 标记提问为未读。已回答的提问恒为已读且锁定，故追加 answer=” 条件：
+// 即使上层遗漏校验，也不会把已回答的提问错误地改回未读（纵深防御）。
+func (db *questions) SetUnread(ctx context.Context, id uint) error {
+	return db.WithContext(ctx).Model(&Question{}).Where("id = ? AND answer = ''", id).Update("is_read", false).Error
+}
+
+// SearchByUserID 全文搜索提问箱主人收到的提问（含私密，仅限本人管理后台使用）。
+// 使用 LIKE 模糊匹配问题内容与回答；keyword 中的通配符 % _ \ 会被转义，避免模式滥用。
+func (db *questions) SearchByUserID(ctx context.Context, userID uint, keyword string) ([]*Question, error) {
+	escaped := escapeLike(keyword)
+	var questions []*Question
+	if err := db.WithContext(ctx).
+		Where("user_id = ? AND (content LIKE ? OR answer LIKE ?)", userID, "%"+escaped+"%", "%"+escaped+"%").
+		Order("created_at DESC").
+		Find(&questions).Error; err != nil {
+		return nil, errors.Wrap(err, "search questions by user id")
+	}
+	return questions, nil
+}
+
+// escapeLike 转义 LIKE 模式中的特殊字符。
+func escapeLike(s string) string {
+	r := strings.NewReplacer(`\`, `\\`, `%`, `\%`, `_`, `\_`)
+	return r.Replace(s)
+}
+
+// GetHotQuestions 返回"热门问题"：最新活跃的公开已回答提问（按回答更新时间倒序）。
+// 提问箱没有点赞数据，用"最近被回答"作为热度近似，适合主页/探索页展示。
+func (db *questions) GetHotQuestions(ctx context.Context, limit int) ([]*Question, error) {
+	if limit <= 0 {
+		limit = 10
+	}
+	var questions []*Question
+	if err := db.WithContext(ctx).
+		Where("is_private = ? AND answer != ''", false).
+		Order("updated_at DESC").
+		Limit(limit).
+		Find(&questions).Error; err != nil {
+		return nil, errors.Wrap(err, "get hot questions")
+	}
+	return questions, nil
+}
+
+// QuestionStats 返回全站提问相关聚合统计。
+// 使用 gorm 查询构造器生成 COUNT / MAX，兼容 MySQL 与 PostgreSQL。
+// 最后一个回答时间取"已回答问题"的 updated_at 最大值——回答动作会更新 updated_at，
+// 与 crontab 旧逻辑（answer 非空记录中 updated_at 最大）一致。
+func (db *questions) QuestionStats(ctx context.Context) (*QuestionStats, error) {
+	var total, answered int64
+	if err := db.WithContext(ctx).Model(&Question{}).Count(&total).Error; err != nil {
+		return nil, errors.Wrap(err, "count questions")
+	}
+	if err := db.WithContext(ctx).Model(&Question{}).Where("answer != ''").Count(&answered).Error; err != nil {
+		return nil, errors.Wrap(err, "count answered questions")
+	}
+
+	var t struct {
+		LastQ *time.Time `gorm:"column:last_q"`
+		LastA *time.Time `gorm:"column:last_a"`
+	}
+	if err := db.WithContext(ctx).Model(&Question{}).
+		Select("MAX(created_at) AS last_q, MAX(CASE WHEN answer != '' THEN updated_at ELSE NULL END) AS last_a").
+		Scan(&t).Error; err != nil {
+		return nil, errors.Wrap(err, "get last question/answer time")
+	}
+
+	return &QuestionStats{
+		TotalQuestions:    total,
+		AnsweredQuestions: answered,
+		LastQuestionAt:    t.LastQ,
+		LastAnswerAt:      t.LastA,
+	}, nil
+}
diff --git a/internal/db/questions_test.go b/internal/db/questions_test.go
new file mode 100644
index 0000000..779d7e6
--- /dev/null
+++ b/internal/db/questions_test.go
@@ -0,0 +1,467 @@
+// Copyright 2023 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package db
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/tamakyi/TamaBox/internal/dbutil"
+)
+
+func TestQuestions(t *testing.T) {
+	t.Parallel()
+
+	db, cleanup := newTestDB(t)
+	ctx := context.Background()
+
+	questionsStore := NewQuestionsStore(db)
+
+	for _, tc := range []struct {
+		name string
+		test func(t *testing.T, ctx context.Context, db *questions)
+	}{
+		{"Create", testQuestionsCreate},
+		{"GetByID", testQuestionsGetByID},
+		{"GetByUserID", testQuestionsGetByUserID},
+		{"GetByAskUserID", testQuestionsGetByAskUserID},
+		{"AnswerByID", testQuestionsAnswerByID},
+		{"DeleteByID", testQuestionsDeleteByID},
+		{"UpdateCensor", testQuestionsUpdateCensor},
+		{"Count", testQuestionsCount},
+		{"SetPrivate", testQuestionsSetPrivate},
+		{"SetPublic", testQuestionsSetPublic},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Cleanup(func() {
+				if err := cleanup("questions"); err != nil {
+					t.Fatal(err)
+				}
+			})
+			tc.test(t, ctx, questionsStore.(*questions))
+		})
+	}
+}
+
+func testQuestionsCreate(t *testing.T, ctx context.Context, db *questions) {
+	t.Run("normal", func(t *testing.T) {
+		got, err := db.Create(ctx, CreateQuestionOptions{
+			FromIP:            "114.5.1.4",
+			UserID:            1,
+			Content:           "Hello, world!",
+			ReceiveReplyEmail: "i@github.red",
+			AskerUserID:       0,
+		})
+		require.Nil(t, err)
+
+		got.Token = ""
+		got.CreatedAt = time.Time{}
+		got.UpdatedAt = time.Time{}
+
+		want := &Question{
+			Model: dbutil.Model{
+				ID: 1,
+			},
+			FromIP:            "114.5.1.4",
+			UserID:            1,
+			Content:           "Hello, world!",
+			ReceiveReplyEmail: "i@github.red",
+		}
+		require.Equal(t, got, want)
+	})
+}
+
+func testQuestionsGetByID(t *testing.T, ctx context.Context, db *questions) {
+	_, err := db.Create(ctx, CreateQuestionOptions{
+		FromIP:            "114.5.1.4",
+		UserID:            1,
+		Content:           "Hello, world!",
+		ReceiveReplyEmail: "i@github.red",
+		AskerUserID:       0,
+	})
+	require.Nil(t, err)
+
+	t.Run("normal", func(t *testing.T) {
+		got, err := db.GetByID(ctx, 1)
+		require.Nil(t, err)
+
+		got.Token = ""
+		got.CreatedAt = time.Time{}
+		got.UpdatedAt = time.Time{}
+
+		want := &Question{
+			Model: dbutil.Model{
+				ID: 1,
+			},
+			FromIP:            "114.5.1.4",
+			UserID:            1,
+			Content:           "Hello, world!",
+			ReceiveReplyEmail: "i@github.red",
+		}
+		require.Equal(t, got, want)
+	})
+
+	t.Run("not found", func(t *testing.T) {
+		_, err := db.GetByID(ctx, 404)
+		require.Equal(t, ErrQuestionNotExist, err)
+	})
+}
+
+func testQuestionsGetByUserID(t *testing.T, ctx context.Context, db *questions) {
+	_, err := db.Create(ctx, CreateQuestionOptions{
+		FromIP:            "114.5.1.4",
+		UserID:            1,
+		Content:           "Content - 1",
+		ReceiveReplyEmail: "i@github.red",
+		AskerUserID:       0,
+	})
+	require.Nil(t, err)
+
+	_, err = db.Create(ctx, CreateQuestionOptions{
+		FromIP:            "114.5.1.4",
+		UserID:            2,
+		Content:           "Content - 2",
+		ReceiveReplyEmail: "i@github.red",
+		AskerUserID:       0,
+	})
+	require.Nil(t, err)
+
+	_, err = db.Create(ctx, CreateQuestionOptions{
+		FromIP:            "114.5.1.4",
+		UserID:            1,
+		Content:           "Content - 3",
+		ReceiveReplyEmail: "i@github.red",
+		AskerUserID:       0,
+	})
+	require.Nil(t, err)
+
+	t.Run("all", func(t *testing.T) {
+		got, err := db.GetByUserID(ctx, 1, GetQuestionsByUserIDOptions{})
+		require.Nil(t, err)
+
+		for _, g := range got {
+			g.Token = ""
+			g.CreatedAt = time.Time{}
+			g.UpdatedAt = time.Time{}
+		}
+
+		want := []*Question{
+			{
+				Model: dbutil.Model{
+					ID: 3,
+				},
+				FromIP:            "114.5.1.4",
+				UserID:            1,
+				Content:           "Content - 3",
+				ReceiveReplyEmail: "i@github.red",
+			},
+			{
+				Model: dbutil.Model{
+					ID: 1,
+				},
+				FromIP:            "114.5.1.4",
+				UserID:            1,
+				Content:           "Content - 1",
+				ReceiveReplyEmail: "i@github.red",
+			},
+		}
+		require.Equal(t, want, got)
+	})
+
+	t.Run("cursor", func(t *testing.T) {
+		got, err := db.GetByUserID(ctx, 1, GetQuestionsByUserIDOptions{
+			Cursor: &dbutil.Cursor{
+				Value:    3,
+				PageSize: 10,
+			},
+		})
+		require.Nil(t, err)
+
+		for _, g := range got {
+			g.Token = ""
+			g.CreatedAt = time.Time{}
+			g.UpdatedAt = time.Time{}
+		}
+
+		want := []*Question{
+			{
+				Model: dbutil.Model{
+					ID: 1,
+				},
+				FromIP:            "114.5.1.4",
+				UserID:            1,
+				Content:           "Content - 1",
+				ReceiveReplyEmail: "i@github.red",
+			},
+		}
+		require.Equal(t, want, got)
+	})
+
+	t.Run("not found", func(t *testing.T) {
+		_, err := db.GetByID(ctx, 404)
+		require.Equal(t, ErrQuestionNotExist, err)
+	})
+}
+
+func testQuestionsGetByAskUserID(t *testing.T, ctx context.Context, db *questions) {
+	_, err := db.Create(ctx, CreateQuestionOptions{
+		FromIP:            "114.5.1.4",
+		UserID:            1,
+		Content:           "Content - 1",
+		ReceiveReplyEmail: "i@github.red",
+		AskerUserID:       1,
+	})
+	require.Nil(t, err)
+
+	_, err = db.Create(ctx, CreateQuestionOptions{
+		FromIP:            "114.5.1.4",
+		UserID:            2,
+		Content:           "Content - 2",
+		ReceiveReplyEmail: "i@github.red",
+		AskerUserID:       2,
+	})
+	require.Nil(t, err)
+
+	_, err = db.Create(ctx, CreateQuestionOptions{
+		FromIP:            "114.5.1.4",
+		UserID:            2,
+		Content:           "Content - 2",
+		ReceiveReplyEmail: "i@github.red",
+		AskerUserID:       2,
+	})
+	require.Nil(t, err)
+
+	t.Run("all", func(t *testing.T) {
+		got, err := db.GetByAskUserID(ctx, 1, GetQuestionsByAskUserIDOptions{})
+		require.Nil(t, err)
+
+		for _, g := range got {
+			g.Token = ""
+			g.CreatedAt = time.Time{}
+			g.UpdatedAt = time.Time{}
+		}
+
+		want := []*Question{
+			{
+				Model: dbutil.Model{
+					ID: 1,
+				},
+				FromIP:            "114.5.1.4",
+				UserID:            1,
+				Content:           "Content - 1",
+				ReceiveReplyEmail: "i@github.red",
+				AskerUserID:       1,
+			},
+		}
+		require.Equal(t, want, got)
+	})
+
+	t.Run("cursor", func(t *testing.T) {
+		got, err := db.GetByAskUserID(ctx, 2, GetQuestionsByAskUserIDOptions{
+			Cursor: &dbutil.Cursor{
+				Value:    3,
+				PageSize: 10,
+			},
+		})
+		require.Nil(t, err)
+
+		for _, g := range got {
+			g.Token = ""
+			g.CreatedAt = time.Time{}
+			g.UpdatedAt = time.Time{}
+		}
+
+		want := []*Question{
+			{
+				Model: dbutil.Model{
+					ID: 2,
+				},
+				FromIP:            "114.5.1.4",
+				UserID:            2,
+				Content:           "Content - 2",
+				ReceiveReplyEmail: "i@github.red",
+				AskerUserID:       2,
+			},
+		}
+		require.Equal(t, want, got)
+	})
+
+	t.Run("not found", func(t *testing.T) {
+		_, err := db.GetByID(ctx, 404)
+		require.Equal(t, ErrQuestionNotExist, err)
+	})
+}
+
+func testQuestionsAnswerByID(t *testing.T, ctx context.Context, db *questions) {
+	t.Run("normal", func(t *testing.T) {
+		_, err := db.Create(ctx, CreateQuestionOptions{
+			FromIP:            "114.5.1.4",
+			UserID:            1,
+			Content:           "Content - 1",
+			ReceiveReplyEmail: "i@github.red",
+			AskerUserID:       1,
+		})
+		require.Nil(t, err)
+
+		err = db.AnswerByID(ctx, 1, "Answer - 1")
+		require.Nil(t, err)
+
+		got, err := db.GetByID(ctx, 1)
+		require.Nil(t, err)
+		require.Equal(t, "Answer - 1", got.Answer)
+	})
+
+	t.Run("not found", func(t *testing.T) {
+		err := db.AnswerByID(ctx, 404, "Answer - 1")
+		require.Equal(t, ErrQuestionNotExist, err)
+	})
+}
+
+func testQuestionsDeleteByID(t *testing.T, ctx context.Context, db *questions) {
+	t.Run("normal", func(t *testing.T) {
+		_, err := db.Create(ctx, CreateQuestionOptions{
+			FromIP:            "114.5.1.4",
+			UserID:            1,
+			Content:           "Content - 1",
+			ReceiveReplyEmail: "i@github.red",
+			AskerUserID:       1,
+		})
+		require.Nil(t, err)
+
+		err = db.DeleteByID(ctx, 1)
+		require.Nil(t, err)
+
+		_, err = db.GetByID(ctx, 1)
+		require.Equal(t, ErrQuestionNotExist, err)
+	})
+
+	t.Run("not found", func(t *testing.T) {
+		err := db.DeleteByID(ctx, 404)
+		require.Equal(t, ErrQuestionNotExist, err)
+	})
+}
+
+func testQuestionsUpdateCensor(t *testing.T, ctx context.Context, db *questions) {
+	t.Run("normal", func(t *testing.T) {
+		_, err := db.Create(ctx, CreateQuestionOptions{
+			FromIP:            "114.5.1.4",
+			UserID:            1,
+			Content:           "Content - 1",
+			ReceiveReplyEmail: "i@github.red",
+			AskerUserID:       1,
+		})
+		require.Nil(t, err)
+
+		err = db.DeleteByID(ctx, 1)
+		require.Nil(t, err)
+
+		_, err = db.GetByID(ctx, 1)
+		require.Equal(t, ErrQuestionNotExist, err)
+	})
+
+	t.Run("not found", func(t *testing.T) {
+		err := db.UpdateCensor(ctx, 404, UpdateQuestionCensorOptions{})
+		require.NotNil(t, err)
+	})
+}
+
+func testQuestionsCount(t *testing.T, ctx context.Context, db *questions) {
+	_, err := db.Create(ctx, CreateQuestionOptions{
+		FromIP:            "114.5.1.4",
+		UserID:            1,
+		Content:           "Content - 1",
+		ReceiveReplyEmail: "i@github.red",
+		AskerUserID:       1,
+	})
+	require.Nil(t, err)
+
+	_, err = db.Create(ctx, CreateQuestionOptions{
+		FromIP:            "114.5.1.4",
+		UserID:            2,
+		Content:           "Content - 2",
+		ReceiveReplyEmail: "i@github.red",
+		AskerUserID:       0,
+	})
+	require.Nil(t, err)
+
+	_, err = db.Create(ctx, CreateQuestionOptions{
+		FromIP:            "114.5.1.4",
+		UserID:            1,
+		Content:           "Content - 3",
+		ReceiveReplyEmail: "i@github.red",
+		AskerUserID:       0,
+	})
+	require.Nil(t, err)
+
+	err = db.AnswerByID(ctx, 3, "Answer - 3")
+	require.Nil(t, err)
+
+	t.Run("normal", func(t *testing.T) {
+		got, err := db.Count(ctx, 1, GetQuestionsCountOptions{})
+		require.Nil(t, err)
+
+		want := int64(2)
+		require.Equal(t, want, got)
+	})
+
+	t.Run("filter", func(t *testing.T) {
+		got, err := db.Count(ctx, 1, GetQuestionsCountOptions{FilterAnswered: true})
+		require.Nil(t, err)
+
+		want := int64(1)
+		require.Equal(t, want, got)
+	})
+
+	t.Run("not found", func(t *testing.T) {
+		got, err := db.Count(ctx, 404, GetQuestionsCountOptions{})
+		require.Nil(t, err)
+
+		want := int64(0)
+		require.Equal(t, want, got)
+	})
+}
+
+func testQuestionsSetPrivate(t *testing.T, ctx context.Context, db *questions) {
+	_, err := db.Create(ctx, CreateQuestionOptions{
+		FromIP:            "114.5.1.4",
+		UserID:            1,
+		Content:           "Content - 1",
+		ReceiveReplyEmail: "i@github.red",
+		AskerUserID:       1,
+	})
+	require.Nil(t, err)
+
+	t.Run("normal", func(t *testing.T) {
+		err = db.SetPrivate(ctx, 1)
+		require.Nil(t, err)
+
+		got, err := db.GetByID(ctx, 1)
+		require.Nil(t, err)
+		require.True(t, got.IsPrivate)
+	})
+}
+
+func testQuestionsSetPublic(t *testing.T, ctx context.Context, db *questions) {
+	_, err := db.Create(ctx, CreateQuestionOptions{
+		FromIP:            "114.5.1.4",
+		UserID:            1,
+		Content:           "Content - 1",
+		ReceiveReplyEmail: "i@github.red",
+		AskerUserID:       1,
+	})
+	require.Nil(t, err)
+
+	t.Run("normal", func(t *testing.T) {
+		err = db.SetPublic(ctx, 1)
+		require.Nil(t, err)
+
+		got, err := db.GetByID(ctx, 1)
+		require.Nil(t, err)
+		require.False(t, got.IsPrivate)
+	})
+}
diff --git a/internal/db/upload_images.go b/internal/db/upload_images.go
new file mode 100644
index 0000000..22f44d1
--- /dev/null
+++ b/internal/db/upload_images.go
@@ -0,0 +1,190 @@
+// Copyright 2023 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package db
+
+import (
+	"context"
+
+	"github.com/pkg/errors"
+	"github.com/samber/lo"
+	"gorm.io/gorm"
+)
+
+var UploadImages UploadImagesStore
+
+var _ UploadImagesStore = (*uploadImages)(nil)
+
+type UploadImagesStore interface {
+	Create(ctx context.Context, opts CreateUploadImageOptions) (*UploadImage, error)
+	GetByQuestionID(ctx context.Context, questionID uint) ([]*UploadImage, error)
+	// GetByQuestionIDs 批量获取多个提问的图片，按 question_id 分组返回。
+	// 用于账号导出等场景，将 N 次单题查询合并为少量 IN 查询，避免 N+1。
+	GetByQuestionIDs(ctx context.Context, questionIDs []uint) (map[uint][]*UploadImage, error)
+	GetByTypeQuestionID(ctx context.Context, typ UploadImageQuestionType, questionID uint) ([]*UploadImage, error)
+	// DeleteByQuestionID 删除某条提问时级联清理其全部上传图片记录（软删除，与提问保持一致）。
+	DeleteByQuestionID(ctx context.Context, questionID uint) error
+}
+
+func NewUploadImagesStore(db *gorm.DB) UploadImagesStore {
+	return &uploadImages{db}
+}
+
+type uploadImages struct {
+	*gorm.DB
+}
+
+type UploadImage struct {
+	gorm.Model
+	UploaderUserID uint
+	Name           string
+	FileSize       int64
+	Md5            string
+	Key            string
+}
+
+type UploadImageQuestionType string
+
+const (
+	UploadImageQuestionTypeAsk    UploadImageQuestionType = "ask"
+	UploadImageQuestionTypeAnswer UploadImageQuestionType = "answer"
+)
+
+type UploadImageQuestion struct {
+	Type          UploadImageQuestionType
+	UploadImageID uint `gorm:"primaryKey"`
+	QuestionID    uint `gorm:"primaryKey"`
+}
+
+type CreateUploadImageOptions struct {
+	Type               UploadImageQuestionType
+	QuestionID         uint
+	UploaderUserID     uint
+	Name               string
+	FileSize           int64
+	Md5                string
+	Key                string
+	IsDeletingPrevious bool
+}
+
+func (db *uploadImages) Create(ctx context.Context, opts CreateUploadImageOptions) (*UploadImage, error) {
+	image := &UploadImage{
+		UploaderUserID: opts.UploaderUserID,
+		Name:           opts.Name,
+		FileSize:       opts.FileSize,
+		Md5:            opts.Md5,
+		Key:            opts.Key,
+	}
+	if err := db.Transaction(func(tx *gorm.DB) error {
+		if err := tx.WithContext(ctx).Create(image).Error; err != nil {
+			return errors.Wrap(err, "create image")
+		}
+
+		if opts.IsDeletingPrevious {
+			if err := tx.WithContext(ctx).Where("type = ? AND question_id = ?", opts.Type, opts.QuestionID).Delete(&UploadImageQuestion{}).Error; err != nil {
+				return errors.Wrap(err, "delete previous image question link")
+			}
+		}
+		if err := tx.WithContext(ctx).Create(&UploadImageQuestion{
+			Type:          opts.Type,
+			UploadImageID: image.ID,
+			QuestionID:    opts.QuestionID,
+		}).Error; err != nil {
+			return errors.Wrap(err, "create image question link")
+		}
+		return nil
+	}); err != nil {
+		return nil, err
+	}
+
+	return image, nil
+}
+
+func (db *uploadImages) getBy(ctx context.Context, where string, args ...interface{}) ([]*UploadImage, error) {
+	var uploadImageQuestions []*UploadImageQuestion
+	if err := db.WithContext(ctx).Model(&UploadImageQuestion{}).Where(where, args...).Find(&uploadImageQuestions).Error; err != nil {
+		return nil, errors.Wrap(err, "get image questions")
+	}
+
+	uploadImageIDs := lo.Map(uploadImageQuestions, func(item *UploadImageQuestion, _ int) uint {
+		return item.UploadImageID
+	})
+
+	var uploadImages []*UploadImage
+	if err := db.WithContext(ctx).Model(&UploadImage{}).Where("id IN ?", uploadImageIDs).Order("id ASC").Find(&uploadImages).Error; err != nil {
+		return nil, errors.Wrap(err, "get images")
+	}
+	return uploadImages, nil
+}
+
+func (db *uploadImages) GetByQuestionID(ctx context.Context, questionID uint) ([]*UploadImage, error) {
+	return db.getBy(ctx, "question_id = ?", questionID)
+}
+
+// GetByQuestionIDs 批量获取多个提问的图片，按 question_id 分组返回（解决导出 N+1）。
+// 实现：先按 IN 批量取关联行，再按 IN 批量取图片主体，最后在内存中按 question_id 归组，
+// 将每个提问原本的 2 次查询降为整体 2 次查询。
+func (db *uploadImages) GetByQuestionIDs(ctx context.Context, questionIDs []uint) (map[uint][]*UploadImage, error) {
+	result := make(map[uint][]*UploadImage)
+	if len(questionIDs) == 0 {
+		return result, nil
+	}
+
+	var links []*UploadImageQuestion
+	if err := db.WithContext(ctx).Model(&UploadImageQuestion{}).Where("question_id IN ?", questionIDs).Find(&links).Error; err != nil {
+		return nil, errors.Wrap(err, "get image questions batch")
+	}
+	if len(links) == 0 {
+		return result, nil
+	}
+
+	imageIDs := lo.Map(links, func(item *UploadImageQuestion, _ int) uint {
+		return item.UploadImageID
+	})
+	var images []*UploadImage
+	if err := db.WithContext(ctx).Model(&UploadImage{}).Where("id IN ?", imageIDs).Order("id ASC").Find(&images).Error; err != nil {
+		return nil, errors.Wrap(err, "get images batch")
+	}
+	imageByID := lo.SliceToMap(images, func(img *UploadImage) (uint, *UploadImage) {
+		return img.ID, img
+	})
+
+	for _, link := range links {
+		if img, ok := imageByID[link.UploadImageID]; ok {
+			result[link.QuestionID] = append(result[link.QuestionID], img)
+		}
+	}
+	return result, nil
+}
+
+func (db *uploadImages) GetByTypeQuestionID(ctx context.Context, typ UploadImageQuestionType, questionID uint) ([]*UploadImage, error) {
+	return db.getBy(ctx, "type = ? AND question_id = ?", typ, questionID)
+}
+
+// DeleteByQuestionID 删除某条提问时级联清理其全部上传图片记录（软删除，与提问保持一致）。
+// 注意：question_id 列在关联表 upload_image_questions 上，不在 upload_images 表上，
+// 需先查关联行拿到 imageID 列表，再软删图片主体并删除关联行（同一事务内完成）。
+// 注：仅清理数据库记录，对象存储中的实际文件不在此处删除（避免误删复用资源）。
+func (db *uploadImages) DeleteByQuestionID(ctx context.Context, questionID uint) error {
+	return db.Transaction(func(tx *gorm.DB) error {
+		var links []*UploadImageQuestion
+		if err := tx.WithContext(ctx).Where("question_id = ?", questionID).Find(&links).Error; err != nil {
+			return errors.Wrap(err, "get image questions for delete")
+		}
+		if len(links) == 0 {
+			return nil
+		}
+
+		imageIDs := lo.Map(links, func(item *UploadImageQuestion, _ int) uint {
+			return item.UploadImageID
+		})
+		if err := tx.WithContext(ctx).Where("id IN ?", imageIDs).Delete(&UploadImage{}).Error; err != nil {
+			return errors.Wrap(err, "delete upload images by question id")
+		}
+		if err := tx.WithContext(ctx).Where("question_id = ?", questionID).Delete(&UploadImageQuestion{}).Error; err != nil {
+			return errors.Wrap(err, "delete image question links")
+		}
+		return nil
+	})
+}
diff --git a/internal/db/upload_images_test.go b/internal/db/upload_images_test.go
new file mode 100644
index 0000000..9e783fe
--- /dev/null
+++ b/internal/db/upload_images_test.go
@@ -0,0 +1,133 @@
+// Copyright 2023 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package db
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestUploadImages(t *testing.T) {
+	t.Parallel()
+
+	db, cleanup := newTestDB(t)
+	ctx := context.Background()
+
+	uploadImagesStore := NewUploadImagesStore(db)
+
+	for _, tc := range []struct {
+		name string
+		test func(t *testing.T, ctx context.Context, db *uploadImages)
+	}{
+		{"Create", testUploadImagesCreate},
+		{"GetByQuestionID", testUploadImagesGetByQuestionID},
+		{"GetByTypeQuestionID", testUploadImagesGetByTypeQuestionID},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Cleanup(func() {
+				if err := cleanup("upload_images"); err != nil {
+					t.Fatal(err)
+				}
+			})
+			tc.test(t, ctx, uploadImagesStore.(*uploadImages))
+		})
+	}
+}
+
+func testUploadImagesCreate(t *testing.T, ctx context.Context, db *uploadImages) {
+	got, err := db.Create(ctx, CreateUploadImageOptions{
+		Type:               UploadImageQuestionTypeAsk,
+		QuestionID:         1,
+		UploaderUserID:     1,
+		Name:               "test.png",
+		FileSize:           12345,
+		Md5:                "d41d8cd98f00b204e9800998ecf8427e",
+		Key:                "uploads/test.png",
+		IsDeletingPrevious: false,
+	})
+	require.Nil(t, err)
+
+	want := &UploadImage{
+		Model:          got.Model,
+		UploaderUserID: 1,
+		Name:           "test.png",
+		FileSize:       12345,
+		Md5:            "d41d8cd98f00b204e9800998ecf8427e",
+		Key:            "uploads/test.png",
+	}
+	require.Equal(t, want, got)
+}
+
+func testUploadImagesGetByQuestionID(t *testing.T, ctx context.Context, db *uploadImages) {
+	_, err := db.Create(ctx, CreateUploadImageOptions{
+		Type:               UploadImageQuestionTypeAsk,
+		QuestionID:         1,
+		UploaderUserID:     1,
+		Name:               "test.png",
+		FileSize:           12345,
+		Md5:                "d41d8cd98f00b204e9800998ecf8427e",
+		Key:                "uploads/test.png",
+		IsDeletingPrevious: false,
+	})
+	require.Nil(t, err)
+
+	t.Run("normal", func(t *testing.T) {
+		got, err := db.GetByQuestionID(ctx, 1)
+		require.Nil(t, err)
+
+		want := []*UploadImage{{
+			Model:          got[0].Model,
+			UploaderUserID: 1,
+			Name:           "test.png",
+			FileSize:       12345,
+			Md5:            "d41d8cd98f00b204e9800998ecf8427e",
+			Key:            "uploads/test.png",
+		}}
+		require.Equal(t, got, want)
+	})
+
+	t.Run("not found", func(t *testing.T) {
+		got, err := db.GetByQuestionID(ctx, 2)
+		require.Nil(t, err)
+		require.Equal(t, 0, len(got))
+	})
+}
+
+func testUploadImagesGetByTypeQuestionID(t *testing.T, ctx context.Context, db *uploadImages) {
+	_, err := db.Create(ctx, CreateUploadImageOptions{
+		Type:               UploadImageQuestionTypeAsk,
+		QuestionID:         1,
+		UploaderUserID:     1,
+		Name:               "test.png",
+		FileSize:           12345,
+		Md5:                "d41d8cd98f00b204e9800998ecf8427e",
+		Key:                "uploads/test.png",
+		IsDeletingPrevious: false,
+	})
+	require.Nil(t, err)
+
+	t.Run("normal", func(t *testing.T) {
+		got, err := db.GetByTypeQuestionID(ctx, UploadImageQuestionTypeAsk, 1)
+		require.Nil(t, err)
+
+		want := []*UploadImage{{
+			Model:          got[0].Model,
+			UploaderUserID: 1,
+			Name:           "test.png",
+			FileSize:       12345,
+			Md5:            "d41d8cd98f00b204e9800998ecf8427e",
+			Key:            "uploads/test.png",
+		}}
+		require.Equal(t, got, want)
+	})
+
+	t.Run("not found", func(t *testing.T) {
+		got, err := db.GetByTypeQuestionID(ctx, UploadImageQuestionTypeAsk, 2)
+		require.Nil(t, err)
+		require.Equal(t, 0, len(got))
+	})
+}
diff --git a/internal/db/user_block.go b/internal/db/user_block.go
new file mode 100644
index 0000000..64b3a53
--- /dev/null
+++ b/internal/db/user_block.go
@@ -0,0 +1,21 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package db
+
+import "time"
+
+// UserBlock 记录用户拉黑关系（UserID 拉黑了 BlockedID）。
+// 使用独立关联表而非在 users 上存 JSON，以获得：
+//   - (user_id, blocked_id) 唯一索引保证幂等，并发拉黑不会互相覆盖；
+//   - 判断是否拉黑走索引查询，无需反序列化整串 JSON。
+//
+// 注意：本表采用物理删除（取消拉黑即删行），不使用 gorm.DeletedAt 软删除，
+// 否则「拉黑 → 取消 → 再拉黑」会因软删记录仍占用唯一索引而插入冲突。
+type UserBlock struct {
+	ID        uint      `gorm:"primarykey"`
+	UserID    uint      `gorm:"not null;uniqueIndex:idx_user_block_unique"`
+	BlockedID uint      `gorm:"not null;uniqueIndex:idx_user_block_unique"`
+	CreatedAt time.Time `json:"-"`
+}
diff --git a/internal/db/users.go b/internal/db/users.go
new file mode 100644
index 0000000..b8297a4
--- /dev/null
+++ b/internal/db/users.go
@@ -0,0 +1,921 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+// Modify by tamakyi
+
+package db
+
+import (
+	"context"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/rs/xid"
+	"github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+)
+
+var Users UsersStore
+
+var _ UsersStore = (*users)(nil)
+
+type UsersStore interface {
+	Create(ctx context.Context, opts CreateUserOptions) error
+	GetByID(ctx context.Context, id uint) (*User, error)
+	GetByEmail(ctx context.Context, email string) (*User, error)
+	GetByDomain(ctx context.Context, domain string) (*User, error)
+	GetByIDs(ctx context.Context, ids []uint) ([]*User, error)
+	Update(ctx context.Context, id uint, opts UpdateUserOptions) error
+	// 防骚扰设置拆分为两个独立更新：仅允许注册用户（harassment_setting 列）与
+	// 全局屏蔽词（block_words 列）。两者设置入口现已分处不同面板（屏蔽词在
+	// 提问/私聊/投票三个面板共用一份），必须分开写，避免单侧保存误清空另一侧。
+	UpdateHarassmentType(ctx context.Context, id uint, typ HarassmentSettingType) error
+	UpdateBlockWords(ctx context.Context, id uint, words string) error
+	Authenticate(ctx context.Context, email, password string) (*User, error)
+	ChangePassword(ctx context.Context, id uint, oldPassword, newPassword string) error
+	UpdatePassword(ctx context.Context, id uint, newPassword string) error
+	Deactivate(ctx context.Context, id uint) error
+	GetShowInHome(ctx context.Context, page, pageSize int, sort string) ([]*User, int64, error)
+	GetByTag(ctx context.Context, tag string, page, pageSize int, sort string) ([]*User, int64, error)
+	UpdateTags(ctx context.Context, id uint, opts UpdateTagsOptions) error
+	GetRandom(ctx context.Context, limit int) ([]*User, error)
+	GetRandomFresh(ctx context.Context, limit int) ([]*User, error)
+	GetHotTags(ctx context.Context, limit int) ([]string, error)
+
+	// 全站统计
+	CountAll(ctx context.Context) (int64, error)
+
+	UpdatePagePassword(ctx context.Context, id uint, password string) error
+	UpdateAskPassword(ctx context.Context, id uint, password string) error
+	// 私聊设置
+	UpdateChatSettings(ctx context.Context, id uint, allowChat bool, maxMessages int) error
+	// UpdateAllowChat 仅同步私聊开关（功能管理页统一开关时调用，不影响条数上限）
+	UpdateAllowChat(ctx context.Context, id uint, allowChat bool) error
+
+	// 拉黑相关
+	BlockUser(ctx context.Context, userID, blockedUserID uint) error
+	UnblockUser(ctx context.Context, userID, blockedUserID uint) error
+	IsUserBlocked(ctx context.Context, userID, targetID uint) (bool, error)
+	BlockedByUser(ctx context.Context, userID uint, targetIDs []uint) (map[uint]bool, error)
+	BlockedByAnyOf(ctx context.Context, blockerIDs []uint, targetID uint) (map[uint]bool, error)
+	// 每日限制相关
+	CountTodayMessagesFromUser(ctx context.Context, ownerID, askerID uint) (int64, error)
+	UpdateDailyMessageLimit(ctx context.Context, id uint, limit int) error
+	BanUserAndCleanup(ctx context.Context, userID uint) error
+}
+
+func NewUsersStore(db *gorm.DB) UsersStore {
+	return &users{db}
+}
+
+type users struct {
+	*gorm.DB
+}
+
+type User struct {
+	gorm.Model           `json:"-"`
+	UID                  string                `json:"-"`
+	Name                 string                `json:"name"`
+	Password             string                `json:"-"`
+	Email                string                `json:"email" gorm:"uniqueIndex:idx_users_email_unique"`
+	Avatar               string                `json:"avatar"`
+	Domain               string                `json:"domain" gorm:"uniqueIndex:idx_users_domain_unique"`
+	Background           string                `json:"background"`
+	Intro                string                `json:"intro"`
+	Introcolor           string                `json:"introcolor"`
+	Usernamecolor        string                `json:"usernamecolor"`
+	Qrcodebackcolor      string                `json:"qrcodebackcolor"`
+	Qrcodecolor          string                `json:"qrcodecolor"`
+	BackgroundImage      string                `json:"backgroundimage"`
+	Dotscale             string                `json:"dotscale"`
+	Acfunlink            string                `json:"acfunlink"`
+	Bililink             string                `json:"bililink"`
+	Weibolink            string                `json:"weibolink"`
+	Bloglink             string                `json:"bloglink"`
+	Xiaohongshulink      string                `json:"xiaohongshulink"`
+	Qrcodepdpcolor       string                `json:"qrcodepdpcolor"`
+	Backgroundimagealpha string                `json:"Backgroundimagealpha"`
+	Notify               NotifyType            `json:"notify"`
+	HarassmentSetting    HarassmentSettingType `json:"harassment_setting"`
+	BlockWords           string                `json:"-"`
+	Tags                 string                `json:"tags" gorm:"type:text"`
+	ShowInHome           bool                  `json:"show_in_home" gorm:"default:false;index"`
+	UseCustomQRColor     bool                  `json:"use_custom_qr_color" gorm:"default:false"`
+
+	PagePassword string `json:"-" gorm:"column:page_password;type:varchar(255);default:''"`
+	AskPassword  string `json:"-" gorm:"column:ask_password;type:varchar(255);default:''"`
+
+	// 私聊相关
+	AllowChat bool `json:"allow_chat" gorm:"default:false"`
+	// 每个私聊会话的消息条数上限（用户自设）。default:20 仅是 DB 层兜底；
+	// 应用层创建用户时按 conf.Limits.ChatMaxMessages（[limits] 段）显式写入默认值，
+	// 新用户默认即系统硬顶，而非固定 20。
+	ChatMaxMessages int `json:"chat_max_messages" gorm:"default:20"`
+
+	// 每日私信条数上限
+	DailyMessageLimit int `gorm:"default:0" json:"daily_message_limit"`
+
+	// 界面语言（提问箱页面与后台页面展示语言，取值见 internal/i18n）
+	Language string `gorm:"type:varchar(16);default:''" json:"language"`
+
+	// PasswordVersion 用于在密码变更后使旧会话失效（会话中保存登录时的版本号）。
+	PasswordVersion uint `gorm:"default:0" json:"-"`
+}
+
+func (u *User) BeforeCreate(_ *gorm.DB) error {
+	u.UID = xid.New().String()
+	return nil
+}
+
+type NotifyType string
+
+const (
+	NotifyTypeEmail NotifyType = "email"
+	NotifyTypeNone  NotifyType = "none"
+)
+
+type HarassmentSettingType string
+
+const (
+	HarassmentSettingNone             HarassmentSettingType = "none"
+	HarassmentSettingTypeRegisterOnly HarassmentSettingType = "register_only"
+)
+
+func (u *User) EncodePassword() {
+	u.Password = encodePasswordBcrypt(u.Password)
+}
+
+func (u *User) Authenticate(password string) bool {
+	ok, _ := authenticatePassword(u.Password, password)
+	return ok
+}
+
+func (u *User) SetPagePassword(password string) {
+	if password == "" {
+		u.PagePassword = ""
+	} else {
+		u.PagePassword = encodePasswordBcrypt(password)
+	}
+}
+
+func (u *User) CheckPagePassword(password string) bool {
+	ok, _ := authenticatePassword(u.PagePassword, password)
+	return ok
+}
+
+func (u *User) SetAskPassword(password string) {
+	if password == "" {
+		u.AskPassword = ""
+	} else {
+		u.AskPassword = encodePasswordBcrypt(password)
+	}
+}
+
+func (u *User) CheckAskPassword(password string) bool {
+	ok, _ := authenticatePassword(u.AskPassword, password)
+	return ok
+}
+
+type CreateUserOptions struct {
+	Name                 string
+	Password             string
+	Email                string
+	Avatar               string
+	Domain               string
+	Background           string
+	Intro                string
+	Dotscale             string
+	Qrcodebackcolor      string
+	Qrcodecolor          string
+	Qrcodepdpcolor       string
+	BackgroundImage      string
+	Backgroundimagealpha string
+	Usernamecolor        string
+	Introcolor           string
+	Acfunlink            string
+	Bililink             string
+	Weibolink            string
+	Xiaohongshulink      string
+	Bloglink             string
+	Tags                 string
+	ShowInHome           bool
+	Language             string // 界面语言（i18n 规范代码，如 zh-CN / zh-TW / en / ja）
+}
+
+var (
+	ErrUserNotExists   = errors.New("账号不存在")
+	ErrBadCredential   = errors.New("邮箱或密码错误")
+	ErrDuplicateEmail  = errors.New("这个邮箱已经注册过账号了！")
+	ErrDuplicateDomain = errors.New("个性域名重复了，换一个吧~")
+)
+
+func (db *users) Create(ctx context.Context, opts CreateUserOptions) error {
+	if err := db.validate(ctx, opts); err != nil {
+		return err
+	}
+
+	newUser := &User{
+		Name:                 opts.Name,
+		Password:             opts.Password,
+		Email:                opts.Email,
+		Avatar:               opts.Avatar,
+		Domain:               opts.Domain,
+		Background:           opts.Background,
+		Intro:                opts.Intro,
+		Qrcodebackcolor:      opts.Qrcodebackcolor,
+		Qrcodecolor:          opts.Qrcodecolor,
+		Dotscale:             opts.Dotscale,
+		BackgroundImage:      opts.BackgroundImage,
+		Backgroundimagealpha: opts.Backgroundimagealpha,
+		Qrcodepdpcolor:       opts.Qrcodepdpcolor,
+		Notify:               NotifyTypeEmail,
+		Usernamecolor:        opts.Usernamecolor,
+		Introcolor:           opts.Introcolor,
+		Acfunlink:            opts.Acfunlink,
+		Bililink:             opts.Bililink,
+		Weibolink:            opts.Weibolink,
+		Xiaohongshulink:      opts.Xiaohongshulink,
+		Bloglink:             opts.Bloglink,
+		Tags:                 opts.Tags,
+		ShowInHome:           opts.ShowInHome,
+		Language:             opts.Language,
+		// 私聊会话条数上限：新用户默认取系统硬顶（conf.Limits.ChatMaxMessages，
+		// [limits] 配置段），用户可在 1..硬顶 之间下调。不要回退到 gorm default:20。
+		ChatMaxMessages: conf.Limits.ChatMaxMessages,
+	}
+	newUser.EncodePassword()
+
+	if err := db.WithContext(ctx).Create(newUser).Error; err != nil {
+		// 并发同值双过（TOCTOU）：唯一索引兜底会返回重复键错误。
+		// 此时重新执行校验，给出与主动校验一致的友好错误，而非暴露底层数据库错误。
+		if verr := db.validate(ctx, opts); verr != nil {
+			return verr
+		}
+		return errors.Wrap(err, "create user")
+	}
+	return nil
+}
+
+func (db *users) getBy(ctx context.Context, where string, args ...interface{}) (*User, error) {
+	var user User
+	if err := db.WithContext(ctx).Where(where, args...).First(&user).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, ErrUserNotExists
+		}
+		return nil, errors.Wrap(err, "get user")
+	}
+	return &user, nil
+}
+
+func (db *users) GetByID(ctx context.Context, id uint) (*User, error) {
+	return db.getBy(ctx, "id = ?", id)
+}
+
+func (db *users) GetByEmail(ctx context.Context, email string) (*User, error) {
+	return db.getBy(ctx, "email = ?", email)
+}
+
+func (db *users) GetByDomain(ctx context.Context, domain string) (*User, error) {
+	return db.getBy(ctx, "domain = ?", domain)
+}
+
+// GetByIDs 批量按 ID 查询用户，返回顺序与数据库返回一致（不保证与入参顺序一致），
+// 用于批量关联查询，避免循环 GetByID 造成 N+1。
+func (db *users) GetByIDs(ctx context.Context, ids []uint) ([]*User, error) {
+	if len(ids) == 0 {
+		return []*User{}, nil
+	}
+	var users []*User
+	if err := db.WithContext(ctx).Where("id IN ?", ids).Find(&users).Error; err != nil {
+		return nil, errors.Wrap(err, "get users by ids")
+	}
+	return users, nil
+}
+
+type UpdateUserOptions struct {
+	Name                 string
+	Avatar               string
+	Background           string
+	Intro                string
+	Qrcodebackcolor      string
+	Qrcodecolor          string
+	Dotscale             string
+	BackgroundImage      string
+	Backgroundimagealpha string
+	Qrcodepdpcolor       string
+	Usernamecolor        string
+	Introcolor           string
+	Acfunlink            string
+	Bililink             string
+	Weibolink            string
+	Xiaohongshulink      string
+	Bloglink             string
+	UseCustomQRColor     bool
+	Notify               NotifyType
+	Language             string
+}
+
+func (db *users) Update(ctx context.Context, id uint, opts UpdateUserOptions) error {
+	_, err := db.GetByID(ctx, id)
+	if err != nil {
+		return errors.Wrap(err, "get user by id")
+	}
+
+	switch opts.Notify {
+	case NotifyTypeEmail, NotifyTypeNone:
+	default:
+		return errors.Errorf("unexpected notify type: %q", opts.Notify)
+	}
+
+	updates := map[string]interface{}{
+		"Name":                 opts.Name,
+		"Avatar":               opts.Avatar,
+		"Background":           opts.Background,
+		"Intro":                opts.Intro,
+		"Qrcodebackcolor":      opts.Qrcodebackcolor,
+		"Qrcodecolor":          opts.Qrcodecolor,
+		"Dotscale":             opts.Dotscale,
+		"BackgroundImage":      opts.BackgroundImage,
+		"Backgroundimagealpha": opts.Backgroundimagealpha,
+		"Qrcodepdpcolor":       opts.Qrcodepdpcolor,
+		"Usernamecolor":        opts.Usernamecolor,
+		"Introcolor":           opts.Introcolor,
+		"Acfunlink":            opts.Acfunlink,
+		"Bililink":             opts.Bililink,
+		"Weibolink":            opts.Weibolink,
+		"Xiaohongshulink":      opts.Xiaohongshulink,
+		"Bloglink":             opts.Bloglink,
+		"UseCustomQRColor":     opts.UseCustomQRColor,
+		"Notify":               opts.Notify,
+		"Language":             opts.Language,
+	}
+
+	if err := db.WithContext(ctx).Model(&User{}).Where("id = ?", id).Updates(updates).Error; err != nil {
+		return errors.Wrap(err, "update user")
+	}
+	return nil
+}
+
+// UpdateHarassmentType 仅更新骚扰防护类型（none / register_only）。
+// 只写 harassment_setting 列，不动 block_words，避免与全局屏蔽词的独立保存互相覆盖。
+func (db *users) UpdateHarassmentType(ctx context.Context, id uint, typ HarassmentSettingType) error {
+	switch typ {
+	case HarassmentSettingNone, HarassmentSettingTypeRegisterOnly:
+	default:
+		return errors.Errorf("unexpected harassment setting type: %q", typ)
+	}
+
+	if err := db.WithContext(ctx).Model(&User{}).Where("id = ?", id).Updates(map[string]interface{}{
+		"HarassmentSetting": typ,
+	}).Error; err != nil {
+		return errors.Wrap(err, "update user")
+	}
+	return nil
+}
+
+// UpdateBlockWords 仅更新全局屏蔽词表（逗号分隔，保存前已去重/去空白/限额）。
+// 只写 block_words 列，不动 harassment_setting。
+func (db *users) UpdateBlockWords(ctx context.Context, id uint, words string) error {
+	if err := db.WithContext(ctx).Model(&User{}).Where("id = ?", id).Updates(map[string]interface{}{
+		"BlockWords": words,
+	}).Error; err != nil {
+		return errors.Wrap(err, "update user")
+	}
+	return nil
+}
+
+func (db *users) Authenticate(ctx context.Context, email, password string) (*User, error) {
+	u, err := db.GetByEmail(ctx, email)
+	if err != nil {
+		return nil, ErrBadCredential
+	}
+
+	ok, newHash := authenticatePassword(u.Password, password)
+	if !ok {
+		return nil, ErrBadCredential
+	}
+
+	// 透明升级：如果密码是旧的 HMAC-SHA1 格式，自动升级为 bcrypt。
+	if newHash != "" {
+		if err := db.WithContext(ctx).Model(&User{}).Where("id = ?", u.ID).Update("password", newHash).Error; err != nil {
+			logrus.WithContext(ctx).WithError(err).Warn("Failed to auto-upgrade password to bcrypt")
+		} else {
+			u.Password = newHash
+		}
+	}
+
+	return u, nil
+}
+
+func (db *users) ChangePassword(ctx context.Context, id uint, oldPassword, newPassword string) error {
+	u, err := db.GetByID(ctx, id)
+	if err != nil {
+		return errors.Wrap(err, "get user by id")
+	}
+
+	ok, upgradeHash := authenticatePassword(u.Password, oldPassword)
+	if !ok {
+		return ErrBadCredential
+	}
+
+	// 如果旧密码触发升级，先升级
+	if upgradeHash != "" {
+		u.Password = upgradeHash
+	}
+
+	u.Password = newPassword
+	u.EncodePassword()
+
+	if err := db.WithContext(ctx).Model(&User{}).Where("id = ?", u.ID).Updates(map[string]interface{}{
+		"password":         u.Password,
+		"password_version": gorm.Expr("password_version + 1"),
+	}).Error; err != nil {
+		return errors.Wrap(err, "change password")
+	}
+	return nil
+}
+
+func (db *users) UpdatePassword(ctx context.Context, id uint, newPassword string) error {
+	u, err := db.GetByID(ctx, id)
+	if err != nil {
+		return errors.Wrap(err, "get user by id")
+	}
+
+	u.Password = newPassword
+	u.EncodePassword()
+
+	if err := db.WithContext(ctx).Model(&User{}).Where("id = ?", u.ID).Updates(map[string]interface{}{
+		"password":         u.Password,
+		"password_version": gorm.Expr("password_version + 1"),
+	}).Error; err != nil {
+		return errors.Wrap(err, "change password")
+	}
+	return nil
+}
+
+func (db *users) Deactivate(ctx context.Context, id uint) error {
+	u, err := db.GetByID(ctx, id)
+	if err != nil {
+		return errors.Wrap(err, "get user by id")
+	}
+
+	if err := db.WithContext(ctx).Model(&User{}).Delete("id = ?", u.ID).Error; err != nil {
+		return errors.Wrap(err, "delete user")
+	}
+	return nil
+}
+
+func (db *users) validate(ctx context.Context, opts CreateUserOptions) error {
+	if err := db.WithContext(ctx).Model(&User{}).Where("email = ?", opts.Email).First(&User{}).Error; err != nil {
+		if err != gorm.ErrRecordNotFound {
+			return errors.Wrap(err, "validate email")
+		}
+	} else {
+		return ErrDuplicateEmail
+	}
+
+	if err := db.WithContext(ctx).Model(&User{}).Where("domain = ?", opts.Domain).First(&User{}).Error; err != nil {
+		if err != gorm.ErrRecordNotFound {
+			return errors.Wrap(err, "validate name")
+		}
+	} else {
+		return ErrDuplicateDomain
+	}
+
+	return nil
+}
+
+type UpdateTagsOptions struct {
+	Tags       string
+	ShowInHome bool
+}
+
+func (db *users) UpdateTags(ctx context.Context, id uint, opts UpdateTagsOptions) error {
+	if err := db.WithContext(ctx).Model(&User{}).Where("id = ?", id).Updates(map[string]interface{}{
+		"Tags":       opts.Tags,
+		"ShowInHome": opts.ShowInHome,
+	}).Error; err != nil {
+		return errors.Wrap(err, "update user tags")
+	}
+	return nil
+}
+
+func (db *users) GetShowInHome(ctx context.Context, page, pageSize int, sort string) ([]*User, int64, error) {
+	var users []*User
+	var count int64
+
+	if err := db.WithContext(ctx).Model(&User{}).Where("show_in_home = ?", true).Count(&count).Error; err != nil {
+		return nil, 0, errors.Wrap(err, "count show in home users")
+	}
+
+	query := db.WithContext(ctx).Where("show_in_home = ?", true)
+	switch sort {
+	case "oldest":
+		query = query.Order("created_at asc")
+	default:
+		query = query.Order("created_at desc")
+	}
+
+	offset := (page - 1) * pageSize
+	if err := query.Offset(offset).Limit(pageSize).Find(&users).Error; err != nil {
+		return nil, 0, errors.Wrap(err, "get show in home users")
+	}
+	return users, count, nil
+}
+
+func (db *users) GetByTag(ctx context.Context, tag string, page, pageSize int, sort string) ([]*User, int64, error) {
+	var users []*User
+	var count int64
+
+	// tags 以逗号分隔存储；按数据库类型使用不同的标签匹配语法：
+	// PostgreSQL: string_to_array + ANY；MySQL/SQLite: FIND_IN_SET
+	var tagCond string
+	if conf.Database.Type == "postgres" {
+		tagCond = "? = ANY(string_to_array(tags, ','))"
+	} else {
+		tagCond = "FIND_IN_SET(?, tags)"
+	}
+	baseQuery := db.WithContext(ctx).Model(&User{}).Where("show_in_home = ? AND tags IS NOT NULL AND "+tagCond, true, tag)
+	if err := baseQuery.Count(&count).Error; err != nil {
+		return nil, 0, errors.Wrap(err, "count users by tag")
+	}
+
+	query := baseQuery
+	switch sort {
+	case "oldest":
+		query = query.Order("created_at asc")
+	default:
+		query = query.Order("created_at desc")
+	}
+
+	offset := (page - 1) * pageSize
+	if err := query.Offset(offset).Limit(pageSize).Find(&users).Error; err != nil {
+		return nil, 0, errors.Wrap(err, "get users by tag")
+	}
+	return users, count, nil
+}
+
+// 随机推荐列表缓存：ORDER BY RANDOM() 在大表上会全表扫描+排序，
+// explore 页面高频调用，用 30 秒短缓存吸收并发，成本是列表最多滞后 30 秒。
+// 缓存池大小 24（4 倍展示数），初始页面取前 6 个，
+// "换一批"用 GetRandomFresh 绕过缓存，确保每次返回不同结果。
+var (
+	randomUsersCacheMu   sync.Mutex
+	randomUsersCache     []*User
+	randomUsersCacheTime time.Time
+)
+
+const (
+	randomUsersCacheTTL = 30 * time.Second
+	randomCachePoolSize = 24
+)
+
+// GetRandom 获取随机用户（带缓存）。缓存池大小 24，返回前 limit 个。
+// 返回的是切片副本，调用方修改返回值不会污染缓存。
+func (db *users) GetRandom(ctx context.Context, limit int) ([]*User, error) {
+	randomUsersCacheMu.Lock()
+	if randomUsersCache != nil && time.Since(randomUsersCacheTime) < randomUsersCacheTTL {
+		cached := copyUsers(randomUsersCache)
+		randomUsersCacheMu.Unlock()
+		if limit < len(cached) {
+			cached = cached[:limit]
+		}
+		return cached, nil
+	}
+	randomUsersCacheMu.Unlock()
+
+	// 缓存未命中，查询一个较大的池以覆盖后续请求
+	users, err := db.getRandomUsers(ctx, randomCachePoolSize)
+	if err != nil {
+		return nil, err
+	}
+
+	// 更新缓存（缓存持有的是 DB 查询结果，与返回给调用方的副本分离）
+	randomUsersCacheMu.Lock()
+	randomUsersCache = users
+	randomUsersCacheTime = time.Now()
+	randomUsersCacheMu.Unlock()
+
+	copied := copyUsers(users)
+	if limit < len(copied) {
+		copied = copied[:limit]
+	}
+	return copied, nil
+}
+
+// copyUsers 深拷贝 User 切片，避免调用方修改（如给 User 字段赋值）污染缓存。
+func copyUsers(src []*User) []*User {
+	dst := make([]*User, len(src))
+	for i, u := range src {
+		if u == nil {
+			continue
+		}
+		cp := *u
+		dst[i] = &cp
+	}
+	return dst
+}
+
+// GetRandomFresh 获取随机用户（绕过缓存），用于"换一批"按钮。
+func (db *users) GetRandomFresh(ctx context.Context, limit int) ([]*User, error) {
+	return db.getRandomUsers(ctx, limit)
+}
+
+func (db *users) getRandomUsers(ctx context.Context, limit int) ([]*User, error) {
+	var users []*User
+	randomFunc := "RAND()" // MySQL / SQLite 默认
+	if conf.Database.Type == "postgres" {
+		randomFunc = "RANDOM()"
+	}
+	if err := db.WithContext(ctx).
+		Where("show_in_home = ?", true).
+		Order(randomFunc).
+		Limit(limit).
+		Find(&users).Error; err != nil {
+		return nil, errors.Wrap(err, "get random users")
+	}
+	return users, nil
+}
+
+// 热标签缓存：GetHotTags 每次 explore 都全表 Pluck tags 再内存聚合，
+// 标签变化不频繁，用 60 秒进程内缓存吸收重复计算，避免每次翻页都触发全表扫描。
+var (
+	hotTagsCacheMu   sync.Mutex
+	hotTagsCache     []string
+	hotTagsCacheTime time.Time
+)
+
+const hotTagsCacheTTL = 60 * time.Second
+
+// CountAll 返回全站注册用户总数（首页统计用，不按单个用户过滤）。
+func (db *users) CountAll(ctx context.Context) (int64, error) {
+	var count int64
+	if err := db.WithContext(ctx).Model(&User{}).Count(&count).Error; err != nil {
+		return 0, errors.Wrap(err, "count all users")
+	}
+	return count, nil
+}
+
+// GetHotTags 统计所有展示在首页的用户标签，返回出现次数最多的前 limit 个标签。
+// 标签存于 users.tags（逗号分隔），此处取出后在内存中聚合统计，结果带短缓存。
+func (db *users) GetHotTags(ctx context.Context, limit int) ([]string, error) {
+	if limit <= 0 {
+		limit = 10
+	}
+
+	hotTagsCacheMu.Lock()
+	if hotTagsCache != nil && time.Since(hotTagsCacheTime) < hotTagsCacheTTL {
+		cached := append([]string(nil), hotTagsCache...)
+		hotTagsCacheMu.Unlock()
+		if limit < len(cached) {
+			cached = cached[:limit]
+		}
+		return cached, nil
+	}
+	hotTagsCacheMu.Unlock()
+
+	var tagsList []string
+	if err := db.WithContext(ctx).
+		Model(&User{}).
+		Where("show_in_home = ? AND tags IS NOT NULL AND tags != ''", true).
+		Pluck("tags", &tagsList).Error; err != nil {
+		return nil, errors.Wrap(err, "get user tags for hot tags")
+	}
+
+	counts := make(map[string]int)
+	for _, tags := range tagsList {
+		for _, tag := range strings.Split(tags, ",") {
+			tag = strings.TrimSpace(tag)
+			if tag == "" {
+				continue
+			}
+			counts[tag]++
+		}
+	}
+
+	// 按出现次数降序
+	hot := make([]string, 0, len(counts))
+	for tag := range counts {
+		hot = append(hot, tag)
+	}
+	sort.Slice(hot, func(i, j int) bool {
+		if counts[hot[i]] == counts[hot[j]] {
+			return hot[i] < hot[j]
+		}
+		return counts[hot[i]] > counts[hot[j]]
+	})
+
+	// 缓存完整排序结果（不按 limit 截断），供不同 limit 的调用方复用。
+	hotTagsCacheMu.Lock()
+	hotTagsCache = append([]string(nil), hot...)
+	hotTagsCacheTime = time.Now()
+	hotTagsCacheMu.Unlock()
+
+	if len(hot) > limit {
+		hot = hot[:limit]
+	}
+	return hot, nil
+}
+
+func (db *users) UpdatePagePassword(ctx context.Context, id uint, password string) error {
+	user, err := db.GetByID(ctx, id)
+	if err != nil {
+		return err
+	}
+	user.SetPagePassword(password)
+	return db.WithContext(ctx).Model(user).Update("page_password", user.PagePassword).Error
+}
+
+func (db *users) UpdateAskPassword(ctx context.Context, id uint, password string) error {
+	user, err := db.GetByID(ctx, id)
+	if err != nil {
+		return err
+	}
+	user.SetAskPassword(password)
+	return db.WithContext(ctx).Model(user).Update("ask_password", user.AskPassword).Error
+}
+
+// 新增私聊设置
+func (db *users) UpdateChatSettings(ctx context.Context, id uint, allowChat bool, maxMessages int) error {
+	return db.WithContext(ctx).Model(&User{}).Where("id = ?", id).Updates(map[string]interface{}{
+		"allow_chat":        allowChat,
+		"chat_max_messages": maxMessages,
+	}).Error
+}
+
+// UpdateAllowChat 仅更新 users.allow_chat，用于与 feature_controls 的私聊开关保持同步
+// （users.allow_chat 仍被邮件/导出等既有逻辑读取，保留双向一致）。
+func (db *users) UpdateAllowChat(ctx context.Context, id uint, allowChat bool) error {
+	return db.WithContext(ctx).Model(&User{}).Where("id = ?", id).
+		Update("allow_chat", allowChat).Error
+}
+
+// ---------- 拉黑与每日限制 ----------
+
+// BlockUser 拉黑用户。使用 (user_id, blocked_id) 唯一索引 + INSERT ... ON CONFLICT DO NOTHING，
+// 幂等且并发安全（重复/并发拉黑不会互相覆盖丢失）。
+func (db *users) BlockUser(ctx context.Context, userID, blockedUserID uint) error {
+	if userID == blockedUserID {
+		return errors.New("cannot block self")
+	}
+	block := &UserBlock{UserID: userID, BlockedID: blockedUserID}
+	if err := db.WithContext(ctx).
+		Clauses(clause.OnConflict{DoNothing: true}).
+		Create(block).Error; err != nil {
+		return errors.Wrap(err, "block user")
+	}
+	return nil
+}
+
+// UnblockUser 取消拉黑（物理删除关联行）。
+func (db *users) UnblockUser(ctx context.Context, userID, blockedUserID uint) error {
+	if err := db.WithContext(ctx).
+		Where("user_id = ? AND blocked_id = ?", userID, blockedUserID).
+		Delete(&UserBlock{}).Error; err != nil {
+		return errors.Wrap(err, "unblock user")
+	}
+	return nil
+}
+
+// IsUserBlocked 检查 userID 是否拉黑了 targetID（走唯一索引查询）。
+func (db *users) IsUserBlocked(ctx context.Context, userID, targetID uint) (bool, error) {
+	var count int64
+	if err := db.WithContext(ctx).Model(&UserBlock{}).
+		Where("user_id = ? AND blocked_id = ?", userID, targetID).
+		Count(&count).Error; err != nil {
+		return false, errors.Wrap(err, "check block status")
+	}
+	return count > 0, nil
+}
+
+// BlockedByUser 批量判断：返回 targetIDs 中被 userID 拉黑的子集（map[targetID]bool）。
+func (db *users) BlockedByUser(ctx context.Context, userID uint, targetIDs []uint) (map[uint]bool, error) {
+	result := make(map[uint]bool, len(targetIDs))
+	if len(targetIDs) == 0 {
+		return result, nil
+	}
+	var blocks []UserBlock
+	if err := db.WithContext(ctx).
+		Where("user_id = ? AND blocked_id IN ?", userID, targetIDs).
+		Find(&blocks).Error; err != nil {
+		return nil, errors.Wrap(err, "get blocked users")
+	}
+	for _, b := range blocks {
+		result[b.BlockedID] = true
+	}
+	return result, nil
+}
+
+// BlockedByAnyOf 批量判断：返回 blockerIDs 中拉黑了 targetID 的子集（map[blockerID]bool）。
+func (db *users) BlockedByAnyOf(ctx context.Context, blockerIDs []uint, targetID uint) (map[uint]bool, error) {
+	result := make(map[uint]bool, len(blockerIDs))
+	if len(blockerIDs) == 0 {
+		return result, nil
+	}
+	var blocks []UserBlock
+	if err := db.WithContext(ctx).
+		Where("user_id IN ? AND blocked_id = ?", blockerIDs, targetID).
+		Find(&blocks).Error; err != nil {
+		return nil, errors.Wrap(err, "get blockers")
+	}
+	for _, b := range blocks {
+		result[b.UserID] = true
+	}
+	return result, nil
+}
+
+// CountTodayMessagesFromUser 统计某提问者当天给某被提问者发送的私信总条数。
+// 使用应用进程所在时区（time.Local）的"当日 00:00"作为窗口起点，
+// 而非数据库服务器的 CURRENT_DATE，避免 DB 时区与应用时区不一致导致每日上限窗口偏移。
+func (db *users) CountTodayMessagesFromUser(ctx context.Context, ownerID, askerID uint) (int64, error) {
+	now := time.Now()
+	startOfDay := time.Date(now.Year(), now.Month(), now.Day(), 0, 0, 0, 0, now.Location())
+	var count int64
+	err := db.WithContext(ctx).Table("messages").
+		Joins("JOIN conversations ON conversations.id = messages.conversation_id").
+		Where("conversations.owner_id = ? AND messages.sender_id = ?", ownerID, askerID).
+		Where("messages.created_at >= ?", startOfDay).
+		Count(&count).Error
+	return count, err
+}
+
+// UpdateDailyMessageLimit 更新每日限制
+func (db *users) UpdateDailyMessageLimit(ctx context.Context, id uint, limit int) error {
+	return db.WithContext(ctx).Model(&User{}).Where("id = ?", id).
+		Update("daily_message_limit", limit).Error
+}
+
+// BanUserAndCleanup 封禁用户并连带清理其全部数据（提问、追问、私聊、消息、图片关联），
+// 最后物理删除用户记录。供管理 CLI 命令（tamabox ban）使用。
+//
+// 注意：该操作不可恢复，执行前请确认目标账号。
+func (db *users) BanUserAndCleanup(ctx context.Context, userID uint) error {
+	return db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		// 追问：属于该用户提问下的追问
+		if err := tx.WithContext(ctx).
+			Where("question_id IN (SELECT id FROM questions WHERE user_id = ?)", userID).
+			Delete(&FollowUp{}).Error; err != nil {
+			return errors.Wrap(err, "delete follow ups of banned user")
+		}
+
+		// 消息：属于该用户作为 owner 或 asker 的会话
+		if err := tx.WithContext(ctx).
+			Where("conversation_id IN (SELECT id FROM conversations WHERE owner_id = ? OR asker_id = ?)", userID, userID).
+			Delete(&Message{}).Error; err != nil {
+			return errors.Wrap(err, "delete messages of banned user")
+		}
+		// 消息图片
+		if err := tx.WithContext(ctx).
+			Where("message_id IN (SELECT id FROM messages WHERE conversation_id IN (SELECT id FROM conversations WHERE owner_id = ? OR asker_id = ?))", userID, userID).
+			Delete(&MessageImage{}).Error; err != nil {
+			return errors.Wrap(err, "delete message images of banned user")
+		}
+
+		// 私聊会话
+		if err := tx.WithContext(ctx).
+			Where("owner_id = ? OR asker_id = ?", userID, userID).
+			Delete(&Conversation{}).Error; err != nil {
+			return errors.Wrap(err, "delete conversations of banned user")
+		}
+
+		// 提问-图片关联（仅删除关联记录；UploadImage 本体为通用资源，保留）
+		if err := tx.WithContext(ctx).
+			Where("question_id IN (SELECT id FROM questions WHERE user_id = ?)", userID).
+			Delete(&UploadImageQuestion{}).Error; err != nil {
+			return errors.Wrap(err, "delete upload image links of banned user")
+		}
+
+		// 提问
+		if err := tx.WithContext(ctx).
+			Where("user_id = ?", userID).
+			Delete(&Question{}).Error; err != nil {
+			return errors.Wrap(err, "delete questions of banned user")
+		}
+
+		// 拉黑关系（该用户拉黑别人，或被别人拉黑）
+		if err := tx.WithContext(ctx).
+			Where("user_id = ? OR blocked_id = ?", userID, userID).
+			Delete(&UserBlock{}).Error; err != nil {
+			return errors.Wrap(err, "delete user blocks of banned user")
+		}
+
+		// 功能开关配置（提问 / 私聊 / 投票）
+		if err := tx.WithContext(ctx).Unscoped().
+			Where("user_id = ?", userID).
+			Delete(&FeatureControl{}).Error; err != nil {
+			return errors.Wrap(err, "delete feature controls of banned user")
+		}
+
+		// 物理删除用户
+		if err := tx.WithContext(ctx).Unscoped().Delete(&User{}, userID).Error; err != nil {
+			return errors.Wrap(err, "delete banned user")
+		}
+		return nil
+	})
+}
diff --git a/internal/db/users_test.go b/internal/db/users_test.go
new file mode 100644
index 0000000..dabed95
--- /dev/null
+++ b/internal/db/users_test.go
@@ -0,0 +1,428 @@
+// Copyright 2023 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package db
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
+)
+
+func TestUsers(t *testing.T) {
+	t.Parallel()
+
+	db, cleanup := newTestDB(t)
+	ctx := context.Background()
+
+	usersStore := NewUsersStore(db)
+
+	for _, tc := range []struct {
+		name string
+		test func(t *testing.T, ctx context.Context, db *users)
+	}{
+		{"Create", testUsersCreate},
+		{"GetByID", testUsersGetByID},
+		{"GetByEmail", testUsersGetByEmail},
+		{"GetByDomain", testUsersGetByDomain},
+		{"Update", testUsersUpdate},
+		{"UpdateHarassmentType", testUsersUpdateHarassmentType},
+		{"UpdateBlockWords", testUsersUpdateBlockWords},
+		{"Authenticate", testUsersAuthenticate},
+		{"ChangePassword", testUsersChangePassword},
+		{"UpdatePassword", testUsersUpdatePassword},
+		{"Deactivate", testUsersDeactivate},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Cleanup(func() {
+				if err := cleanup("users"); err != nil {
+					t.Fatal(err)
+				}
+			})
+			tc.test(t, ctx, usersStore.(*users))
+		})
+	}
+}
+
+func testUsersCreate(t *testing.T, ctx context.Context, db *users) {
+	t.Run("normal", func(t *testing.T) {
+		err := db.Create(ctx, CreateUserOptions{
+			Name:       "E99p1ant",
+			Password:   "super_secret",
+			Email:      "i@github.red",
+			Avatar:     "avater.png",
+			Domain:     "e99",
+			Background: "background.png",
+			Intro:      "Be cool, but also be warm.",
+		})
+		require.Nil(t, err)
+	})
+
+	t.Run("repeat email", func(t *testing.T) {
+		err := db.Create(ctx, CreateUserOptions{
+			Name:       "E99p1ant",
+			Password:   "super_secret",
+			Email:      "i@github.red",
+			Avatar:     "avater.png",
+			Domain:     "e99p1ant",
+			Background: "background.png",
+			Intro:      "Be cool, but also be warm.",
+		})
+		require.Equal(t, ErrDuplicateEmail, err)
+	})
+
+	t.Run("repeat domain", func(t *testing.T) {
+		err := db.Create(ctx, CreateUserOptions{
+			Name:       "E99p1ant",
+			Password:   "super_secret",
+			Email:      "e99@github.red",
+			Avatar:     "avater.png",
+			Domain:     "e99",
+			Background: "background.png",
+			Intro:      "Be cool, but also be warm.",
+		})
+		require.Equal(t, ErrDuplicateDomain, err)
+	})
+}
+
+func testUsersGetByID(t *testing.T, ctx context.Context, db *users) {
+	err := db.Create(ctx, CreateUserOptions{
+		Name:       "E99p1ant",
+		Password:   "super_secret",
+		Email:      "i@github.red",
+		Avatar:     "avater.png",
+		Domain:     "e99",
+		Background: "background.png",
+		Intro:      "Be cool, but also be warm.",
+	})
+	require.Nil(t, err)
+
+	t.Run("normal", func(t *testing.T) {
+		got, err := db.GetByID(ctx, 1)
+		require.Nil(t, err)
+
+		got.CreatedAt = time.Time{}
+		got.UpdatedAt = time.Time{}
+
+		want := &User{
+			Model: gorm.Model{
+				ID: 1,
+			},
+			UID:        got.UID,
+			Name:       "E99p1ant",
+			Password:   "super_secret",
+			Email:      "i@github.red",
+			Avatar:     "avater.png",
+			Domain:     "e99",
+			Background: "background.png",
+			Intro:      "Be cool, but also be warm.",
+			Notify:     NotifyTypeEmail,
+		}
+		want.EncodePassword()
+		require.Equal(t, want, got)
+	})
+
+	t.Run("not found", func(t *testing.T) {
+		_, err := db.GetByID(ctx, 404)
+		require.Equal(t, ErrUserNotExists, err)
+	})
+}
+
+func testUsersGetByEmail(t *testing.T, ctx context.Context, db *users) {
+	err := db.Create(ctx, CreateUserOptions{
+		Name:       "E99p1ant",
+		Password:   "super_secret",
+		Email:      "i@github.red",
+		Avatar:     "avater.png",
+		Domain:     "e99",
+		Background: "background.png",
+		Intro:      "Be cool, but also be warm.",
+	})
+	require.Nil(t, err)
+
+	t.Run("normal", func(t *testing.T) {
+		got, err := db.GetByEmail(ctx, "i@github.red")
+		require.Nil(t, err)
+
+		got.CreatedAt = time.Time{}
+		got.UpdatedAt = time.Time{}
+
+		want := &User{
+			Model: gorm.Model{
+				ID: 1,
+			},
+			UID:        got.UID,
+			Name:       "E99p1ant",
+			Password:   "super_secret",
+			Email:      "i@github.red",
+			Avatar:     "avater.png",
+			Domain:     "e99",
+			Background: "background.png",
+			Intro:      "Be cool, but also be warm.",
+			Notify:     NotifyTypeEmail,
+		}
+		want.EncodePassword()
+		require.Equal(t, want, got)
+	})
+
+	t.Run("not found", func(t *testing.T) {
+		_, err := db.GetByEmail(ctx, "404")
+		require.Equal(t, ErrUserNotExists, err)
+	})
+}
+
+func testUsersGetByDomain(t *testing.T, ctx context.Context, db *users) {
+	err := db.Create(ctx, CreateUserOptions{
+		Name:       "E99p1ant",
+		Password:   "super_secret",
+		Email:      "i@github.red",
+		Avatar:     "avater.png",
+		Domain:     "e99",
+		Background: "background.png",
+		Intro:      "Be cool, but also be warm.",
+	})
+	require.Nil(t, err)
+
+	t.Run("normal", func(t *testing.T) {
+		got, err := db.GetByDomain(ctx, "e99")
+		require.Nil(t, err)
+
+		got.CreatedAt = time.Time{}
+		got.UpdatedAt = time.Time{}
+
+		want := &User{
+			Model: gorm.Model{
+				ID: 1,
+			},
+			UID:        got.UID,
+			Name:       "E99p1ant",
+			Password:   "super_secret",
+			Email:      "i@github.red",
+			Avatar:     "avater.png",
+			Domain:     "e99",
+			Background: "background.png",
+			Intro:      "Be cool, but also be warm.",
+			Notify:     NotifyTypeEmail,
+		}
+		want.EncodePassword()
+		require.Equal(t, want, got)
+	})
+
+	t.Run("not found", func(t *testing.T) {
+		_, err := db.GetByDomain(ctx, "404")
+		require.Equal(t, ErrUserNotExists, err)
+	})
+}
+
+func testUsersUpdate(t *testing.T, ctx context.Context, db *users) {
+	err := db.Create(ctx, CreateUserOptions{
+		Name:       "E99p1ant",
+		Password:   "super_secret",
+		Email:      "i@github.red",
+		Avatar:     "avater.png",
+		Domain:     "e99",
+		Background: "background.png",
+		Intro:      "Be cool, but also be warm.",
+	})
+	require.Nil(t, err)
+
+	t.Run("normal", func(t *testing.T) {
+		err := db.Update(ctx, 1, UpdateUserOptions{
+			Name:       "e99",
+			Avatar:     "new_avatar.png",
+			Background: "new_background.png",
+			Intro:      "Be cool, but also be warm!!",
+			Notify:     NotifyTypeNone,
+		})
+		require.Nil(t, err)
+
+		got, err := db.GetByID(ctx, 1)
+		require.Nil(t, err)
+
+		got.CreatedAt = time.Time{}
+		got.UpdatedAt = time.Time{}
+
+		want := &User{
+			Model: gorm.Model{
+				ID: 1,
+			},
+			UID:        got.UID,
+			Name:       "e99",
+			Password:   "super_secret",
+			Email:      "i@github.red",
+			Avatar:     "new_avatar.png",
+			Domain:     "e99",
+			Background: "new_background.png",
+			Intro:      "Be cool, but also be warm!!",
+			Notify:     NotifyTypeNone,
+		}
+		want.EncodePassword()
+		require.Equal(t, want, got)
+	})
+}
+
+func testUsersUpdateHarassmentType(t *testing.T, ctx context.Context, db *users) {
+	err := db.Create(ctx, CreateUserOptions{
+		Name:       "E99p1ant",
+		Password:   "super_secret",
+		Email:      "i@github.red",
+		Avatar:     "avater.png",
+		Domain:     "e99",
+		Background: "background.png",
+		Intro:      "Be cool, but also be warm.",
+	})
+	require.Nil(t, err)
+
+	t.Run("normal", func(t *testing.T) {
+		err := db.UpdateHarassmentType(ctx, 1, HarassmentSettingTypeRegisterOnly)
+		require.Nil(t, err)
+
+		got, err := db.GetByID(ctx, 1)
+		require.Nil(t, err)
+		require.Equal(t, HarassmentSettingTypeRegisterOnly, got.HarassmentSetting)
+		// 只应更新类型，屏蔽词列不受影响
+		require.Equal(t, "", got.BlockWords)
+	})
+
+	t.Run("unexpected harassment setting", func(t *testing.T) {
+		err := db.UpdateHarassmentType(ctx, 1, HarassmentSettingType("not found"))
+		require.NotNil(t, err)
+	})
+}
+
+func testUsersUpdateBlockWords(t *testing.T, ctx context.Context, db *users) {
+	err := db.Create(ctx, CreateUserOptions{
+		Name:       "E99p1ant",
+		Password:   "super_secret",
+		Email:      "i@github.red",
+		Avatar:     "avater.png",
+		Domain:     "e99",
+		Background: "background.png",
+		Intro:      "Be cool, but also be warm.",
+	})
+	require.Nil(t, err)
+
+	t.Run("normal", func(t *testing.T) {
+		err := db.UpdateBlockWords(ctx, 1, "广告,抽奖")
+		require.Nil(t, err)
+
+		got, err := db.GetByID(ctx, 1)
+		require.Nil(t, err)
+		require.Equal(t, "广告,抽奖", got.BlockWords)
+		// 只应更新屏蔽词，类型列不受影响
+		require.Equal(t, HarassmentSettingNone, got.HarassmentSetting)
+	})
+
+	t.Run("empty clears words", func(t *testing.T) {
+		err := db.UpdateBlockWords(ctx, 1, "")
+		require.Nil(t, err)
+
+		got, err := db.GetByID(ctx, 1)
+		require.Nil(t, err)
+		require.Equal(t, "", got.BlockWords)
+	})
+}
+
+func testUsersAuthenticate(t *testing.T, ctx context.Context, db *users) {
+	err := db.Create(ctx, CreateUserOptions{
+		Name:       "E99p1ant",
+		Password:   "super_secret",
+		Email:      "i@github.red",
+		Avatar:     "avater.png",
+		Domain:     "e99",
+		Background: "background.png",
+		Intro:      "Be cool, but also be warm.",
+	})
+	require.Nil(t, err)
+
+	got, err := db.Authenticate(ctx, "i@github.red", "super_secret")
+	require.Nil(t, err)
+
+	got.CreatedAt = time.Time{}
+	got.UpdatedAt = time.Time{}
+
+	want := &User{
+		Model: gorm.Model{
+			ID: 1,
+		},
+		UID:        got.UID,
+		Name:       "E99p1ant",
+		Password:   "super_secret",
+		Email:      "i@github.red",
+		Avatar:     "avater.png",
+		Domain:     "e99",
+		Background: "background.png",
+		Intro:      "Be cool, but also be warm.",
+		Notify:     NotifyTypeEmail,
+	}
+	want.EncodePassword()
+	require.Equal(t, want, got)
+}
+
+func testUsersChangePassword(t *testing.T, ctx context.Context, db *users) {
+	err := db.Create(ctx, CreateUserOptions{
+		Name:       "E99p1ant",
+		Password:   "super_secret",
+		Email:      "i@github.red",
+		Avatar:     "avater.png",
+		Domain:     "e99",
+		Background: "background.png",
+		Intro:      "Be cool, but also be warm.",
+	})
+	require.Nil(t, err)
+
+	t.Run("normal", func(t *testing.T) {
+		err := db.ChangePassword(ctx, 1, "super_secret", "new_password")
+		require.Nil(t, err)
+	})
+
+	t.Run("wrong password", func(t *testing.T) {
+		err := db.ChangePassword(ctx, 1, "wrong_password", "new_password")
+		require.Equal(t, ErrBadCredential, err)
+	})
+}
+
+func testUsersUpdatePassword(t *testing.T, ctx context.Context, db *users) {
+	err := db.Create(ctx, CreateUserOptions{
+		Name:       "E99p1ant",
+		Password:   "super_secret",
+		Email:      "i@github.red",
+		Avatar:     "avater.png",
+		Domain:     "e99",
+		Background: "background.png",
+		Intro:      "Be cool, but also be warm.",
+	})
+	require.Nil(t, err)
+
+	t.Run("normal", func(t *testing.T) {
+		err := db.UpdatePassword(ctx, 1, "new_password")
+		require.Nil(t, err)
+	})
+}
+
+func testUsersDeactivate(t *testing.T, ctx context.Context, db *users) {
+	err := db.Create(ctx, CreateUserOptions{
+		Name:       "E99p1ant",
+		Password:   "super_secret",
+		Email:      "i@github.red",
+		Avatar:     "avater.png",
+		Domain:     "e99",
+		Background: "background.png",
+		Intro:      "Be cool, but also be warm.",
+	})
+	require.Nil(t, err)
+
+	t.Run("normal", func(t *testing.T) {
+		err := db.Deactivate(ctx, 1)
+		require.Nil(t, err)
+	})
+
+	t.Run("not found", func(t *testing.T) {
+		err := db.Deactivate(ctx, 404)
+		require.NotNil(t, err)
+	})
+}
diff --git a/internal/db/vote_form_fields.go b/internal/db/vote_form_fields.go
new file mode 100644
index 0000000..cc7d249
--- /dev/null
+++ b/internal/db/vote_form_fields.go
@@ -0,0 +1,184 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package db
+
+import (
+	"context"
+
+	"github.com/pkg/errors"
+	"gorm.io/gorm"
+
+	"github.com/tamakyi/TamaBox/internal/dbutil"
+)
+
+var VoteFormFields VoteFormFieldsStore
+
+// CustomFieldMarker 参与端"其他/自定义选项"的保留标记值（radio/select/checkbox 字段）。
+// 选中该值时，后端从 field_{id}_custom 读取参与者填写的文本；预设选项不允许使用该保留值。
+const CustomFieldMarker = "__tb_custom_option__"
+
+// 表单字段类型（type=form 时使用）
+const (
+	VoteFormFieldTypeText     = "text"     // 单行文本
+	VoteFormFieldTypeTextarea = "textarea" // 多行文本
+	VoteFormFieldTypeSelect   = "select"   // 下拉单选
+	VoteFormFieldTypeRadio    = "radio"    // 单选
+	VoteFormFieldTypeCheckbox = "checkbox" // 多选
+	VoteFormFieldTypeNumber   = "number"   // 数字
+	VoteFormFieldTypeRating   = "rating"   // 评分
+	VoteFormFieldTypeRank     = "rank"     // 排序（对预置选项排 1..N）
+)
+
+type VoteFormFieldsStore interface {
+	Create(ctx context.Context, opts CreateVoteFormFieldOptions) (*VoteFormField, error)
+	BulkCreate(ctx context.Context, voteID uint, fields []CreateVoteFormFieldOptions) ([]*VoteFormField, error)
+	ListByVoteID(ctx context.Context, voteID uint) ([]*VoteFormField, error)
+	ReplaceByVoteID(ctx context.Context, voteID uint, fields []CreateVoteFormFieldOptions) error
+	CountByVoteID(ctx context.Context, voteID uint) (int64, error)
+	DeleteByVoteID(ctx context.Context, voteID uint) error
+	DeleteByID(ctx context.Context, id uint) error
+}
+
+func NewVoteFormFieldsStore(db *gorm.DB) VoteFormFieldsStore {
+	return &voteFormFields{db}
+}
+
+type voteFormFields struct {
+	*gorm.DB
+}
+
+// VoteFormField 表单字段定义表：结构化表单（type=form）的字段配置。
+type VoteFormField struct {
+	dbutil.Model
+	VoteID      uint   `gorm:"index:idx_form_field_vote" json:"vote_id"`
+	FieldType   string `gorm:"size:20" json:"field_type"`
+	Label       string `gorm:"size:100" json:"label"`
+	Required    bool   `gorm:"default:false" json:"required"`
+	MaxLength   int    `gorm:"default:0" json:"max_length"` // 0 = 不限制（字数限制）
+	Options     string `gorm:"type:text" json:"options"`    // JSON 数组（select/radio/checkbox 用）
+	SortOrder   int    `gorm:"default:0" json:"sort_order"`
+	AllowCustom bool   `gorm:"default:false" json:"allow_custom"` // 允许参与者补充自定义选项（radio/select/checkbox）
+}
+
+type CreateVoteFormFieldOptions struct {
+	VoteID      uint
+	FieldType   string
+	Label       string
+	Required    bool
+	MaxLength   int
+	Options     string
+	SortOrder   int
+	AllowCustom bool
+}
+
+func (db *voteFormFields) Create(ctx context.Context, opts CreateVoteFormFieldOptions) (*VoteFormField, error) {
+	field := &VoteFormField{
+		VoteID:      opts.VoteID,
+		FieldType:   opts.FieldType,
+		Label:       opts.Label,
+		Required:    opts.Required,
+		MaxLength:   opts.MaxLength,
+		Options:     opts.Options,
+		SortOrder:   opts.SortOrder,
+		AllowCustom: opts.AllowCustom,
+	}
+	if err := db.WithContext(ctx).Create(field).Error; err != nil {
+		return nil, errors.Wrap(err, "create vote form field")
+	}
+	return field, nil
+}
+
+// BulkCreate 批量创建表单字段（箱主一次提交全部字段配置）。
+func (db *voteFormFields) BulkCreate(ctx context.Context, voteID uint, fields []CreateVoteFormFieldOptions) ([]*VoteFormField, error) {
+	formFields := make([]*VoteFormField, 0, len(fields))
+	for _, f := range fields {
+		formFields = append(formFields, &VoteFormField{
+			VoteID:      voteID,
+			FieldType:   f.FieldType,
+			Label:       f.Label,
+			Required:    f.Required,
+			MaxLength:   f.MaxLength,
+			Options:     f.Options,
+			SortOrder:   f.SortOrder,
+			AllowCustom: f.AllowCustom,
+		})
+	}
+	if len(formFields) == 0 {
+		return formFields, nil
+	}
+	if err := db.WithContext(ctx).Create(&formFields).Error; err != nil {
+		return nil, errors.Wrap(err, "bulk create vote form fields")
+	}
+	return formFields, nil
+}
+
+// ListByVoteID 获取某投票的全部表单字段（按 SortOrder 升序）。
+func (db *voteFormFields) ListByVoteID(ctx context.Context, voteID uint) ([]*VoteFormField, error) {
+	var fields []*VoteFormField
+	if err := db.WithContext(ctx).
+		Where("vote_id = ?", voteID).
+		Order("sort_order ASC, id ASC").
+		Find(&fields).Error; err != nil {
+		return nil, errors.Wrap(err, "list vote form fields by vote id")
+	}
+	return fields, nil
+}
+
+// CountByVoteID 统计某投票的表单字段数量（发布前完整性校验用）。
+func (db *voteFormFields) CountByVoteID(ctx context.Context, voteID uint) (int64, error) {
+	var count int64
+	if err := db.WithContext(ctx).Model(&VoteFormField{}).Where("vote_id = ?", voteID).Count(&count).Error; err != nil {
+		return 0, errors.Wrap(err, "count vote form fields by vote id")
+	}
+	return count, nil
+}
+
+// ReplaceByVoteID 在单个事务内替换投票的全部表单字段（先删后建），保证原子性。
+// 仅在草稿状态编辑时调用。
+func (db *voteFormFields) ReplaceByVoteID(ctx context.Context, voteID uint, fields []CreateVoteFormFieldOptions) error {
+	return db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		if err := tx.Where("vote_id = ?", voteID).Delete(&VoteFormField{}).Error; err != nil {
+			return err
+		}
+		if len(fields) == 0 {
+			return nil
+		}
+		formFields := make([]*VoteFormField, 0, len(fields))
+		for _, f := range fields {
+			formFields = append(formFields, &VoteFormField{
+				VoteID:      voteID,
+				FieldType:   f.FieldType,
+				Label:       f.Label,
+				Required:    f.Required,
+				MaxLength:   f.MaxLength,
+				Options:     f.Options,
+				SortOrder:   f.SortOrder,
+				AllowCustom: f.AllowCustom,
+			})
+		}
+		return tx.Create(&formFields).Error
+	})
+}
+
+// DeleteByVoteID 删除投票时级联清理全部表单字段。
+func (db *voteFormFields) DeleteByVoteID(ctx context.Context, voteID uint) error {
+	if err := db.WithContext(ctx).Where("vote_id = ?", voteID).Delete(&VoteFormField{}).Error; err != nil {
+		return errors.Wrap(err, "delete vote form fields by vote id")
+	}
+	return nil
+}
+
+func (db *voteFormFields) DeleteByID(ctx context.Context, id uint) error {
+	res := db.WithContext(ctx).Delete(&VoteFormField{}, id)
+	if res.Error != nil {
+		return errors.Wrap(res.Error, "delete vote form field")
+	}
+	if res.RowsAffected == 0 {
+		return ErrVoteFormFieldNotExist
+	}
+	return nil
+}
+
+var ErrVoteFormFieldNotExist = errors.New("投票表单字段不存在")
diff --git a/internal/db/vote_form_fields_test.go b/internal/db/vote_form_fields_test.go
new file mode 100644
index 0000000..3d819b6
--- /dev/null
+++ b/internal/db/vote_form_fields_test.go
@@ -0,0 +1,109 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package db
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestVoteFormFields(t *testing.T) {
+	t.Parallel()
+
+	db, cleanup := newTestDB(t)
+	ctx := context.Background()
+
+	store := NewVoteFormFieldsStore(db)
+
+	for _, tc := range []struct {
+		name string
+		test func(t *testing.T, ctx context.Context, db *voteFormFields)
+	}{
+		{"Create", testVoteFormFieldsCreate},
+		{"BulkCreate", testVoteFormFieldsBulkCreate},
+		{"ListByVoteID", testVoteFormFieldsListByVoteID},
+		{"DeleteByID", testVoteFormFieldsDeleteByID},
+		{"DeleteByVoteID", testVoteFormFieldsDeleteByVoteID},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Cleanup(func() {
+				if err := cleanup("vote_form_fields"); err != nil {
+					t.Fatal(err)
+				}
+			})
+			tc.test(t, ctx, store.(*voteFormFields))
+		})
+	}
+}
+
+func testVoteFormFieldsCreate(t *testing.T, ctx context.Context, db *voteFormFields) {
+	got, err := db.Create(ctx, CreateVoteFormFieldOptions{
+		VoteID:    1,
+		FieldType: VoteFormFieldTypeText,
+		Label:     "你的昵称",
+		Required:  true,
+		MaxLength: 50,
+	})
+	require.Nil(t, err)
+	require.Equal(t, uint(1), got.ID)
+	require.True(t, got.Required)
+	require.Equal(t, 50, got.MaxLength)
+}
+
+func testVoteFormFieldsBulkCreate(t *testing.T, ctx context.Context, db *voteFormFields) {
+	got, err := db.BulkCreate(ctx, 1, []CreateVoteFormFieldOptions{
+		{FieldType: VoteFormFieldTypeText, Label: "昵称", Required: true, MaxLength: 20, SortOrder: 0},
+		{FieldType: VoteFormFieldTypeTextarea, Label: "建议", Required: false, MaxLength: 500, SortOrder: 1},
+		{FieldType: VoteFormFieldTypeRadio, Label: "满意度", Options: `["满意","一般","不满意"]`, SortOrder: 2},
+	})
+	require.Nil(t, err)
+	require.Len(t, got, 3)
+	require.Equal(t, VoteFormFieldTypeTextarea, got[1].FieldType)
+	require.Equal(t, `["满意","一般","不满意"]`, got[2].Options)
+}
+
+func testVoteFormFieldsListByVoteID(t *testing.T, ctx context.Context, db *voteFormFields) {
+	_, err := db.BulkCreate(ctx, 1, []CreateVoteFormFieldOptions{
+		{FieldType: VoteFormFieldTypeText, Label: "B", SortOrder: 1},
+		{FieldType: VoteFormFieldTypeText, Label: "A", SortOrder: 0},
+	})
+	require.Nil(t, err)
+
+	got, err := db.ListByVoteID(ctx, 1)
+	require.Nil(t, err)
+	require.Len(t, got, 2)
+	require.Equal(t, "A", got[0].Label, "按 SortOrder 升序")
+}
+
+func testVoteFormFieldsDeleteByID(t *testing.T, ctx context.Context, db *voteFormFields) {
+	_, err := db.Create(ctx, CreateVoteFormFieldOptions{VoteID: 1, FieldType: VoteFormFieldTypeText, Label: "A"})
+	require.Nil(t, err)
+
+	t.Run("normal", func(t *testing.T) {
+		require.Nil(t, db.DeleteByID(ctx, 1))
+		got, err := db.ListByVoteID(ctx, 1)
+		require.Nil(t, err)
+		require.Len(t, got, 0)
+	})
+
+	t.Run("not found", func(t *testing.T) {
+		require.Equal(t, ErrVoteFormFieldNotExist, db.DeleteByID(ctx, 404))
+	})
+}
+
+func testVoteFormFieldsDeleteByVoteID(t *testing.T, ctx context.Context, db *voteFormFields) {
+	_, err := db.BulkCreate(ctx, 1, []CreateVoteFormFieldOptions{
+		{FieldType: VoteFormFieldTypeText, Label: "A"},
+		{FieldType: VoteFormFieldTypeText, Label: "B"},
+	})
+	require.Nil(t, err)
+
+	require.Nil(t, db.DeleteByVoteID(ctx, 1))
+	got, err := db.ListByVoteID(ctx, 1)
+	require.Nil(t, err)
+	require.Len(t, got, 0)
+}
diff --git a/internal/db/vote_options.go b/internal/db/vote_options.go
new file mode 100644
index 0000000..db36f2c
--- /dev/null
+++ b/internal/db/vote_options.go
@@ -0,0 +1,163 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package db
+
+import (
+	"context"
+
+	"github.com/pkg/errors"
+	"gorm.io/gorm"
+
+	"github.com/tamakyi/TamaBox/internal/dbutil"
+)
+
+var VoteOptions VoteOptionsStore
+
+type VoteOptionsStore interface {
+	Create(ctx context.Context, opts CreateVoteOptionOptions) (*VoteOption, error)
+	BulkCreate(ctx context.Context, voteID uint, contents []string) ([]*VoteOption, error)
+	ListByVoteID(ctx context.Context, voteID uint) ([]*VoteOption, error)
+	ReplaceByVoteID(ctx context.Context, voteID uint, contents []string) error
+	DeleteByVoteID(ctx context.Context, voteID uint) error
+	DeleteByID(ctx context.Context, id uint) error
+	CountByVoteID(ctx context.Context, voteID uint) (int64, error)
+	CountByVoteIDs(ctx context.Context, voteIDs []uint) (map[uint]int64, error)
+}
+
+func NewVoteOptionsStore(db *gorm.DB) VoteOptionsStore {
+	return &voteOptions{db}
+}
+
+type voteOptions struct {
+	*gorm.DB
+}
+
+// VoteOption 选项表：单选/多选/评分/排序共用。
+type VoteOption struct {
+	dbutil.Model
+	VoteID    uint   `gorm:"index:idx_option_vote" json:"vote_id"`
+	Content   string `gorm:"size:200" json:"content"`
+	SortOrder int    `gorm:"default:0" json:"sort_order"`
+}
+
+type CreateVoteOptionOptions struct {
+	VoteID    uint
+	Content   string
+	SortOrder int
+}
+
+func (db *voteOptions) Create(ctx context.Context, opts CreateVoteOptionOptions) (*VoteOption, error) {
+	option := &VoteOption{
+		VoteID:    opts.VoteID,
+		Content:   opts.Content,
+		SortOrder: opts.SortOrder,
+	}
+	if err := db.WithContext(ctx).Create(option).Error; err != nil {
+		return nil, errors.Wrap(err, "create vote option")
+	}
+	return option, nil
+}
+
+// BulkCreate 批量创建选项（用于箱主一次提交全部选项）。
+func (db *voteOptions) BulkCreate(ctx context.Context, voteID uint, contents []string) ([]*VoteOption, error) {
+	options := make([]*VoteOption, 0, len(contents))
+	for i, content := range contents {
+		options = append(options, &VoteOption{
+			VoteID:    voteID,
+			Content:   content,
+			SortOrder: i,
+		})
+	}
+	if len(options) == 0 {
+		return options, nil
+	}
+	if err := db.WithContext(ctx).Create(&options).Error; err != nil {
+		return nil, errors.Wrap(err, "bulk create vote options")
+	}
+	return options, nil
+}
+
+// ListByVoteID 获取某投票的全部选项（按 SortOrder 升序，保证选项顺序稳定）。
+func (db *voteOptions) ListByVoteID(ctx context.Context, voteID uint) ([]*VoteOption, error) {
+	var options []*VoteOption
+	if err := db.WithContext(ctx).
+		Where("vote_id = ?", voteID).
+		Order("sort_order ASC, id ASC").
+		Find(&options).Error; err != nil {
+		return nil, errors.Wrap(err, "list vote options by vote id")
+	}
+	return options, nil
+}
+
+// ReplaceByVoteID 在单个事务内替换投票的全部选项（先删后建），保证原子性。
+// 仅在草稿状态编辑时调用（发布后不可改选项，避免破坏历史投票归因）。
+func (db *voteOptions) ReplaceByVoteID(ctx context.Context, voteID uint, contents []string) error {
+	return db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		if err := tx.Where("vote_id = ?", voteID).Delete(&VoteOption{}).Error; err != nil {
+			return err
+		}
+		if len(contents) == 0 {
+			return nil
+		}
+		options := make([]*VoteOption, 0, len(contents))
+		for i, content := range contents {
+			options = append(options, &VoteOption{VoteID: voteID, Content: content, SortOrder: i})
+		}
+		return tx.Create(&options).Error
+	})
+}
+
+// DeleteByVoteID 删除投票时级联清理全部选项。
+func (db *voteOptions) DeleteByVoteID(ctx context.Context, voteID uint) error {
+	if err := db.WithContext(ctx).Where("vote_id = ?", voteID).Delete(&VoteOption{}).Error; err != nil {
+		return errors.Wrap(err, "delete vote options by vote id")
+	}
+	return nil
+}
+
+func (db *voteOptions) DeleteByID(ctx context.Context, id uint) error {
+	res := db.WithContext(ctx).Delete(&VoteOption{}, id)
+	if res.Error != nil {
+		return errors.Wrap(res.Error, "delete vote option")
+	}
+	if res.RowsAffected == 0 {
+		return ErrVoteOptionNotExist
+	}
+	return nil
+}
+
+var ErrVoteOptionNotExist = errors.New("投票选项不存在")
+
+func (db *voteOptions) CountByVoteID(ctx context.Context, voteID uint) (int64, error) {
+	var count int64
+	if err := db.WithContext(ctx).Model(&VoteOption{}).Where("vote_id = ?", voteID).Count(&count).Error; err != nil {
+		return 0, errors.Wrap(err, "count vote options by vote id")
+	}
+	return count, nil
+}
+
+// CountByVoteIDs 一次查询批量统计多个投票的选项数（替代逐投票 N 次 COUNT，消除 N+1）。
+func (db *voteOptions) CountByVoteIDs(ctx context.Context, voteIDs []uint) (map[uint]int64, error) {
+	out := make(map[uint]int64, len(voteIDs))
+	if len(voteIDs) == 0 {
+		return out, nil
+	}
+	type row struct {
+		VoteID uint
+		Cnt    int64
+	}
+	var rows []row
+	if err := db.WithContext(ctx).Model(&VoteOption{}).
+		Select("vote_id, COUNT(id) AS cnt").
+		Where("vote_id IN ?", voteIDs).
+		Group("vote_id").
+		Find(&rows).Error; err != nil {
+		return nil, errors.Wrap(err, "count vote options by vote ids")
+	}
+	for _, r := range rows {
+		out[r.VoteID] = r.Cnt
+	}
+	return out, nil
+}
diff --git a/internal/db/vote_options_test.go b/internal/db/vote_options_test.go
new file mode 100644
index 0000000..1f8962f
--- /dev/null
+++ b/internal/db/vote_options_test.go
@@ -0,0 +1,116 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package db
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestVoteOptions(t *testing.T) {
+	t.Parallel()
+
+	db, cleanup := newTestDB(t)
+	ctx := context.Background()
+
+	store := NewVoteOptionsStore(db)
+
+	for _, tc := range []struct {
+		name string
+		test func(t *testing.T, ctx context.Context, db *voteOptions)
+	}{
+		{"Create", testVoteOptionsCreate},
+		{"BulkCreate", testVoteOptionsBulkCreate},
+		{"ListByVoteID", testVoteOptionsListByVoteID},
+		{"DeleteByID", testVoteOptionsDeleteByID},
+		{"DeleteByVoteID", testVoteOptionsDeleteByVoteID},
+		{"CountByVoteID", testVoteOptionsCountByVoteID},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Cleanup(func() {
+				if err := cleanup("vote_options"); err != nil {
+					t.Fatal(err)
+				}
+			})
+			tc.test(t, ctx, store.(*voteOptions))
+		})
+	}
+}
+
+func testVoteOptionsCreate(t *testing.T, ctx context.Context, db *voteOptions) {
+	got, err := db.Create(ctx, CreateVoteOptionOptions{
+		VoteID:    1,
+		Content:   "选项 A",
+		SortOrder: 0,
+	})
+	require.Nil(t, err)
+	require.Equal(t, uint(1), got.ID)
+	require.Equal(t, "选项 A", got.Content)
+}
+
+func testVoteOptionsBulkCreate(t *testing.T, ctx context.Context, db *voteOptions) {
+	got, err := db.BulkCreate(ctx, 1, []string{"A", "B", "C"})
+	require.Nil(t, err)
+	require.Len(t, got, 3)
+
+	// SortOrder 应按传入顺序从 0 递增
+	require.Equal(t, 0, got[0].SortOrder)
+	require.Equal(t, 2, got[2].SortOrder)
+	require.Equal(t, "C", got[2].Content)
+}
+
+func testVoteOptionsListByVoteID(t *testing.T, ctx context.Context, db *voteOptions) {
+	_, err := db.BulkCreate(ctx, 1, []string{"B", "A", "C"})
+	require.Nil(t, err)
+	_, err = db.BulkCreate(ctx, 2, []string{"X"})
+	require.Nil(t, err)
+
+	got, err := db.ListByVoteID(ctx, 1)
+	require.Nil(t, err)
+	require.Len(t, got, 3)
+	require.Equal(t, "B", got[0].Content, "按 SortOrder 升序：B(sort 0), A(sort 1), C(sort 2)")
+	require.Equal(t, "C", got[2].Content)
+}
+
+func testVoteOptionsDeleteByID(t *testing.T, ctx context.Context, db *voteOptions) {
+	_, err := db.Create(ctx, CreateVoteOptionOptions{VoteID: 1, Content: "A"})
+	require.Nil(t, err)
+
+	t.Run("normal", func(t *testing.T) {
+		require.Nil(t, db.DeleteByID(ctx, 1))
+		got, err := db.ListByVoteID(ctx, 1)
+		require.Nil(t, err)
+		require.Len(t, got, 0)
+	})
+
+	t.Run("not found", func(t *testing.T) {
+		require.Equal(t, ErrVoteOptionNotExist, db.DeleteByID(ctx, 404))
+	})
+}
+
+func testVoteOptionsDeleteByVoteID(t *testing.T, ctx context.Context, db *voteOptions) {
+	_, err := db.BulkCreate(ctx, 1, []string{"A", "B", "C"})
+	require.Nil(t, err)
+
+	require.Nil(t, db.DeleteByVoteID(ctx, 1))
+	got, err := db.ListByVoteID(ctx, 1)
+	require.Nil(t, err)
+	require.Len(t, got, 0)
+}
+
+func testVoteOptionsCountByVoteID(t *testing.T, ctx context.Context, db *voteOptions) {
+	_, err := db.BulkCreate(ctx, 1, []string{"A", "B"})
+	require.Nil(t, err)
+
+	got, err := db.CountByVoteID(ctx, 1)
+	require.Nil(t, err)
+	require.Equal(t, int64(2), got)
+
+	got, err = db.CountByVoteID(ctx, 404)
+	require.Nil(t, err)
+	require.Equal(t, int64(0), got)
+}
diff --git a/internal/db/vote_submissions.go b/internal/db/vote_submissions.go
new file mode 100644
index 0000000..95f9726
--- /dev/null
+++ b/internal/db/vote_submissions.go
@@ -0,0 +1,256 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package db
+
+import (
+	"context"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/go-sql-driver/mysql"
+	"github.com/jackc/pgconn"
+	"github.com/pkg/errors"
+	"gorm.io/datatypes"
+	"gorm.io/gorm"
+
+	"github.com/tamakyi/TamaBox/internal/dbutil"
+)
+
+var VoteSubmissions VoteSubmissionsStore
+
+type VoteSubmissionsStore interface {
+	Create(ctx context.Context, opts CreateVoteSubmissionOptions) (*VoteSubmission, error)
+	GetByID(ctx context.Context, id uint) (*VoteSubmission, error)
+	ListByVoteID(ctx context.Context, voteID uint, cursor *dbutil.Cursor) ([]*VoteSubmission, error)
+	CountByVoteID(ctx context.Context, voteID uint) (int64, error)
+	CountByVoteIDs(ctx context.Context, voteIDs []uint) (map[uint]int64, error)
+	CountByOptionID(ctx context.Context, voteID, optionID uint) (int64, error)
+	CountGroupByOptionID(ctx context.Context, voteID uint) (map[uint]int64, error)
+	CountByIP(ctx context.Context, voteID uint, ip string, since time.Time) (int64, error)
+	HasUserVoted(ctx context.Context, voteID, userID uint) (bool, error)
+	HasTokenVoted(ctx context.Context, voteID uint, token string) (bool, error)
+	DeleteByVoteID(ctx context.Context, voteID uint) error
+}
+
+func NewVoteSubmissionsStore(db *gorm.DB) VoteSubmissionsStore {
+	return &voteSubmissions{db}
+}
+
+type voteSubmissions struct {
+	*gorm.DB
+}
+
+// VoteSubmission 投票/提交记录（不记名：IP / token / user_id 仅用于防刷与审计，任何界面不展示）。
+//
+// 防一人一票的数据库硬保证（复合唯一索引 + NULL 不冲突，规避 MySQL 5.7 部分索引兼容问题）：
+//   - UNIQUE(vote_id, user_id)：登录用户一个账号对同一投票只能投一次（匿名行 user_id 为 NULL 不冲突）
+//   - UNIQUE(vote_id, voter_token)：同一匿名指纹（服务端签发 Cookie）只能投一次（登录行 voter_token 为 NULL 不冲突）
+type VoteSubmission struct {
+	dbutil.Model
+	VoteID   uint  `gorm:"index:idx_submission_vote;uniqueIndex:idx_submission_user;uniqueIndex:idx_submission_token" json:"vote_id"`
+	OptionID uint  `gorm:"index:idx_submission_option" json:"option_id"`
+	UserID   *uint `gorm:"uniqueIndex:idx_submission_user" json:"-"`
+	// HMAC token = 64-char hex nonce + dot + 43-char base64url signature (108 chars).
+	VoterToken *string        `gorm:"size:128;uniqueIndex:idx_submission_token" json:"-"`
+	VoterIP    string         `gorm:"size:64;index:idx_submission_ip" json:"-"`
+	FormData   datatypes.JSON `json:"form_data"`
+	CustomText string         `gorm:"type:text" json:"custom_text"`
+}
+
+type CreateVoteSubmissionOptions struct {
+	VoteID     uint
+	OptionID   uint
+	UserID     *uint
+	VoterToken *string
+	VoterIP    string
+	FormData   datatypes.JSON
+	CustomText string
+}
+
+var (
+	// ErrVoteAlreadyVoted 同一投票被同一身份重复提交（数据库唯一索引兜底返回）。
+	ErrVoteAlreadyVoted       = errors.New("你已参与过该投票")
+	ErrVoteSubmissionNotExist = errors.New("投票记录不存在")
+)
+
+// Create 写入一条投票/提交记录。若命中复合唯一索引（同一 user 或同一 token 重复提交），
+// 返回 ErrVoteAlreadyVoted。
+func (db *voteSubmissions) Create(ctx context.Context, opts CreateVoteSubmissionOptions) (*VoteSubmission, error) {
+	submission := &VoteSubmission{
+		VoteID:     opts.VoteID,
+		OptionID:   opts.OptionID,
+		UserID:     opts.UserID,
+		VoterToken: opts.VoterToken,
+		VoterIP:    opts.VoterIP,
+		FormData:   opts.FormData,
+		CustomText: opts.CustomText,
+	}
+	if err := db.WithContext(ctx).Create(submission).Error; err != nil {
+		if isDuplicateKeyError(err) {
+			return nil, ErrVoteAlreadyVoted
+		}
+		return nil, errors.Wrap(err, "create vote submission")
+	}
+	return submission, nil
+}
+
+func (db *voteSubmissions) GetByID(ctx context.Context, id uint) (*VoteSubmission, error) {
+	var submission VoteSubmission
+	if err := db.WithContext(ctx).First(&submission, id).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, ErrVoteSubmissionNotExist
+		}
+		return nil, errors.Wrap(err, "get vote submission by ID")
+	}
+	return &submission, nil
+}
+
+// ListByVoteID 分页获取某投票的提交记录（箱主查看表单回复用，新提交在前）。
+func (db *voteSubmissions) ListByVoteID(ctx context.Context, voteID uint, cursor *dbutil.Cursor) ([]*VoteSubmission, error) {
+	q := db.WithContext(ctx).Model(&VoteSubmission{}).Where("vote_id = ?", voteID)
+	if cursor != nil && cursor.Value != nil {
+		// 游标必须为纯数字 id：直接传 string 在 PG 下会因 integer < text 无操作符而报错。
+		cursorStr := strings.TrimSpace(cursorValueToString(cursor.Value))
+		if idVal, err := strconv.ParseUint(cursorStr, 10, 64); err == nil && idVal > 0 {
+			q = q.Where("id < ?", idVal)
+		}
+	}
+	if cursor != nil {
+		q = q.Limit(cursor.Limit())
+	}
+	q = q.Order("created_at DESC")
+
+	var submissions []*VoteSubmission
+	if err := q.Find(&submissions).Error; err != nil {
+		return nil, errors.Wrap(err, "list vote submissions by vote id")
+	}
+	return submissions, nil
+}
+
+// CountByVoteID 统计某投票的总参与人数。
+func (db *voteSubmissions) CountByVoteID(ctx context.Context, voteID uint) (int64, error) {
+	var count int64
+	if err := db.WithContext(ctx).Model(&VoteSubmission{}).Where("vote_id = ?", voteID).Count(&count).Error; err != nil {
+		return 0, errors.Wrap(err, "count vote submissions by vote id")
+	}
+	return count, nil
+}
+
+// CountByVoteIDs 一次查询批量统计多个投票的参与人数（替代逐投票 N 次 COUNT，消除 N+1）。
+// 返回 map[voteID]count；未出现在结果中的 voteID 视为 0 参与。
+func (db *voteSubmissions) CountByVoteIDs(ctx context.Context, voteIDs []uint) (map[uint]int64, error) {
+	out := make(map[uint]int64, len(voteIDs))
+	if len(voteIDs) == 0 {
+		return out, nil
+	}
+	type row struct {
+		VoteID uint
+		Cnt    int64
+	}
+	var rows []row
+	if err := db.WithContext(ctx).Model(&VoteSubmission{}).
+		Select("vote_id, COUNT(id) AS cnt").
+		Where("vote_id IN ?", voteIDs).
+		Group("vote_id").
+		Find(&rows).Error; err != nil {
+		return nil, errors.Wrap(err, "count vote submissions by vote ids")
+	}
+	for _, r := range rows {
+		out[r.VoteID] = r.Cnt
+	}
+	return out, nil
+}
+
+// CountByOptionID 统计某选项的票数（结果页条形图数据源）。
+func (db *voteSubmissions) CountByOptionID(ctx context.Context, voteID, optionID uint) (int64, error) {
+	var count int64
+	if err := db.WithContext(ctx).Model(&VoteSubmission{}).
+		Where("vote_id = ? AND option_id = ?", voteID, optionID).
+		Count(&count).Error; err != nil {
+		return 0, errors.Wrap(err, "count vote submissions by option id")
+	}
+	return count, nil
+}
+
+// CountGroupByOptionID 一次查询统计某投票下各选项的票数（替代逐选项 N 次 COUNT）。
+func (db *voteSubmissions) CountGroupByOptionID(ctx context.Context, voteID uint) (map[uint]int64, error) {
+	type row struct {
+		OptionID uint
+		Cnt      int64
+	}
+	var rows []row
+	if err := db.WithContext(ctx).Model(&VoteSubmission{}).
+		Select("option_id, COUNT(id) AS cnt").
+		Where("vote_id = ?", voteID).
+		Group("option_id").
+		Find(&rows).Error; err != nil {
+		return nil, errors.Wrap(err, "count vote submissions group by option id")
+	}
+	out := make(map[uint]int64, len(rows))
+	for _, r := range rows {
+		out[r.OptionID] = r.Cnt
+	}
+	return out, nil
+}
+
+// CountByIP 统计同一 IP 在 since 时间窗内的提交次数（匿名防刷兜底：清 Cookie 重投时按 IP 计数）。
+func (db *voteSubmissions) CountByIP(ctx context.Context, voteID uint, ip string, since time.Time) (int64, error) {
+	var count int64
+	if err := db.WithContext(ctx).Model(&VoteSubmission{}).
+		Where("vote_id = ? AND voter_ip = ? AND created_at >= ?", voteID, ip, since).
+		Count(&count).Error; err != nil {
+		return 0, errors.Wrap(err, "count vote submissions by ip")
+	}
+	return count, nil
+}
+
+// HasUserVoted 判断登录用户是否已投过该投票（应用层预检查，返回友好提示；最终防重由唯一索引兜底）。
+func (db *voteSubmissions) HasUserVoted(ctx context.Context, voteID, userID uint) (bool, error) {
+	var count int64
+	if err := db.WithContext(ctx).Model(&VoteSubmission{}).
+		Where("vote_id = ? AND user_id = ?", voteID, userID).
+		Count(&count).Error; err != nil {
+		return false, errors.Wrap(err, "check user voted")
+	}
+	return count > 0, nil
+}
+
+// HasTokenVoted 判断匿名指纹是否已投过该投票。
+func (db *voteSubmissions) HasTokenVoted(ctx context.Context, voteID uint, token string) (bool, error) {
+	var count int64
+	if err := db.WithContext(ctx).Model(&VoteSubmission{}).
+		Where("vote_id = ? AND voter_token = ?", voteID, token).
+		Count(&count).Error; err != nil {
+		return false, errors.Wrap(err, "check token voted")
+	}
+	return count > 0, nil
+}
+
+// DeleteByVoteID 删除投票时级联清理全部提交记录。
+//
+// 使用 Unscoped 物理删除而非软删除：VoteSubmission 上的复合唯一索引
+// (vote_id, user_id)/(vote_id, voter_token) 不含 deleted_at，软删除会让被删行继续占据
+// 唯一槽位，导致"统计归零却无法重投"。级联删除发生在整个投票被删时，物理删除安全且正确。
+func (db *voteSubmissions) DeleteByVoteID(ctx context.Context, voteID uint) error {
+	if err := db.WithContext(ctx).Unscoped().Where("vote_id = ?", voteID).Delete(&VoteSubmission{}).Error; err != nil {
+		return errors.Wrap(err, "delete vote submissions by vote id")
+	}
+	return nil
+}
+
+// isDuplicateKeyError 判断数据库唯一索引冲突错误（MySQL 1062 / PostgreSQL 23505）。
+// 不依赖 GORM 的 TranslateError 配置（全局未开启），手动映射以保证语义化错误。
+func isDuplicateKeyError(err error) bool {
+	var mysqlErr *mysql.MySQLError
+	if errors.As(err, &mysqlErr) && mysqlErr.Number == 1062 {
+		return true
+	}
+	var pgErr *pgconn.PgError
+	if errors.As(err, &pgErr) && pgErr.Code == "23505" {
+		return true
+	}
+	return false
+}
diff --git a/internal/db/vote_submissions_test.go b/internal/db/vote_submissions_test.go
new file mode 100644
index 0000000..53b7a65
--- /dev/null
+++ b/internal/db/vote_submissions_test.go
@@ -0,0 +1,308 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package db
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"gorm.io/datatypes"
+
+	"github.com/tamakyi/TamaBox/internal/dbutil"
+)
+
+func TestVoteSubmissions(t *testing.T) {
+	t.Parallel()
+
+	db, cleanup := newTestDB(t)
+	ctx := context.Background()
+
+	store := NewVoteSubmissionsStore(db)
+
+	for _, tc := range []struct {
+		name string
+		test func(t *testing.T, ctx context.Context, db *voteSubmissions)
+	}{
+		{"Create", testVoteSubmissionsCreate},
+		{"UniqueUser", testVoteSubmissionsUniqueUser},
+		{"UniqueToken", testVoteSubmissionsUniqueToken},
+		{"UserAndAnonCoexist", testVoteSubmissionsUserAndAnonCoexist},
+		{"CrossVote", testVoteSubmissionsCrossVote},
+		{"Count", testVoteSubmissionsCount},
+		{"HasUserVoted", testVoteSubmissionsHasUserVoted},
+		{"HasTokenVoted", testVoteSubmissionsHasTokenVoted},
+		{"CountByIP", testVoteSubmissionsCountByIP},
+		{"ListByVoteID", testVoteSubmissionsListByVoteID},
+		{"DeleteByVoteID", testVoteSubmissionsDeleteByVoteID},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Cleanup(func() {
+				if err := cleanup("vote_submissions"); err != nil {
+					t.Fatal(err)
+				}
+			})
+			tc.test(t, ctx, store.(*voteSubmissions))
+		})
+	}
+}
+
+func userIDPtr(id uint) *uint   { return &id }
+func tokenPtr(s string) *string { return &s }
+
+func testVoteSubmissionsCreate(t *testing.T, ctx context.Context, db *voteSubmissions) {
+	got, err := db.Create(ctx, CreateVoteSubmissionOptions{
+		VoteID:   1,
+		OptionID: 2,
+		UserID:   userIDPtr(10),
+		VoterIP:  "114.5.1.4",
+	})
+	require.Nil(t, err)
+	require.Equal(t, uint(1), got.ID)
+	require.Equal(t, uint(10), *got.UserID)
+}
+
+// 核心防刷：同一登录用户对同一投票重复提交必须被数据库唯一索引拦截。
+func testVoteSubmissionsUniqueUser(t *testing.T, ctx context.Context, db *voteSubmissions) {
+	_, err := db.Create(ctx, CreateVoteSubmissionOptions{
+		VoteID:   1,
+		OptionID: 1,
+		UserID:   userIDPtr(10),
+		VoterIP:  "114.5.1.4",
+	})
+	require.Nil(t, err)
+
+	t.Run("duplicate rejected", func(t *testing.T) {
+		_, err := db.Create(ctx, CreateVoteSubmissionOptions{
+			VoteID:   1,
+			OptionID: 2,
+			UserID:   userIDPtr(10),
+			VoterIP:  "114.5.1.4",
+		})
+		require.Equal(t, ErrVoteAlreadyVoted, err)
+	})
+
+	t.Run("different user allowed", func(t *testing.T) {
+		_, err := db.Create(ctx, CreateVoteSubmissionOptions{
+			VoteID:   1,
+			OptionID: 1,
+			UserID:   userIDPtr(11),
+			VoterIP:  "114.5.1.5",
+		})
+		require.Nil(t, err)
+	})
+}
+
+// 核心防刷：同一匿名指纹对同一投票重复提交必须被拦截。
+func testVoteSubmissionsUniqueToken(t *testing.T, ctx context.Context, db *voteSubmissions) {
+	_, err := db.Create(ctx, CreateVoteSubmissionOptions{
+		VoteID:     1,
+		OptionID:   1,
+		VoterToken: tokenPtr("fp-token-001"),
+		VoterIP:    "114.5.1.4",
+	})
+	require.Nil(t, err)
+
+	t.Run("duplicate rejected", func(t *testing.T) {
+		_, err := db.Create(ctx, CreateVoteSubmissionOptions{
+			VoteID:     1,
+			OptionID:   2,
+			VoterToken: tokenPtr("fp-token-001"),
+			VoterIP:    "114.5.1.4",
+		})
+		require.Equal(t, ErrVoteAlreadyVoted, err)
+	})
+
+	t.Run("different token allowed", func(t *testing.T) {
+		_, err := db.Create(ctx, CreateVoteSubmissionOptions{
+			VoteID:     1,
+			OptionID:   1,
+			VoterToken: tokenPtr("fp-token-002"),
+			VoterIP:    "114.5.1.4",
+		})
+		require.Nil(t, err)
+	})
+}
+
+// 登录用户与匿名指纹可在同一投票下并存（user_id 为 NULL 与 voter_token 为 NULL 不冲突）。
+func testVoteSubmissionsUserAndAnonCoexist(t *testing.T, ctx context.Context, db *voteSubmissions) {
+	_, err := db.Create(ctx, CreateVoteSubmissionOptions{
+		VoteID:   1,
+		OptionID: 1,
+		UserID:   userIDPtr(10),
+		VoterIP:  "114.5.1.4",
+	})
+	require.Nil(t, err)
+
+	_, err = db.Create(ctx, CreateVoteSubmissionOptions{
+		VoteID:     1,
+		OptionID:   2,
+		VoterToken: tokenPtr("fp-anon-001"),
+		VoterIP:    "114.5.1.6",
+	})
+	require.Nil(t, err)
+
+	// 同一 user 换匿名 token 再来：user_id 相同仍应被拦截
+	_, err = db.Create(ctx, CreateVoteSubmissionOptions{
+		VoteID:     1,
+		OptionID:   1,
+		UserID:     userIDPtr(10),
+		VoterToken: tokenPtr("fp-anon-002"),
+		VoterIP:    "114.5.1.7",
+	})
+	require.Equal(t, ErrVoteAlreadyVoted, err)
+
+	count, err := db.CountByVoteID(ctx, 1)
+	require.Nil(t, err)
+	require.Equal(t, int64(2), count)
+}
+
+// 同一用户 / 同一 token 对不同投票不受约束。
+func testVoteSubmissionsCrossVote(t *testing.T, ctx context.Context, db *voteSubmissions) {
+	for voteID := uint(1); voteID <= 2; voteID++ {
+		_, err := db.Create(ctx, CreateVoteSubmissionOptions{
+			VoteID:   voteID,
+			OptionID: 1,
+			UserID:   userIDPtr(10),
+			VoterIP:  "114.5.1.4",
+		})
+		require.Nil(t, err)
+	}
+
+	// 同一 token 投两个不同投票也允许
+	_, err := db.Create(ctx, CreateVoteSubmissionOptions{
+		VoteID:     1,
+		OptionID:   1,
+		VoterToken: tokenPtr("fp-x"),
+		VoterIP:    "114.5.1.8",
+	})
+	require.Nil(t, err)
+	_, err = db.Create(ctx, CreateVoteSubmissionOptions{
+		VoteID:     2,
+		OptionID:   1,
+		VoterToken: tokenPtr("fp-x"),
+		VoterIP:    "114.5.1.8",
+	})
+	require.Nil(t, err)
+
+	count, err := db.CountByVoteID(ctx, 1)
+	require.Nil(t, err)
+	require.Equal(t, int64(2), count)
+}
+
+func testVoteSubmissionsCount(t *testing.T, ctx context.Context, db *voteSubmissions) {
+	// 投票 1：选项 1 两票，选项 2 一票
+	_, err := db.Create(ctx, CreateVoteSubmissionOptions{VoteID: 1, OptionID: 1, UserID: userIDPtr(1), VoterIP: "a"})
+	require.Nil(t, err)
+	_, err = db.Create(ctx, CreateVoteSubmissionOptions{VoteID: 1, OptionID: 1, UserID: userIDPtr(2), VoterIP: "b"})
+	require.Nil(t, err)
+	_, err = db.Create(ctx, CreateVoteSubmissionOptions{VoteID: 1, OptionID: 2, UserID: userIDPtr(3), VoterIP: "c"})
+	require.Nil(t, err)
+	// 投票 2：一票
+	_, err = db.Create(ctx, CreateVoteSubmissionOptions{VoteID: 2, OptionID: 1, UserID: userIDPtr(4), VoterIP: "d"})
+	require.Nil(t, err)
+
+	t.Run("total", func(t *testing.T) {
+		got, err := db.CountByVoteID(ctx, 1)
+		require.Nil(t, err)
+		require.Equal(t, int64(3), got)
+	})
+
+	t.Run("by option", func(t *testing.T) {
+		got, err := db.CountByOptionID(ctx, 1, 1)
+		require.Nil(t, err)
+		require.Equal(t, int64(2), got)
+
+		got, err = db.CountByOptionID(ctx, 1, 2)
+		require.Nil(t, err)
+		require.Equal(t, int64(1), got)
+	})
+
+	t.Run("empty", func(t *testing.T) {
+		got, err := db.CountByVoteID(ctx, 404)
+		require.Nil(t, err)
+		require.Equal(t, int64(0), got)
+	})
+}
+
+func testVoteSubmissionsHasUserVoted(t *testing.T, ctx context.Context, db *voteSubmissions) {
+	_, err := db.Create(ctx, CreateVoteSubmissionOptions{VoteID: 1, OptionID: 1, UserID: userIDPtr(10), VoterIP: "a"})
+	require.Nil(t, err)
+
+	got, err := db.HasUserVoted(ctx, 1, 10)
+	require.Nil(t, err)
+	require.True(t, got)
+
+	got, err = db.HasUserVoted(ctx, 1, 11)
+	require.Nil(t, err)
+	require.False(t, got)
+}
+
+func testVoteSubmissionsHasTokenVoted(t *testing.T, ctx context.Context, db *voteSubmissions) {
+	_, err := db.Create(ctx, CreateVoteSubmissionOptions{VoteID: 1, OptionID: 1, VoterToken: tokenPtr("fp-1"), VoterIP: "a"})
+	require.Nil(t, err)
+
+	got, err := db.HasTokenVoted(ctx, 1, "fp-1")
+	require.Nil(t, err)
+	require.True(t, got)
+
+	got, err = db.HasTokenVoted(ctx, 1, "fp-2")
+	require.Nil(t, err)
+	require.False(t, got)
+}
+
+func testVoteSubmissionsCountByIP(t *testing.T, ctx context.Context, db *voteSubmissions) {
+	since := time.Now().Add(-1 * time.Hour)
+	_, err := db.Create(ctx, CreateVoteSubmissionOptions{VoteID: 1, OptionID: 1, UserID: userIDPtr(1), VoterIP: "1.2.3.4"})
+	require.Nil(t, err)
+	_, err = db.Create(ctx, CreateVoteSubmissionOptions{VoteID: 1, OptionID: 1, UserID: userIDPtr(2), VoterIP: "1.2.3.4"})
+	require.Nil(t, err)
+	_, err = db.Create(ctx, CreateVoteSubmissionOptions{VoteID: 1, OptionID: 1, UserID: userIDPtr(3), VoterIP: "5.6.7.8"})
+	require.Nil(t, err)
+
+	got, err := db.CountByIP(ctx, 1, "1.2.3.4", since)
+	require.Nil(t, err)
+	require.Equal(t, int64(2), got)
+
+	got, err = db.CountByIP(ctx, 1, "5.6.7.8", since)
+	require.Nil(t, err)
+	require.Equal(t, int64(1), got)
+}
+
+func testVoteSubmissionsListByVoteID(t *testing.T, ctx context.Context, db *voteSubmissions) {
+	for i := 0; i < 3; i++ {
+		_, err := db.Create(ctx, CreateVoteSubmissionOptions{
+			VoteID:   1,
+			OptionID: 1,
+			UserID:   userIDPtr(uint(100 + i)),
+			VoterIP:  "x",
+			FormData: datatypes.JSON(`{"nickname":"user` + string(rune('0'+i)) + `"}`),
+		})
+		require.Nil(t, err)
+	}
+
+	got, err := db.ListByVoteID(ctx, 1, &dbutil.Cursor{Value: 2, PageSize: 10})
+	require.Nil(t, err)
+	require.Len(t, got, 1)
+	require.Equal(t, uint(1), got[0].ID, "游标取 id < 2 的记录")
+}
+
+func testVoteSubmissionsDeleteByVoteID(t *testing.T, ctx context.Context, db *voteSubmissions) {
+	_, err := db.Create(ctx, CreateVoteSubmissionOptions{VoteID: 1, OptionID: 1, UserID: userIDPtr(1), VoterIP: "a"})
+	require.Nil(t, err)
+	_, err = db.Create(ctx, CreateVoteSubmissionOptions{VoteID: 2, OptionID: 1, UserID: userIDPtr(2), VoterIP: "b"})
+	require.Nil(t, err)
+
+	require.Nil(t, db.DeleteByVoteID(ctx, 1))
+
+	got, err := db.CountByVoteID(ctx, 1)
+	require.Nil(t, err)
+	require.Equal(t, int64(0), got)
+
+	got, err = db.CountByVoteID(ctx, 2)
+	require.Nil(t, err)
+	require.Equal(t, int64(1), got)
+}
diff --git a/internal/db/votes.go b/internal/db/votes.go
new file mode 100644
index 0000000..aa713cf
--- /dev/null
+++ b/internal/db/votes.go
@@ -0,0 +1,377 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package db
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/thanhpk/randstr"
+	"gorm.io/datatypes"
+	"gorm.io/gorm"
+
+	"github.com/tamakyi/TamaBox/internal/dbutil"
+)
+
+var Votes VotesStore
+
+// 投票状态
+const (
+	VoteStatusDraft     = "draft"     // 草稿（未发布，不可访问）
+	VoteStatusPublished = "published" // 进行中
+	VoteStatusEnded     = "ended"     // 已结束
+	VoteStatusArchived  = "archived"  // 归档
+	// VoteStatusNotStarted 仅作为管理列表的"有效展示状态"（published + 未到开始时间），不入库。
+	VoteStatusNotStarted = "not_started"
+)
+
+// 投票类型（收集方式）
+const (
+	VoteTypeSingle   = "single"   // 单选
+	VoteTypeMultiple = "multiple" // 多选
+	VoteTypeRating   = "rating"   // 评分
+	VoteTypeRank     = "rank"     // 排序
+	VoteTypeForm     = "form"     // 结构化表单
+)
+
+// 展示可见性
+const (
+	VoteVisibilityPublic   = "public"    // 探索页 + 提问箱页公开展示
+	VoteVisibilityLinkOnly = "link_only" // 仅通过链接分享
+)
+
+// 投票范围
+const (
+	VoteVoterScopeAnyone         = "anyone"          // 完全匿名可投
+	VoteVoterScopeRegisteredOnly = "registered_only" // 仅注册用户可投
+)
+
+// 结果可见策略
+const (
+	VoteShowResultAfterVote = "after_vote" // 投票后立即可见
+	VoteShowResultAfterEnd  = "after_end"  // 结束后可见
+	VoteShowResultOwnerOnly = "owner_only" // 仅主人可见
+)
+
+type VotesStore interface {
+	Create(ctx context.Context, opts CreateVoteOptions) (*Vote, error)
+	GetByID(ctx context.Context, id uint) (*Vote, error)
+	GetByToken(ctx context.Context, token string) (*Vote, error)
+	ListByUserID(ctx context.Context, userID uint, opts ListVotesOptions) ([]*Vote, error)
+	ListPublishedPublicByUserID(ctx context.Context, userID uint, limit int) ([]*Vote, error)
+	ListPublishedPublic(ctx context.Context, limit int) ([]*Vote, error)
+	GetHot(ctx context.Context, limit int) ([]*Vote, error)
+	Update(ctx context.Context, id uint, opts UpdateVoteOptions) error
+	UpdateStatus(ctx context.Context, id uint, status string) error
+	DeleteByID(ctx context.Context, id uint) error
+	CountByUserID(ctx context.Context, userID uint) (int64, error)
+}
+
+func NewVotesStore(db *gorm.DB) VotesStore {
+	return &votes{db}
+}
+
+type votes struct {
+	*gorm.DB
+}
+
+type Vote struct {
+	dbutil.Model
+	UserID                 uint       `gorm:"index:idx_vote_user" json:"-"`
+	Title                  string     `gorm:"size:100" json:"title"`
+	Description            string     `gorm:"type:text" json:"description"`
+	Type                   string     `gorm:"size:20;default:single" json:"type"`
+	Status                 string     `gorm:"size:20;default:draft;index" json:"status"`
+	Visibility             string     `gorm:"size:20;default:public" json:"visibility"`
+	VoterScope             string     `gorm:"size:20;default:anyone" json:"voter_scope"`
+	ShowResult             string     `gorm:"size:20;default:after_vote" json:"show_result"`
+	AllowCustom            bool       `gorm:"default:false" json:"allow_custom"`
+	MaxChoices             int        `gorm:"default:1" json:"max_choices"`
+	StartAt                *time.Time `json:"start_at"`
+	EndAt                  *time.Time `json:"end_at"`
+	LinkToken              string     `gorm:"size:16;uniqueIndex" json:"-"`
+	MaxVotesPerFingerprint int        `gorm:"default:1" json:"-"`
+	// ⚠️ 不要给 RequireCaptcha 加 gorm:"default:true" 标签：GORM 在 Create 时会把零值 false
+	// 替换为字段默认值（true），导致「创建时不要求验证码」的配置被静默写成 true。
+	// 当前业务硬编码 requireCaptcha=true（决策 #3），去掉标签不影响现状，但消除同类陷阱。
+	RequireCaptcha bool           `json:"-"`
+	CensorMetadata datatypes.JSON `json:"-"`
+	// QuotaLimit 定量收集上限：收集到该份数后自动结束投票（0 表示不限制）。
+	// 与 EndAt 互补——EndAt 按时间关闭，QuotaLimit 按数量关闭。
+	QuotaLimit int `gorm:"default:0" json:"quota_limit"`
+}
+
+// BeforeCreate 自动生成链接分享 token（与私信 Conversation.Token 同款模式，
+// 不可枚举，防止通过数字 ID 扫描他人投票）。
+func (v *Vote) BeforeCreate(tx *gorm.DB) error {
+	if v.LinkToken == "" {
+		v.LinkToken = randstr.String(12)
+	}
+	return nil
+}
+
+type CreateVoteOptions struct {
+	UserID                 uint
+	Title                  string
+	Description            string
+	Type                   string
+	Visibility             string
+	VoterScope             string
+	ShowResult             string
+	AllowCustom            bool
+	MaxChoices             int
+	StartAt                *time.Time
+	EndAt                  *time.Time
+	MaxVotesPerFingerprint int
+	RequireCaptcha         bool
+	CensorMetadata         datatypes.JSON
+	QuotaLimit             int
+}
+
+func (db *votes) Create(ctx context.Context, opts CreateVoteOptions) (*Vote, error) {
+	vote := &Vote{
+		UserID:                 opts.UserID,
+		Title:                  opts.Title,
+		Description:            opts.Description,
+		Type:                   opts.Type,
+		Visibility:             opts.Visibility,
+		VoterScope:             opts.VoterScope,
+		ShowResult:             opts.ShowResult,
+		AllowCustom:            opts.AllowCustom,
+		MaxChoices:             opts.MaxChoices,
+		StartAt:                opts.StartAt,
+		EndAt:                  opts.EndAt,
+		MaxVotesPerFingerprint: opts.MaxVotesPerFingerprint,
+		RequireCaptcha:         opts.RequireCaptcha,
+		CensorMetadata:         opts.CensorMetadata,
+		QuotaLimit:             opts.QuotaLimit,
+	}
+	if err := db.WithContext(ctx).Create(vote).Error; err != nil {
+		return nil, errors.Wrap(err, "create vote")
+	}
+	return vote, nil
+}
+
+var ErrVoteNotExist = errors.New("投票不存在")
+
+func (db *votes) GetByID(ctx context.Context, id uint) (*Vote, error) {
+	var vote Vote
+	if err := db.WithContext(ctx).First(&vote, id).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, ErrVoteNotExist
+		}
+		return nil, errors.Wrap(err, "get vote by ID")
+	}
+	return &vote, nil
+}
+
+func (db *votes) GetByToken(ctx context.Context, token string) (*Vote, error) {
+	var vote Vote
+	if err := db.WithContext(ctx).Where("link_token = ?", token).First(&vote).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, ErrVoteNotExist
+		}
+		return nil, errors.Wrap(err, "get vote by token")
+	}
+	return &vote, nil
+}
+
+type ListVotesOptions struct {
+	*dbutil.Cursor
+	Status string // 空 = 全部；否则按状态筛选（draft/published/ended/archived）
+}
+
+// ListByUserID 根据箱主 ID 获取投票列表，支持游标分页与状态筛选。
+func (db *votes) ListByUserID(ctx context.Context, userID uint, opts ListVotesOptions) ([]*Vote, error) {
+	q := db.WithContext(ctx).Model(&Vote{}).Where("user_id = ?", userID)
+	if opts.Status != "" {
+		q = q.Where("status = ?", opts.Status)
+	}
+	if opts.Cursor != nil && opts.Cursor.Value != nil {
+		cursorStr := strings.TrimSpace(cursorValueToString(opts.Cursor.Value))
+		// 游标必须为纯数字 id：直接传 string 在 PG 下会因 integer < text 无操作符而报错。
+		if idVal, err := strconv.ParseUint(cursorStr, 10, 64); err == nil && idVal > 0 {
+			q = q.Where("id < ?", idVal)
+		}
+		// 解析失败则忽略该游标（从首页重新开始），与提问列表游标行为一致。
+	}
+	if opts.Cursor != nil {
+		q = q.Limit(opts.Cursor.Limit())
+	}
+	q = q.Order("created_at DESC")
+
+	var votes []*Vote
+	if err := q.Find(&votes).Error; err != nil {
+		return nil, errors.Wrap(err, "list votes by user id")
+	}
+	return votes, nil
+}
+
+// ListPublishedPublicByUserID 获取箱主"进行中"的公开投票（提问箱页内嵌板块用）：
+// status=published 且 visibility=public，且在开始/结束时间窗内，按创建时间倒序。
+func (db *votes) ListPublishedPublicByUserID(ctx context.Context, userID uint, limit int) ([]*Vote, error) {
+	if limit <= 0 {
+		limit = 3
+	}
+	now := time.Now()
+	q := db.WithContext(ctx).Model(&Vote{}).
+		Where("user_id = ? AND status = ? AND visibility = ?", userID, VoteStatusPublished, VoteVisibilityPublic).
+		Where("(start_at IS NULL OR start_at <= ?)", now).
+		Where("(end_at IS NULL OR end_at > ?)", now).
+		Order("created_at DESC").
+		Limit(limit)
+
+	var votes []*Vote
+	if err := q.Find(&votes).Error; err != nil {
+		return nil, errors.Wrap(err, "list published public votes by user id")
+	}
+	return votes, nil
+}
+
+// ListPublishedPublic 返回探索页可展示的公开投票，按创建时间倒序。
+func (db *votes) ListPublishedPublic(ctx context.Context, limit int) ([]*Vote, error) {
+	if limit <= 0 {
+		limit = 20
+	}
+	now := time.Now()
+	var votes []*Vote
+	err := db.WithContext(ctx).Model(&Vote{}).
+		Where("status = ? AND visibility = ?", VoteStatusPublished, VoteVisibilityPublic).
+		Where("(start_at IS NULL OR start_at <= ?)", now).
+		Where("(end_at IS NULL OR end_at > ?)", now).
+		Order("created_at DESC").
+		Limit(limit).Find(&votes).Error
+	if err != nil {
+		return nil, errors.Wrap(err, "list published public votes")
+	}
+	return votes, nil
+}
+
+// GetHot 返回探索页"热门投票"：进行中的公开投票，按参与人数倒序。
+// 参与数通过子查询聚合（跨 MySQL/PostgreSQL 兼容，规避 GROUP BY 全列要求）。
+func (db *votes) GetHot(ctx context.Context, limit int) ([]*Vote, error) {
+	if limit <= 0 {
+		limit = 6
+	}
+	now := time.Now()
+	sub := db.WithContext(ctx).Model(&VoteSubmission{}).
+		Select("vote_id, COUNT(id) AS cnt").
+		Where("deleted_at IS NULL").
+		Group("vote_id")
+
+	q := db.WithContext(ctx).Model(&Vote{}).
+		Select("votes.*").
+		Joins("LEFT JOIN (?) AS vote_stat ON vote_stat.vote_id = votes.id", sub).
+		Where("votes.status = ? AND votes.visibility = ?", VoteStatusPublished, VoteVisibilityPublic).
+		Where("(votes.start_at IS NULL OR votes.start_at <= ?)", now).
+		Where("(votes.end_at IS NULL OR votes.end_at > ?)", now).
+		Order("COALESCE(vote_stat.cnt, 0) DESC, votes.created_at DESC").
+		Limit(limit)
+
+	var votes []*Vote
+	if err := q.Find(&votes).Error; err != nil {
+		return nil, errors.Wrap(err, "get hot votes")
+	}
+	return votes, nil
+}
+
+type UpdateVoteOptions struct {
+	Title                  string
+	Description            string
+	Type                   *string
+	Visibility             string
+	VoterScope             string
+	ShowResult             string
+	AllowCustom            bool
+	MaxChoices             *int
+	StartAt                *time.Time
+	EndAt                  *time.Time
+	MaxVotesPerFingerprint int
+	RequireCaptcha         bool
+	CensorMetadata         datatypes.JSON
+	QuotaLimit             int
+}
+
+// Update 更新投票的可编辑字段（不含 Status，状态流转走 UpdateStatus）。
+func (db *votes) Update(ctx context.Context, id uint, opts UpdateVoteOptions) error {
+	updates := map[string]interface{}{
+		"title":                     opts.Title,
+		"description":               opts.Description,
+		"visibility":                opts.Visibility,
+		"voter_scope":               opts.VoterScope,
+		"show_result":               opts.ShowResult,
+		"allow_custom":              opts.AllowCustom,
+		"start_at":                  opts.StartAt,
+		"end_at":                    opts.EndAt,
+		"max_votes_per_fingerprint": opts.MaxVotesPerFingerprint,
+		"require_captcha":           opts.RequireCaptcha,
+		"censor_metadata":           opts.CensorMetadata,
+		"quota_limit":               opts.QuotaLimit,
+	}
+	// Type / MaxChoices 用指针承载：nil 表示「不修改」，db 层跳过写入，避免调用方漏传时
+	// 被 map 更新写成零值（曾导致发布后编辑把 type 写成 "" 的同类 bug）。草稿阶段显式传 &值
+	// 以设置；已发布编辑传 nil 以保留原值。
+	if opts.Type != nil {
+		updates["type"] = *opts.Type
+	}
+	if opts.MaxChoices != nil {
+		updates["max_choices"] = *opts.MaxChoices
+	}
+	res := db.WithContext(ctx).Model(&Vote{}).Where("id = ?", id).Updates(updates)
+	if res.Error != nil {
+		return errors.Wrap(res.Error, "update vote")
+	}
+	if res.RowsAffected == 0 {
+		return ErrVoteNotExist
+	}
+	return nil
+}
+
+// UpdateStatus 更新投票状态（draft → published → ended → archived）。
+func (db *votes) UpdateStatus(ctx context.Context, id uint, status string) error {
+	res := db.WithContext(ctx).Model(&Vote{}).Where("id = ?", id).Update("status", status)
+	if res.Error != nil {
+		return errors.Wrap(res.Error, "update vote status")
+	}
+	if res.RowsAffected == 0 {
+		return ErrVoteNotExist
+	}
+	return nil
+}
+
+func (db *votes) DeleteByID(ctx context.Context, id uint) error {
+	var vote Vote
+	if err := db.WithContext(ctx).First(&vote, id).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return ErrVoteNotExist
+		}
+		return errors.Wrap(err, "get vote by ID")
+	}
+	if err := db.WithContext(ctx).Delete(&Vote{}, id).Error; err != nil {
+		return errors.Wrap(err, "delete vote")
+	}
+	return nil
+}
+
+// CountByUserID 统计箱主的投票总数（全部状态）。
+func (db *votes) CountByUserID(ctx context.Context, userID uint) (int64, error) {
+	var count int64
+	if err := db.WithContext(ctx).Model(&Vote{}).Where("user_id = ?", userID).Count(&count).Error; err != nil {
+		return 0, errors.Wrap(err, "count votes by user id")
+	}
+	return count, nil
+}
+
+// cursorValueToString 将游标值转为字符串，兼容传入 uint / string。
+func cursorValueToString(v interface{}) string {
+	if s, ok := v.(string); ok {
+		return s
+	}
+	return fmt.Sprintf("%v", v)
+}
diff --git a/internal/db/votes_test.go b/internal/db/votes_test.go
new file mode 100644
index 0000000..449da9f
--- /dev/null
+++ b/internal/db/votes_test.go
@@ -0,0 +1,252 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package db
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/tamakyi/TamaBox/internal/dbutil"
+)
+
+func TestVotes(t *testing.T) {
+	t.Parallel()
+
+	db, cleanup := newTestDB(t)
+	ctx := context.Background()
+
+	store := NewVotesStore(db)
+
+	for _, tc := range []struct {
+		name string
+		test func(t *testing.T, ctx context.Context, db *votes)
+	}{
+		{"Create", testVotesCreate},
+		{"GetByID", testVotesGetByID},
+		{"GetByToken", testVotesGetByToken},
+		{"ListByUserID", testVotesListByUserID},
+		{"Update", testVotesUpdate},
+		{"UpdateStatus", testVotesUpdateStatus},
+		{"DeleteByID", testVotesDeleteByID},
+		{"CountByUserID", testVotesCountByUserID},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Cleanup(func() {
+				if err := cleanup("votes"); err != nil {
+					t.Fatal(err)
+				}
+			})
+			tc.test(t, ctx, store.(*votes))
+		})
+	}
+}
+
+func testVotesCreate(t *testing.T, ctx context.Context, db *votes) {
+	got, err := db.Create(ctx, CreateVoteOptions{
+		UserID:      1,
+		Title:       "今天穿什么？",
+		Description: "单选题",
+		Type:        VoteTypeSingle,
+		Visibility:  VoteVisibilityPublic,
+		VoterScope:  VoteVoterScopeAnyone,
+		ShowResult:  VoteShowResultAfterVote,
+		MaxChoices:  1,
+	})
+	require.Nil(t, err)
+	require.Equal(t, uint(1), got.ID)
+	require.NotEmpty(t, got.LinkToken, "LinkToken 应自动生成")
+	require.Equal(t, VoteStatusDraft, got.Status, "默认状态应为草稿")
+	// RequireCaptcha 不再被 gorm:"default:true" 隐式默认（零值陷阱已修复）：Create 未显式传入时按 false 落库。
+	// 业务层在创建/编辑投票时始终强制 requireCaptcha=true（决策 #3），真实投票行为不受影响。
+	require.False(t, got.RequireCaptcha, "底层 Create 不再隐式默认开启验证码")
+}
+
+func testVotesGetByID(t *testing.T, ctx context.Context, db *votes) {
+	_, err := db.Create(ctx, CreateVoteOptions{
+		UserID: 1,
+		Title:  "Title - 1",
+	})
+	require.Nil(t, err)
+
+	t.Run("normal", func(t *testing.T) {
+		got, err := db.GetByID(ctx, 1)
+		require.Nil(t, err)
+		require.Equal(t, "Title - 1", got.Title)
+		require.Equal(t, uint(1), got.UserID)
+	})
+
+	t.Run("not found", func(t *testing.T) {
+		_, err := db.GetByID(ctx, 404)
+		require.Equal(t, ErrVoteNotExist, err)
+	})
+}
+
+func testVotesGetByToken(t *testing.T, ctx context.Context, db *votes) {
+	created, err := db.Create(ctx, CreateVoteOptions{
+		UserID: 1,
+		Title:  "Title - 1",
+	})
+	require.Nil(t, err)
+
+	t.Run("normal", func(t *testing.T) {
+		got, err := db.GetByToken(ctx, created.LinkToken)
+		require.Nil(t, err)
+		require.Equal(t, created.ID, got.ID)
+	})
+
+	t.Run("not found", func(t *testing.T) {
+		_, err := db.GetByToken(ctx, "no-such-token")
+		require.Equal(t, ErrVoteNotExist, err)
+	})
+}
+
+func testVotesListByUserID(t *testing.T, ctx context.Context, db *votes) {
+	for i := 0; i < 3; i++ {
+		_, err := db.Create(ctx, CreateVoteOptions{
+			UserID: 1,
+			Title:  "Vote - 1",
+		})
+		require.Nil(t, err)
+	}
+	_, err := db.Create(ctx, CreateVoteOptions{
+		UserID: 2,
+		Title:  "Vote - 2",
+	})
+	require.Nil(t, err)
+
+	t.Run("all", func(t *testing.T) {
+		got, err := db.ListByUserID(ctx, 1, ListVotesOptions{})
+		require.Nil(t, err)
+		require.Len(t, got, 3)
+	})
+
+	t.Run("status filter", func(t *testing.T) {
+		err := db.UpdateStatus(ctx, 1, VoteStatusPublished)
+		require.Nil(t, err)
+
+		got, err := db.ListByUserID(ctx, 1, ListVotesOptions{Status: VoteStatusPublished})
+		require.Nil(t, err)
+		require.Len(t, got, 1)
+		require.Equal(t, uint(1), got[0].ID)
+	})
+
+	t.Run("cursor", func(t *testing.T) {
+		got, err := db.ListByUserID(ctx, 1, ListVotesOptions{
+			Cursor: &dbutil.Cursor{Value: 3, PageSize: 10},
+		})
+		require.Nil(t, err)
+		require.Len(t, got, 2)
+	})
+}
+
+func testVotesUpdate(t *testing.T, ctx context.Context, db *votes) {
+	_, err := db.Create(ctx, CreateVoteOptions{
+		UserID: 1,
+		Title:  "Title - 1",
+	})
+	require.Nil(t, err)
+
+	t.Run("normal", func(t *testing.T) {
+		vt := VoteTypeMultiple
+		mc := 3
+		err := db.Update(ctx, 1, UpdateVoteOptions{
+			Title:          "Title - updated",
+			Description:    "desc",
+			Type:           &vt,
+			Visibility:     VoteVisibilityLinkOnly,
+			VoterScope:     VoteVoterScopeRegisteredOnly,
+			ShowResult:     VoteShowResultAfterEnd,
+			MaxChoices:     &mc,
+			RequireCaptcha: false,
+		})
+		require.Nil(t, err)
+
+		got, err := db.GetByID(ctx, 1)
+		require.Nil(t, err)
+		require.Equal(t, "Title - updated", got.Title)
+		require.Equal(t, VoteTypeMultiple, got.Type)
+		require.Equal(t, VoteVisibilityLinkOnly, got.Visibility)
+		require.Equal(t, VoteVoterScopeRegisteredOnly, got.VoterScope)
+		require.Equal(t, VoteShowResultAfterEnd, got.ShowResult)
+		require.Equal(t, 3, got.MaxChoices)
+		require.False(t, got.RequireCaptcha)
+	})
+
+	// 回归：调用方漏传 Type/MaxChoices（nil 指针）时，db.Update 必须跳过写入，
+	// 不得把 type 写成 ""（曾导致发布后编辑使公开页报「未知的投票类型」）。
+	t.Run("omit type preserves existing", func(t *testing.T) {
+		err := db.Update(ctx, 1, UpdateVoteOptions{Title: "Title - meta only"})
+		require.Nil(t, err)
+
+		got, err := db.GetByID(ctx, 1)
+		require.Nil(t, err)
+		require.Equal(t, "Title - meta only", got.Title)
+		require.Equal(t, VoteTypeMultiple, got.Type, "type 不应被清零")
+		require.Equal(t, 3, got.MaxChoices, "max_choices 不应被清零")
+	})
+
+	t.Run("not found", func(t *testing.T) {
+		err := db.Update(ctx, 404, UpdateVoteOptions{Title: "x"})
+		require.Equal(t, ErrVoteNotExist, err)
+	})
+}
+
+func testVotesUpdateStatus(t *testing.T, ctx context.Context, db *votes) {
+	_, err := db.Create(ctx, CreateVoteOptions{
+		UserID: 1,
+		Title:  "Title - 1",
+	})
+	require.Nil(t, err)
+
+	t.Run("normal", func(t *testing.T) {
+		require.Nil(t, db.UpdateStatus(ctx, 1, VoteStatusPublished))
+		got, err := db.GetByID(ctx, 1)
+		require.Nil(t, err)
+		require.Equal(t, VoteStatusPublished, got.Status)
+
+		require.Nil(t, db.UpdateStatus(ctx, 1, VoteStatusEnded))
+		got, err = db.GetByID(ctx, 1)
+		require.Nil(t, err)
+		require.Equal(t, VoteStatusEnded, got.Status)
+	})
+
+	t.Run("not found", func(t *testing.T) {
+		require.Equal(t, ErrVoteNotExist, db.UpdateStatus(ctx, 404, VoteStatusEnded))
+	})
+}
+
+func testVotesDeleteByID(t *testing.T, ctx context.Context, db *votes) {
+	t.Run("normal", func(t *testing.T) {
+		_, err := db.Create(ctx, CreateVoteOptions{UserID: 1, Title: "Title - 1"})
+		require.Nil(t, err)
+
+		require.Nil(t, db.DeleteByID(ctx, 1))
+		_, err = db.GetByID(ctx, 1)
+		require.Equal(t, ErrVoteNotExist, err)
+	})
+
+	t.Run("not found", func(t *testing.T) {
+		require.Equal(t, ErrVoteNotExist, db.DeleteByID(ctx, 404))
+	})
+}
+
+func testVotesCountByUserID(t *testing.T, ctx context.Context, db *votes) {
+	_, err := db.Create(ctx, CreateVoteOptions{UserID: 1, Title: "A"})
+	require.Nil(t, err)
+	_, err = db.Create(ctx, CreateVoteOptions{UserID: 1, Title: "B"})
+	require.Nil(t, err)
+	_, err = db.Create(ctx, CreateVoteOptions{UserID: 2, Title: "C"})
+	require.Nil(t, err)
+
+	got, err := db.CountByUserID(ctx, 1)
+	require.Nil(t, err)
+	require.Equal(t, int64(2), got)
+
+	got, err = db.CountByUserID(ctx, 404)
+	require.Nil(t, err)
+	require.Equal(t, int64(0), got)
+}
diff --git a/internal/dbutil/clock.go b/internal/dbutil/clock.go
new file mode 100644
index 0000000..4740796
--- /dev/null
+++ b/internal/dbutil/clock.go
@@ -0,0 +1,11 @@
+// Copyright 2021 E99p1ant. All rights reserved.
+
+package dbutil
+
+import (
+	"time"
+)
+
+func Now() time.Time {
+	return time.Now().Truncate(time.Microsecond)
+}
diff --git a/internal/dbutil/model.go b/internal/dbutil/model.go
new file mode 100644
index 0000000..7b1b0f4
--- /dev/null
+++ b/internal/dbutil/model.go
@@ -0,0 +1,24 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package dbutil
+
+import (
+	"time"
+
+	"gorm.io/gorm"
+)
+
+// Model a basic GoLang struct which includes the following fields: ID, CreatedAt, UpdatedAt, DeletedAt
+// It may be embedded into your model or you may build your own model without it
+//
+//	type User struct {
+//	  gorm.Model
+//	}
+type Model struct {
+	ID        uint           `gorm:"primarykey" json:"id"`
+	CreatedAt time.Time      `json:"created_at"`
+	UpdatedAt time.Time      `json:"-"`
+	DeletedAt gorm.DeletedAt `gorm:"index" json:"-"`
+}
diff --git a/internal/dbutil/pagination.go b/internal/dbutil/pagination.go
new file mode 100644
index 0000000..c79ca3c
--- /dev/null
+++ b/internal/dbutil/pagination.go
@@ -0,0 +1,46 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package dbutil
+
+var (
+	DefaultPageSize    = 20
+	MaxDefaultPageSize = 100
+)
+
+type Pagination struct {
+	Page     int
+	PageSize int
+}
+
+// LimitOffset returns LIMIT and OFFSET parameter for SQL.
+// The first page is page 0.
+func (p Pagination) LimitOffset() (limit, offset int) {
+	page := p.Page
+	pageSize := p.PageSize
+
+	if page <= 0 {
+		page = 1
+	}
+	if pageSize < 1 {
+		pageSize = DefaultPageSize
+	}
+	return pageSize, (page - 1) * pageSize
+}
+
+type Cursor struct {
+	Value    interface{}
+	PageSize int
+}
+
+func (p Cursor) Limit() int {
+	pageSize := p.PageSize
+	if pageSize < 1 {
+		pageSize = DefaultPageSize
+	}
+	if pageSize > MaxDefaultPageSize {
+		pageSize = MaxDefaultPageSize
+	}
+	return pageSize
+}
diff --git a/internal/dbutil/testing.go b/internal/dbutil/testing.go
new file mode 100644
index 0000000..84d2ca6
--- /dev/null
+++ b/internal/dbutil/testing.go
@@ -0,0 +1,145 @@
+// Copyright 2023 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package dbutil
+
+import (
+	"context"
+	"flag"
+	"math/rand"
+	"net/url"
+	"os"
+	"strconv"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"gorm.io/driver/mysql"
+	"gorm.io/driver/postgres"
+	"gorm.io/gorm"
+)
+
+var flagParseOnce sync.Once
+
+func NewTestDB(t *testing.T, migrationTables ...interface{}) (testDB *gorm.DB, cleanup func(...string) error) {
+	dbType := os.Getenv("DB_TYPE")
+
+	var dsn string
+	var dialectFunc func(string) gorm.Dialector
+
+	switch dbType {
+	case "mysql":
+		dsn = os.ExpandEnv("$DB_USER:$DB_PASSWORD@tcp($DB_HOST:$DB_PORT)/$DB_DATABASE?charset=utf8mb4&parseTime=True&loc=Local")
+		dialectFunc = mysql.Open
+	case "postgres":
+		dsn = os.ExpandEnv("postgres://$DB_USER:$DB_PASSWORD@$DB_HOST:$DB_PORT?sslmode=disable")
+		dialectFunc = postgres.Open
+	default:
+		t.Fatalf("Unknown database type: %q", dbType)
+	}
+
+	db, err := gorm.Open(dialectFunc(dsn), &gorm.Config{
+		NowFunc:                Now,
+		SkipDefaultTransaction: true,
+	})
+	if err != nil {
+		t.Fatalf("Failed to open connection: %v", err)
+	}
+
+	ctx := context.Background()
+	rng := rand.New(rand.NewSource(time.Now().UnixNano()))
+	dbname := "tamabox-test-" + strconv.FormatUint(rng.Uint64(), 10)
+
+	err = db.WithContext(ctx).Exec(`CREATE DATABASE ` + QuoteIdentifier(dbType, dbname)).Error
+	if err != nil {
+		t.Fatalf("Failed to create test database: %v", err)
+	}
+
+	switch dbType {
+	case "mysql":
+		dsn = strings.ReplaceAll(dsn, os.Getenv("DB_DATABASE"), dbname)
+	case "postgres":
+		cfg, err := url.Parse(dsn)
+		if err != nil {
+			t.Fatalf("Failed to parse DSN")
+		}
+		cfg.Path = "/" + dbname
+		dsn = cfg.String()
+	}
+
+	flagParseOnce.Do(flag.Parse)
+
+	testDB, err = gorm.Open(dialectFunc(dsn), &gorm.Config{
+		NowFunc:                Now,
+		SkipDefaultTransaction: true,
+	})
+	if err != nil {
+		t.Fatalf("Failed to open test connection: %v", err)
+	}
+
+	err = testDB.AutoMigrate(migrationTables...)
+	if err != nil {
+		t.Fatalf("Failed to auto migrate tables: %v", err)
+	}
+
+	t.Cleanup(func() {
+		defer func() {
+			if database, err := db.DB(); err == nil {
+				_ = database.Close()
+			}
+		}()
+
+		if t.Failed() {
+			t.Logf("DATABASE %s left intact for inspection", dbname)
+			return
+		}
+
+		database, err := testDB.DB()
+		if err != nil {
+			t.Fatalf("Failed to get currently open database: %v", err)
+		}
+
+		err = database.Close()
+		if err != nil {
+			t.Fatalf("Failed to close currently open database: %v", err)
+		}
+
+		err = db.WithContext(ctx).Exec(`DROP DATABASE ` + QuoteIdentifier(dbType, dbname)).Error
+		if err != nil {
+			t.Fatalf("Failed to drop test database: %v", err)
+		}
+	})
+
+	return testDB, func(tables ...string) error {
+		if t.Failed() {
+			return nil
+		}
+
+		for _, table := range tables {
+			var query string
+			switch dbType {
+			case "mysql":
+				query = `TRUNCATE TABLE ` + QuoteIdentifier(dbType, table)
+			case "postgres":
+				query = `TRUNCATE TABLE ` + QuoteIdentifier(dbType, table) + ` RESTART IDENTITY CASCADE`
+			}
+
+			err := testDB.WithContext(ctx).Exec(query).Error
+			if err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+}
+
+// QuoteIdentifier quotes an "identifier" (e.g. a table or a column name) to be
+// used as part of an SQL statement.
+func QuoteIdentifier(typ, s string) string {
+	if typ == "postgres" {
+		return `"` + strings.ReplaceAll(s, `"`, `""`) + `"`
+	}
+	return "`" + strings.ReplaceAll(s, "`", "``") + "`"
+}
diff --git a/internal/form/auth.go b/internal/form/auth.go
new file mode 100644
index 0000000..4614ac5
--- /dev/null
+++ b/internal/form/auth.go
@@ -0,0 +1,31 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package form
+
+type Register struct {
+	Email          string `valid:"required;email;maxlen:100" label:"电子邮箱" msg:"form.register.email"`
+	Domain         string `valid:"required;alphadash;minlen:3;maxlen:20" label:"个性域名" msg:"form.register.domain"`
+	Name           string `valid:"required;maxlen:20" label:"昵称" msg:"form.register.name"`
+	Password       string `valid:"required;minlen:8;maxlen:30" label:"密码" msg:"form.register.password"`
+	RepeatPassword string `valid:"required;equal:Password" label:"重复密码" msg:"form.register.repeatPassword"`
+	Recaptcha      string `form:"g-recaptcha-response" valid:"required" label:"Recaptcha" msg:"form.register.recaptcha"`
+	Language       string `form:"language" label:"界面语言"` // 可选：注册时选择界面语言，留空使用站点默认
+}
+
+type Login struct {
+	Email     string `valid:"required;email;maxlen:100" label:"电子邮箱" msg:"form.email.required"`
+	Password  string `valid:"required" label:"密码" msg:"form.login.password"`
+	Recaptcha string `form:"g-recaptcha-response" valid:"required" label:"Recaptcha" msg:"form.recaptcha"`
+}
+
+type ForgotPassword struct {
+	Email     string `valid:"required;email;maxlen:100" label:"电子邮箱" msg:"form.email.required"`
+	Recaptcha string `form:"g-recaptcha-response" valid:"required" label:"Recaptcha" msg:"form.recaptcha"`
+}
+
+type RecoverPassword struct {
+	NewPassword    string `valid:"required;minlen:8;maxlen:30" label:"新密码" msg:"form.recover.newPassword"`
+	RepeatPassword string `valid:"required;equal:NewPassword" label:"重复密码" msg:"form.recover.repeatPassword"`
+}
diff --git a/internal/form/form.go b/internal/form/form.go
new file mode 100644
index 0000000..df6c37f
--- /dev/null
+++ b/internal/form/form.go
@@ -0,0 +1,172 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package form
+
+import (
+	"mime"
+	"mime/multipart"
+	"net/http"
+	"reflect"
+
+	"github.com/flamego/flamego"
+	"github.com/flamego/template"
+	"github.com/unknwon/com"
+	"github.com/wuhan005/govalid"
+
+	"github.com/tamakyi/TamaBox/internal/context"
+)
+
+type ErrorCategory string
+
+const (
+	ErrorCategoryDeserialization ErrorCategory = "deserialization"
+	ErrorCategoryValidation      ErrorCategory = "validation"
+)
+
+type Error struct {
+	Category ErrorCategory
+	Error    error
+}
+
+const (
+	// multipartMemoryLimit 是 multipart 解析时驻留内存的上限，超出部分由
+	// mime/multipart 落盘到临时文件。
+	multipartMemoryLimit = 10 << 20 // 10 MiB
+
+	// MaxRequestBodySize 是单次请求体的**总**大小上限（含落盘部分）。
+	//
+	// ⚠️ 必须显式限制：ParseMultipartForm 的参数只约束内存缓冲，超出部分会无上限地
+	// 写入临时文件。匿名可达的提问接口即接受 multipart，若不加总量限制，攻击者可持续
+	// POST 超大 body 撑满磁盘（http.Server 的 ReadTimeout 在高带宽下不足以形成约束）。
+	// 略高于内存上限，为 multipart 边界与其他表单字段留出开销。
+	// 导出供 internal/route 的全局 requestBodyLimitMiddleware 复用同一上限：
+	// 仅靠本 Bind 内的 MaxBytesReader 不够——Contexter 组级 CSRF 校验先于 Bind 执行，
+	// 无 X-CSRF-Token 头时它会整包惰性解析 body，超大 multipart 会在 Bind 限制生效前
+	// 落盘；全局中间件把上限提前到一切解析之前（见 internal/route/bodylimit.go）。
+	MaxRequestBodySize = 12 << 20 // 12 MiB
+)
+
+func Bind(model interface{}) flamego.Handler {
+	// Ensure not pointer.
+	if reflect.TypeOf(model).Kind() == reflect.Ptr {
+		panic("form: pointer can not be accepted as binding model")
+	}
+
+	return func(c context.Context, data template.Data) {
+		obj := reflect.New(reflect.TypeOf(model))
+		defer func() { c.Map(obj.Elem().Interface()) }()
+
+		r := c.Request()
+
+		// 在任何解析之前封顶请求体总大小。
+		// 注意：c.Request() 返回 flamego 的包装类型，其 Body 是方法而非字段，
+		// 必须取内嵌的 *http.Request 才能替换 Body。
+		// MaxBytesReader 在超限时让后续 Read 返回错误，从而使 ParseForm /
+		// ParseMultipartForm 失败并走下方的反序列化错误分支，避免超大 body 落盘或读入内存。
+		httpReq := r.Request
+		httpReq.Body = http.MaxBytesReader(c.ResponseWriter(), httpReq.Body, MaxRequestBodySize)
+
+		contentType, _, _ := mime.ParseMediaType(r.Header.Get("Content-Type"))
+		switch contentType {
+		case "application/x-www-form-urlencoded", "":
+			if err := r.ParseForm(); err != nil {
+				// ⚠️ 必须同时 SetError（写响应则在此提前中止）：flamego 的 handler 链
+				// 只要响应未写入就会自动执行下一 handler，仅 Map(Error) 不中断链，
+				// 零值结构体会照常进入业务动作（如把用户资料/屏蔽词静默清空、解除页面密码）。
+				// SetError 置位 HasError，业务 action 开头若检查 ctx.HasError() 即会早退；
+				// 不检查的 action 也已在 route/user 各 handler 补了 abortOnFormError 守卫。
+				c.SetError(err)
+				c.Map(Error{Category: ErrorCategoryDeserialization, Error: err})
+				return
+			}
+		case "multipart/form-data":
+			if err := r.ParseMultipartForm(multipartMemoryLimit); err != nil {
+				c.SetError(err)
+				c.Map(Error{Category: ErrorCategoryDeserialization, Error: err})
+				return
+			}
+		}
+
+		// Bind the form data to the given struct.
+		typ := reflect.TypeOf(obj.Interface())
+		val := reflect.ValueOf(obj.Interface())
+		if typ.Kind() == reflect.Ptr {
+			typ = typ.Elem()
+			val = val.Elem()
+		}
+		for i := 0; i < typ.NumField(); i++ {
+			field := typ.Field(i)
+			fieldName := typ.Field(i).Tag.Get("form")
+			if fieldName == "" {
+				fieldName = com.ToSnakeCase(field.Name)
+			}
+
+			if r.MultipartForm != nil {
+				fhType := reflect.TypeOf((*multipart.FileHeader)(nil))
+
+				value, ok := r.MultipartForm.Value[fieldName]
+				if ok {
+					if val.Field(i).Kind() == reflect.Slice && val.Field(i).Type().Elem() == fhType {
+						continue
+					}
+
+					// FIXME: We don't implement the slice type yet.
+					val.Field(i).Set(reflect.ValueOf(value[0]))
+				} else {
+					value, ok := r.MultipartForm.File[fieldName]
+					if ok {
+						numElems := len(value)
+
+						if val.Field(i).Kind() == reflect.Slice && numElems > 0 && val.Field(i).Type().Elem() == fhType {
+							slice := reflect.MakeSlice(val.Field(i).Type(), numElems, numElems)
+							for i := 0; i < numElems; i++ {
+								slice.Index(i).Set(reflect.ValueOf(value[i]))
+							}
+							val.Field(i).Set(slice)
+						} else if val.Field(i).Type() == fhType {
+							val.Field(i).Set(reflect.ValueOf(value[0]))
+						}
+					}
+				}
+			} else {
+				// 非 multipart 请求（application/x-www-form-urlencoded）：仅绑定 string 字段。
+				// 其余类型（如 []*multipart.FileHeader 图片字段）保持零值，
+				// 否则 reflect.Set 会因类型不匹配 panic（string → []*multipart.FileHeader）。
+				// 此前提问表单因带 enctype="multipart/form-data" 走上面分支而从未触发；
+				// 独立私聊表单等纯文本提交会命中此路径，必须先做类型判断。
+				if val.Field(i).Kind() == reflect.String {
+					val.Field(i).Set(reflect.ValueOf(r.Form.Get(fieldName)))
+				}
+			}
+		}
+
+		errors, ok := govalid.Check(obj.Interface())
+		if !ok {
+			Assign(obj.Interface(), data)
+
+			c.SetError(errors[0])
+			c.Map(Error{Category: ErrorCategoryValidation, Error: errors[0]})
+			return
+		}
+	}
+}
+
+// Assign assigns form values back to the template data.
+func Assign(form interface{}, data map[string]interface{}) {
+	typ := reflect.TypeOf(form)
+	val := reflect.ValueOf(form)
+
+	if typ.Kind() == reflect.Ptr {
+		typ = typ.Elem()
+		val = val.Elem()
+	}
+
+	for i := 0; i < typ.NumField(); i++ {
+		field := typ.Field(i)
+		fieldName := com.ToSnakeCase(field.Name)
+
+		data[fieldName] = val.Field(i).Interface()
+	}
+}
diff --git a/internal/form/form_test.go b/internal/form/form_test.go
new file mode 100644
index 0000000..18fadb2
--- /dev/null
+++ b/internal/form/form_test.go
@@ -0,0 +1,94 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package form
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/flamego/flamego"
+	"github.com/flamego/template"
+
+	"github.com/tamakyi/TamaBox/internal/context"
+)
+
+// TestBindURLEncodedSkipsFileHeaderField 回归测试：application/x-www-form-urlencoded 提交
+// 到带 []*multipart.FileHeader 字段的结构体时不应 panic。
+//
+// 背景：Bind 的非 multipart 分支曾对所有字段无条件 Set(string)，遇到 NewQuestion.Images
+// （[]*multipart.FileHeader）触发 reflect.Set 类型不匹配 panic（提问表单因带
+// enctype="multipart/form-data" 走 multipart 分支而从未触发；独立私聊表单等纯文本提交
+// 会命中此路径，导致提问关闭时提交私聊 500）。
+func TestBindURLEncodedSkipsFileHeaderField(t *testing.T) {
+	f := flamego.New()
+	// 最小依赖注入：提供项目 context.Context 与 template.Data（Bind 仅用到这两个参数）。
+	f.Use(func(ctx flamego.Context) {
+		data := template.Data{}
+		ctx.Map(context.Context{Context: ctx, Data: data})
+		ctx.Map(data)
+	})
+
+	var bound NewQuestion
+	f.Post("/", Bind(NewQuestion{}), func(q NewQuestion) {
+		bound = q
+	})
+
+	req := httptest.NewRequest(http.MethodPost, "/",
+		strings.NewReader("content=你好&start_chat_val=true"))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	rec := httptest.NewRecorder()
+	f.ServeHTTP(rec, req)
+
+	if rec.Code >= http.StatusInternalServerError {
+		t.Fatalf("unexpected status %d, want < 500 (reflect.Set panic 不应发生)", rec.Code)
+	}
+	if bound.Content != "你好" {
+		t.Fatalf("Content = %q, want %q", bound.Content, "你好")
+	}
+	if bound.StartChat != "true" {
+		t.Fatalf("StartChat = %q, want %q", bound.StartChat, "true")
+	}
+	if bound.Images != nil {
+		t.Fatalf("Images = %v, want nil（非 multipart 请求应跳过图片字段）", bound.Images)
+	}
+}
+
+// TestBindMultipartStillBindsImages 确认 multipart 分支（提问表单路径）不受影响：
+// 文件字段仍能正常绑定。
+func TestBindMultipartStillBindsImages(t *testing.T) {
+	f := flamego.New()
+	f.Use(func(ctx flamego.Context) {
+		data := template.Data{}
+		ctx.Map(context.Context{Context: ctx, Data: data})
+		ctx.Map(data)
+	})
+
+	var bound NewQuestion
+	f.Post("/", Bind(NewQuestion{}), func(q NewQuestion) {
+		bound = q
+	})
+
+	// multipart 请求，携带一个普通字段，无文件
+	body := "--BOUND\r\n" +
+		"Content-Disposition: form-data; name=\"content\"\r\n\r\n" +
+		"hello\r\n" +
+		"--BOUND--\r\n"
+	req := httptest.NewRequest(http.MethodPost, "/", strings.NewReader(body))
+	req.Header.Set("Content-Type", "multipart/form-data; boundary=BOUND")
+	rec := httptest.NewRecorder()
+	f.ServeHTTP(rec, req)
+
+	if rec.Code >= http.StatusInternalServerError {
+		t.Fatalf("unexpected status %d, want < 500", rec.Code)
+	}
+	if bound.Content != "hello" {
+		t.Fatalf("Content = %q, want %q", bound.Content, "hello")
+	}
+	if bound.Images != nil {
+		t.Fatalf("Images = %v, want nil", bound.Images)
+	}
+}
diff --git a/internal/form/question.go b/internal/form/question.go
new file mode 100644
index 0000000..d64ef24
--- /dev/null
+++ b/internal/form/question.go
@@ -0,0 +1,43 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package form
+
+import (
+	"mime/multipart"
+)
+
+// 注意：以下结构体的 Content / Answer 字段刻意不再带 govalid 的 maxlen 标签 ——
+// struct tag 是编译期常量，无法跟随 conf/app.ini 的 [limits] 段调整（历史上写死 2000，
+// 与前端 maxlength 不一致且无法调参）。长度上限改由各路由 handler 读取
+// conf.Limits.QuestionContentLen / AnswerContentLen / FollowUpContentLen 做 rune 校验。
+type NewQuestion struct {
+	Content              string `form:"content" valid:"required" label:"问题内容" msg:"form.question.content"`
+	ReceiveReplyViaEmail string
+	ReceiveReplyEmail    string                  `valid:"email;maxlen:254" label:"接收回复的电子邮箱" msg:"form.question.receiveReplyEmail"`
+	Recaptcha            string                  `form:"g-recaptcha-response" valid:"required" label:"Recaptcha" msg:"form.recaptcha"`
+	Images               []*multipart.FileHeader `form:"images" label:"图片"`
+	IsPrivate            string                  `form:"private"`
+	AskPassword          string                  `form:"ask_password" label:"提问密码"`
+	StartChat            string                  `form:"start_chat_val"`
+}
+
+type PublishAnswerQuestion struct {
+	Answer string                  `form:"answer" valid:"required" label:"回答内容" msg:"form.answer.content"`
+	Images []*multipart.FileHeader `form:"images" label:"图片"`
+}
+
+type UpdateAnswerQuestion struct {
+	Answer string                  `form:"answer" valid:"required" label:"回答内容" msg:"form.answer.content"`
+	Images []*multipart.FileHeader `form:"images" label:"图片"`
+}
+
+type PublishFollowUpQuestion struct {
+	Content string `form:"content" valid:"required" label:"追问内容" msg:"form.followup.content"`
+	Token   string `form:"token"`
+}
+
+type AnswerFollowUpQuestion struct {
+	Answer string `form:"answer" valid:"required" label:"追问回答" msg:"form.followup.answer"`
+}
diff --git a/internal/form/user.go b/internal/form/user.go
new file mode 100644
index 0000000..ff1fb9e
--- /dev/null
+++ b/internal/form/user.go
@@ -0,0 +1,53 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package form
+
+type UpdateProfile struct {
+	Name                 string `valid:"required;maxlen:20" label:"昵称" msg:"form.profile.name"`
+	OldPassword          string `label:"旧密码"`
+	NewPassword          string `valid:"maxlen:30" label:"新密码" msg:"form.profile.passwordMax"`
+	Intro                string `valid:"required;maxlen:100" label:"介绍" msg:"form.profile.intro"`
+	Usernamecolor        string `valid:"required;minlen:7;maxlen:7" label:"用户名颜色" msg:"form.profile.colorHex"`
+	Introcolor           string `valid:"required;minlen:7;maxlen:7" label:"个人说明颜色" msg:"form.profile.colorHex"`
+	Qrcodebackcolor      string `valid:"required;minlen:7;maxlen:7" label:"二维码背景色" msg:"form.profile.colorHex"`
+	Qrcodecolor          string `valid:"required;minlen:7;maxlen:7" label:"二维码前景色" msg:"form.profile.colorHex"`
+	Dotscale             string `valid:"required" label:"二维码点大小" msg:"form.profile.dotscale"`
+	Backgroundimagealpha string `valid:"required" label:"二维码背景透明度" msg:"form.profile.backgroundimagealpha"`
+	Qrcodepdpcolor       string `valid:"required;minlen:7;maxlen:7" label:"二维码探测图形颜色" msg:"form.profile.colorHex"`
+	NotifyEmail          string `label:"开启邮箱通知"`
+	Acfunlink            string `valid:"maxlen:30" label:"AcFun主页" msg:"form.profile.linkMax"`
+	Bililink             string `valid:"maxlen:30" label:"Bili主页" msg:"form.profile.linkMax"`
+	Weibolink            string `valid:"maxlen:30" label:"微博主页" msg:"form.profile.linkMax"`
+	Bloglink             string `valid:"maxlen:30" label:"博客主页" msg:"form.profile.linkMax"`
+	Xiaohongshulink      string `valid:"maxlen:30" label:"小红书主页" msg:"form.profile.linkMax"`
+	UseCustomQRColor     string `form:"use_custom_qr_color"`
+	Language             string `form:"language"`
+}
+
+// UpdateHarassment 仅「允许注册用户向我提问」开关（防骚扰类型）。
+// 全局屏蔽词为独立入口 UpdateBlockWords：二者分处不同设置面板保存，
+// 若仍共用一个结构体会互相覆盖对方字段（见 route/user/harassment.go 注释）。
+type UpdateHarassment struct {
+	RegisterOnly string `label:"仅允许注册用户"`
+}
+
+type UpdateBlockWords struct {
+	BlockWords string `label:"屏蔽词"`
+}
+
+type UpdateTags struct {
+	Tags       string `form:"tags"`
+	ShowInHome string `form:"show_in_home"`
+}
+
+// 新增：页面访问密码表单
+type UpdatePagePassword struct {
+	Password string `valid:"maxlen:30" label:"页面访问密码" msg:"form.profile.passwordMax"` // 留空表示关闭
+}
+
+// 新增：提问密码表单
+type UpdateAskPassword struct {
+	Password string `valid:"maxlen:30" label:"提问密码" msg:"form.profile.passwordMax"` // 留空表示关闭
+}
diff --git a/internal/i18n/dict_en.go b/internal/i18n/dict_en.go
new file mode 100644
index 0000000..ae7d11c
--- /dev/null
+++ b/internal/i18n/dict_en.go
@@ -0,0 +1,840 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package i18n
+
+// enDict English copy.
+var enDict = map[string]string{
+	// Navigation
+	"nav.explore":  "Explore",
+	"nav.mine":     "Mine",
+	"nav.register": "Sign up",
+	"nav.login":    "Log in",
+	"nav.ask":      "Ask",
+	"nav.settings": "Settings",
+	"nav.lang":     "Language",
+
+	// Common
+	"common.login":      "Log in",
+	"common.forgot":     "Forgot password",
+	"common.submit":     "Submit",
+	"common.cancel":     "Cancel",
+	"common.save":       "Save",
+	"common.close":      "Close",
+	"common.delete":     "Delete",
+	"common.moveUp":     "Move up",
+	"common.moveDown":   "Move down",
+	"common.share":      "Share",
+	"common.verifying":  "Verifying...",
+	"common.submitting": "Submitting...",
+	"common.uploading":  "Uploading...",
+	"common.lang":       "Language",
+	"common.menu":       "Menu",
+
+	"common.pleaseWait": "Please wait...",
+	"common.backHome":   "Back to Home",
+	"common.theme":      "Toggle dark/light mode",
+
+	// Site
+	"site.title":          "Wolf's Question Box | Anonymous Question Box",
+	"site.description":    "Wolf's Question Box is an anonymous question box — ask me anything without signing up, a safe space to share and respond.",
+	"site.keywords":       "Anonymous Question Box,question box,anonymous ask,ask anonymously,Wolf's Question Box,anonymous Q&A",
+	"site.footer.runtime": "The box has been alive for",
+	"site.footer.admin":   "Contact admin",
+	"site.footer.notice":  "Announcements",
+	"site.footer.chat":    "Chat room",
+	"site.footer.drive":   "Drive",
+	"site.footer.status":  "Status",
+	"site.footer.nav":     "Links",
+	"site.maintenance":    "The site is under maintenance. Please come back later ~",
+
+	// Auth
+	"auth.login.title":       "User Log in",
+	"auth.login.email":       "Email",
+	"auth.login.password":    "Password",
+	"auth.login.submit":      "Log in",
+	"auth.login.forgot":      "Forgot password",
+	"auth.register.title":    "User Sign up",
+	"auth.register.name":     "Nickname",
+	"auth.register.email":    "Email",
+	"auth.register.password": "Password",
+	"auth.register.submit":   "Sign up",
+	"auth.forgot.title":      "Forgot password",
+	"auth.forgot.email":      "Email",
+	"auth.forgot.submit":     "Send reset email",
+	"auth.forgot.submitBtn":  "Recover password",
+	"auth.forgot.sent":       "An email has been sent to %s, please check your inbox.",
+	"auth.recover.title":     "Reset password",
+	"auth.recover.greeting":  "%s, you are resetting your password:",
+	"auth.recover.password":  "New password",
+	"auth.recover.confirm":   "Confirm password",
+	"auth.recover.submit":    "Reset password",
+
+	// Explore
+	"explore.title":        "Explore User Tags",
+	"explore.notice":       "Here you can find users who enabled <span class=\"uk-text-bold\">\"Show my tags on the homepage\"</span>. This feature is off by default. To get discovered here, go to <a href=\"/user/profile\" class=\"uk-text-bold\">your profile settings</a> and enable it.",
+	"explore.shuffle":      "Shuffle",
+	"explore.empty":        "No users to show yet. Enable it and be the first!",
+	"explore.hotVotes":     "Hot polls",
+	"explore.questionsTab": "Questions",
+	"explore.votesTab":     "Polls",
+	"explore.votesTitle":   "Public polls",
+	"explore.votesDesc":    "Browse active public polls and join the topics that interest you.",
+	"explore.randomVote":   "Random pick",
+	"explore.allVotes":     "All polls",
+	"explore.noVotes":      "There are no public polls available right now.",
+
+	// Ask page
+	"ask.scan":              "Scan to ask @%s",
+	"ask.anonymous":         "Anyone can ask anonymously",
+	"ask.registerOnly":      "Only registered users can ask",
+	"ask.nextOpenAt":        "Next opening: %s",
+	"ask.lastCloseAt":       "Last closed: %s",
+	"weekday.0":             "Sun",
+	"weekday.1":             "Mon",
+	"weekday.2":             "Tue",
+	"weekday.3":             "Wed",
+	"weekday.4":             "Thu",
+	"weekday.5":             "Fri",
+	"weekday.6":             "Sat",
+	"ask.pinned":            "Pinned",
+	"ask.share":             "Share this box",
+	"ask.placeholder":       "Write your question here...",
+	"ask.chatPlaceholder":   "Write your chat message here...",
+	"ask.addImage":          "Add image",
+	"ask.private":           "Don't publish after reply",
+	"ask.notify":            "Notify me",
+	"ask.emailPlaceholder":  "Enter your email address",
+	"ask.submit":            "Send question",
+	"ask.chat":              "Start a chat",
+	"ask.chatDisabled":      "Chat is disabled on this box",
+	"ask.chatLimit":         "Message limit: %d",
+	"ask.history":           "Previously answered by @%s",
+	"ask.loginRequired":     "Log in required",
+	"ask.loginRequiredChat": "You need to log in to start a chat",
+	"ask.goLogin":           "Go to login",
+	"ask.needPassword":      "This box requires a password",
+	"ask.needLogin":         "The owner only allows registered users to ask questions. Please log in first.",
+	"ask.pleaseEmail":       "Please enter your email to receive notifications",
+	"ask.generating":        "Generating share card…",
+	"ask.genFailed":         "Failed to generate share card. Please try again later",
+	"ask.networkError":      "Network error",
+	"ask.shareFilename":     "share.png",
+
+	// Question item
+	"qitem.answer":            "Answer",
+	"qitem.delete":            "Delete",
+	"qitem.private":           "Make private",
+	"qitem.public":            "Make public",
+	"qitem.asked":             "Asked",
+	"qitem.pending":           "Pending reply",
+	"qitem.answeredBy":        "Answer by @%s on %s",
+	"qitem.danger":            "Danger!",
+	"qitem.deleteConfirm":     "Are you sure you want to delete this question? This cannot be undone.",
+	"qitem.deleteConfirmBtn":  "Yes, delete",
+	"qitem.backToBox":         "Back to %s's question box",
+	"qitem.answerTitle":       "Answer the question",
+	"qitem.answerPlaceholder": "Write your answer here...",
+	"qitem.emailNotifyHint":   "The asker left their email. Once you answer this question for the first time, they will receive an email notification.",
+	"qitem.submitAnswer":      "Answer",
+	"qitem.updateAnswer":      "Update answer",
+	"qitem.askMore":           "Ask something else?",
+	"qitem.markRead":          "Mark as read",
+	"qitem.markUnread":        "Mark as unread",
+	"qitem.readLocked":        "Answered, locked as read",
+
+	// Admin / profile page
+	"admin.profile":           "Profile",
+	"admin.lang":              "Language",
+	"admin.langHint":          "Choose the language visitors see when they open your question box (admin pages follow this too)",
+	"admin.email":             "Email",
+	"admin.name":              "Nickname",
+	"admin.nameColor":         "Nickname color",
+	"admin.oldPassword":       "Old password",
+	"admin.newPassword":       "New password",
+	"admin.notify":            "New question notifications",
+	"admin.personalize":       "Customization",
+	"admin.intro":             "Box introduction",
+	"admin.introColor":        "Introduction color",
+	"admin.qrBgColor":         "QR background color (light part)",
+	"admin.qrPdColor":         "QR finder pattern color (corner squares)",
+	"admin.qrFgColor":         "QR foreground color",
+	"admin.qrDotSize":         "QR dot size (←small large→)",
+	"admin.qrBgAlpha":         "QR background opacity (←opaque transparent→)",
+	"admin.avatar":            "Avatar",
+	"admin.background":        "Box background",
+	"admin.qrBackground":      "QR background image",
+	"admin.social":            "Social links",
+	"admin.harassment":        "Anti-harassment",
+	"admin.askLimit":          "Asking restriction",
+	"admin.blockWords":        "Blocked words (press Enter or comma to add, up to 10 words, 10 characters each)",
+	"admin.chat":              "Chat settings",
+	"admin.chatMaxMessages":   "Max messages per chat",
+	"admin.chatDailyLimit":    "Daily message limit per user",
+	"admin.tags":              "Tags",
+	"admin.tagsHint":          "Tags (up to 5, 5 characters each, press Enter or comma to add)",
+	"admin.tagsPlaceholder":   "e.g. anime, music, games",
+	"admin.tagInputHint":      "Type and press Enter or comma to add",
+	"admin.tagInputDuplicate": "Already exists, ignored",
+	"admin.pagePassword":      "Page access password",
+	"admin.pagePasswordHint":  "Set a page password (leave empty to disable)",
+	"admin.askPassword":       "Ask password",
+	"admin.askPasswordHint":   "Set a password for asking (leave empty to disable)",
+	"admin.saveProfile":       "Save changes",
+	"admin.updated":           "Profile updated successfully",
+	"admin.logout":            "Log out",
+	"admin.export":            "Export data",
+
+	// Admin settings (additional)
+	"admin.oldPasswordHint":         "Only needed when changing password; leave empty to keep it unchanged",
+	"admin.newPasswordHint":         "6-64 characters; leave empty to keep it unchanged",
+	"admin.notifyEmail":             "Email",
+	"admin.useCustomFg":             "Use custom foreground color (otherwise auto-matched)",
+	"admin.customFgHint":            "Only takes effect when enabled; otherwise the color is auto-generated",
+	"admin.avatarPlaceholder":       "Upload avatar (non-1:1 images will be squished)",
+	"admin.backgroundPlaceholder":   "Upload box background",
+	"admin.qrBackgroundPlaceholder": "Upload QR background (a background that is too dark may make the QR code unreadable)",
+	"admin.qrPreviewHint":           "The preview updates instantly after choosing an image",
+	"admin.preview":                 "Live preview",
+	"admin.themePreset":             "Preset themes",
+	"admin.themeDefault":            "Default",
+	"admin.themeDark":               "Dark",
+	"admin.themeOcean":              "Ocean",
+	"admin.themeSunset":             "Sunset",
+	"admin.resetDefaults":           "🔄 Reset to defaults",
+	"admin.previewHint":             "Adjustments are for preview only; click \"Save changes\" to apply",
+	"admin.socialHint":              "Check the box and fill in the profile URL (no https:// needed). Unchecked items won't be shown on your page.",
+	"admin.enableAcfun":             "Enable AcFun",
+	"admin.enableBili":              "Enable Bilibili",
+	"admin.enableWeibo":             "Enable Weibo",
+	"admin.enableXiaohongshu":       "Enable Xiaohongshu",
+	"admin.enableBlog":              "Enable Personal Blog",
+	"admin.registerOnly":            "Only allow registered users to ask me questions",
+	"admin.updateHarassment":        "Update anti-harassment settings",
+	"admin.globalBlockWords":        "Global blocked words",
+	"admin.globalBlockWordsHint":    "Blocked words apply to questions, chat messages sent to you, and vote submissions. This single setting is shared across the question / chat / vote panels and takes effect immediately from any of them.",
+	"admin.updateBlockWords":        "Save blocked words",
+	"admin.allowChat":               "Allow registered users to start a chat with me",
+	"admin.dailyLimitHint":          "0 means unlimited",
+	"admin.updateChat":              "Update chat settings",
+	"admin.showInHome":              "Show my tags on the home page (let other users find me by tags)",
+	"admin.updateTags":              "Update tags",
+	"admin.updatePagePassword":      "Update page password",
+	"admin.pagePasswordPlaceholder": "Enter page access password",
+	"admin.updateAskPassword":       "Update ask password",
+	"admin.askPasswordPlaceholder":  "Enter ask password",
+	"admin.account":                 "Account settings",
+	"admin.exportHint":              "You can export all your personal data from %s, including your basic information, received questions and answers.",
+	"admin.exportJSON":              "Export all data (JSON)",
+	"admin.exportJSONHint":          "Includes questions, answers, follow-ups and chats for full backup or migration.",
+	"admin.deactivate":              "Deactivate my account",
+	"admin.deactivateHint":          "You can deactivate your account at any time. After deactivation, your account can no longer log in, your question box page and questions will be inaccessible, and others won't be able to send you new questions.<b>This action cannot be undone. Please be careful!</b>",
+	"admin.socialRequired":          "Please fill in the link or uncheck the box",
+
+	// Question management
+	"qlist.title":              "My Questions",
+	"qlist.answered":           "Answered",
+	"qlist.pending":            "Pending",
+	"qlist.private":            "Private",
+	"qlist.empty":              "No questions yet. Share your box and get some!",
+	"qlist.action":             "Actions",
+	"qlist.answerNow":          "Answer",
+	"qlist.sort":               "Sort",
+	"qlist.status":             "Status",
+	"qlist.type":               "Type",
+	"qlist.latest":             "Latest",
+	"qlist.oldest":             "Oldest",
+	"qlist.all":                "All",
+	"qlist.public":             "Normal question",
+	"qlist.privateQuestion":    "Private question",
+	"qlist.received":           "Questions I received",
+	"qlist.myChats":            "Chats I started",
+	"qlist.statsTotal":         "Total questions",
+	"qlist.statsAnswered":      "Answered",
+	"qlist.statsUnanswered":    "Unanswered",
+	"qlist.statsPrivate":       "Private",
+	"qlist.statsPinned":        "Pinned",
+	"qlist.statsChats":         "Chats",
+	"qlist.searchPlaceholder":  "Search questions or answers...",
+	"qlist.searchBtn":          "Search",
+	"qlist.searchClear":        "Clear",
+	"qlist.questionsTab":       "Questions",
+	"qlist.votesTab":           "Votes",
+	"qlist.chatsTab":           "Chats",
+	"qlist.receivedChats":      "Chats I received",
+	"qlist.chatEmpty":          "No chats yet. Share your question box to start chatting!",
+	"qlist.pinnedShort":        "Pin",
+	"qlist.privateShort":       "Pvt",
+	"qlist.chatStatsTotal":     "Total chats",
+	"qlist.chatStatsReceived":  "Received",
+	"qlist.chatStatsInitiated": "Initiated",
+	"qlist.chatStatsClosed":    "Closed",
+	"qlist.unansweredShort":    "Open",
+	"qlist.readShort":          "Read",
+	"qlist.unreadShort":        "Unread",
+	"qitem.markReadShort":      "Mark",
+	"qlist.pinShort":           "Pin",
+	"qlist.unpinShort":         "Unpin",
+	"qlist.myVotes":            "My votes",
+	"qlist.loadMore":           "Load more",
+	"qlist.newVote":            "New vote",
+	"qlist.edit":               "Edit",
+	"qlist.untitledVote":       "Untitled vote",
+	"qlist.blocked":            "Blocked",
+	"qlist.unanswered":         "Unanswered",
+
+	// Site logo suffix (random animal emoji + suffix)
+	"site.logoSuffix": "'s Question Box",
+	"site.stats":      "Question Box Statistics",
+
+	// Captcha modal
+	"captcha.title":        "Verification",
+	"captcha.hint":         "Solve the math problem below to prove you are not a robot",
+	"captcha.refresh":      "New problem",
+	"captcha.submit":       "Verify & submit",
+	"captcha.loading":      "Loading...",
+	"captcha.loadFailed":   "Load failed",
+	"captcha.loadRetry":    "Load failed, please retry",
+	"captcha.inputAnswer":  "Please enter the answer",
+	"captcha.wrongAnswer":  "Wrong answer, please recalculate",
+	"captcha.verifyFailed": "Verification failed, please retry",
+
+	// Register page extras
+	"auth.register.domain.prefix":   "Custom domain (your box URL will be: %s + ",
+	"auth.register.domain.suffix":   " + what you fill in below)",
+	"auth.register.confirm":         "Confirm password",
+	"auth.register.language":        "Language",
+	"auth.register.languageDefault": "Use site default",
+	"auth.register.success":         "Registration successful, welcome to TamaBox!",
+
+	// Explore page extras
+	"explore.recommend":    "Random picks",
+	"explore.search":       "Search tags...",
+	"explore.sortLatest":   "Newest",
+	"explore.sortOldest":   "Oldest",
+	"explore.noTags":       "No tags",
+	"explore.noRecommend":  "No recommendations yet",
+	"explore.hotTags":      "Hot Tags",
+	"explore.hotQuestions": "Hot Questions",
+	"explore.noResult":     "No users match your criteria.",
+	"explore.lazy":         "This user is too lazy to write anything~",
+	"explore.prevPage":     "Previous",
+	"explore.nextPage":     "Next",
+	"explore.loading":      "Loading...",
+	"explore.loadFailed":   "Load failed",
+
+	// Question box password page
+	"password.title":  "This question box is password protected",
+	"password.desc":   "This question box is password protected. Enter the password to view its contents.",
+	"password.input":  "Enter the access password",
+	"password.enter":  "Enter",
+	"password.submit": "Confirm",
+
+	// Question not found
+	"qitem.notFound": "Question not found or has been deleted",
+
+	// Chat page
+	"chat.title":          "Chat",
+	"chat.input":          "Type a message...",
+	"chat.send":           "Send",
+	"chat.delete":         "Delete conversation",
+	"chat.block":          "Block user",
+	"chat.unblock":        "Unblock user",
+	"chat.empty":          "No messages yet. Say something~",
+	"chat.withAsker":      "Chat with the asker",
+	"chat.withUser":       "Chat with %s",
+	"chat.closed":         "Conversation closed",
+	"chat.closedNoSend":   "The conversation is closed. You cannot send new messages.",
+	"chat.remaining":      "Messages left: %d (of %d total)",
+	"chat.me":             "Me",
+	"chat.other":          "Other",
+	"chat.userBlocked":    "This user has been blocked",
+	"chat.addImage":       "Add image (optional, max 5MB)",
+	"chat.confirm":        "Confirm",
+	"chat.confirmBlock":   "Block this user? They won't be able to send you messages anymore.",
+	"chat.confirmUnblock": "Unblock this user? They will be able to send you messages again.",
+	"chat.deleteConfirm":  "Delete this conversation? The other party will no longer be able to see it, and this cannot be undone.",
+	"maintenance.title":   "NekoBox is under maintenance...",
+	"maintenance.desc":    "NekoBox is currently under maintenance and temporarily unavailable. Please come back later~",
+
+	// Single-question share (v4)
+	"qitem.shareCard": "Share this question",
+
+	// Follow-ups (v4)
+	"followup.title":              "Follow-ups",
+	"followup.content":            "Follow-up: ",
+	"followup.answerPlaceholder":  "Answer this follow-up...",
+	"followup.answerBtn":          "Answer",
+	"followup.waiting":            "Waiting for answer...",
+	"followup.askMore":            "Add a follow-up",
+	"followup.remaining":          "%d / %d follow-ups remaining",
+	"followup.contentPlaceholder": "Add more details...",
+	"followup.waitingReply":       "Your follow-up has been sent. Waiting for the box owner to reply...",
+	"followup.submit":             "Submit",
+
+	// Pinning (v4)
+	"qlist.pinned":      "Pinned",
+	"qlist.pin":         "Pin",
+	"qlist.unpin":       "Unpin",
+	"qlist.readStatus":  "Read status",
+	"qlist.read":        "Read",
+	"qlist.unread":      "Unread",
+	"qlist.statsRead":   "Read",
+	"qlist.statsUnread": "Unread",
+
+	// Question submitted page (v4)
+	"success.title":        "Question sent successfully!",
+	"success.yourQuestion": "Your question:",
+	"success.emailSent":    "A private link to this question was sent to your email. You can also use the link below to view the question, receive replies, and follow up.",
+	"success.saveLink":     "<strong>Please save the private link below!</strong> Since you didn't leave an email, this link (including the token) is your <strong>only credential</strong> to view the question, receive replies, and follow up. If you lose it, it cannot be recovered.",
+	"success.privateLink":  "Your private link (click to copy)",
+	"success.copy":         "Copy",
+	"success.copied":       "Copied ✓",
+	"success.copyFailed":   "Copy failed",
+	"success.token":        "Token: %s (the asker uses this token to access the private link)",
+	"success.viewQuestion": "View my question",
+	"success.backToBox":    "Back to %s's box",
+	"success.pageTitle":    "Question Sent - %s",
+
+	// Deactivate page
+	"deactivate.title":   "Deactivate account",
+	"deactivate.desc":    "After deactivation your question box will be inaccessible and all data will be deleted. This cannot be undone!",
+	"deactivate.confirm": "I confirm I want to deactivate my account",
+	"deactivate.submit":  "Deactivate account",
+
+	// Anonymous voting
+	"nav.votes": "Polls",
+
+	"common.back": "Back",
+
+	"vote.listTitle":              "Poll Management",
+	"vote.newTitle":               "New Poll",
+	"vote.editTitle":              "Edit Poll",
+	"vote.resultsTitle":           "Poll Results",
+	"vote.statsTotal":             "Total Polls",
+	"vote.statsPublished":         "Active",
+	"vote.createNew":              "New Poll",
+	"vote.typeSingle":             "Single choice",
+	"vote.typeMultiple":           "Multiple choice",
+	"vote.typeRating":             "Rating",
+	"vote.typeRank":               "Ranking",
+	"vote.typeForm":               "Form",
+	"vote.statusNotStarted":       "Not started",
+	"vote.statusDraft":            "Draft",
+	"vote.statusPublished":        "Active",
+	"vote.statusEnded":            "Ended",
+	"vote.statusArchived":         "Archived",
+	"vote.participants":           "Participants",
+	"vote.remainLabel":            "Remaining",
+	"vote.perpetual":              "No deadline",
+	"vote.durationDay":            "d",
+	"vote.durationHour":           "h",
+	"vote.durationMinute":         "m",
+	"vote.createdAt":              "Created",
+	"vote.edit":                   "Edit",
+	"vote.results":                "Results",
+	"vote.preview":                "Preview",
+	"vote.page.mustComplete":      "Please complete",
+	"vote.page.rankHintRequired":  "Rank 1-N (required)",
+	"vote.page.rankHintOptional":  "Rank 1-N (optional, partial OK)",
+	"vote.page.previewHint":       "Preview mode: this is a sample of the live page; submitting is disabled",
+	"vote.page.previewSubmitHint": "Preview mode; submitting is enabled after publish",
+	"vote.publish":                "Publish",
+	"vote.close":                  "End",
+	"vote.share":                  "Copy link",
+	"vote.copied":                 "Copied",
+	"vote.shareURL":               "Poll share link",
+	"vote.confirmPublish":         "Publish this poll? A shareable link will be generated.",
+	"vote.confirmClose":           "End this poll? Participants will no longer be able to vote.",
+	"vote.confirmDelete":          "Delete this poll? All vote data will be removed and cannot be recovered!",
+	"vote.manageEntry":            "Manage polls",
+
+	"vote.manageTitle": "Manage polls",
+	"vote.manageDesc":  "Create and manage your anonymous polls", "vote.empty": "No polls yet. Click \"New Poll\" in the top right to get started.",
+	"vote.formLockedHint":              "This poll is live. Only basic info can be edited; type and options are locked to protect collected votes.",
+	"vote.formBasic":                   "Basic Settings",
+	"vote.formTitle":                   "Poll Title",
+	"vote.formTitlePlaceholder":        "e.g. What should we eat today?",
+	"vote.formDescription":             "Description",
+	"vote.formDescriptionPlaceholder":  "Optional details",
+	"vote.formType":                    "Poll Type",
+	"vote.formVisibility":              "Visibility",
+	"vote.formVisibilityPublic":        "Public (Explore + question box)",
+	"vote.formVisibilityLinkOnly":      "Link only",
+	"vote.formVoterScope":              "Voting Scope",
+	"vote.formVoterScopeAnyone":        "Anyone (including anonymous)",
+	"vote.formVoterScopeRegistered":    "Registered users only",
+	"vote.formShowResult":              "Result Visibility",
+	"vote.formShowResultAfterVote":     "Visible right after voting",
+	"vote.formShowResultAfterEnd":      "Visible after the poll ends",
+	"vote.formShowResultOwnerOnly":     "Owner only",
+	"vote.formStartAt":                 "Start time (empty = now)",
+	"vote.formEndAt":                   "End time (empty = no limit)",
+	"vote.formMaxChoices":              "Max choices",
+	"vote.formMaxVotesPerFingerprint":  "One vote per device per poll; repeated submissions from the same browser are blocked.",
+	"vote.formMaxVotesPerAccount":      "One vote per registered account per poll; repeated submissions from the same account are blocked.",
+	"vote.formAllowCustom":             "Allow participants to add custom options",
+	"vote.formRequireCaptcha":          "Require captcha for anonymous voting",
+	"vote.formOptions":                 "Poll Options",
+	"vote.formRatingHint":              "Rating polls need no options (1-10).",
+	"vote.addOption":                   "Add option",
+	"vote.optionPlaceholder":           "Option text",
+	"vote.formFields":                  "Form Fields",
+	"vote.addField":                    "Add field",
+	"vote.field":                       "Field",
+	"vote.formFieldType":               "Field Type",
+	"vote.fieldTypeText":               "Single-line text",
+	"vote.fieldTypeTextarea":           "Multi-line text",
+	"vote.fieldTypeSelect":             "Dropdown select",
+	"vote.fieldTypeRadio":              "Single choice",
+	"vote.fieldTypeCheckbox":           "Multiple choice",
+	"vote.fieldTypeNumber":             "Number",
+	"vote.fieldTypeRank":               "Ranking",
+	"vote.page.selectPlaceholder":      "Select...",
+	"vote.page.avgNumber":              "Average",
+	"vote.page.fieldFilled":            "Filled",
+	"vote.fieldTypeRating":             "Rating",
+	"vote.formFieldLabel":              "Field Label",
+	"vote.formFieldRequired":           "Required",
+	"vote.formFieldMaxLength":          "Max length (0 = unlimited)",
+	"vote.formFieldOptions":            "Options",
+	"vote.formFieldOptionsHint":        "Click \"Add option\" to add each option; no comma needed",
+	"vote.fieldAllowCustom":            "Allow participants to add a custom option",
+	"vote.formFieldOptionsPlaceholder": "e.g. Great,Okay,Poor",
+	"vote.createDraft":                 "Save draft",
+	"vote.builderHintOptions":          "At least 2 options are required",
+	"vote.builderHintFields":           "Add at least 1 field",
+	"vote.builderHintFieldOptions":     "Choice/rank fields need options (rank needs at least 2)",
+	"vote.resultsAnswered":             "Answered",
+	"vote.page.rankedTimes":            "Ranked",
+	"vote.resultsTotal":                "Total participants",
+	"vote.resultsSubmissions":          "Form responses",
+	"vote.resultsViewTexts":            "View text responses",
+	"vote.resultsToggleHint":           "Click to expand or collapse text responses",
+	"vote.resultsOptions":              "Poll results",
+	"vote.resultsVotes":                "votes",
+	"vote.export":                      "Export CSV",
+	"vote.resultsEmpty":                "No participation yet. Share the link!",
+
+	// Poll participation page
+	"vote.inlineTitle":                 "Polls",
+	"vote.page.by":                     "poll",
+	"vote.page.goVote":                 "Vote",
+	"vote.page.notStarted":             "Not started",
+	"vote.page.notStartedHint":         "This poll has not started yet.",
+	"vote.page.ended":                  "Ended",
+	"vote.page.endedHint":              "This poll has ended.",
+	"vote.page.active":                 "Active",
+	"vote.page.participated":           "Participated",
+	"vote.page.loginRequired":          "This poll is limited to registered users. Please log in first.",
+	"vote.page.anonymousHint":          "Anonymous participation is allowed and your identity is not recorded (max 1 per device).",
+	"vote.page.submit":                 "Submit vote",
+	"vote.page.alreadyVoted":           "You have already participated in this poll. Thanks!",
+	"vote.page.resultsTitle":           "Poll Results",
+	"vote.page.totalVotes":             "Total",
+	"vote.page.avgRating":              "Average",
+	"vote.page.avgRank":                "Avg rank",
+	"vote.page.optionColumn":           "Option",
+	"vote.page.ratingLabel":            "Rate",
+	"vote.page.ratingUnit":             "pts",
+	"vote.page.rankHint":               "Rank each option 1-N (smaller = higher, no duplicates)",
+	"vote.page.rankPlaceholder":        "Rank",
+	"vote.page.multipleHint":           "Multiple choice",
+	"vote.page.customOption":           "Custom option (optional)",
+	"vote.page.customPlaceholder":      "Type your own option",
+	"vote.page.customOther":            "Other",
+	"vote.page.customFieldPlaceholder": "Type a custom option...",
+	"vote.page.customStats":            "Custom options",
+	"vote.page.formCount":              "Responses received",
+	"vote.page.ownerManage":            "Manage this poll (results visible only to you)",
+
+	// Per-poll quota collection
+	"vote.formQuotaLimit":          "Collection quota (responses)",
+	"vote.formQuotaHint":           "0 means unlimited; the poll ends automatically once the quota is reached.",
+	"vote.flash.notFound":          "This poll does not exist or is no longer available",
+	"vote.flash.notPublished":      "This poll has not been published yet",
+	"vote.flash.archived":          "This poll has been archived and is closed",
+	"vote.flash.ended":             "This poll has ended",
+	"vote.flash.notStarted":        "This poll has not started yet",
+	"vote.flash.success":           "Vote submitted. Thanks for participating!",
+	"vote.err.noChoice":            "Please select at least one option",
+	"vote.err.tooManyChoices":      "You can select at most %d options",
+	"vote.err.pickOne":             "Please select an option",
+	"vote.err.invalidOption":       "Invalid option",
+	"vote.err.optionDuplicate":     "Options cannot be duplicated",
+	"vote.err.ratingRequired":      "Please provide a rating from 1 to 10",
+	"vote.err.rankRequired":        "Please rank every option from 1 to %d",
+	"vote.err.rankDuplicate":       "Rankings must not repeat",
+	"vote.err.fieldRequired":       "Please fill in \"%s\"",
+	"vote.err.fieldCustomRequired": "Please fill in the custom option for \"%s\"",
+	"vote.err.fieldCustomTooLong":  "The custom option for \"%s\" must be at most %d characters",
+	"vote.err.fieldInvalidOption":  "Invalid option for \"%s\"",
+	"vote.err.fieldConfigError":    "Misconfigured options for \"%s\"",
+	"vote.err.fieldRankIncomplete": "Please provide a complete ranking for \"%s\"",
+	"vote.err.fieldRankRange":      "The ranking for \"%s\" must be a number between 1 and %d",
+	"vote.err.fieldRankDuplicate":  "Rankings for \"%s\" must not repeat",
+	"vote.err.fieldTooLong":        "\"%s\" exceeds the length limit (max %d characters)",
+	"vote.err.fieldNotNumber":      "\"%s\" must be a number",
+	"vote.err.fieldRating":         "\"%s\" requires a rating from 1 to 10",
+	"vote.err.unknownType":         "Unknown poll type",
+	"vote.err.customTooLong":       "The custom option must be at most %d characters",
+	"vote.err.blockWords":          "Your submission contains a blocked word set by the poll creator and could not be submitted",
+	"vote.err.serialize":           "Failed to serialize the submission",
+	"captcha.error":                "Captcha verification failed",
+	"captcha.errEmpty":             "Captcha cannot be empty",
+	"captcha.errFormat":            "Invalid captcha format, please refresh and try again",
+	"captcha.errAnswerFormat":      "Invalid captcha answer format",
+	"captcha.errExpired":           "Captcha expired, please refresh and try again",
+	"captcha.errService":           "Captcha service error, please try again later",
+	"captcha.errAnswerWrong":       "Incorrect captcha answer",
+	"censor.unavailable":           "The content moderation service is temporarily unavailable. Please try again later.",
+
+	// Feature management: switch / schedule / quota for questions, chats and polls
+	"admin.tabAccount":            "Settings",
+	"admin.featuresHint":          "Manage the switch, opening hours and collection quota of each feature on the Questions / Chats / Polls panels. A feature closes automatically once its quota is reached.",
+	"admin.featuresEntry":         "Settings",
+	"admin.featureHint.question":  "Visitors cannot submit new questions while closed; collection stops automatically once the quota is reached (private questions included).",
+	"admin.featureHint.chat":      "Visitors cannot start new chats while closed; existing conversations are unaffected.",
+	"admin.featureHint.vote":      "Your polls are hidden from your box page and cannot be answered while closed. Each poll can also define its own quota on the edit page.",
+	"admin.featureEnabled":        "Enable this feature",
+	"admin.featureOpenAt":         "Open at",
+	"admin.featureCloseAt":        "Close at",
+	"admin.featureTimeHint":       "Leave blank for no limit; the feature is unavailable before the open time and after the close time.",
+	"admin.featureSchedule":       "Recurring schedule (weekly)",
+	"admin.featureScheduleStart":  "Daily start",
+	"admin.featureScheduleEnd":    "Daily end",
+	"admin.featureScheduleHint":   "Select the weekdays and a daily time window to open every week. Leave all empty to disable. Days without a time window open all day; a time window with no weekday selected opens every day.",
+	"admin.featureMode":           "Schedule mode",
+	"admin.featureModeAlways":     "Always open",
+	"admin.featureModeWindow":     "One-time window",
+	"admin.featureModeRecurring":  "Weekly schedule",
+	"admin.featureModeHint":       "Always open: no time limit until manually disabled. One-time window: a single open/close time window. Weekly schedule: recurring weekly open days and hours. Modes are mutually exclusive; settings of unselected modes are cleared on save.",
+	"admin.featureQuotaLimit":     "Collection quota (items)",
+	"admin.featureQuotaHint":      "0 means unlimited; the feature closes automatically once the quota is reached. Reset the counter to start a new round.",
+	"admin.featureQuotaCount":     "Collected",
+	"admin.featureQuotaUnlimited": "Unlimited",
+	"admin.featureQuotaResetAt":   "Last reset: ",
+	"admin.featureResetQuota":     "Reset counter",
+	"admin.featureSave":           "Save this feature",
+
+	// Feature management: states and messages
+	"feature.name.question":        "Questions",
+	"feature.name.chat":            "Chats",
+	"feature.name.vote":            "Polls",
+	"feature.statusOpen":           "Open",
+	"feature.status.disabled":      "Closed",
+	"feature.status.not_started":   "Not started",
+	"feature.status.ended":         "Ended",
+	"feature.status.quota_reached": "Quota reached",
+	"feature.saved":                "Feature settings saved",
+	"feature.errTime":              "Invalid date for %s, please use the date-time picker",
+	"feature.errTimeRange":         "The close time of %s must be later than the open time",
+	"feature.errQuota":             "The collection quota of %s must be an integer between 0 and 1000000",
+	"feature.errInvalid":           "Unknown feature",
+	"feature.quotaReset":           "The collection counter of %s has been reset",
+	"feature.errScheduleHalf":      "The recurring start and end times of %s must be filled in together",
+	"feature.errScheduleTime":      "Invalid recurring time for %s, please use the time picker",
+	"feature.errScheduleRange":     "The recurring end time of %s must be later than the start time",
+
+	// Messages shown to visitors when a feature is closed
+	"feature.disabled.question":      "The box owner has closed questions",
+	"feature.disabled.chat":          "This box does not accept chats",
+	"feature.disabled.vote":          "This box has closed polls",
+	"feature.not_started.question":   "Questions are not open yet",
+	"feature.not_started.chat":       "Chats are not open yet",
+	"feature.not_started.vote":       "Polls are not open yet",
+	"feature.ended.question":         "Question collection has ended",
+	"feature.ended.chat":             "Chats have ended",
+	"feature.ended.vote":             "Polls have ended",
+	"feature.quota_reached.question": "The question quota has been reached",
+	"feature.quota_reached.chat":     "The chat quota has been reached",
+	"feature.quota_reached.vote":     "The poll quota has been reached",
+
+	// Auth: visitor-visible messages (P0)
+	"auth.errBadCredential":   "Incorrect email or password",
+	"auth.errUserNotFound":    "User does not exist",
+	"auth.errEmailFrequent":   "Emails are sent too frequently, please try again later",
+	"auth.errEmailFailed":     "Failed to send email, please try again later",
+	"auth.errCodeExpired":     "The verification code has expired",
+	"auth.errPasswordChanged": "Password changed successfully",
+	"auth.errLoginRequired":   "Please log in first",
+	"auth.errDuplicateEmail":  "This email is already registered",
+	"auth.errDuplicateDomain": "This custom domain is already taken",
+
+	// Question box page: visitor-visible (P0)
+	"question.errWrongPassword":     "Wrong password",
+	"question.errAskPasswordWrong":  "Wrong ask password",
+	"question.errLoginRequired":     "The owner only allows registered users to ask questions. Please log in first.",
+	"question.errSelfChat":          "You cannot start a chat with yourself",
+	"question.errBlockedChat":       "You have been blocked by the other party and cannot start a chat",
+	"question.errChatDailyLimit":    "You have reached today's message limit (%d). Please try again tomorrow",
+	"question.errDuplicateSubmit":   "Duplicate submission detected, please try again later",
+	"question.errImageTooLarge":     "Image file size cannot exceed 5Mb",
+	"question.errUploadImageFailed": "Failed to upload image",
+	"question.errBlockWords":        "The question contains a blocked word set by the box owner, and could not be sent",
+	"question.errAnsweredLocked":    "An answered question cannot be marked as unread",
+	"question.flash.chatSent":       "Chat request sent! You can view the conversation via this link: %s",
+	"question.flash.answered":       "Answer published successfully!",
+	"question.flash.operated":       "Operation successful",
+	"question.flash.markedRead":     "Marked as read",
+	"question.flash.markedUnread":   "Marked as unread",
+
+	// Follow-ups: visitor/owner visible (P0)
+	"followup.errNoPermission": "Permission denied",
+	"followup.errNotAnswered":  "This question has not been answered yet, so you cannot follow up",
+	"followup.errLimit":        "Each question allows at most %d follow-ups, and the limit has been reached",
+	"followup.errWaitReply":    "Please wait for the owner to reply to your previous follow-up before continuing",
+	"followup.errNotFound":     "The follow-up does not exist",
+	"followup.flash.sent":      "Follow-up sent successfully!",
+	"followup.flash.answered":  "Answer posted successfully!",
+
+	// Admin settings: owner visible (P1)
+	"admin.flash.profileUpdated":    "Profile updated successfully",
+	"admin.flash.chatUpdated":       "Chat settings updated successfully",
+	"admin.flash.pagePwdOff":        "Page password access disabled",
+	"admin.flash.pagePwdUpdated":    "Page access password updated",
+	"admin.flash.askPwdOff":         "Ask password disabled",
+	"admin.flash.askPwdUpdated":     "Ask password updated",
+	"admin.flash.tagsTooMany":       "You can have at most 5 tags",
+	"admin.flash.tagsUpdated":       "Tags updated successfully",
+	"admin.flash.tagTooLong":        "Each tag cannot exceed 5 characters: %s",
+	"admin.flash.blockWordsTooMany": "You can have at most 10 blocked words",
+	"admin.flash.blockWordTooLong":  "A blocked word cannot exceed 10 characters: %s",
+	"admin.flash.harassmentUpdated": "Anti-harassment settings updated successfully",
+	"admin.flash.blockWordsUpdated": "Blocked words updated",
+	"admin.flash.deactivated":       "Your account has been deactivated. Thank you for using Wolf's Question Box. We hope to see you again 👋🏻",
+	"admin.export.errUser":          "Export failed: could not get user information",
+	"admin.export.errQuestion":      "Export failed: could not get question information",
+
+	// Vote management: owner visible (P1)
+	"vote.err.invalidID":                 "Invalid vote ID",
+	"vote.err.notExist":                  "The vote does not exist",
+	"vote.err.noPermission":              "You are not allowed to operate this vote",
+	"vote.err.type":                      "Unknown poll type",
+	"vote.err.titleRequired":             "Please fill in the poll title",
+	"vote.err.titleTooLong":              "The poll title cannot exceed 100 characters",
+	"vote.err.visibility":                "Unknown visibility setting",
+	"vote.err.voterScope":                "Unknown voting scope setting",
+	"vote.err.showResult":                "Unknown result visibility setting",
+	"vote.err.timeRange":                 "The end time must be later than the start time",
+	"vote.err.quota":                     "The collection quota must be an integer between 0 and 1000000",
+	"vote.err.optionsTooFew":             "Please add at least 2 options",
+	"vote.err.optionsFormat":             "Invalid options data format",
+	"vote.err.optionTooLong":             "A single option cannot exceed %d characters",
+	"vote.err.maxChoicesExceed":          "The max choices cannot exceed the total number of options",
+	"vote.err.fieldsTooFew":              "Please add at least 1 form field",
+	"vote.err.fieldsFormat":              "Invalid form fields data format",
+	"vote.err.fieldsTooMany":             "You can have at most 50 form fields",
+	"vote.err.fieldType":                 "Unknown form field type",
+	"vote.err.fieldLabelMissing":         "Field #%d is missing a label",
+	"vote.err.fieldLabelTooLong":         "Field #%d label cannot exceed 100 characters",
+	"vote.err.fieldLabelDuplicate":       "The field label \"%s\" is duplicated, please use a different label",
+	"vote.err.fieldMaxLength":            "Field #%d max length must be between 0 and 2000",
+	"vote.err.fieldReservedOption":       "Field #%d (%s) contains a reserved option value, please change it",
+	"vote.err.fieldOptionsTooFew":        "Field #%d (%s) needs at least 1 option",
+	"vote.err.fieldRankTooFew":           "Field #%d (%s) ranking questions need at least 2 options",
+	"vote.err.fieldSerialize":            "Failed to serialize field options",
+	"vote.err.editClosed":                "Votes that are ended or archived cannot be edited",
+	"vote.err.publishDraftOnly":          "Only draft polls can be published",
+	"vote.err.closePublishedOnly":        "Only active polls can be closed",
+	"vote.err.publishTitleRequired":      "Please fill in the poll title before publishing",
+	"vote.err.publishFormFieldsRequired": "Form polls need at least 1 field",
+	"vote.err.publishOptionsRequired":    "Choice polls need at least 2 options",
+	"vote.err.optionUpdateFailed":        "Failed to update options, please retry",
+	"vote.err.fieldUpdateFailed":         "Failed to update form fields, please retry",
+	"vote.flash.published":               "Poll published! Share link: %s",
+	"vote.flash.updated":                 "Poll info updated (active polls cannot change type or options)",
+	"vote.flash.draftSaved":              "Saved to draft",
+	"vote.flash.closed":                  "Poll ended",
+	"vote.flash.deleted":                 "Poll deleted",
+	"vote.err.timeFormat":                "Invalid time format, please use the datetime picker",
+	"vote.err.maxChoicesLimit":           "Maximum number of choices cannot exceed 20",
+	"vote.err.descriptionTooLong":        "Vote description cannot exceed 5000 characters",
+	"profile.err.avatarTooLarge":         "Avatar file is too large, maximum 2MB",
+	"profile.err.backgroundTooLarge":     "Background image is too large, maximum 2MB",
+	"profile.err.newPasswordTooShort":    "New password must be at least 8 characters",
+	"profile.err.badOldPassword":         "Incorrect old password",
+	"admin.export.errCreateExcel":        "Export failed: could not create Excel file",
+	"admin.export.errWriteExcel":         "Export failed: could not write Excel file",
+
+	// Profile page UI rework: card sections / avatar & background cropping / force re-login after password change
+	"profile.card.basic":             "Basic info",
+	"profile.card.avatarBg":          "Avatar & background",
+	"profile.card.qr":                "QR code style",
+	"profile.card.password":          "Change password",
+	"profile.avatarCropHint":         "Crop frame is locked to 1:1 (square)",
+	"profile.backgroundCropHint":     "Crop frame is locked to 16:9",
+	"profile.cropTitle":              "Crop image",
+	"profile.cropConfirm":            "Apply crop",
+	"profile.err.avatarRatio":        "Avatar image must be a 1:1 square. Please crop it and upload again.",
+	"profile.err.backgroundRatio":    "Background image must have a 16:9 aspect ratio. Please crop it and upload again.",
+	"profile.flash.passwordChanged":  "Password changed. You have been signed out; please sign in again with your new password.",
+	"profile.pwdNote":                "After saving, your current session will end immediately and you will need to sign in again with the new password.",
+	"profile.pickAvatar":             "Change avatar",
+	"profile.pickBackground":         "Change background",
+	"profile.saveBasic":              "Save basic info",
+	"profile.saveMedia":              "Save avatar & background",
+	"profile.savePassword":           "Update password",
+	"profile.saveQR":                 "Save QR code style",
+	"profile.saveSocial":             "Save social links",
+	"profile.err.cropLibUnavailable": "The image cropper failed to load. Please refresh the page and try again.",
+
+	// Captcha JSON endpoint: consumed by frontend (P2)
+	"captcha.json.badRequest": "Invalid request format",
+	"captcha.json.idRequired": "Captcha ID cannot be empty",
+	"captcha.json.genFailed":  "Failed to generate captcha",
+	"chat.errDeletedByOwner":  "This private conversation has been deleted by the other party.",
+	"chat.errBlockedView":     "You have been blocked by the other party and cannot view this chat",
+	"chat.errEmpty":           "Message cannot be empty",
+	"chat.errTooLong":         "Message is too long, please keep it within %d characters",
+	"chat.errConvDeletedSend": "This conversation has been deleted and messages cannot be sent",
+	"chat.errBlockedSend":     "You have been blocked by the other party and cannot send messages",
+	"chat.errBlockWords":      "Your message contains a blocked word set by the box owner and could not be sent",
+	"chat.errDailyLimit":      "You have reached today's message limit (%d), please try again tomorrow",
+	"chat.errLimitReached":    "The conversation has reached its limit and no new messages can be sent",
+	"chat.errChatClosed":      "The box owner has disabled private chat and messages cannot be sent",
+	"chat.errImageTooLarge":   "Image size cannot exceed %dMB",
+	"chat.errUploadFailed":    "Image upload failed, please try again later",
+	"chat.errNoPermission":    "You are not authorized to perform this action",
+	"chat.flash.sent":         "Message sent successfully",
+	"chat.flash.deleted":      "Private conversation deleted",
+	"chat.flash.operated":     "Operation successful",
+	"image.errTooLarge":       "Image is too large, maximum supported size is %d×%d pixels, please compress and re-upload",
+	"internal.errFlash":       "Internal server error, please try again later.",
+	"internal.errServer":      "Internal server error",
+	"home.errStats":           "Failed to retrieve statistics",
+	"pixel.errPath":           "Invalid request path",
+	"proxy.errNotFound":       "Page not found",
+	"proxy.errInternal":       "Service gateway internal error",
+	"explore.errRandomUser":   "Failed to retrieve random users",
+	// 表单校验
+	"form.answer.content":               "Answer content is required",
+	"form.answer.contentTooLong":        "Answer content must be within %d characters",
+	"form.email.required":               "Please enter a valid email address",
+	"form.followup.answer":              "Follow-up answer is required",
+	"form.followup.answerTooLong":       "Follow-up answer must be within %d characters",
+	"form.followup.content":             "Follow-up content is required",
+	"form.followup.contentTooLong":      "Follow-up content must be within %d characters",
+	"form.login.password":               "Please enter your password",
+	"form.profile.backgroundimagealpha": "Please enter the QR code background opacity",
+	"form.profile.colorHex":             "Please enter a 7-character hex color code (including #)",
+	"form.profile.dotscale":             "Please enter the QR code dot size",
+	"form.profile.intro":                "Bio is required and must be at most 100 characters",
+	"form.profile.linkMax":              "Profile link must be at most 30 characters",
+	"form.profile.name":                 "Nickname is required and must be at most 20 characters",
+	"form.profile.newPassword":          "New password must be at most 30 characters",
+	"form.profile.passwordMax":          "Password must be at most 30 characters",
+	"form.question.content":             "Question content is required",
+	"form.question.contentTooLong":      "Question content must be within %d characters",
+	"form.question.receiveReplyEmail":   "Please enter a valid email address to receive replies",
+	"form.recaptcha":                    "Please complete the CAPTCHA verification",
+	"form.recover.newPassword":          "Please set a new password of 8–30 characters",
+	"form.recover.repeatPassword":       "The two new passwords do not match",
+	"form.register.domain":              "The custom domain may only contain letters, digits and underscores, and must be 3–20 characters long",
+	"form.register.email":               "Please enter a valid email address (max 100 characters)",
+	"form.register.name":                "Nickname is required and must be at most 20 characters",
+	"form.register.password":            "Please set a password of 8–30 characters",
+	"form.register.recaptcha":           "Unable to load the CAPTCHA. Please refresh the page or switch your network and try again",
+	"form.register.repeatPassword":      "The two passwords do not match",
+}
diff --git a/internal/i18n/dict_ja.go b/internal/i18n/dict_ja.go
new file mode 100644
index 0000000..5f5fcbe
--- /dev/null
+++ b/internal/i18n/dict_ja.go
@@ -0,0 +1,840 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package i18n
+
+// jaDict 日本語文案。
+var jaDict = map[string]string{
+	// ナビゲーション
+	"nav.explore":  "探索",
+	"nav.mine":     "マイ",
+	"nav.register": "登録",
+	"nav.login":    "ログイン",
+	"nav.ask":      "質問",
+	"nav.settings": "設定",
+	"nav.lang":     "言語",
+
+	// 共通
+	"common.login":      "ログイン",
+	"common.forgot":     "パスワードを忘れた",
+	"common.submit":     "送信",
+	"common.cancel":     "キャンセル",
+	"common.save":       "保存",
+	"common.close":      "閉じる",
+	"common.delete":     "削除",
+	"common.moveUp":     "上へ移動",
+	"common.moveDown":   "下へ移動",
+	"common.share":      "共有",
+	"common.verifying":  "認証中...",
+	"common.submitting": "送信中...",
+	"common.uploading":  "アップロード中...",
+	"common.lang":       "言語",
+	"common.menu":       "メニュー",
+
+	"common.pleaseWait": "お待ちください...",
+	"common.backHome":   "ホームに戻る",
+	"common.theme":      "ダーク/ライトモード切替",
+
+	// サイト
+	"site.title":          "狼の質問箱 | 匿名質問箱",
+	"site.description":    "狼の質問箱は登録不要で使える匿名質問箱。誰でも匿名で質問でき、安心してやり取りできる場所です。",
+	"site.keywords":       "匿名質問箱,質問箱,匿名質問,狼の質問箱,匿名で質問,匿名Q&A",
+	"site.footer.runtime": "質問箱は稼働中",
+	"site.footer.admin":   "管理者へ",
+	"site.footer.notice":  "お知らせ",
+	"site.footer.chat":    "チャット",
+	"site.footer.drive":   "ドライブ",
+	"site.footer.status":  "ステータス",
+	"site.footer.nav":     "リンク",
+	"site.maintenance":    "メンテナンス中です。しばらくお待ちください～",
+
+	// 認証
+	"auth.login.title":       "ログイン",
+	"auth.login.email":       "メールアドレス",
+	"auth.login.password":    "パスワード",
+	"auth.login.submit":      "ログイン",
+	"auth.login.forgot":      "パスワードを忘れた",
+	"auth.register.title":    "ユーザー登録",
+	"auth.register.name":     "ニックネーム",
+	"auth.register.email":    "メールアドレス",
+	"auth.register.password": "パスワード",
+	"auth.register.submit":   "登録",
+	"auth.forgot.title":      "パスワードを忘れた",
+	"auth.forgot.email":      "メールアドレス",
+	"auth.forgot.submit":     "再設定メールを送信",
+	"auth.forgot.submitBtn":  "パスワードを再取得",
+	"auth.forgot.sent":       "%s にメールを送信しました。ご確認ください。",
+	"auth.recover.title":     "パスワード再設定",
+	"auth.recover.greeting":  "%s さん、パスワードを再設定しています：",
+	"auth.recover.password":  "新しいパスワード",
+	"auth.recover.confirm":   "パスワード（確認）",
+	"auth.recover.submit":    "パスワードを再設定",
+
+	// 探索ページ
+	"explore.title":        "ユーザータグを探索",
+	"explore.notice":       "ここでは<span class=\"uk-text-bold\">「ホームでタグを表示」</span>を有効にしたユーザーを紹介しています。この機能は初期状態でオフです。自分の質問箱を見つけてもらいたい場合は <a href=\"/user/profile\" class=\"uk-text-bold\">個人設定</a> から有効にしてください。",
+	"explore.shuffle":      "シャッフル",
+	"explore.empty":        "表示できるユーザーがいません。有効にしてみましょう～",
+	"explore.hotVotes":     "人気の投票",
+	"explore.questionsTab": "質問",
+	"explore.votesTab":     "投票",
+	"explore.votesTitle":   "公開投票",
+	"explore.votesDesc":    "開催中の公開投票を見て、興味のあるテーマに参加できます。",
+	"explore.randomVote":   "ランダムおすすめ",
+	"explore.allVotes":     "すべての投票",
+	"explore.noVotes":      "現在、参加できる公開投票はありません。",
+
+	// 質問ページ
+	"ask.scan":              "QRコードで@%sに質問",
+	"ask.anonymous":         "誰でも匿名で質問できます",
+	"ask.registerOnly":      "登録ユーザーのみ質問できます",
+	"ask.nextOpenAt":        "次回開放：%s",
+	"ask.lastCloseAt":       "前回終了：%s",
+	"weekday.0":             "日",
+	"weekday.1":             "月",
+	"weekday.2":             "火",
+	"weekday.3":             "水",
+	"weekday.4":             "木",
+	"weekday.5":             "金",
+	"weekday.6":             "土",
+	"ask.pinned":            "ピン留め済み",
+	"ask.share":             "質問箱を共有",
+	"ask.placeholder":       "ここに質問を書いてください...",
+	"ask.chatPlaceholder":   "ここにチャットメッセージを書いてください...",
+	"ask.addImage":          "画像を追加",
+	"ask.private":           "返信後に公開しない",
+	"ask.notify":            "通知を受け取る",
+	"ask.emailPlaceholder":  "メールアドレスを入力してください",
+	"ask.submit":            "質問を送信",
+	"ask.chat":              "チャットを開始",
+	"ask.chatDisabled":      "この質問箱ではチャットが無効です",
+	"ask.chatLimit":         "メッセージ上限：%d件",
+	"ask.history":           "@%s が以前回答した質問",
+	"ask.loginRequired":     "ログインが必要",
+	"ask.loginRequiredChat": "チャットを開始するにはログインが必要です",
+	"ask.goLogin":           "ログインへ",
+	"ask.needPassword":      "この質問箱にはパスワードが必要です",
+	"ask.needLogin":         "質問箱の所有者は登録ユーザーのみ質問できるように設定しています。先にログインしてください。",
+	"ask.pleaseEmail":       "通知を受け取るメールアドレスを入力してください",
+	"ask.generating":        "共有カードを生成中…",
+	"ask.genFailed":         "共有カードの生成に失敗しました。しばらくしてからお試しください",
+	"ask.networkError":      "ネットワークエラー",
+	"ask.shareFilename":     "share.png",
+
+	// 質問アイテム
+	"qitem.answer":            "回答",
+	"qitem.delete":            "削除",
+	"qitem.private":           "非公開にする",
+	"qitem.public":            "公開にする",
+	"qitem.asked":             "質問",
+	"qitem.pending":           "回答待ち",
+	"qitem.answeredBy":        "@%s による %s の回答",
+	"qitem.danger":            "危険！",
+	"qitem.deleteConfirm":     "この質問を削除してもよろしいですか？この操作は取り消せません。",
+	"qitem.deleteConfirmBtn":  "削除する",
+	"qitem.backToBox":         "%sの質問箱に戻る",
+	"qitem.answerTitle":       "質問に回答する",
+	"qitem.answerPlaceholder": "ここに回答を入力...",
+	"qitem.emailNotifyHint":   "質問者はメールアドレスを残しています。最初に回答すると、質問者にメール通知が送信されます。",
+	"qitem.submitAnswer":      "回答",
+	"qitem.updateAnswer":      "回答を更新",
+	"qitem.askMore":           "ほかの質問は？",
+	"qitem.markRead":          "既読にする",
+	"qitem.markUnread":        "未読にする",
+	"qitem.readLocked":        "回答済みのため既読に固定",
+
+	// 個人設定ページ
+	"admin.profile":           "プロフィール",
+	"admin.lang":              "表示言語",
+	"admin.langHint":          "訪問者があなたの質問箱を開いたときに表示する言語を選択します（管理画面もこの設定に従います）",
+	"admin.email":             "メールアドレス",
+	"admin.name":              "ニックネーム",
+	"admin.nameColor":         "ニックネームの色",
+	"admin.oldPassword":       "現在のパスワード",
+	"admin.newPassword":       "新しいパスワード",
+	"admin.notify":            "新着質問の通知",
+	"admin.personalize":       "カスタマイズ",
+	"admin.intro":             "質問箱の紹介文",
+	"admin.introColor":        "紹介文の色",
+	"admin.qrBgColor":         "QRコードの背景色（明るい部分）",
+	"admin.qrPdColor":         "QRコードのファインダーパターン色（角の四角）",
+	"admin.qrFgColor":         "QRコードの前景色",
+	"admin.qrDotSize":         "QRコードのドットサイズ (←小 大→)",
+	"admin.qrBgAlpha":         "QRコードの背景透明度 (←不透明 透明→)",
+	"admin.avatar":            "アバター",
+	"admin.background":        "質問箱の背景",
+	"admin.qrBackground":      "QRコードの背景画像",
+	"admin.social":            "ソーシャルリンク",
+	"admin.harassment":        "迷惑行為対策",
+	"admin.askLimit":          "質問制限",
+	"admin.blockWords":        "ブロックワード設定（Enter またはカンマ区切り、最大10個、各10文字まで）",
+	"admin.chat":              "チャット設定",
+	"admin.chatMaxMessages":   "チャットのメッセージ上限",
+	"admin.chatDailyLimit":    "1ユーザーあたりの1日のメッセージ上限",
+	"admin.tags":              "タグ設定",
+	"admin.tagsHint":          "タグ（最大5個、各5文字まで、Enter またはカンマ区切り）",
+	"admin.tagsPlaceholder":   "例：アニメ,音楽,ゲーム",
+	"admin.tagInputHint":      "入力して Enter またはカンマで追加",
+	"admin.tagInputDuplicate": "既に存在するため無視しました",
+	"admin.pagePassword":      "ページアクセスパスワード",
+	"admin.pagePasswordHint":  "アクセスパスワードを設定（空欄で無効）",
+	"admin.askPassword":       "質問パスワード",
+	"admin.askPasswordHint":   "質問用パスワードを設定（空欄で無効）",
+	"admin.saveProfile":       "変更を保存",
+	"admin.updated":           "プロフィールを更新しました",
+	"admin.logout":            "ログアウト",
+	"admin.export":            "データをエクスポート",
+
+	// 管理画面設定（追加）
+	"admin.oldPasswordHint":         "パスワード変更時のみ使用。空欄のままなら変更されません",
+	"admin.newPasswordHint":         "6〜64文字。空欄のままなら変更されません",
+	"admin.notifyEmail":             "メール",
+	"admin.useCustomFg":             "カスタム前景色を使用（それ以外は自動マッチ）",
+	"admin.customFgHint":            "有効時のみ適用されます。それ以外は自動生成されます",
+	"admin.avatarPlaceholder":       "アバターをアップロード（1:1 以外は縦横比が崩れます）",
+	"admin.backgroundPlaceholder":   "質問箱の背景をアップロード",
+	"admin.qrBackgroundPlaceholder": "QRコードの背景画像をアップロード（暗すぎる背景はQRコードが読み取れなくなることがあります）",
+	"admin.qrPreviewHint":           "画像を選択するとプレビューが即時更新されます",
+	"admin.preview":                 "ライブプレビュー",
+	"admin.themePreset":             "プリセットテーマ",
+	"admin.themeDefault":            "デフォルト",
+	"admin.themeDark":               "ダーク",
+	"admin.themeOcean":              "オーシャン",
+	"admin.themeSunset":             "サンセット",
+	"admin.resetDefaults":           "🔄 デフォルトに戻す",
+	"admin.previewHint":             "調整はプレビューのみです。「変更を保存」をクリックすると反映されます",
+	"admin.socialHint":              "チェックを入れてプロフィールURLを入力してください（https:// は不要）。チェックのない項目は表示されません。",
+	"admin.enableAcfun":             "AcFun を有効にする",
+	"admin.enableBili":              "Bilibili を有効にする",
+	"admin.enableWeibo":             "Weibo を有効にする",
+	"admin.enableXiaohongshu":       "小紅書 を有効にする",
+	"admin.enableBlog":              "個人ブログを有効にする",
+	"admin.registerOnly":            "登録ユーザーのみ質問を許可",
+	"admin.updateHarassment":        "迷惑行為対策を更新",
+	"admin.globalBlockWords":        "共通ブロックワード",
+	"admin.globalBlockWordsHint":    "ブロックワードは質問・チャット（相手からあなたへのメッセージ）・投票の投稿内容に適用されます。この設定は質問/チャット/投票の3つのタブで共有され、どこで変更してもすぐに反映されます。",
+	"admin.updateBlockWords":        "ブロックワードを保存",
+	"admin.allowChat":               "登録ユーザーからのチャットを許可",
+	"admin.dailyLimitHint":          "0 は無制限",
+	"admin.updateChat":              "チャット設定を更新",
+	"admin.showInHome":              "ホームページでタグを表示（タグで検索されることを許可）",
+	"admin.updateTags":              "タグを更新",
+	"admin.updatePagePassword":      "ページパスワードを更新",
+	"admin.pagePasswordPlaceholder": "ページアクセスパスワードを入力",
+	"admin.updateAskPassword":       "質問パスワードを更新",
+	"admin.askPasswordPlaceholder":  "質問パスワードを入力",
+	"admin.account":                 "アカウント設定",
+	"admin.exportHint":              "%s のすべての個人データ（基本情報、受け取った質問と回答を含む）をエクスポートできます。",
+	"admin.exportJSON":              "全データをエクスポート（JSON）",
+	"admin.exportJSONHint":          "質問・回答・追加質問・チャットを含む完全バックアップ。",
+	"admin.deactivate":              "アカウントを停止",
+	"admin.deactivateHint":          "いつでもアカウントを停止できます。停止後はログインできなくなり、質問箱のページや質問にもアクセスできなくなります。新しい質問も受け付けられません。<b>この操作は取り消せません。ご注意ください！</b>",
+	"admin.socialRequired":          "リンクを入力するか、チェックを外してください",
+
+	// 質問管理ページ
+	"qlist.title":              "マイ質問",
+	"qlist.answered":           "回答済み",
+	"qlist.pending":            "回答待ち",
+	"qlist.private":            "非公開",
+	"qlist.empty":              "質問はまだありません。質問箱を共有しましょう～",
+	"qlist.action":             "操作",
+	"qlist.answerNow":          "回答する",
+	"qlist.sort":               "並び替え",
+	"qlist.status":             "状態",
+	"qlist.type":               "種類",
+	"qlist.latest":             "最新",
+	"qlist.oldest":             "最古",
+	"qlist.all":                "すべて",
+	"qlist.public":             "通常の質問",
+	"qlist.privateQuestion":    "非公開の質問",
+	"qlist.received":           "受け取った質問",
+	"qlist.myChats":            "開始したチャット",
+	"qlist.statsTotal":         "質問総数",
+	"qlist.statsAnswered":      "回答済み",
+	"qlist.statsUnanswered":    "未回答",
+	"qlist.statsPrivate":       "非公開質問",
+	"qlist.statsPinned":        "ピン留め",
+	"qlist.statsChats":         "チャット",
+	"qlist.searchPlaceholder":  "質問や回答を検索...",
+	"qlist.searchBtn":          "検索",
+	"qlist.searchClear":        "クリア",
+	"qlist.questionsTab":       "質問",
+	"qlist.votesTab":           "投票",
+	"qlist.chatsTab":           "チャット",
+	"qlist.receivedChats":      "受け取ったチャット",
+	"qlist.chatEmpty":          "まだチャットがありません。質問箱を共有してチャットを始めましょう！",
+	"qlist.pinnedShort":        "ピン",
+	"qlist.privateShort":       "非公開",
+	"qlist.chatStatsTotal":     "チャット総数",
+	"qlist.chatStatsReceived":  "受け取った",
+	"qlist.chatStatsInitiated": "開始した",
+	"qlist.chatStatsClosed":    "終了",
+	"qlist.unansweredShort":    "未答",
+	"qlist.readShort":          "既読",
+	"qlist.unreadShort":        "未読",
+	"qitem.markReadShort":      "既読に",
+	"qlist.pinShort":           "ピン",
+	"qlist.unpinShort":         "解除",
+	"qlist.myVotes":            "作成した投票",
+	"qlist.loadMore":           "もっと読み込む",
+	"qlist.newVote":            "投票を作成",
+	"qlist.edit":               "編集",
+	"qlist.untitledVote":       "無題の投票",
+	"qlist.blocked":            "ブロック済み",
+	"qlist.unanswered":         "未回答",
+
+	// サイトロゴの接尾辞
+	"site.logoSuffix": "の質問箱",
+	"site.stats":      "質問箱の統計",
+
+	// キャプチャモーダル
+	"captcha.title":        "人機認証",
+	"captcha.hint":         "以下の計算問題を解いて、ロボットでないことを証明してください",
+	"captcha.refresh":      "別の問題",
+	"captcha.submit":       "認証して送信",
+	"captcha.loading":      "読み込み中...",
+	"captcha.loadFailed":   "読み込み失敗",
+	"captcha.loadRetry":    "読み込み失敗、再試行してください",
+	"captcha.inputAnswer":  "答えを入力してください",
+	"captcha.wrongAnswer":  "答えが違います。もう一度計算してください",
+	"captcha.verifyFailed": "認証失敗、再試行してください",
+
+	// 登録ページ補足
+	"auth.register.domain.prefix":   "カスタムドメイン（あなたの質問箱URLは %s + ",
+	"auth.register.domain.suffix":   " + 下記に入力した内容になります）",
+	"auth.register.confirm":         "パスワード（確認）",
+	"auth.register.language":        "表示言語",
+	"auth.register.languageDefault": "サイト既定に従う",
+	"auth.register.success":         "登録が完了しました。狼の質問箱へようこそ！",
+
+	// 探索ページ補足
+	"explore.recommend":    "ランダムおすすめ",
+	"explore.search":       "タグを検索...",
+	"explore.sortLatest":   "新着順",
+	"explore.sortOldest":   "古い順",
+	"explore.noTags":       "タグなし",
+	"explore.noRecommend":  "おすすめユーザーはいません",
+	"explore.hotTags":      "人気タグ",
+	"explore.hotQuestions": "人気質問",
+	"explore.noResult":     "条件に一致するユーザーはいません。",
+	"explore.lazy":         "このユーザーは何も書いていません~",
+	"explore.prevPage":     "前へ",
+	"explore.nextPage":     "次へ",
+	"explore.loading":      "読み込み中...",
+	"explore.loadFailed":   "読み込み失敗",
+
+	// 質問箱パスワードページ
+	"password.title":  "この質問箱はパスワード保護されています",
+	"password.desc":   "この質問箱はパスワード保護されています。パスワードを入力して内容を表示してください",
+	"password.input":  "アクセスパスワードを入力してください",
+	"password.enter":  "認証して入る",
+	"password.submit": "確認",
+
+	// 質問が見つかりません
+	"qitem.notFound": "質問が見つからないか、削除されました",
+
+	// チャットページ
+	"chat.title":          "チャット",
+	"chat.input":          "メッセージを入力...",
+	"chat.send":           "送信",
+	"chat.delete":         "会話を削除",
+	"chat.block":          "相手をブロック",
+	"chat.unblock":        "ブロック解除",
+	"chat.empty":          "メッセージはまだありません。何か書いてみましょう~",
+	"chat.withAsker":      "質問者とのチャット",
+	"chat.withUser":       "%s とのチャット",
+	"chat.closed":         "会話は終了しました",
+	"chat.closedNoSend":   "会話は終了したため、新しいメッセージを送信できません",
+	"chat.remaining":      "残りメッセージ：%d 件（全 %d 件）",
+	"chat.me":             "自分",
+	"chat.other":          "相手",
+	"chat.userBlocked":    "このユーザーはブロックされています",
+	"chat.addImage":       "画像を追加（任意、最大5MB）",
+	"chat.confirm":        "確認",
+	"chat.confirmBlock":   "このユーザーをブロックしますか？ブロック後はメッセージを送信できなくなります。",
+	"chat.confirmUnblock": "このユーザーのブロックを解除しますか？再度メッセージを送信できるようになります。",
+	"chat.deleteConfirm":  "このチャットを削除しますか？相手はこの会話を見られなくなり、この操作は取り消せません。",
+	"maintenance.title":   "NekoBox メンテナンス中...",
+	"maintenance.desc":    "NekoBox はメンテナンス中のため、一時的にご利用いただけません。また後でお越しください~",
+
+	// 質問の個別シェア（v4）
+	"qitem.shareCard": "この質問をシェア",
+
+	// 追加質問（v4）
+	"followup.title":              "追加質問",
+	"followup.content":            "追加質問：",
+	"followup.answerPlaceholder":  "この追加質問に回答...",
+	"followup.answerBtn":          "回答する",
+	"followup.waiting":            "回答待ち...",
+	"followup.askMore":            "追加で質問する",
+	"followup.remaining":          "追加質問可能: %d / %d 回",
+	"followup.contentPlaceholder": "質問を補足...",
+	"followup.submit":             "送信",
+	"followup.waitingReply":       "追記を送信しました。ボックス所有者の返信をお待ちください...",
+
+	// ピン留め（v4）
+	"qlist.pinned":      "ピン留め中",
+	"qlist.pin":         "ピン留め",
+	"qlist.unpin":       "ピン留め解除",
+	"qlist.readStatus":  "既読ステータス",
+	"qlist.read":        "既読",
+	"qlist.unread":      "未読",
+	"qlist.statsRead":   "既読",
+	"qlist.statsUnread": "未読",
+
+	// 質問送信完了ページ（v4）
+	"success.title":        "質問を送信しました！",
+	"success.yourQuestion": "あなたの質問：",
+	"success.emailSent":    "この質問のプライベートリンクをメールで送信しました。以下のリンクからいつでも質問の確認、回答の受信、追加質問ができます。",
+	"success.saveLink":     "<strong>以下のプライベートリンクを必ず保存してください！</strong>メールアドレスを入力しなかったため、このリンク（トークンを含む）が質問の確認・回答の受信・追加質問のための<strong>唯一の証拠</strong>です。失くすと復元できません。",
+	"success.privateLink":  "あなたのプライベートリンク（クリックしてコピー）",
+	"success.copy":         "コピー",
+	"success.copied":       "コピーしました ✓",
+	"success.copyFailed":   "コピーに失敗",
+	"success.token":        "トークン: %s（質問者はこのトークンでプライベートリンクにアクセス）",
+	"success.viewQuestion": "質問を確認する",
+	"success.backToBox":    "%sの質問箱に戻る",
+	"success.pageTitle":    "質問送信完了 - %s",
+
+	// アカウント停止ページ
+	"deactivate.title":   "アカウント停止",
+	"deactivate.desc":    "停止後、あなたの質問箱にはアクセスできなくなり、すべてのデータが削除されます。この操作は取り消せません！",
+	"deactivate.confirm": "アカウントを停止することに同意します",
+	"deactivate.submit":  "アカウントを停止",
+
+	// 匿名投票
+	"nav.votes": "投票",
+
+	"common.back": "戻る",
+
+	"vote.listTitle":              "投票管理",
+	"vote.newTitle":               "投票を作成",
+	"vote.editTitle":              "投票を編集",
+	"vote.resultsTitle":           "投票結果",
+	"vote.statsTotal":             "投票総数",
+	"vote.statsPublished":         "進行中",
+	"vote.createNew":              "投票を作成",
+	"vote.typeSingle":             "単一選択",
+	"vote.typeMultiple":           "複数選択",
+	"vote.typeRating":             "評価",
+	"vote.typeRank":               "順位付け",
+	"vote.typeForm":               "フォーム",
+	"vote.statusNotStarted":       "未開始",
+	"vote.statusDraft":            "下書き",
+	"vote.statusPublished":        "進行中",
+	"vote.statusEnded":            "終了",
+	"vote.statusArchived":         "アーカイブ",
+	"vote.participants":           "参加者",
+	"vote.remainLabel":            "残り",
+	"vote.perpetual":              "期限なし",
+	"vote.durationDay":            "日",
+	"vote.durationHour":           "時間",
+	"vote.durationMinute":         "分",
+	"vote.createdAt":              "作成日時",
+	"vote.edit":                   "編集",
+	"vote.results":                "結果",
+	"vote.preview":                "プレビュー",
+	"vote.page.mustComplete":      "入力してください",
+	"vote.page.rankHintRequired":  "順位 1-N（必須）",
+	"vote.page.rankHintOptional":  "順位 1-N（任意、一部のみ可）",
+	"vote.page.previewHint":       "プレビューモード：公開前のサンプルです。送信は無効です",
+	"vote.page.previewSubmitHint": "プレビューモード。公開後に送信できます",
+	"vote.publish":                "公開",
+	"vote.close":                  "終了",
+	"vote.share":                  "リンクをコピー",
+	"vote.copied":                 "コピーしました",
+	"vote.shareURL":               "投票の共有リンク",
+	"vote.confirmPublish":         "この投票を公開しますか？公開後、共有リンクが生成されます。",
+	"vote.confirmClose":           "この投票を終了しますか？終了後、参加者は投票できなくなります。",
+	"vote.confirmDelete":          "この投票を削除しますか？投票データもすべて削除され、元に戻せません！",
+	"vote.manageEntry":            "投票を管理",
+
+	"vote.manageTitle": "投票管理",
+	"vote.manageDesc":  "匿名投票の作成と管理", "vote.empty": "投票はまだありません。右上の\"投票を作成\"から始めましょう。",
+	"vote.formLockedHint":              "この投票は公開中です。基本情報のみ編集可能です（収集済みデータを守るため、タイプと選択肢はロックされています）",
+	"vote.formBasic":                   "基本設定",
+	"vote.formTitle":                   "投票タイトル",
+	"vote.formTitlePlaceholder":        "例：今日の昼ごはんは？",
+	"vote.formDescription":             "説明",
+	"vote.formDescriptionPlaceholder":  "補足説明（任意）",
+	"vote.formType":                    "投票タイプ",
+	"vote.formVisibility":              "表示方法",
+	"vote.formVisibilityPublic":        "公開（探索ページ + 質問箱ページ）",
+	"vote.formVisibilityLinkOnly":      "リンクのみ",
+	"vote.formVoterScope":              "投票範囲",
+	"vote.formVoterScopeAnyone":        "誰でも（匿名含む）",
+	"vote.formVoterScopeRegistered":    "登録ユーザーのみ",
+	"vote.formShowResult":              "結果の表示タイミング",
+	"vote.formShowResultAfterVote":     "投票後すぐに表示",
+	"vote.formShowResultAfterEnd":      "終了後に表示",
+	"vote.formShowResultOwnerOnly":     "本人のみ",
+	"vote.formStartAt":                 "開始時間（空欄=すぐ開始）",
+	"vote.formEndAt":                   "終了時間（空欄=制限なし）",
+	"vote.formMaxChoices":              "最大選択数",
+	"vote.formMaxVotesPerFingerprint":  "投票ごとに1台の端末につき1回まで。同じブラウザからの再送信は拒否されます。",
+	"vote.formMaxVotesPerAccount":      "投票ごとに1つの登録アカウントにつき1回まで。同じアカウントからの再送信は拒否されます。",
+	"vote.formAllowCustom":             "参加者がカスタム選択肢を追加できる",
+	"vote.formRequireCaptcha":          "匿名投票にキャプチャを要求",
+	"vote.formOptions":                 "投票の選択肢",
+	"vote.formRatingHint":              "評価投票は選択肢不要（1-10点）",
+	"vote.addOption":                   "選択肢を追加",
+	"vote.optionPlaceholder":           "選択肢の内容",
+	"vote.formFields":                  "フォーム項目",
+	"vote.addField":                    "項目を追加",
+	"vote.field":                       "項目",
+	"vote.formFieldType":               "項目タイプ",
+	"vote.fieldTypeText":               "一行テキスト",
+	"vote.fieldTypeTextarea":           "複数行テキスト",
+	"vote.fieldTypeSelect":             "ドロップダウン選択",
+	"vote.fieldTypeRadio":              "単一選択",
+	"vote.fieldTypeCheckbox":           "複数選択",
+	"vote.fieldTypeNumber":             "数値",
+	"vote.fieldTypeRank":               "順位",
+	"vote.page.selectPlaceholder":      "選択してください",
+	"vote.page.avgNumber":              "平均",
+	"vote.page.fieldFilled":            "回答数",
+	"vote.fieldTypeRating":             "評価",
+	"vote.formFieldLabel":              "項目ラベル",
+	"vote.formFieldRequired":           "必須",
+	"vote.formFieldMaxLength":          "文字数上限（0=制限なし）",
+	"vote.formFieldOptions":            "選択肢",
+	"vote.formFieldOptionsHint":        "下の「選択肢を追加」で一つずつ追加してください（カンマ不要）",
+	"vote.fieldAllowCustom":            "参加者がカスタム選択肢を追加できる",
+	"vote.formFieldOptionsPlaceholder": "例：良い,普通,悪い",
+	"vote.createDraft":                 "下書きを保存",
+	"vote.builderHintOptions":          "選択肢は最低 2 つ必要です",
+	"vote.builderHintFields":           "フィールドを最低 1 つ追加してください",
+	"vote.builderHintFieldOptions":     "選択・順位題には選択肢が必要です（順位は最低 2 つ）",
+	"vote.resultsAnswered":             "回答数",
+	"vote.page.rankedTimes":            "順位付け数",
+	"vote.resultsTotal":                "総参加人数",
+	"vote.resultsSubmissions":          "フォームの回答",
+	"vote.resultsViewTexts":            "テキスト回答を表示",
+	"vote.resultsToggleHint":           "クリックでテキスト回答の表示・非表示を切り替え",
+	"vote.resultsOptions":              "投票結果",
+	"vote.resultsVotes":                "票",
+	"vote.export":                      "CSV エクスポート",
+	"vote.resultsEmpty":                "まだ参加者がいません。リンクを共有しましょう！",
+
+	// 投票参加ページ
+	"vote.inlineTitle":                 "投票",
+	"vote.page.by":                     "の投票",
+	"vote.page.goVote":                 "投票する",
+	"vote.page.notStarted":             "未開始",
+	"vote.page.notStartedHint":         "この投票はまだ始まっていません。",
+	"vote.page.ended":                  "終了",
+	"vote.page.endedHint":              "この投票は終了しました。",
+	"vote.page.active":                 "進行中",
+	"vote.page.participated":           "参加済み",
+	"vote.page.loginRequired":          "この投票は登録ユーザーのみ参加できます。ログインしてください。",
+	"vote.page.anonymousHint":          "匿名での参加が可能で、あなたの身元は記録されません（同一端末で最大1回）。",
+	"vote.page.submit":                 "投票する",
+	"vote.page.alreadyVoted":           "この投票にはすでに参加済みです。ありがとうございます！",
+	"vote.page.resultsTitle":           "投票結果",
+	"vote.page.totalVotes":             "総参加",
+	"vote.page.avgRating":              "平均点",
+	"vote.page.avgRank":                "平均順位",
+	"vote.page.optionColumn":           "選択肢",
+	"vote.page.ratingLabel":            "評価",
+	"vote.page.ratingUnit":             "点",
+	"vote.page.rankHint":               "各選択肢に 1-N の順位を入力してください（小さいほど上位、重複不可）",
+	"vote.page.rankPlaceholder":        "順位",
+	"vote.page.multipleHint":           "複数選択可",
+	"vote.page.customOption":           "カスタム選択肢（任意）",
+	"vote.page.customPlaceholder":      "あなたの選択肢を入力",
+	"vote.page.customOther":            "その他",
+	"vote.page.customFieldPlaceholder": "カスタム選択肢を入力…",
+	"vote.page.customStats":            "カスタム選択肢",
+	"vote.page.formCount":              "回答受付数",
+	"vote.page.ownerManage":            "この投票を管理（結果は本人のみ閲覧可能）",
+
+	// 投票ごとの定量収集
+	"vote.formQuotaLimit":          "収集上限（件）",
+	"vote.formQuotaHint":           "0 は無制限。指定件数に達すると自動的に投票を終了します。",
+	"vote.flash.notFound":          "この投票は存在しないか、既に無効です",
+	"vote.flash.notPublished":      "この投票はまだ公開されていません",
+	"vote.flash.archived":          "この投票はアーカイブ済みのため参加できません",
+	"vote.flash.ended":             "この投票は終了しました",
+	"vote.flash.notStarted":        "この投票はまだ開始していません",
+	"vote.flash.success":           "投票が完了しました。ご参加ありがとうございます！",
+	"vote.err.noChoice":            "少なくとも 1 つの選択肢を選んでください",
+	"vote.err.tooManyChoices":      "選択できるのは最大 %d 個までです",
+	"vote.err.pickOne":             "選択肢を 1 つ選んでください",
+	"vote.err.invalidOption":       "無効な選択肢です",
+	"vote.err.optionDuplicate":     "選択肢は重複できません",
+	"vote.err.ratingRequired":      "1〜10 点の評価を入力してください",
+	"vote.err.rankRequired":        "すべての選択肢に 1〜%d の順位を入力してください",
+	"vote.err.rankDuplicate":       "順位が重複しています",
+	"vote.err.fieldRequired":       "「%s」を入力してください",
+	"vote.err.fieldCustomRequired": "「%s」の自由記入欄を入力してください",
+	"vote.err.fieldCustomTooLong":  "「%s」の自由記入は %d 字以内にしてください",
+	"vote.err.fieldInvalidOption":  "「%s」の選択肢が無効です",
+	"vote.err.fieldConfigError":    "「%s」の選択肢の設定に誤りがあります",
+	"vote.err.fieldRankIncomplete": "「%s」の順位をすべて入力してください",
+	"vote.err.fieldRankRange":      "「%s」の順位は 1〜%d の数字で入力してください",
+	"vote.err.fieldRankDuplicate":  "「%s」の順位が重複しています",
+	"vote.err.fieldTooLong":        "「%s」が文字数上限（最大 %d 字）を超えています",
+	"vote.err.fieldNotNumber":      "「%s」は数値で入力してください",
+	"vote.err.fieldRating":         "「%s」は 1〜10 点で評価してください",
+	"vote.err.unknownType":         "不明な投票タイプです",
+	"vote.err.customTooLong":       "自由記入オプションは %d 字以内にしてください",
+	"vote.err.blockWords":          "投稿内容に投票作成者が設定したブロックワードが含まれているため、送信できませんでした",
+	"vote.err.serialize":           "送信内容の保存に失敗しました",
+	"captcha.error":                "認証コードが正しくありません",
+	"captcha.errEmpty":             "認証コードを入力してください",
+	"captcha.errFormat":            "認証コードの形式が正しくありません。再読み込みしてお試しください",
+	"captcha.errAnswerFormat":      "認証コードの回答形式が正しくありません",
+	"captcha.errExpired":           "認証コードの有効期限が切れました。再読み込みしてお試しください",
+	"captcha.errService":           "認証コードサービスでエラーが発生しました。後ほどお試しください",
+	"captcha.errAnswerWrong":       "認証コードの回答が正しくありません",
+	"censor.unavailable":           "コンテンツ審査サービスが一時的に利用できません。後ほどお試しください",
+
+	// 機能管理：質問 / チャット / 投票 の ON・OFF、期間指定、定量収集
+	"admin.tabAccount":            "ユーザー設定",
+	"admin.featuresHint":          "「質問 / チャット / 投票」パネルで各機能の ON/OFF、公開期間、収集上限を管理します。上限に達すると対象機能は自動的に閉じられます。",
+	"admin.featuresEntry":         "設定",
+	"admin.featureHint.question":  "OFF にすると新しい質問を投稿できません。上限に達すると自動的に受付を停止します（非公開質問を含む）。",
+	"admin.featureHint.chat":      "OFF にすると新しいチャットを開始できません。既存の会話には影響しません。",
+	"admin.featureHint.vote":      "OFF にすると質問箱ページに投票が表示されず、回答もできなくなります。投票ごとの上限は編集ページで設定できます。",
+	"admin.featureEnabled":        "この機能を有効にする",
+	"admin.featureOpenAt":         "公開開始",
+	"admin.featureCloseAt":        "公開終了",
+	"admin.featureTimeHint":       "空欄は制限なし。開始前と終了後はその機能を利用できません。",
+	"admin.featureSchedule":       "定期公開（毎週）",
+	"admin.featureScheduleStart":  "毎日の開始",
+	"admin.featureScheduleEnd":    "毎日の終了",
+	"admin.featureScheduleHint":   "毎週の公開曜日と毎日の時間帯を設定すると、毎週繰り返し公開されます。すべて空欄で無効。曜日のみ（時間なし）は終日公開、時間のみ（曜日なし）は毎日その時間帯に公開。",
+	"admin.featureMode":           "収集モード",
+	"admin.featureModeAlways":     "常時開放",
+	"admin.featureModeWindow":     "期間限定",
+	"admin.featureModeRecurring":  "曜日スケジュール",
+	"admin.featureModeHint":       "常時開放：手動でオフにするまで開放し続けます。期間限定：一回限りの開始／終了時刻で開放します。曜日スケジュール：毎週の開放日と時間帯を繰り返し適用します。モードは保存時に排他となり、未選択モードの設定はクリアされます。",
+	"admin.featureQuotaLimit":     "収集上限（件）",
+	"admin.featureQuotaHint":      "0 は無制限。上限に達すると自動的に閉じられます。カウントをリセットすると次の回を開始できます。",
+	"admin.featureQuotaCount":     "収集済み",
+	"admin.featureQuotaUnlimited": "無制限",
+	"admin.featureQuotaResetAt":   "最終リセット：",
+	"admin.featureResetQuota":     "カウントをリセット",
+	"admin.featureSave":           "この機能を保存",
+
+	// 機能管理：状態とメッセージ
+	"feature.name.question":        "質問",
+	"feature.name.chat":            "チャット",
+	"feature.name.vote":            "投票",
+	"feature.statusOpen":           "受付中",
+	"feature.status.disabled":      "停止中",
+	"feature.status.not_started":   "未開始",
+	"feature.status.ended":         "終了",
+	"feature.status.quota_reached": "上限到達",
+	"feature.saved":                "機能設定を保存しました",
+	"feature.errTime":              "%s の日時形式が正しくありません。日時選択ツールを使用してください",
+	"feature.errTimeRange":         "%s の公開終了時刻は公開開始時刻より後にしてください",
+	"feature.errQuota":             "%s の収集上限は 0〜1000000 の整数で入力してください",
+	"feature.errInvalid":           "不明な機能です",
+	"feature.quotaReset":           "%s の収集カウントをリセットしました",
+	"feature.errScheduleHalf":      "%s の定期公開の開始時間と終了時間は両方入力してください",
+	"feature.errScheduleTime":      "%s の定期公開の時刻形式が正しくありません。時刻選択ツールを使用してください",
+	"feature.errScheduleRange":     "%s の定期公開の終了時刻は開始時刻より後にしてください",
+
+	// 機能が無効なときに訪問者へ表示するメッセージ
+	"feature.disabled.question":      "この質問箱の管理者は質問の受付を停止しています",
+	"feature.disabled.chat":          "この質問箱ではチャットを受け付けていません",
+	"feature.disabled.vote":          "この質問箱では投票を受け付けていません",
+	"feature.not_started.question":   "質問の受付はまだ開始していません",
+	"feature.not_started.chat":       "チャットの受付はまだ開始していません",
+	"feature.not_started.vote":       "投票の受付はまだ開始していません",
+	"feature.ended.question":         "質問の受付は終了しました",
+	"feature.ended.chat":             "チャットの受付は終了しました",
+	"feature.ended.vote":             "投票の受付は終了しました",
+	"feature.quota_reached.question": "質問の収集上限に達しました",
+	"feature.quota_reached.chat":     "チャットの収集上限に達しました",
+	"feature.quota_reached.vote":     "投票の収集上限に達しました",
+
+	// 認証：訪問者に表示されるメッセージ（P0）
+	"auth.errBadCredential":   "メールアドレスまたはパスワードが正しくありません",
+	"auth.errUserNotFound":    "ユーザーが存在しません",
+	"auth.errEmailFrequent":   "メールの送信頻度が高すぎます。しばらくしてからお試しください",
+	"auth.errEmailFailed":     "メールの送信に失敗しました。しばらくしてからお試しください",
+	"auth.errCodeExpired":     "認証コードの有効期限が切れました",
+	"auth.errPasswordChanged": "パスワードを変更しました",
+	"auth.errLoginRequired":   "ログインしてください",
+	"auth.errDuplicateEmail":  "このメールアドレスは既に登録されています",
+	"auth.errDuplicateDomain": "このカスタムドメインは既に使用されています",
+
+	// 質問箱ページ：訪問者に表示（P0）
+	"question.errWrongPassword":     "パスワードが正しくありません",
+	"question.errAskPasswordWrong":  "質問用パスワードが正しくありません",
+	"question.errLoginRequired":     "質問箱の所有者は登録ユーザーのみ質問できるように設定しています。先にログインしてください。",
+	"question.errSelfChat":          "自分自身とのチャットは開始できません",
+	"question.errBlockedChat":       "相手にブロックされているため、チャットを開始できません",
+	"question.errChatDailyLimit":    "本日の送信上限（%d件）に達しました。明日お試しください",
+	"question.errDuplicateSubmit":   "重複送信が検出されました。しばらくしてからお試しください",
+	"question.errImageTooLarge":     "画像ファイルのサイズは 5Mb 以下である必要があります",
+	"question.errUploadImageFailed": "画像のアップロードに失敗しました",
+	"question.errBlockWords":        "質問に所有者が設定したブロックワードが含まれているため、送信できませんでした",
+	"question.errAnsweredLocked":    "回答済みの質問は未読にできません",
+	"question.flash.chatSent":       "チャットリクエストを送信しました！以下のリンクから会話を確認できます：%s",
+	"question.flash.answered":       "回答を公開しました！",
+	"question.flash.operated":       "操作が完了しました",
+	"question.flash.markedRead":     "既読にしました",
+	"question.flash.markedUnread":   "未読にしました",
+
+	// 追加質問：訪問者/所有者に表示（P0）
+	"followup.errNoPermission": "権限がありません",
+	"followup.errNotAnswered":  "この質問にはまだ回答がありません。追加質問はできません",
+	"followup.errLimit":        "各質問の追加質問は最大 %d 回までで、上限に達しました",
+	"followup.errWaitReply":    "前の追加質問への返信を待ってから続けてください",
+	"followup.errNotFound":     "追加質問が存在しません",
+	"followup.flash.sent":      "追加質問を送信しました！",
+	"followup.flash.answered":  "回答を投稿しました！",
+
+	// 管理設定：所有者に表示（P1）
+	"admin.flash.profileUpdated":    "プロフィールを更新しました",
+	"admin.flash.chatUpdated":       "チャット設定を更新しました",
+	"admin.flash.pagePwdOff":        "ページパスワード認証を無効にしました",
+	"admin.flash.pagePwdUpdated":    "ページアクセスパスワードを更新しました",
+	"admin.flash.askPwdOff":         "質問パスワードを無効にしました",
+	"admin.flash.askPwdUpdated":     "質問パスワードを更新しました",
+	"admin.flash.tagsTooMany":       "タグは最大 5 個までです",
+	"admin.flash.tagsUpdated":       "タグを更新しました",
+	"admin.flash.tagTooLong":        "各タグは 5 文字以内である必要があります：%s",
+	"admin.flash.blockWordsTooMany": "ブロックワードは最大 10 個までです",
+	"admin.flash.blockWordTooLong":  "ブロックワードの長さは 10 文字以内である必要があります：%s",
+	"admin.flash.harassmentUpdated": "迷惑行為対策を更新しました",
+	"admin.flash.blockWordsUpdated": "ブロックワードを更新しました",
+	"admin.flash.deactivated":       "アカウントを停止しました。狼の質問箱をご利用いただきありがとうございます。またのお越しをお待ちしています 👋🏻",
+	"admin.export.errUser":          "エクスポート失敗：ユーザー情報の取得に失敗しました",
+	"admin.export.errQuestion":      "エクスポート失敗：質問情報の取得に失敗しました",
+
+	// 投票管理：所有者に表示（P1）
+	"vote.err.invalidID":                 "無効な投票 ID",
+	"vote.err.notExist":                  "投票が存在しません",
+	"vote.err.noPermission":              "この投票を操作する権限がありません",
+	"vote.err.type":                      "不明な投票タイプです",
+	"vote.err.titleRequired":             "投票のタイトルを入力してください",
+	"vote.err.titleTooLong":              "投票のタイトルは 100 文字以内である必要があります",
+	"vote.err.visibility":                "不明な表示設定です",
+	"vote.err.voterScope":                "不明な投票範囲設定です",
+	"vote.err.showResult":                "不明な結果表示設定です",
+	"vote.err.timeRange":                 "終了時刻は開始時刻より後にしてください",
+	"vote.err.quota":                     "収集上限は 0〜1000000 の整数で入力してください",
+	"vote.err.optionsTooFew":             "選択肢を最低 2 つ追加してください",
+	"vote.err.optionsFormat":             "選択肢データの形式が正しくありません",
+	"vote.err.optionTooLong":             "1 つの選択肢は %d 文字以内である必要があります",
+	"vote.err.maxChoicesExceed":          "最大選択数は選択肢の総数を超えられません",
+	"vote.err.fieldsTooFew":              "フォーム項目を最低 1 つ追加してください",
+	"vote.err.fieldsFormat":              "フォーム項目データの形式が正しくありません",
+	"vote.err.fieldsTooMany":             "フォーム項目は最大 50 個までです",
+	"vote.err.fieldType":                 "不明なフォーム項目タイプです",
+	"vote.err.fieldLabelMissing":         "%d 番目の項目にラベルがありません",
+	"vote.err.fieldLabelTooLong":         "%d 番目の項目のラベルは 100 文字以内である必要があります",
+	"vote.err.fieldLabelDuplicate":       "項目ラベル「%s」が重複しています。別のラベルを使用してください",
+	"vote.err.fieldMaxLength":            "%d 番目の項目の文字数上限は 0〜2000 の間である必要があります",
+	"vote.err.fieldReservedOption":       "%d 番目の項目（%s）の選択肢に予約値が含まれています。変更してください",
+	"vote.err.fieldOptionsTooFew":        "%d 番目の項目（%s）は選択肢を最低 1 つ入力してください",
+	"vote.err.fieldRankTooFew":           "%d 番目の項目（%s）の順位付けには最低 2 つの選択肢が必要です",
+	"vote.err.fieldSerialize":            "項目の選択肢のシリアライズに失敗しました",
+	"vote.err.editClosed":                "終了またはアーカイブされた投票は編集できません",
+	"vote.err.publishDraftOnly":          "草稿状態の投票のみ公開できます",
+	"vote.err.closePublishedOnly":        "進行中の投票のみ終了できます",
+	"vote.err.publishTitleRequired":      "公開前に投票のタイトルを入力してください",
+	"vote.err.publishFormFieldsRequired": "フォーム型投票には最低 1 つの項目が必要です",
+	"vote.err.publishOptionsRequired":    "選択型投票には最低 2 つの選択肢が必要です",
+	"vote.err.optionUpdateFailed":        "選択肢の更新に失敗しました。再試行してください",
+	"vote.err.fieldUpdateFailed":         "フォーム項目の更新に失敗しました。再試行してください",
+	"vote.flash.published":               "投票を公開しました！共有リンク：%s",
+	"vote.flash.updated":                 "投票情報を更新しました（進行中の投票はタイプと選択肢を変更できません）",
+	"vote.flash.draftSaved":              "下書きに保存しました",
+	"vote.flash.closed":                  "投票を終了しました",
+	"vote.flash.deleted":                 "投票を削除しました",
+	"vote.err.timeFormat":                "日時の形式が正しくありません。日時選択器を使用してください",
+	"vote.err.maxChoicesLimit":           "選択可能数は20を超えられません",
+	"vote.err.descriptionTooLong":        "投票の説明は5000文字を超えられません",
+	"profile.err.avatarTooLarge":         "アイコンファイルが大きすぎます。最大2MB",
+	"profile.err.backgroundTooLarge":     "背景画像が大きすぎます。最大2MB",
+	"profile.err.newPasswordTooShort":    "新しいパスワードは8文字以上である必要があります",
+	"profile.err.badOldPassword":         "古いパスワードが間違っています",
+	"admin.export.errCreateExcel":        "エクスポート失敗：Excelファイルの作成に失敗しました",
+	"admin.export.errWriteExcel":         "エクスポート失敗：Excelファイルの書き込みに失敗しました",
+
+	// プロフィール設定ページ UI リニューアル：カード区切り／アイコン・背景の切り取り／パスワード変更後の強制ログアウト
+	"profile.card.basic":             "基本情報",
+	"profile.card.avatarBg":          "アイコンと背景",
+	"profile.card.qr":                "QRコードのスタイル",
+	"profile.card.password":          "パスワード変更",
+	"profile.avatarCropHint":         "切り取り枠は 1:1（正方形）に固定されています",
+	"profile.backgroundCropHint":     "切り取り枠は 16:9 に固定されています",
+	"profile.cropTitle":              "画像を切り取る",
+	"profile.cropConfirm":            "切り取りを確定",
+	"profile.err.avatarRatio":        "アイコン画像は 1:1 の正方形である必要があります。切り取ってから再アップロードしてください",
+	"profile.err.backgroundRatio":    "背景画像は 16:9 の縦横比である必要があります。切り取ってから再アップロードしてください",
+	"profile.flash.passwordChanged":  "パスワードを変更しました。ログアウトしましたので、新しいパスワードで再度ログインしてください",
+	"profile.pwdNote":                "保存後、現在のセッションはすぐに無効になり、新しいパスワードで再ログインする必要があります",
+	"profile.pickAvatar":             "アイコンを変更",
+	"profile.pickBackground":         "背景を変更",
+	"profile.saveBasic":              "基本情報を保存",
+	"profile.saveMedia":              "アイコンと背景を保存",
+	"profile.savePassword":           "パスワードを更新",
+	"profile.saveQR":                 "QRコードのスタイルを保存",
+	"profile.saveSocial":             "SNSリンクを保存",
+	"profile.err.cropLibUnavailable": "画像切り取り機能の読み込みに失敗しました。ページを更新してもう一度お試しください",
+
+	// 認証コード JSON インターフェース：フロントエンドが消費（P2）
+	"captcha.json.badRequest": "リクエスト形式が正しくありません",
+	"captcha.json.idRequired": "認証コード ID を入力してください",
+	"captcha.json.genFailed":  "認証コードの生成に失敗しました",
+	"chat.errDeletedByOwner":  "このプライベート会話は相手によって削除されました。",
+	"chat.errBlockedView":     "あなたは相手にブロックされ、このチャットを表示できません",
+	"chat.errEmpty":           "メッセージを入力してください",
+	"chat.errTooLong":         "メッセージが長すぎます。%d文字以内でお願いします",
+	"chat.errConvDeletedSend": "この会話は削除されたため、メッセージを送信できません",
+	"chat.errBlockedSend":     "あなたは相手にブロックされ、メッセージを送信できません",
+	"chat.errBlockWords":      "メッセージにボックス所有者が設定したブロックワードが含まれているため、送信できませんでした",
+	"chat.errDailyLimit":      "本日の送信上限（%d件）に達しました。明日再度お試しください",
+	"chat.errLimitReached":    "会話が上限に達したため、新しいメッセージを送信できません",
+	"chat.errChatClosed":      "箱の所有者がプライベートチャットを無効にしたため、メッセージを送信できません",
+	"chat.errImageTooLarge":   "画像サイズは%dMBを超えることはできません",
+	"chat.errUploadFailed":    "画像のアップロードに失敗しました。後でもう一度お試しください",
+	"chat.errNoPermission":    "この操作を実行する権限がありません",
+	"chat.flash.sent":         "メッセージを送信しました",
+	"chat.flash.deleted":      "プライベート会話を削除しました",
+	"chat.flash.operated":     "操作が完了しました",
+	"image.errTooLarge":       "画像が大きすぎます。最大%d×%dピクセルまで対応しています。圧縮して再アップロードしてください",
+	"internal.errFlash":       "サーバー内部エラーが発生しました。後でもう一度お試しください。",
+	"internal.errServer":      "サーバー内部エラー",
+	"home.errStats":           "統計情報の取得に失敗しました",
+	"pixel.errPath":           "不正なリクエストパス",
+	"proxy.errNotFound":       "ページが見つかりません",
+	"proxy.errInternal":       "サービスゲートウェイ内部エラー",
+	"explore.errRandomUser":   "ランダムユーザーの取得に失敗しました",
+	// 表单校验
+	"form.answer.content":               "回答内容を入力してください",
+	"form.answer.contentTooLong":        "回答内容は%d文字以内にしてください",
+	"form.email.required":               "有効なメールアドレスを入力してください",
+	"form.followup.answer":              "フォローアップの回答を入力してください",
+	"form.followup.answerTooLong":       "フォローアップの回答は%d文字以内にしてください",
+	"form.followup.content":             "フォローアップ内容を入力してください",
+	"form.followup.contentTooLong":      "フォローアップ内容は%d文字以内にしてください",
+	"form.login.password":               "パスワードを入力してください",
+	"form.profile.backgroundimagealpha": "QRコードの背景の不透明度を入力してください",
+	"form.profile.colorHex":             "7文字の16進数カラーコード（#を含む）を入力してください",
+	"form.profile.dotscale":             "QRコードの点の大きさを入力してください",
+	"form.profile.intro":                "自己紹介は必須で、100文字以内である必要があります",
+	"form.profile.linkMax":              "プロフィールリンクは30文字以内である必要があります",
+	"form.profile.name":                 "ニックネームは必須で、20文字以内である必要があります",
+	"form.profile.newPassword":          "新しいパスワードは30文字以内である必要があります",
+	"form.profile.passwordMax":          "パスワードは30文字以内である必要があります",
+	"form.question.content":             "質問内容を入力してください",
+	"form.question.contentTooLong":      "質問内容は%d文字以内にしてください",
+	"form.question.receiveReplyEmail":   "返信を受け取るための有効なメールアドレスを入力してください",
+	"form.recaptcha":                    "CAPTCHA認証を完了してください",
+	"form.recover.newPassword":          "8〜30文字の新しいパスワードを設定してください",
+	"form.recover.repeatPassword":       "入力した2つの新しいパスワードが一致しません",
+	"form.register.domain":              "カスタムドメインは半角英数字とアンダースコアのみ使用でき、3〜20文字である必要があります",
+	"form.register.email":               "有効なメールアドレスを入力してください（100文字以内）",
+	"form.register.name":                "ニックネームは必須で、20文字以内である必要があります",
+	"form.register.password":            "8〜30文字のパスワードを設定してください",
+	"form.register.recaptcha":           "CAPTCHAを読み込めません。ページを再読み込みするか、ネットワークを変更してお試しください",
+	"form.register.repeatPassword":      "入力した2つのパスワードが一致しません",
+}
diff --git a/internal/i18n/dict_zh_cn.go b/internal/i18n/dict_zh_cn.go
new file mode 100644
index 0000000..09f10c4
--- /dev/null
+++ b/internal/i18n/dict_zh_cn.go
@@ -0,0 +1,840 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package i18n
+
+// zhCNDict 简体中文文案。
+var zhCNDict = map[string]string{
+	// 导航
+	"nav.explore":  "探索",
+	"nav.mine":     "我的",
+	"nav.register": "注册",
+	"nav.login":    "登录",
+	"nav.ask":      "提问",
+	"nav.settings": "设置",
+	"nav.lang":     "语言",
+
+	// 通用
+	"common.login":      "登录",
+	"common.forgot":     "忘记密码",
+	"common.submit":     "提交",
+	"common.cancel":     "取消",
+	"common.save":       "保存",
+	"common.close":      "关闭",
+	"common.delete":     "删除",
+	"common.moveUp":     "上移",
+	"common.moveDown":   "下移",
+	"common.share":      "分享",
+	"common.verifying":  "验证中...",
+	"common.submitting": "提交中...",
+	"common.uploading":  "上传中...",
+	"common.lang":       "语言",
+	"common.menu":       "菜单",
+
+	"common.pleaseWait": "请稍候...",
+	"common.backHome":   "返回首页",
+	"common.theme":      "切换深色/浅色模式",
+
+	// 站点
+	"site.title":          "狼的提问箱 | 匿名提问箱",
+	"site.description":    "狼的提问箱——一个无需注册、可匿名提问的匿名提问箱，安全地倾诉与回应。",
+	"site.keywords":       "匿名提问箱,提问箱,匿名提问,狼的提问箱,匿名问答,匿名提问网站",
+	"site.footer.runtime": "提问箱已成功存活",
+	"site.footer.admin":   "找站长",
+	"site.footer.notice":  "公告板",
+	"site.footer.chat":    "聊天室",
+	"site.footer.drive":   "盘",
+	"site.footer.status":  "监控板",
+	"site.footer.nav":     "导航页",
+	"site.maintenance":    "本站正在维护中，请稍后再来～",
+
+	// 认证
+	"auth.login.title":       "用户登录",
+	"auth.login.email":       "电子邮箱",
+	"auth.login.password":    "密码",
+	"auth.login.submit":      "登录",
+	"auth.login.forgot":      "忘记密码",
+	"auth.register.title":    "用户注册",
+	"auth.register.name":     "昵称",
+	"auth.register.email":    "电子邮箱",
+	"auth.register.password": "密码",
+	"auth.register.submit":   "注册",
+	"auth.forgot.title":      "忘记密码",
+	"auth.forgot.email":      "电子邮箱",
+	"auth.forgot.submit":     "发送重置邮件",
+	"auth.forgot.submitBtn":  "找回密码",
+	"auth.forgot.sent":       "邮件已发送至 %s，请查收。",
+	"auth.recover.title":     "重置密码",
+	"auth.recover.greeting":  "%s，您正在重置您的密码：",
+	"auth.recover.password":  "新密码",
+	"auth.recover.confirm":   "确认密码",
+	"auth.recover.submit":    "重置密码",
+
+	// 探索页
+	"explore.title":        "探索用户标签",
+	"explore.notice":       "此处展示已开启<span class=\"uk-text-bold\">“在首页展示我的标签”</span>的用户。该功能默认关闭，若希望自己的提问箱在这里被发现，请前往 <a href=\"/user/profile\" class=\"uk-text-bold\">个人设置</a> 手动开启。",
+	"explore.shuffle":      "换一批",
+	"explore.empty":        "暂时没有发现可展示的用户，快去开启吧～",
+	"explore.hotVotes":     "热门投票",
+	"explore.questionsTab": "提问",
+	"explore.votesTab":     "投票",
+	"explore.votesTitle":   "公开投票",
+	"explore.votesDesc":    "浏览正在进行的公开投票，选择你感兴趣的主题参与。",
+	"explore.randomVote":   "随机推荐",
+	"explore.allVotes":     "全部投票",
+	"explore.noVotes":      "暂时没有可参与的公开投票。",
+
+	// 提问页
+	"ask.scan":              "扫码向@%s提问",
+	"ask.anonymous":         "谁都可以以匿名的形式提问",
+	"ask.registerOnly":      "仅允许注册用户向TA提问",
+	"ask.nextOpenAt":        "下次开放时间：%s",
+	"ask.lastCloseAt":       "上次关闭时间：%s",
+	"weekday.0":             "周日",
+	"weekday.1":             "周一",
+	"weekday.2":             "周二",
+	"weekday.3":             "周三",
+	"weekday.4":             "周四",
+	"weekday.5":             "周五",
+	"weekday.6":             "周六",
+	"ask.pinned":            "已置顶",
+	"ask.share":             "分享提问箱",
+	"ask.placeholder":       "在此处撰写你的问题...",
+	"ask.chatPlaceholder":   "在此处撰写你的私聊消息...",
+	"ask.addImage":          "添加图片",
+	"ask.private":           "回复后不公开",
+	"ask.notify":            "接收通知",
+	"ask.emailPlaceholder":  "请输入你的邮箱地址",
+	"ask.submit":            "发送提问",
+	"ask.chat":              "发起私聊",
+	"ask.chatDisabled":      "该提问箱未开启私聊",
+	"ask.chatLimit":         "消息上限：%d条",
+	"ask.history":           "@%s 以前回答过的问题",
+	"ask.loginRequired":     "需要登录",
+	"ask.loginRequiredChat": "发起私聊需要登录账号",
+	"ask.goLogin":           "去登录",
+	"ask.needPassword":      "此提问箱需要密码",
+	"ask.needLogin":         "提问箱的主人设置了仅注册用户才能提问，你需要先登录才能向他提问。",
+	"ask.pleaseEmail":       "请填写接收通知的邮箱地址",
+	"ask.generating":        "正在生成分享图…",
+	"ask.genFailed":         "生成分享图失败，请稍后重试",
+	"ask.networkError":      "网络错误",
+	"ask.shareFilename":     "share.png",
+
+	// 问题条目
+	"qitem.answer":            "回答",
+	"qitem.delete":            "删除",
+	"qitem.private":           "设为私密",
+	"qitem.public":            "设为公开",
+	"qitem.asked":             "提问",
+	"qitem.pending":           "等待回答",
+	"qitem.answeredBy":        "@%s 于 %s 的回答",
+	"qitem.danger":            "危险！",
+	"qitem.deleteConfirm":     "你确定要删除这个提问吗？该操作不可恢复，请谨慎操作。",
+	"qitem.deleteConfirmBtn":  "确认删除",
+	"qitem.backToBox":         "返回%s的提问箱",
+	"qitem.answerTitle":       "回答问题",
+	"qitem.answerPlaceholder": "在此处撰写你的回答...",
+	"qitem.emailNotifyHint":   "提问人留下了自己的电子邮箱，在你第一次回复该问题后，提问人将会收到一封邮件通知。",
+	"qitem.submitAnswer":      "回答",
+	"qitem.updateAnswer":      "更新回答",
+	"qitem.askMore":           "再问点别的问题？",
+	"qitem.markRead":          "标记为已读",
+	"qitem.markUnread":        "标记为未读",
+	"qitem.readLocked":        "已回答，已锁定为已读",
+
+	// 个人设置页
+	"admin.profile":           "个人信息",
+	"admin.lang":              "界面语言",
+	"admin.langHint":          "选择访客访问你的提问箱时显示的语言（后台页面跟随此设置）",
+	"admin.email":             "电子邮箱",
+	"admin.name":              "昵称",
+	"admin.nameColor":         "昵称颜色",
+	"admin.oldPassword":       "旧密码",
+	"admin.newPassword":       "新密码",
+	"admin.notify":            "新提问通知",
+	"admin.personalize":       "个性化设置",
+	"admin.intro":             "提问箱介绍",
+	"admin.introColor":        "提问箱介绍颜色",
+	"admin.qrBgColor":         "二维码背景色（亮色部分）",
+	"admin.qrPdColor":         "二维码探测图形颜色（边角方形）",
+	"admin.qrFgColor":         "二维码前景色",
+	"admin.qrDotSize":         "二维码点大小 (←小 大→)",
+	"admin.qrBgAlpha":         "二维码背景透明度 (←不透明 很透明→)",
+	"admin.avatar":            "个人头像",
+	"admin.background":        "提问箱背景",
+	"admin.qrBackground":      "二维码背景图",
+	"admin.social":            "社交信息设置",
+	"admin.harassment":        "防骚扰设置",
+	"admin.askLimit":          "提问限制",
+	"admin.blockWords":        "屏蔽词设置（回车或逗号分隔，最多支持 10 个屏蔽词，每个屏蔽词最大长度为 10）",
+	"admin.chat":              "私聊设置",
+	"admin.chatMaxMessages":   "私聊消息条数上限",
+	"admin.chatDailyLimit":    "单用户每日私信条数上限",
+	"admin.tags":              "标签设置",
+	"admin.tagsHint":          "标签（最多5个，每个最多5字，回车或逗号分隔）",
+	"admin.tagsPlaceholder":   "例如：动漫,音乐,游戏",
+	"admin.tagInputHint":      "输入后按回车或逗号添加",
+	"admin.tagInputDuplicate": "已存在，已忽略",
+	"admin.pagePassword":      "页面访问密码",
+	"admin.pagePasswordHint":  "设置访问密码（留空则关闭）",
+	"admin.askPassword":       "提问密码",
+	"admin.askPasswordHint":   "设置提问密码（留空则关闭）",
+	"admin.saveProfile":       "保存修改",
+	"admin.updated":           "更新个人信息成功",
+	"admin.logout":            "退出登录",
+	"admin.export":            "导出数据",
+
+	// 后台设置（补充）
+	"admin.oldPasswordHint":         "修改密码使用，留空则不修改",
+	"admin.newPasswordHint":         "6-64 位，留空则不修改",
+	"admin.notifyEmail":             "邮件",
+	"admin.useCustomFg":             "启用自定义前景色（否则自动匹配）",
+	"admin.customFgHint":            "仅在启用时生效，否则颜色由系统自动生成",
+	"admin.avatarPlaceholder":       "上传个人头像（头像比例不为1:1就扁了你哦）",
+	"admin.backgroundPlaceholder":   "上传提问箱背景",
+	"admin.qrBackgroundPlaceholder": "上传二维码背景（颜色过深的背景会导致二维码无法识别）",
+	"admin.qrPreviewHint":           "选择图片后预览将即时更新",
+	"admin.preview":                 "实时预览",
+	"admin.themePreset":             "预设主题",
+	"admin.themeDefault":            "默认",
+	"admin.themeDark":               "暗夜",
+	"admin.themeOcean":              "海洋",
+	"admin.themeSunset":             "日落",
+	"admin.resetDefaults":           "🔄 恢复默认值",
+	"admin.previewHint":             "调整仅用于预览，最终效果点击「保存修改」后生效",
+	"admin.socialHint":              "勾选后填写主页地址（无需 https://），未勾选的项将不会在前台显示。",
+	"admin.enableAcfun":             "启用 AcFun",
+	"admin.enableBili":              "启用 Bilibili",
+	"admin.enableWeibo":             "启用 微博",
+	"admin.enableXiaohongshu":       "启用 小红书",
+	"admin.enableBlog":              "启用 个人博客",
+	"admin.registerOnly":            "仅允许注册用户向我提问",
+	"admin.updateHarassment":        "更新防骚扰设置",
+	"admin.globalBlockWords":        "全局屏蔽词",
+	"admin.globalBlockWordsHint":    "屏蔽词对提问、私聊（对方发给你的消息）与投票提交内容生效；三个设置页同步显示同一份设置，任意一处修改即时生效。",
+	"admin.updateBlockWords":        "保存屏蔽词",
+	"admin.allowChat":               "允许注册用户向我发起私聊",
+	"admin.dailyLimitHint":          "0 表示不限制",
+	"admin.updateChat":              "更新私聊设置",
+	"admin.showInHome":              "在首页展示我的标签（允许其他用户通过标签搜索到我）",
+	"admin.updateTags":              "更新标签",
+	"admin.updatePagePassword":      "更新页面密码",
+	"admin.pagePasswordPlaceholder": "输入页面访问密码",
+	"admin.updateAskPassword":       "更新提问密码",
+	"admin.askPasswordPlaceholder":  "输入提问密码",
+	"admin.account":                 "账号设置",
+	"admin.exportHint":              "您可以导出您在 %s 中的所有个人数据，包括你的基本信息、收到的问题以及回答。",
+	"admin.exportJSON":              "导出全部数据（JSON）",
+	"admin.exportJSONHint":          "包含提问、回答、追问与私聊记录，可完整备份或迁移。",
+	"admin.deactivate":              "停用我的账号",
+	"admin.deactivateHint":          "您随时可以选择停用您的账号。停用后，您的账号将无法登录，您的提问箱页面以及提问将无法访问，其他人也无法再给您发送新的提问。<b>该操作无法撤销！请谨慎操作！</b>",
+	"admin.socialRequired":          "请填写链接或取消勾选",
+
+	// 问题管理页
+	"qlist.title":              "我的提问",
+	"qlist.answered":           "已回答",
+	"qlist.pending":            "待回答",
+	"qlist.private":            "私密",
+	"qlist.empty":              "还没有提问，快把提问箱分享出去吧～",
+	"qlist.action":             "操作",
+	"qlist.answerNow":          "去回答",
+	"qlist.sort":               "排序",
+	"qlist.status":             "状态",
+	"qlist.type":               "类型",
+	"qlist.latest":             "最新",
+	"qlist.oldest":             "最早",
+	"qlist.all":                "全部",
+	"qlist.public":             "一般提问",
+	"qlist.privateQuestion":    "私密提问",
+	"qlist.received":           "我收到的提问",
+	"qlist.myChats":            "我发起的私聊",
+	"qlist.statsTotal":         "总提问数",
+	"qlist.statsAnswered":      "已回答",
+	"qlist.statsUnanswered":    "未回答",
+	"qlist.statsPrivate":       "私密提问",
+	"qlist.statsPinned":        "置顶",
+	"qlist.statsChats":         "私聊会话",
+	"qlist.searchPlaceholder":  "搜索问题或回答内容...",
+	"qlist.searchBtn":          "搜索",
+	"qlist.searchClear":        "清除搜索",
+	"qlist.questionsTab":       "提问",
+	"qlist.votesTab":           "投票",
+	"qlist.chatsTab":           "私聊",
+	"qlist.receivedChats":      "我收到的私聊",
+	"qlist.chatEmpty":          "还没有私聊，把提问箱分享出去让大家来私聊吧～",
+	"qlist.pinnedShort":        "置顶",
+	"qlist.privateShort":       "私密",
+	"qlist.chatStatsTotal":     "总私聊",
+	"qlist.chatStatsReceived":  "我收到的",
+	"qlist.chatStatsInitiated": "我发起的",
+	"qlist.chatStatsClosed":    "已关闭",
+	"qlist.unansweredShort":    "待答",
+	"qlist.readShort":          "已读",
+	"qlist.unreadShort":        "未读",
+	"qitem.markReadShort":      "标记",
+	"qlist.pinShort":           "置顶",
+	"qlist.unpinShort":         "取消置顶",
+	"qlist.myVotes":            "我创建的投票",
+	"qlist.loadMore":           "加载更多",
+	"qlist.newVote":            "新建投票",
+	"qlist.edit":               "编辑",
+	"qlist.untitledVote":       "未命名投票",
+	"qlist.blocked":            "已拉黑",
+	"qlist.unanswered":         "未回答",
+
+	// 站点 Logo 后缀（emoji 随机动物 + 后缀组成，如 🐺 的提问箱）
+	"site.logoSuffix": "的提问箱",
+	"site.stats":      "提问箱信息统计",
+
+	// 验证码弹窗
+	"captcha.title":        "人机验证",
+	"captcha.hint":         "请计算下方的算术题以验证你不是机器人",
+	"captcha.refresh":      "换一题",
+	"captcha.submit":       "验证并提交",
+	"captcha.loading":      "加载中...",
+	"captcha.loadFailed":   "加载失败",
+	"captcha.loadRetry":    "加载失败，请重试",
+	"captcha.inputAnswer":  "请输入答案",
+	"captcha.wrongAnswer":  "答案错误，请重新计算",
+	"captcha.verifyFailed": "验证失败，请重试",
+
+	// 注册页补充
+	"auth.register.domain.prefix":   "个性域名（你的问答箱网址将会是：%s + ",
+	"auth.register.domain.suffix":   " + 你在下面文本框中填写的内容）",
+	"auth.register.confirm":         "确认密码",
+	"auth.register.language":        "界面语言",
+	"auth.register.languageDefault": "跟随站点默认",
+	"auth.register.success":         "注册成功，欢迎来到 狼的提问箱！",
+
+	// 探索页补充
+	"explore.recommend":    "随机推荐",
+	"explore.search":       "搜索标签...",
+	"explore.sortLatest":   "最新加入",
+	"explore.sortOldest":   "最早加入",
+	"explore.noTags":       "无标签",
+	"explore.noRecommend":  "暂无推荐用户",
+	"explore.hotTags":      "热门标签",
+	"explore.hotQuestions": "热门问题",
+	"explore.noResult":     "暂无符合条件的用户。",
+	"explore.lazy":         "这个人很懒，什么都没写~",
+	"explore.prevPage":     "上一页",
+	"explore.nextPage":     "下一页",
+	"explore.loading":      "加载中...",
+	"explore.loadFailed":   "加载失败",
+
+	// 提问箱密码页
+	"password.title":  "此提问箱需要密码",
+	"password.desc":   "此提问箱已设置访问密码，请输入密码查看内容",
+	"password.input":  "请输入访问密码",
+	"password.enter":  "验证进入",
+	"password.submit": "确认",
+
+	// 问题不存在
+	"qitem.notFound": "问题不存在或已被删除",
+
+	// 聊天页
+	"chat.title":          "私聊",
+	"chat.input":          "输入消息...",
+	"chat.send":           "发送",
+	"chat.delete":         "删除对话",
+	"chat.block":          "拉黑对方",
+	"chat.unblock":        "取消拉黑",
+	"chat.empty":          "还没有消息，说点什么吧~",
+	"chat.withAsker":      "与提问者的私聊",
+	"chat.withUser":       "与 %s 的私聊",
+	"chat.closed":         "对话已关闭",
+	"chat.closedNoSend":   "对话已关闭，无法发送新消息",
+	"chat.remaining":      "消息剩余：%d 条（共 %d 条）",
+	"chat.me":             "我",
+	"chat.other":          "对方",
+	"chat.userBlocked":    "该用户已被拉黑",
+	"chat.addImage":       "添加图片（可选，最大5MB）",
+	"chat.confirm":        "确认",
+	"chat.confirmBlock":   "确定要拉黑该用户吗？他将无法再发送私信。",
+	"chat.confirmUnblock": "确定要取消屏蔽该用户吗？他将可以再次发送私信。",
+	"chat.deleteConfirm":  "确定要删除这条私聊对话吗？对方将无法再看到此对话，且操作不可恢复。",
+	"maintenance.title":   "NekoBox 维护中...",
+	"maintenance.desc":    "NekoBox 正在进行维护，服务暂时不可用。过一会再来吧~",
+
+	// 单题分享（v4）
+	"qitem.shareCard": "分享此提问",
+
+	// 追问（v4）
+	"followup.title":              "追问记录",
+	"followup.content":            "追问：",
+	"followup.answerPlaceholder":  "回答这条追问...",
+	"followup.answerBtn":          "回答追问",
+	"followup.waiting":            "等待回答中...",
+	"followup.askMore":            "继续追问",
+	"followup.remaining":          "还可追问 %d / %d 次",
+	"followup.contentPlaceholder": "补充你的问题...",
+	"followup.waitingReply":       "你的追加提问已发出，等待提问箱主人回复中...",
+	"followup.submit":             "提交追问",
+
+	// 置顶（v4）
+	"qlist.pinned":      "置顶中",
+	"qlist.pin":         "置顶",
+	"qlist.unpin":       "取消置顶",
+	"qlist.readStatus":  "阅读状态",
+	"qlist.read":        "已读",
+	"qlist.unread":      "未读",
+	"qlist.statsRead":   "已读",
+	"qlist.statsUnread": "未读",
+
+	// 提问成功页（v4）
+	"success.title":        "提问发送成功！",
+	"success.yourQuestion": "你的提问：",
+	"success.emailSent":    "已向你的邮箱发送了该提问的私密链接，也可以使用下方链接随时查看提问、接收回答与继续追问。",
+	"success.saveLink":     "<strong>请务必保存下面的私密链接！</strong>由于你没有留下邮箱，此链接（含口令 Token）是你查看提问、接收回答与继续追问的<strong>唯一凭证</strong>，丢失后将无法找回。",
+	"success.privateLink":  "你的提问私密链接（点击复制保存）",
+	"success.copy":         "复制",
+	"success.copied":       "已复制 ✓",
+	"success.copyFailed":   "复制失败",
+	"success.token":        "口令 Token：%s（提问人凭 Token 访问私密链接）",
+	"success.viewQuestion": "查看我的提问",
+	"success.backToBox":    "返回%s的提问箱",
+	"success.pageTitle":    "提问成功 - %s",
+
+	// 停用页
+	"deactivate.title":   "账号停用",
+	"deactivate.desc":    "停用后你的提问箱将无法访问，且所有数据将被删除，此操作不可恢复！",
+	"deactivate.confirm": "我确认要停用账号",
+	"deactivate.submit":  "停用账号",
+
+	// 匿名投票
+	"nav.votes": "投票",
+
+	"common.back": "返回",
+
+	"vote.listTitle":              "投票管理",
+	"vote.newTitle":               "新建投票",
+	"vote.editTitle":              "编辑投票",
+	"vote.resultsTitle":           "投票结果",
+	"vote.statsTotal":             "投票总数",
+	"vote.statsPublished":         "进行中",
+	"vote.createNew":              "新建投票",
+	"vote.typeSingle":             "单选",
+	"vote.typeMultiple":           "多选",
+	"vote.typeRating":             "评分",
+	"vote.typeRank":               "排序",
+	"vote.typeForm":               "表单收集",
+	"vote.statusNotStarted":       "未开始",
+	"vote.statusDraft":            "草稿",
+	"vote.statusPublished":        "进行中",
+	"vote.statusEnded":            "已结束",
+	"vote.statusArchived":         "已归档",
+	"vote.participants":           "参与",
+	"vote.remainLabel":            "剩余",
+	"vote.perpetual":              "无限期",
+	"vote.durationDay":            "天",
+	"vote.durationHour":           "小时",
+	"vote.durationMinute":         "分钟",
+	"vote.createdAt":              "创建于",
+	"vote.edit":                   "编辑",
+	"vote.results":                "结果",
+	"vote.preview":                "预览",
+	"vote.page.mustComplete":      "请完成",
+	"vote.page.rankHintRequired":  "排名 1-N（必填）",
+	"vote.page.rankHintOptional":  "排名 1-N（可选，可只排部分）",
+	"vote.page.previewHint":       "预览模式：这是发布前的页面样例，提交已禁用",
+	"vote.page.previewSubmitHint": "预览模式，发布后即可提交",
+	"vote.publish":                "发布",
+	"vote.close":                  "结束",
+	"vote.share":                  "复制链接",
+	"vote.copied":                 "已复制",
+	"vote.shareURL":               "投票分享链接",
+	"vote.confirmPublish":         "确定发布该投票吗？发布后即生成可分享链接。",
+	"vote.confirmClose":           "确定结束该投票吗？结束后参与者将无法再投票。",
+	"vote.confirmDelete":          "确定删除该投票吗？投票数据将一并删除，不可恢复！",
+	"vote.manageEntry":            "管理投票",
+
+	"vote.manageTitle": "管理投票",
+	"vote.manageDesc":  "创建与管理你的匿名投票", "vote.empty": "还没有投票，点击右上角\"新建投票\"开始吧～",
+	"vote.formLockedHint":              "该投票已发布，仅可修改基本信息；类型与选项已锁定（避免破坏已收集的投票数据）",
+	"vote.formBasic":                   "基本设置",
+	"vote.formTitle":                   "投票标题",
+	"vote.formTitlePlaceholder":        "例如：今天吃什么？",
+	"vote.formDescription":             "描述 / 说明",
+	"vote.formDescriptionPlaceholder":  "补充说明（可选）",
+	"vote.formType":                    "投票类型",
+	"vote.formVisibility":              "展示方式",
+	"vote.formVisibilityPublic":        "公开展示（探索页 + 提问箱页）",
+	"vote.formVisibilityLinkOnly":      "仅链接分享",
+	"vote.formVoterScope":              "投票范围",
+	"vote.formVoterScopeAnyone":        "任何人（含匿名）",
+	"vote.formVoterScopeRegistered":    "仅注册用户",
+	"vote.formShowResult":              "结果可见时机",
+	"vote.formShowResultAfterVote":     "投票后立即可见",
+	"vote.formShowResultAfterEnd":      "结束后可见",
+	"vote.formShowResultOwnerOnly":     "仅我可见",
+	"vote.formStartAt":                 "开始时间（留空立即开始）",
+	"vote.formEndAt":                   "结束时间（留空不限制）",
+	"vote.formMaxChoices":              "最多可选数量",
+	"vote.formMaxVotesPerFingerprint":  "每个投票每个设备限 1 次，使用同一浏览器重复提交将被拦截。",
+	"vote.formMaxVotesPerAccount":      "每个投票每个注册账号限 1 次，使用同一账号重复提交将被拦截。",
+	"vote.formAllowCustom":             "允许参与者补充自定义选项",
+	"vote.formRequireCaptcha":          "匿名投票需通过验证码",
+	"vote.formOptions":                 "投票选项",
+	"vote.formRatingHint":              "评分题无需配置选项（1-10 分）",
+	"vote.addOption":                   "添加选项",
+	"vote.optionPlaceholder":           "选项内容",
+	"vote.formFields":                  "表单字段",
+	"vote.addField":                    "添加字段",
+	"vote.field":                       "字段",
+	"vote.formFieldType":               "字段类型",
+	"vote.fieldTypeText":               "单行文本",
+	"vote.fieldTypeTextarea":           "多行文本",
+	"vote.fieldTypeSelect":             "下拉选择",
+	"vote.fieldTypeRadio":              "单选",
+	"vote.fieldTypeCheckbox":           "多选",
+	"vote.fieldTypeNumber":             "数字",
+	"vote.fieldTypeRank":               "排序",
+	"vote.page.selectPlaceholder":      "请选择",
+	"vote.page.avgNumber":              "平均",
+	"vote.page.fieldFilled":            "已填写",
+	"vote.fieldTypeRating":             "评分",
+	"vote.formFieldLabel":              "字段标签",
+	"vote.formFieldRequired":           "必填",
+	"vote.formFieldMaxLength":          "字数上限（0 不限制）",
+	"vote.formFieldOptions":            "选项",
+	"vote.formFieldOptionsHint":        "点击下方「添加选项」逐条添加，无需用逗号分隔",
+	"vote.fieldAllowCustom":            "允许补充自定义选项",
+	"vote.formFieldOptionsPlaceholder": "如：满意,一般,不满意",
+	"vote.createDraft":                 "保存草稿",
+	"vote.builderHintOptions":          "至少需要 2 个选项",
+	"vote.builderHintFields":           "请至少添加 1 个字段",
+	"vote.builderHintFieldOptions":     "选择题/排序题请填写选项（排序题至少 2 个）",
+	"vote.resultsAnswered":             "回答数",
+	"vote.page.rankedTimes":            "被排次数",
+	"vote.resultsTotal":                "总参与人数",
+	"vote.resultsSubmissions":          "表单回复",
+	"vote.resultsViewTexts":            "查看文本提交",
+	"vote.resultsToggleHint":           "点击展开或收起文本回复明细",
+	"vote.resultsOptions":              "投票结果",
+	"vote.resultsVotes":                "票",
+	"vote.export":                      "导出 CSV",
+	"vote.resultsEmpty":                "还没有人参与，快来分享吧～",
+
+	// 匿名投票参与页
+	"vote.inlineTitle":                 "投票",
+	"vote.page.by":                     "发起的投票",
+	"vote.page.goVote":                 "去投票",
+	"vote.page.notStarted":             "未开始",
+	"vote.page.notStartedHint":         "该投票尚未开始，敬请期待～",
+	"vote.page.ended":                  "已结束",
+	"vote.page.endedHint":              "该投票已结束",
+	"vote.page.active":                 "进行中",
+	"vote.page.participated":           "已参与",
+	"vote.page.loginRequired":          "该投票仅限注册用户参与，请先登录。",
+	"vote.page.anonymousHint":          "该投票允许匿名参与，你的身份不会被记录（同一设备最多可参与 1 次）。",
+	"vote.page.submit":                 "提交投票",
+	"vote.page.alreadyVoted":           "你已参与过该投票，感谢参与！",
+	"vote.page.resultsTitle":           "投票结果",
+	"vote.page.totalVotes":             "总参与",
+	"vote.page.avgRating":              "平均分",
+	"vote.page.avgRank":                "平均排名",
+	"vote.page.optionColumn":           "选项",
+	"vote.page.ratingLabel":            "请评分",
+	"vote.page.ratingUnit":             "分",
+	"vote.page.rankHint":               "请为每个选项填写 1-N 的排名（数字越小越靠前，不可重复）",
+	"vote.page.rankPlaceholder":        "排名",
+	"vote.page.multipleHint":           "可多选",
+	"vote.page.customOption":           "补充选项（可选）",
+	"vote.page.customPlaceholder":      "填写你心中的其他选项",
+	"vote.page.customOther":            "其他",
+	"vote.page.customFieldPlaceholder": "填写自定义选项…",
+	"vote.page.customStats":            "自定义补充选项",
+	"vote.page.formCount":              "已收到回复",
+	"vote.page.ownerManage":            "管理此投票（仅你可见结果）",
+
+	// 单份投票的定量收集
+	"vote.formQuotaLimit":          "收集上限（份）",
+	"vote.formQuotaHint":           "0 表示不限制；收集到指定份数后自动结束该投票。",
+	"vote.flash.notFound":          "投票不存在或已失效",
+	"vote.flash.notPublished":      "该投票尚未发布",
+	"vote.flash.archived":          "该投票已归档，无法参与",
+	"vote.flash.ended":             "该投票已结束",
+	"vote.flash.notStarted":        "该投票尚未开始",
+	"vote.flash.success":           "投票成功！感谢参与",
+	"vote.err.noChoice":            "请至少选择一个选项",
+	"vote.err.tooManyChoices":      "最多只能选择 %d 个选项",
+	"vote.err.pickOne":             "请选择一个选项",
+	"vote.err.invalidOption":       "存在无效的选项",
+	"vote.err.optionDuplicate":     "选项不能重复选择",
+	"vote.err.ratingRequired":      "请给出 1-10 分的评分",
+	"vote.err.rankRequired":        "请为每个选项填写 1-%d 的排名",
+	"vote.err.rankDuplicate":       "排名不能重复",
+	"vote.err.fieldRequired":       "请填写「%s」",
+	"vote.err.fieldCustomRequired": "请填写「%s」的自定义选项",
+	"vote.err.fieldCustomTooLong":  "「%s」的自定义选项不能超过 %d 字",
+	"vote.err.fieldInvalidOption":  "「%s」的选项无效",
+	"vote.err.fieldConfigError":    "「%s」选项配置错误",
+	"vote.err.fieldRankIncomplete": "请填写「%s」的完整排名",
+	"vote.err.fieldRankRange":      "「%s」排名必须是 1-%d 之间的数字",
+	"vote.err.fieldRankDuplicate":  "「%s」排名不能重复",
+	"vote.err.fieldTooLong":        "「%s」超出字数限制（最多 %d 字）",
+	"vote.err.fieldNotNumber":      "「%s」必须是数字",
+	"vote.err.fieldRating":         "「%s」请给出 1-10 分的评分",
+	"vote.err.unknownType":         "未知的投票类型",
+	"vote.err.customTooLong":       "自定义选项不能超过 %d 字",
+	"vote.err.blockWords":          "提交内容中包含了投票发起人设置的屏蔽词，无法提交",
+	"vote.err.serialize":           "提交内容序列化失败",
+	"captcha.error":                "验证码错误",
+	"captcha.errEmpty":             "验证码不能为空",
+	"captcha.errFormat":            "验证码格式错误，请刷新后重试",
+	"captcha.errAnswerFormat":      "验证码答案格式错误",
+	"captcha.errExpired":           "验证码已过期，请刷新后重试",
+	"captcha.errService":           "验证码服务异常，请稍后重试",
+	"captcha.errAnswerWrong":       "验证码答案错误",
+	"censor.unavailable":           "内容审核服务暂时不可用，请稍后再试",
+
+	// 功能管理：提问 / 私聊 / 投票 的开关、定时开关与定量收集
+	"admin.tabAccount":            "用户设置",
+	"admin.featuresHint":          "在「提问 / 私聊 / 投票」面板中管理各功能的开关、开放时段与收集上限；达到上限后对应功能自动关闭。",
+	"admin.featuresEntry":         "设置",
+	"admin.featureHint.question":  "关闭后访客无法提交新提问；达到收集上限后自动停止接收（含私密提问）。",
+	"admin.featureHint.chat":      "关闭后访客无法发起新的私聊；已有会话不受影响。",
+	"admin.featureHint.vote":      "关闭后提问箱页不再展示投票板块，访客也无法参与你的投票。单份投票可在编辑页单独设置收集上限。",
+	"admin.featureEnabled":        "开启该功能",
+	"admin.featureOpenAt":         "定时开放",
+	"admin.featureCloseAt":        "定时关闭",
+	"admin.featureTimeHint":       "留空表示不限制；开放时间之前、关闭时间之后该功能均不可用。",
+	"admin.featureSchedule":       "循环定时（每周循环）",
+	"admin.featureScheduleStart":  "每日开始",
+	"admin.featureScheduleEnd":    "每日结束",
+	"admin.featureScheduleHint":   "勾选每周固定开放日并设置每日时间段，按周循环生效；全部留空表示不启用。只填开放日（不填时间）表示该天全天开放；只填时间（不勾选任何日）表示每天该时段开放。",
+	"admin.featureMode":           "收集模式",
+	"admin.featureModeAlways":     "长期开放",
+	"admin.featureModeWindow":     "定时收集",
+	"admin.featureModeRecurring":  "循环定时",
+	"admin.featureModeHint":       "长期开放：不限时间，保持开放直到手动关闭；定时收集：一次性开放 / 关闭时间窗口；循环定时：每周固定开放日循环生效。三种模式互斥，保存时未选模式的设置将被清空。",
+	"admin.featureQuotaLimit":     "收集上限（条 / 份）",
+	"admin.featureQuotaHint":      "0 表示不限制；累计收集达到上限后自动关闭，重置计数后可开启下一轮。",
+	"admin.featureQuotaCount":     "已收集",
+	"admin.featureQuotaUnlimited": "不限制",
+	"admin.featureQuotaResetAt":   "上次重置：",
+	"admin.featureResetQuota":     "重置计数",
+	"admin.featureSave":           "保存该功能设置",
+
+	// 功能管理：状态与提示
+	"feature.name.question":        "提问",
+	"feature.name.chat":            "私聊",
+	"feature.name.vote":            "投票",
+	"feature.statusOpen":           "进行中",
+	"feature.status.disabled":      "已关闭",
+	"feature.status.not_started":   "未开始",
+	"feature.status.ended":         "已结束",
+	"feature.status.quota_reached": "已达上限",
+	"feature.saved":                "功能设置已保存",
+	"feature.errTime":              "%s 的时间格式不正确，请使用日期时间选择器",
+	"feature.errTimeRange":         "%s 的定时关闭时间必须晚于定时开放时间",
+	"feature.errQuota":             "%s 的收集上限需为 0 到 1000000 之间的整数",
+	"feature.errInvalid":           "未知的功能类型",
+	"feature.quotaReset":           "%s 的收集计数已重置",
+	"feature.errScheduleHalf":      "%s 的循环定时开始与结束时间必须同时填写",
+	"feature.errScheduleTime":      "%s 的循环定时时间格式不正确，请使用时间选择器",
+	"feature.errScheduleRange":     "%s 的循环定时结束时间必须晚于开始时间",
+
+	// 功能关闭时对访客的提示
+	"feature.disabled.question":      "提问箱主人已关闭提问功能",
+	"feature.disabled.chat":          "该提问箱未开启私聊功能",
+	"feature.disabled.vote":          "该提问箱已关闭投票功能",
+	"feature.not_started.question":   "提问功能尚未开放",
+	"feature.not_started.chat":       "私聊功能尚未开放",
+	"feature.not_started.vote":       "投票功能尚未开放",
+	"feature.ended.question":         "提问功能已结束收集",
+	"feature.ended.chat":             "私聊功能已结束",
+	"feature.ended.vote":             "投票功能已结束",
+	"feature.quota_reached.question": "提问功能已达到收集上限",
+	"feature.quota_reached.chat":     "私聊功能已达到收集上限",
+	"feature.quota_reached.vote":     "投票功能已达到收集上限",
+
+	// 认证：访客可见的提示（P0）
+	"auth.errBadCredential":   "邮箱或密码错误",
+	"auth.errUserNotFound":    "用户不存在",
+	"auth.errEmailFrequent":   "邮件发送太频繁，请稍后再试",
+	"auth.errEmailFailed":     "邮件发送失败，请稍后再试",
+	"auth.errCodeExpired":     "验证码已过期",
+	"auth.errPasswordChanged": "密码修改成功",
+	"auth.errLoginRequired":   "请先登录",
+	"auth.errDuplicateEmail":  "该邮箱已被注册",
+	"auth.errDuplicateDomain": "该个性域名已被使用",
+
+	// 提问箱页：访客可见（P0）
+	"question.errWrongPassword":     "密码错误",
+	"question.errAskPasswordWrong":  "提问密码错误",
+	"question.errLoginRequired":     "提问箱的主人设置了仅注册用户才能提问，请先登录。",
+	"question.errSelfChat":          "不能给自己发起私聊",
+	"question.errBlockedChat":       "你已被对方拉黑，无法发起私聊",
+	"question.errChatDailyLimit":    "你今日已达发送上限（%d条），请明天再试",
+	"question.errDuplicateSubmit":   "检测到重复提交，请稍后再试",
+	"question.errImageTooLarge":     "图片文件大小不能大于 5Mb",
+	"question.errUploadImageFailed": "上传图片失败",
+	"question.errBlockWords":        "提问内容中包含了提问箱主人设置的屏蔽词，发送失败",
+	"question.errAnsweredLocked":    "已回答的问题不能标记为未读",
+	"question.flash.chatSent":       "私聊请求已发送！你可以通过以下链接查看对话：%s",
+	"question.flash.answered":       "回答发布成功！",
+	"question.flash.operated":       "操作成功",
+	"question.flash.markedRead":     "已标记为已读",
+	"question.flash.markedUnread":   "已标记为未读",
+
+	// 追问：访客/箱主可见（P0）
+	"followup.errNoPermission": "无权操作",
+	"followup.errNotAnswered":  "问题尚未被回答，暂时不能追问",
+	"followup.errLimit":        "每条提问最多追问 %d 次，已达上限",
+	"followup.errWaitReply":    "请等待主人回复上一条追问后再继续追问",
+	"followup.errNotFound":     "追问不存在",
+	"followup.flash.sent":      "追问发送成功！",
+	"followup.flash.answered":  "回答成功！",
+
+	// 后台设置：箱主可见（P1）
+	"admin.flash.profileUpdated":    "更新个人信息成功",
+	"admin.flash.chatUpdated":       "私聊设置更新成功",
+	"admin.flash.pagePwdOff":        "已关闭页面密码访问",
+	"admin.flash.pagePwdUpdated":    "页面访问密码已更新",
+	"admin.flash.askPwdOff":         "已关闭提问密码",
+	"admin.flash.askPwdUpdated":     "提问密码已更新",
+	"admin.flash.tagsTooMany":       "标签不能超过 5 个",
+	"admin.flash.tagsUpdated":       "更新标签成功",
+	"admin.flash.tagTooLong":        "每个标签不能超过 5 个字符：%s",
+	"admin.flash.blockWordsTooMany": "屏蔽词不能超过 10 个",
+	"admin.flash.blockWordTooLong":  "屏蔽词长度不能超过 10 个字符：%s",
+	"admin.flash.harassmentUpdated": "更新防骚扰设置成功",
+	"admin.flash.blockWordsUpdated": "屏蔽词已更新",
+	"admin.flash.deactivated":       "您的账号已停用，感谢您使用 狼的提问箱。期待未来还能再见 👋🏻",
+	"admin.export.errUser":          "导出失败：获取用户信息失败",
+	"admin.export.errQuestion":      "导出失败：获取问题信息失败",
+
+	// 投票管理：箱主可见（P1）
+	"vote.err.invalidID":                 "无效的投票 ID",
+	"vote.err.notExist":                  "投票不存在",
+	"vote.err.noPermission":              "无权操作该投票",
+	"vote.err.type":                      "未知的投票类型",
+	"vote.err.titleRequired":             "请填写投票标题",
+	"vote.err.titleTooLong":              "投票标题不能超过 100 字",
+	"vote.err.visibility":                "未知的可见性设置",
+	"vote.err.voterScope":                "未知的投票范围设置",
+	"vote.err.showResult":                "未知的结果展示设置",
+	"vote.err.timeRange":                 "结束时间必须晚于开始时间",
+	"vote.err.quota":                     "收集上限需为 0 到 1000000 之间的整数",
+	"vote.err.optionsTooFew":             "请至少添加 2 个选项",
+	"vote.err.optionsFormat":             "选项数据格式错误",
+	"vote.err.optionTooLong":             "单个选项内容不能超过 %d 字",
+	"vote.err.maxChoicesExceed":          "最多可选数量不能超过选项总数",
+	"vote.err.fieldsTooFew":              "请至少添加 1 个表单字段",
+	"vote.err.fieldsFormat":              "表单字段数据格式错误",
+	"vote.err.fieldsTooMany":             "表单字段不能超过 50 个",
+	"vote.err.fieldType":                 "存在未知的表单字段类型",
+	"vote.err.fieldLabelMissing":         "第 %d 个字段缺少标签",
+	"vote.err.fieldLabelTooLong":         "第 %d 个字段的标签不能超过 100 字",
+	"vote.err.fieldLabelDuplicate":       "字段标签「%s」重复，请使用不同的标签",
+	"vote.err.fieldMaxLength":            "第 %d 个字段的字数上限需在 0-2000 之间",
+	"vote.err.fieldReservedOption":       "第 %d 个字段（%s）的选项内容包含保留值，请更换",
+	"vote.err.fieldOptionsTooFew":        "第 %d 个字段（%s）请至少填写 1 个选项",
+	"vote.err.fieldRankTooFew":           "第 %d 个字段（%s）排序题至少需要 2 个选项",
+	"vote.err.fieldSerialize":            "字段选项序列化失败",
+	"vote.err.editClosed":                "已结束或归档的投票不允许编辑",
+	"vote.err.publishDraftOnly":          "只有草稿状态的投票可以发布",
+	"vote.err.closePublishedOnly":        "只有进行中的投票可以结束",
+	"vote.err.publishTitleRequired":      "请先填写投票标题再发布",
+	"vote.err.publishFormFieldsRequired": "表单类型投票至少需要 1 个字段",
+	"vote.err.publishOptionsRequired":    "选项投票至少需要 2 个选项",
+	"vote.err.optionUpdateFailed":        "选项更新失败，请重试",
+	"vote.err.fieldUpdateFailed":         "表单字段更新失败，请重试",
+	"vote.flash.published":               "投票已发布！分享链接：%s",
+	"vote.flash.updated":                 "投票信息已更新（进行中的投票不可修改类型与选项）",
+	"vote.flash.draftSaved":              "已保存到草稿",
+	"vote.flash.closed":                  "投票已结束",
+	"vote.flash.deleted":                 "投票已删除",
+	"vote.err.timeFormat":                "时间格式不正确，请使用日期时间选择器",
+	"vote.err.maxChoicesLimit":           "最多可选数量不能超过 20",
+	"vote.err.descriptionTooLong":        "投票描述不能超过 5000 字",
+	"profile.err.avatarTooLarge":         "头像文件太大，最大支持 2MB",
+	"profile.err.backgroundTooLarge":     "背景图文件太大，最大支持 2MB",
+	"profile.err.newPasswordTooShort":    "新密码长度不能少于 8 位",
+	"profile.err.badOldPassword":         "旧密码输入错误",
+	"admin.export.errCreateExcel":        "导出失败：创建Excel文件失败",
+	"admin.export.errWriteExcel":         "导出失败：写入Excel文件失败",
+
+	// profile 设置页 UI 重构：卡片分区 / 头像背景裁剪 / 改密强制登出
+	"profile.card.basic":             "基础资料",
+	"profile.card.avatarBg":          "头像与背景",
+	"profile.card.qr":                "二维码样式",
+	"profile.card.password":          "修改密码",
+	"profile.avatarCropHint":         "裁剪框已锁定为 1:1 正方形",
+	"profile.backgroundCropHint":     "裁剪框已锁定为 16:9 宽屏",
+	"profile.cropTitle":              "裁剪图片",
+	"profile.cropConfirm":            "确认裁剪",
+	"profile.err.avatarRatio":        "头像图片必须为 1:1 正方形，请裁剪后再上传",
+	"profile.err.backgroundRatio":    "背景图片必须为 16:9 宽高比，请裁剪后再上传",
+	"profile.flash.passwordChanged":  "密码修改成功，已退出登录，请使用新密码重新登录",
+	"profile.pwdNote":                "保存后当前会话立即失效，需使用新密码重新登录",
+	"profile.pickAvatar":             "更换头像",
+	"profile.pickBackground":         "更换背景",
+	"profile.saveBasic":              "保存基础资料",
+	"profile.saveMedia":              "保存头像与背景",
+	"profile.savePassword":           "确认修改密码",
+	"profile.saveQR":                 "保存二维码样式",
+	"profile.saveSocial":             "保存社交链接",
+	"profile.err.cropLibUnavailable": "图片裁剪组件加载失败，请刷新页面后重试",
+
+	// 验证码 JSON 接口：前端消费（P2）
+	"captcha.json.badRequest": "请求格式错误",
+	"captcha.json.idRequired": "验证码 ID 不能为空",
+	"captcha.json.genFailed":  "生成验证码失败",
+	"chat.errDeletedByOwner":  "该私聊对话已被对方删除。",
+	"chat.errBlockedView":     "你已被对方拉黑，无法查看该私聊",
+	"chat.errEmpty":           "消息不能为空",
+	"chat.errTooLong":         "消息内容过长，请控制在 %d 字以内",
+	"chat.errConvDeletedSend": "该对话已被删除，无法发送消息",
+	"chat.errBlockedSend":     "你已被对方拉黑，无法发送私信",
+	"chat.errBlockWords":      "消息中包含了提问箱主人设置的屏蔽词，无法发送",
+	"chat.errDailyLimit":      "你今日已达发送上限（%d条），请明天再试",
+	"chat.errLimitReached":    "对话已达到上限，无法发送新消息",
+	"chat.errChatClosed":      "该箱主已关闭私聊功能，无法发送消息",
+	"chat.errImageTooLarge":   "图片大小不能超过 %dMB",
+	"chat.errUploadFailed":    "图片上传失败，请稍后重试",
+	"chat.errNoPermission":    "无权执行此操作",
+	"chat.flash.sent":         "消息发送成功",
+	"chat.flash.deleted":      "私聊对话已删除",
+	"chat.flash.operated":     "操作成功",
+	"image.errTooLarge":       "图片尺寸过大，最大支持 %d×%d 像素，请压缩后重新上传",
+	"internal.errFlash":       "服务内部错误，请稍后重试。",
+	"internal.errServer":      "服务器内部错误",
+	"home.errStats":           "获取统计信息失败",
+	"pixel.errPath":           "非法的请求路径",
+	"proxy.errNotFound":       "页面不存在",
+	"proxy.errInternal":       "服务网关内部错误",
+	"explore.errRandomUser":   "获取随机用户失败",
+	// 表单校验
+	"form.answer.content":               "回答内容不能为空",
+	"form.answer.contentTooLong":        "回答内容不能超过 %d 个字符",
+	"form.email.required":               "请填写有效的电子邮箱地址",
+	"form.followup.answer":              "追问回答不能为空",
+	"form.followup.answerTooLong":       "追问回答不能超过 %d 个字符",
+	"form.followup.content":             "追问内容不能为空",
+	"form.followup.contentTooLong":      "追问内容不能超过 %d 个字符",
+	"form.login.password":               "请输入密码",
+	"form.profile.backgroundimagealpha": "请填写二维码背景透明度",
+	"form.profile.colorHex":             "请填写 7 位十六进制颜色代码（含 #）",
+	"form.profile.dotscale":             "请填写二维码点大小",
+	"form.profile.intro":                "个人介绍不能为空，且不超过 100 个字符",
+	"form.profile.linkMax":              "主页链接长度不能超过 30 个字符",
+	"form.profile.name":                 "昵称不能为空，且不超过 20 个字符",
+	"form.profile.newPassword":          "新密码长度不能超过 30 个字符",
+	"form.profile.passwordMax":          "密码长度不能超过 30 个字符",
+	"form.question.content":             "问题内容不能为空",
+	"form.question.contentTooLong":      "问题内容不能超过 %d 个字符",
+	"form.question.receiveReplyEmail":   "请填写有效的电子邮箱地址以接收回复",
+	"form.recaptcha":                    "请完成人机验证",
+	"form.recover.newPassword":          "请设置 8 至 30 位的新密码",
+	"form.recover.repeatPassword":       "两次输入的新密码不一致",
+	"form.register.domain":              "个性域名只能包含字母、数字和下划线，长度为 3 至 20 位",
+	"form.register.email":               "请填写有效的电子邮箱地址（不超过 100 个字符）",
+	"form.register.name":                "昵称不能为空，且不超过 20 个字符",
+	"form.register.password":            "请设置 8 至 30 位的密码",
+	"form.register.recaptcha":           "无法加载人机验证，请刷新页面或切换网络后重试",
+	"form.register.repeatPassword":      "两次输入的密码不一致",
+}
diff --git a/internal/i18n/dict_zh_tw.go b/internal/i18n/dict_zh_tw.go
new file mode 100644
index 0000000..45bf9e2
--- /dev/null
+++ b/internal/i18n/dict_zh_tw.go
@@ -0,0 +1,840 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package i18n
+
+// zhTWDict 繁體中文文案。
+var zhTWDict = map[string]string{
+	// 導覽
+	"nav.explore":  "探索",
+	"nav.mine":     "我的",
+	"nav.register": "註冊",
+	"nav.login":    "登入",
+	"nav.ask":      "提問",
+	"nav.settings": "設定",
+	"nav.lang":     "語言",
+
+	// 通用
+	"common.login":      "登入",
+	"common.forgot":     "忘記密碼",
+	"common.submit":     "送出",
+	"common.cancel":     "取消",
+	"common.save":       "儲存",
+	"common.close":      "關閉",
+	"common.delete":     "刪除",
+	"common.moveUp":     "上移",
+	"common.moveDown":   "下移",
+	"common.share":      "分享",
+	"common.verifying":  "驗證中...",
+	"common.submitting": "提交中...",
+	"common.uploading":  "上傳中...",
+	"common.lang":       "語言",
+	"common.menu":       "選單",
+
+	"common.pleaseWait": "請稍候...",
+	"common.backHome":   "返回首頁",
+	"common.theme":      "切換深色/淺色模式",
+
+	// 站點
+	"site.title":          "狼的提問箱 | 匿名提問箱",
+	"site.description":    "狼的提問箱——一個無需註冊、可匿名提問的匿名提問箱，安全地傾訴與回應。",
+	"site.keywords":       "匿名提問箱,提問箱,匿名提問,狼的提問箱,匿名問答,匿名提問網站",
+	"site.footer.runtime": "提問箱已成功存活",
+	"site.footer.admin":   "找站長",
+	"site.footer.notice":  "公告板",
+	"site.footer.chat":    "聊天室",
+	"site.footer.drive":   "盤",
+	"site.footer.status":  "監控板",
+	"site.footer.nav":     "導航頁",
+	"site.maintenance":    "本站正在維護中，請稍後再來～",
+
+	// 認證
+	"auth.login.title":       "使用者登入",
+	"auth.login.email":       "電子郵件",
+	"auth.login.password":    "密碼",
+	"auth.login.submit":      "登入",
+	"auth.login.forgot":      "忘記密碼",
+	"auth.register.title":    "使用者註冊",
+	"auth.register.name":     "暱稱",
+	"auth.register.email":    "電子郵件",
+	"auth.register.password": "密碼",
+	"auth.register.submit":   "註冊",
+	"auth.forgot.title":      "忘記密碼",
+	"auth.forgot.email":      "電子郵件",
+	"auth.forgot.submit":     "傳送重設郵件",
+	"auth.forgot.submitBtn":  "找回密碼",
+	"auth.forgot.sent":       "郵件已傳送至 %s，請查收。",
+	"auth.recover.title":     "重設密碼",
+	"auth.recover.greeting":  "%s，您正在重設您的密碼：",
+	"auth.recover.password":  "新密碼",
+	"auth.recover.confirm":   "確認密碼",
+	"auth.recover.submit":    "重設密碼",
+
+	// 探索頁
+	"explore.title":        "探索使用者標籤",
+	"explore.notice":       "此處展示已開啟<span class=\"uk-text-bold\">「在首頁展示我的標籤」</span>的使用者。該功能預設關閉，若希望自己的提問箱在這裡被發現，請前往 <a href=\"/user/profile\" class=\"uk-text-bold\">個人設定</a> 手動開啟。",
+	"explore.shuffle":      "換一批",
+	"explore.empty":        "暫時沒有可展示的使用者，快去開啟吧～",
+	"explore.hotVotes":     "熱門投票",
+	"explore.questionsTab": "提問",
+	"explore.votesTab":     "投票",
+	"explore.votesTitle":   "公開投票",
+	"explore.votesDesc":    "瀏覽進行中的公開投票，選擇你感興趣的主題參與。",
+	"explore.randomVote":   "隨機推薦",
+	"explore.allVotes":     "全部投票",
+	"explore.noVotes":      "暫時沒有可參與的公開投票。",
+
+	// 提問頁
+	"ask.scan":              "掃碼向@%s提問",
+	"ask.anonymous":         "誰都可以以匿名的方式提問",
+	"ask.registerOnly":      "僅允許註冊使用者向TA提問",
+	"ask.nextOpenAt":        "下次開放時間：%s",
+	"ask.lastCloseAt":       "上次關閉時間：%s",
+	"weekday.0":             "週日",
+	"weekday.1":             "週一",
+	"weekday.2":             "週二",
+	"weekday.3":             "週三",
+	"weekday.4":             "週四",
+	"weekday.5":             "週五",
+	"weekday.6":             "週六",
+	"ask.pinned":            "已置頂",
+	"ask.share":             "分享提問箱",
+	"ask.placeholder":       "在此處撰寫你的問題...",
+	"ask.chatPlaceholder":   "在此處撰寫你的私聊訊息...",
+	"ask.addImage":          "新增圖片",
+	"ask.private":           "回覆後不公開",
+	"ask.notify":            "接收通知",
+	"ask.emailPlaceholder":  "請輸入你的信箱地址",
+	"ask.submit":            "傳送提問",
+	"ask.chat":              "發起私聊",
+	"ask.chatDisabled":      "該提問箱未開啟私聊",
+	"ask.chatLimit":         "訊息上限：%d則",
+	"ask.history":           "@%s 以前回答過的問題",
+	"ask.loginRequired":     "需要登入",
+	"ask.loginRequiredChat": "發起私聊需要登入帳號",
+	"ask.goLogin":           "去登入",
+	"ask.needPassword":      "此提問箱需要密碼",
+	"ask.needLogin":         "提問箱的主人設定了僅註冊使用者才能提問，你需要先登入才能向他提問。",
+	"ask.pleaseEmail":       "請填寫接收通知的信箱地址",
+	"ask.generating":        "正在產生分享圖…",
+	"ask.genFailed":         "產生分享圖失敗，請稍後重試",
+	"ask.networkError":      "網路錯誤",
+	"ask.shareFilename":     "share.png",
+
+	// 問題條目
+	"qitem.answer":            "回答",
+	"qitem.delete":            "刪除",
+	"qitem.private":           "設為私密",
+	"qitem.public":            "設為公開",
+	"qitem.asked":             "提問",
+	"qitem.pending":           "等待回答",
+	"qitem.answeredBy":        "@%s 於 %s 的回答",
+	"qitem.danger":            "危險！",
+	"qitem.deleteConfirm":     "你確定要刪除這個提問嗎？該操作不可恢復，請謹慎操作。",
+	"qitem.deleteConfirmBtn":  "確認刪除",
+	"qitem.backToBox":         "返回%s的提問箱",
+	"qitem.answerTitle":       "回答問題",
+	"qitem.answerPlaceholder": "在此處撰寫你的回答...",
+	"qitem.emailNotifyHint":   "提問人留下了自己的電子郵箱，在你第一次回覆該問題後，提問人將會收到一封郵件通知。",
+	"qitem.submitAnswer":      "回答",
+	"qitem.updateAnswer":      "更新回答",
+	"qitem.askMore":           "再問點別的問題？",
+	"qitem.markRead":          "標記為已讀",
+	"qitem.markUnread":        "標記為未讀",
+	"qitem.readLocked":        "已回答，已鎖定為已讀",
+
+	// 個人設定頁
+	"admin.profile":           "個人資訊",
+	"admin.lang":              "介面語言",
+	"admin.langHint":          "選擇訪客訪問你的提問箱時顯示的語言（後台頁面跟隨此設定）",
+	"admin.email":             "電子郵件",
+	"admin.name":              "暱稱",
+	"admin.nameColor":         "暱稱顏色",
+	"admin.oldPassword":       "舊密碼",
+	"admin.newPassword":       "新密碼",
+	"admin.notify":            "新提問通知",
+	"admin.personalize":       "個人化設定",
+	"admin.intro":             "提問箱介紹",
+	"admin.introColor":        "提問箱介紹顏色",
+	"admin.qrBgColor":         "QR Code 背景色（亮色部分）",
+	"admin.qrPdColor":         "QR Code 探測圖形顏色（邊角方形）",
+	"admin.qrFgColor":         "QR Code 前景色",
+	"admin.qrDotSize":         "QR Code 點大小 (←小 大→)",
+	"admin.qrBgAlpha":         "QR Code 背景透明度 (←不透明 很透明→)",
+	"admin.avatar":            "個人頭像",
+	"admin.background":        "提問箱背景",
+	"admin.qrBackground":      "QR Code 背景圖",
+	"admin.social":            "社交資訊設定",
+	"admin.harassment":        "防騷擾設定",
+	"admin.askLimit":          "提問限制",
+	"admin.blockWords":        "屏蔽詞設定（Enter 或逗號分隔，最多支援 10 個屏蔽詞，每個屏蔽詞最大長度為 10）",
+	"admin.chat":              "私聊設定",
+	"admin.chatMaxMessages":   "私聊訊息條數上限",
+	"admin.chatDailyLimit":    "單一使用者每日私訊條數上限",
+	"admin.tags":              "標籤設定",
+	"admin.tagsHint":          "標籤（最多5個，每個最多5字，Enter 或逗號分隔）",
+	"admin.tagsPlaceholder":   "例如：動漫,音樂,遊戲",
+	"admin.tagInputHint":      "輸入後按 Enter 或逗號新增",
+	"admin.tagInputDuplicate": "已存在，已忽略",
+	"admin.pagePassword":      "頁面訪問密碼",
+	"admin.pagePasswordHint":  "設定訪問密碼（留空則關閉）",
+	"admin.askPassword":       "提問密碼",
+	"admin.askPasswordHint":   "設定提問密碼（留空則關閉）",
+	"admin.saveProfile":       "儲存修改",
+	"admin.updated":           "更新個人資訊成功",
+	"admin.logout":            "登出",
+	"admin.export":            "匯出資料",
+
+	// 後台設定（補充）
+	"admin.oldPasswordHint":         "修改密碼使用，留空則不修改",
+	"admin.newPasswordHint":         "6-64 位，留空則不修改",
+	"admin.notifyEmail":             "郵件",
+	"admin.useCustomFg":             "啟用自訂前景色（否則自動比對）",
+	"admin.customFgHint":            "僅在啟用時生效，否則顏色由系統自動產生",
+	"admin.avatarPlaceholder":       "上傳個人頭像（頭像比例不為1:1就扁了你哦）",
+	"admin.backgroundPlaceholder":   "上傳提問箱背景",
+	"admin.qrBackgroundPlaceholder": "上傳QR Code背景（顏色過深的背景會導致QR Code無法辨識）",
+	"admin.qrPreviewHint":           "選擇圖片後預覽將即時更新",
+	"admin.preview":                 "即時預覽",
+	"admin.themePreset":             "預設主題",
+	"admin.themeDefault":            "預設",
+	"admin.themeDark":               "暗夜",
+	"admin.themeOcean":              "海洋",
+	"admin.themeSunset":             "日落",
+	"admin.resetDefaults":           "🔄 恢復預設值",
+	"admin.previewHint":             "調整僅用於預覽，最終效果點擊「儲存修改」後生效",
+	"admin.socialHint":              "勾選後填寫主頁地址（無需 https://），未勾選的項目將不會在前台顯示。",
+	"admin.enableAcfun":             "啟用 AcFun",
+	"admin.enableBili":              "啟用 Bilibili",
+	"admin.enableWeibo":             "啟用 微博",
+	"admin.enableXiaohongshu":       "啟用 小紅書",
+	"admin.enableBlog":              "啟用 個人部落格",
+	"admin.registerOnly":            "僅允許註冊使用者向我提問",
+	"admin.updateHarassment":        "更新防騷擾設定",
+	"admin.globalBlockWords":        "全局屏蔽詞",
+	"admin.globalBlockWordsHint":    "屏蔽詞對提問、私聊（對方傳送給你的訊息）與投票提交內容生效；三個設定頁同步顯示同一份設定，任意一處修改即時生效。",
+	"admin.updateBlockWords":        "儲存屏蔽詞",
+	"admin.allowChat":               "允許註冊使用者向我發起私聊",
+	"admin.dailyLimitHint":          "0 表示不限制",
+	"admin.updateChat":              "更新私聊設定",
+	"admin.showInHome":              "在首頁展示我的標籤（允許其他使用者透過標籤搜尋到我）",
+	"admin.updateTags":              "更新標籤",
+	"admin.updatePagePassword":      "更新頁面密碼",
+	"admin.pagePasswordPlaceholder": "輸入頁面訪問密碼",
+	"admin.updateAskPassword":       "更新提問密碼",
+	"admin.askPasswordPlaceholder":  "輸入提問密碼",
+	"admin.account":                 "帳號設定",
+	"admin.exportHint":              "您可以匯出您在 %s 中的所有個人資料，包括你的基本資訊、收到的問題以及回答。",
+	"admin.exportJSON":              "導出全部資料（JSON）",
+	"admin.exportJSONHint":          "包含提問、回答、追問與私聊記錄，可完整備份或遷移。",
+	"admin.deactivate":              "停用我的帳號",
+	"admin.deactivateHint":          "您隨時可以選擇停用您的帳號。停用後，您的帳號將無法登入，您的提問箱頁面以及提問將無法訪問，其他人也無法再給您發送新的提問。<b>該操作無法撤銷！請謹慎操作！</b>",
+	"admin.socialRequired":          "請填寫連結或取消勾選",
+
+	// 問題管理頁
+	"qlist.title":              "我的提問",
+	"qlist.answered":           "已回答",
+	"qlist.pending":            "待回答",
+	"qlist.private":            "私密",
+	"qlist.empty":              "還沒有提問，快把提問箱分享出去吧～",
+	"qlist.action":             "操作",
+	"qlist.answerNow":          "去回答",
+	"qlist.sort":               "排序",
+	"qlist.status":             "狀態",
+	"qlist.type":               "類型",
+	"qlist.latest":             "最新",
+	"qlist.oldest":             "最早",
+	"qlist.all":                "全部",
+	"qlist.public":             "一般提問",
+	"qlist.privateQuestion":    "私密提問",
+	"qlist.received":           "我收到的提問",
+	"qlist.myChats":            "我發起的私聊",
+	"qlist.statsTotal":         "總提問數",
+	"qlist.statsAnswered":      "已回答",
+	"qlist.statsUnanswered":    "未回答",
+	"qlist.statsPrivate":       "私密提問",
+	"qlist.statsPinned":        "置頂",
+	"qlist.statsChats":         "私聊會話",
+	"qlist.searchPlaceholder":  "搜尋問題或回答內容...",
+	"qlist.searchBtn":          "搜尋",
+	"qlist.searchClear":        "清除搜尋",
+	"qlist.questionsTab":       "提問",
+	"qlist.votesTab":           "投票",
+	"qlist.chatsTab":           "私聊",
+	"qlist.receivedChats":      "我收到的私聊",
+	"qlist.chatEmpty":          "還沒有私聊，把提問箱分享出去讓大家來私聊吧～",
+	"qlist.pinnedShort":        "置頂",
+	"qlist.privateShort":       "私密",
+	"qlist.chatStatsTotal":     "總私聊",
+	"qlist.chatStatsReceived":  "我收到的",
+	"qlist.chatStatsInitiated": "我發起的",
+	"qlist.chatStatsClosed":    "已關閉",
+	"qlist.unansweredShort":    "待答",
+	"qlist.readShort":          "已讀",
+	"qlist.unreadShort":        "未讀",
+	"qitem.markReadShort":      "標記",
+	"qlist.pinShort":           "置頂",
+	"qlist.unpinShort":         "取消置頂",
+	"qlist.myVotes":            "我建立的投票",
+	"qlist.loadMore":           "載入更多",
+	"qlist.newVote":            "新建投票",
+	"qlist.edit":               "編輯",
+	"qlist.untitledVote":       "未命名投票",
+	"qlist.blocked":            "已拉黑",
+	"qlist.unanswered":         "未回答",
+
+	// 站點 Logo 後綴
+	"site.logoSuffix": "的提問箱",
+	"site.stats":      "提問箱資訊統計",
+
+	// 驗證碼彈窗
+	"captcha.title":        "人機驗證",
+	"captcha.hint":         "請計算下方的算術題以驗證你不是機器人",
+	"captcha.refresh":      "換一題",
+	"captcha.submit":       "驗證並送出",
+	"captcha.loading":      "載入中...",
+	"captcha.loadFailed":   "載入失敗",
+	"captcha.loadRetry":    "載入失敗，請重試",
+	"captcha.inputAnswer":  "請輸入答案",
+	"captcha.wrongAnswer":  "答案錯誤，請重新計算",
+	"captcha.verifyFailed": "驗證失敗，請重試",
+
+	// 註冊頁補充
+	"auth.register.domain.prefix":   "個性網域（你的問答箱網址將會是：%s + ",
+	"auth.register.domain.suffix":   " + 你在下面文字框中填寫的內容）",
+	"auth.register.confirm":         "確認密碼",
+	"auth.register.language":        "介面語言",
+	"auth.register.languageDefault": "跟隨站點預設",
+	"auth.register.success":         "註冊成功，歡迎來到 狼的提問箱！",
+
+	// 探索頁補充
+	"explore.recommend":    "隨機推薦",
+	"explore.search":       "搜尋標籤...",
+	"explore.sortLatest":   "最新加入",
+	"explore.sortOldest":   "最早加入",
+	"explore.noTags":       "無標籤",
+	"explore.noRecommend":  "暫無推薦用戶",
+	"explore.hotTags":      "熱門標籤",
+	"explore.hotQuestions": "熱門問題",
+	"explore.noResult":     "暫無符合條件的用戶。",
+	"explore.lazy":         "這個人很懶，什麼都沒寫~",
+	"explore.prevPage":     "上一頁",
+	"explore.nextPage":     "下一頁",
+	"explore.loading":      "載入中...",
+	"explore.loadFailed":   "載入失敗",
+
+	// 提問箱密碼頁
+	"password.title":  "此提問箱需要密碼",
+	"password.desc":   "此提問箱已設定存取密碼，請輸入密碼查看內容",
+	"password.input":  "請輸入存取密碼",
+	"password.enter":  "驗證進入",
+	"password.submit": "確認",
+
+	// 問題不存在
+	"qitem.notFound": "問題不存在或已被刪除",
+
+	// 聊天頁
+	"chat.title":          "私聊",
+	"chat.input":          "輸入訊息...",
+	"chat.send":           "傳送",
+	"chat.delete":         "刪除對話",
+	"chat.block":          "封鎖對方",
+	"chat.unblock":        "取消封鎖",
+	"chat.empty":          "還沒有訊息，說點什麼吧~",
+	"chat.withAsker":      "與提問者的私聊",
+	"chat.withUser":       "與 %s 的私聊",
+	"chat.closed":         "對話已關閉",
+	"chat.closedNoSend":   "對話已關閉，無法發送新訊息",
+	"chat.remaining":      "訊息剩餘：%d 條（共 %d 條）",
+	"chat.me":             "我",
+	"chat.other":          "對方",
+	"chat.userBlocked":    "該使用者已被拉黑",
+	"chat.addImage":       "新增圖片（可選，最大5MB）",
+	"chat.confirm":        "確認",
+	"chat.confirmBlock":   "確定要拉黑該使用者嗎？他將無法再發送私訊。",
+	"chat.confirmUnblock": "確定要取消封鎖該使用者嗎？他將可以再次發送私訊。",
+	"chat.deleteConfirm":  "確定要刪除這條私聊對話嗎？對方將無法再看到此對話，且操作不可恢復。",
+	"maintenance.title":   "NekoBox 維護中...",
+	"maintenance.desc":    "NekoBox 正在進行維護，服務暫時不可用。過一會再來吧~",
+
+	// 單題分享（v4）
+	"qitem.shareCard": "分享此提問",
+
+	// 追問（v4）
+	"followup.title":              "追問記錄",
+	"followup.content":            "追問：",
+	"followup.answerPlaceholder":  "回答這條追問...",
+	"followup.answerBtn":          "回答追問",
+	"followup.waiting":            "等待回答中...",
+	"followup.askMore":            "繼續追問",
+	"followup.remaining":          "還可追問 %d / %d 次",
+	"followup.contentPlaceholder": "補充你的問題...",
+	"followup.waitingReply":       "你的追加提問已發出，等待提問箱主人回覆中...",
+	"followup.submit":             "提交追問",
+
+	// 置頂（v4）
+	"qlist.pinned":      "置頂中",
+	"qlist.pin":         "置頂",
+	"qlist.unpin":       "取消置頂",
+	"qlist.readStatus":  "閱讀狀態",
+	"qlist.read":        "已讀",
+	"qlist.unread":      "未讀",
+	"qlist.statsRead":   "已讀",
+	"qlist.statsUnread": "未讀",
+
+	// 提問成功頁（v4）
+	"success.title":        "提問發送成功！",
+	"success.yourQuestion": "你的提問：",
+	"success.emailSent":    "已向你的信箱發送了該提問的私密連結，也可以使用下方連結隨時查看提問、接收回答與繼續追問。",
+	"success.saveLink":     "<strong>請務必保存下面的私密連結！</strong>由於你沒有留下信箱，此連結（含口令 Token）是你查看提問、接收回答與繼續追問的<strong>唯一憑證</strong>，遺失後將無法找回。",
+	"success.privateLink":  "你的提問私密連結（點擊複製保存）",
+	"success.copy":         "複製",
+	"success.copied":       "已複製 ✓",
+	"success.copyFailed":   "複製失敗",
+	"success.token":        "口令 Token：%s（提問人憑 Token 存取私密連結）",
+	"success.viewQuestion": "查看我的提問",
+	"success.backToBox":    "返回%s的提問箱",
+	"success.pageTitle":    "提問成功 - %s",
+
+	// 停用頁
+	"deactivate.title":   "帳號停用",
+	"deactivate.desc":    "停用後你的提問箱將無法存取，且所有資料將被刪除，此操作不可恢復！",
+	"deactivate.confirm": "我確認要停用帳號",
+	"deactivate.submit":  "停用帳號",
+
+	// 匿名投票
+	"nav.votes": "投票",
+
+	"common.back": "返回",
+
+	"vote.listTitle":              "投票管理",
+	"vote.newTitle":               "新建投票",
+	"vote.editTitle":              "編輯投票",
+	"vote.resultsTitle":           "投票結果",
+	"vote.statsTotal":             "投票總數",
+	"vote.statsPublished":         "進行中",
+	"vote.createNew":              "新建投票",
+	"vote.typeSingle":             "單選",
+	"vote.typeMultiple":           "多選",
+	"vote.typeRating":             "評分",
+	"vote.typeRank":               "排序",
+	"vote.typeForm":               "表單收集",
+	"vote.statusNotStarted":       "未開始",
+	"vote.statusDraft":            "草稿",
+	"vote.statusPublished":        "進行中",
+	"vote.statusEnded":            "已結束",
+	"vote.statusArchived":         "已歸檔",
+	"vote.participants":           "參與",
+	"vote.remainLabel":            "剩餘",
+	"vote.perpetual":              "無限期",
+	"vote.durationDay":            "天",
+	"vote.durationHour":           "小時",
+	"vote.durationMinute":         "分鐘",
+	"vote.createdAt":              "建立於",
+	"vote.edit":                   "編輯",
+	"vote.results":                "結果",
+	"vote.preview":                "預覽",
+	"vote.page.mustComplete":      "請完成",
+	"vote.page.rankHintRequired":  "排名 1-N（必填）",
+	"vote.page.rankHintOptional":  "排名 1-N（可選，可只排部分）",
+	"vote.page.previewHint":       "預覽模式：這是發布前的頁面範例，提交已停用",
+	"vote.page.previewSubmitHint": "預覽模式，發布後即可提交",
+	"vote.publish":                "發布",
+	"vote.close":                  "結束",
+	"vote.share":                  "複製連結",
+	"vote.copied":                 "已複製",
+	"vote.shareURL":               "投票分享連結",
+	"vote.confirmPublish":         "確定發布該投票嗎？發布後即產生可分享連結。",
+	"vote.confirmClose":           "確定結束該投票嗎？結束後參與者將無法再投票。",
+	"vote.confirmDelete":          "確定刪除該投票嗎？投票資料將一併刪除，不可復原！",
+	"vote.manageEntry":            "管理投票",
+
+	"vote.manageTitle": "管理投票",
+	"vote.manageDesc":  "建立與管理你的匿名投票", "vote.empty": "還沒有投票，點擊右上角\"新建投票\"開始吧～",
+	"vote.formLockedHint":              "該投票已發布，僅可修改基本資訊；類型與選項已鎖定（避免破壞已收集的投票資料）",
+	"vote.formBasic":                   "基本設定",
+	"vote.formTitle":                   "投票標題",
+	"vote.formTitlePlaceholder":        "例如：今天吃什麼？",
+	"vote.formDescription":             "描述 / 說明",
+	"vote.formDescriptionPlaceholder":  "補充說明（可選）",
+	"vote.formType":                    "投票類型",
+	"vote.formVisibility":              "展示方式",
+	"vote.formVisibilityPublic":        "公開展示（探索頁 + 提問箱頁）",
+	"vote.formVisibilityLinkOnly":      "僅連結分享",
+	"vote.formVoterScope":              "投票範圍",
+	"vote.formVoterScopeAnyone":        "任何人（含匿名）",
+	"vote.formVoterScopeRegistered":    "僅註冊用戶",
+	"vote.formShowResult":              "結果可見時機",
+	"vote.formShowResultAfterVote":     "投票後立即可見",
+	"vote.formShowResultAfterEnd":      "結束後可見",
+	"vote.formShowResultOwnerOnly":     "僅我可見",
+	"vote.formStartAt":                 "開始時間（留空立即開始）",
+	"vote.formEndAt":                   "結束時間（留空不限制）",
+	"vote.formMaxChoices":              "最多可選數量",
+	"vote.formMaxVotesPerFingerprint":  "每個投票每個裝置限 1 次，使用同一瀏覽器重複提交將被攔截。",
+	"vote.formMaxVotesPerAccount":      "每個投票每個註冊帳號限 1 次，使用同一帳號重複提交將被攔截。",
+	"vote.formAllowCustom":             "允許參與者補充自訂選項",
+	"vote.formRequireCaptcha":          "匿名投票需通過驗證碼",
+	"vote.formOptions":                 "投票選項",
+	"vote.formRatingHint":              "評分題無需設定選項（1-10 分）",
+	"vote.addOption":                   "新增選項",
+	"vote.optionPlaceholder":           "選項內容",
+	"vote.formFields":                  "表單欄位",
+	"vote.addField":                    "新增欄位",
+	"vote.field":                       "欄位",
+	"vote.formFieldType":               "欄位類型",
+	"vote.fieldTypeText":               "單行文字",
+	"vote.fieldTypeTextarea":           "多行文字",
+	"vote.fieldTypeSelect":             "下拉選擇",
+	"vote.fieldTypeRadio":              "單選",
+	"vote.fieldTypeCheckbox":           "多選",
+	"vote.fieldTypeNumber":             "數字",
+	"vote.fieldTypeRank":               "排序",
+	"vote.page.selectPlaceholder":      "請選擇",
+	"vote.page.avgNumber":              "平均",
+	"vote.page.fieldFilled":            "已填寫",
+	"vote.fieldTypeRating":             "評分",
+	"vote.formFieldLabel":              "欄位標籤",
+	"vote.formFieldRequired":           "必填",
+	"vote.formFieldMaxLength":          "字數上限（0 不限制）",
+	"vote.formFieldOptions":            "選項",
+	"vote.formFieldOptionsHint":        "點擊下方「新增選項」逐條新增，不需用逗號分隔",
+	"vote.fieldAllowCustom":            "允許補充自訂選項",
+	"vote.formFieldOptionsPlaceholder": "如：滿意,一般,不滿意",
+	"vote.createDraft":                 "儲存草稿",
+	"vote.builderHintOptions":          "至少需要 2 個選項",
+	"vote.builderHintFields":           "請至少新增 1 個欄位",
+	"vote.builderHintFieldOptions":     "選擇題/排序題請填寫選項（排序題至少 2 個）",
+	"vote.resultsAnswered":             "回答數",
+	"vote.page.rankedTimes":            "被排次數",
+	"vote.resultsTotal":                "總參與人數",
+	"vote.resultsSubmissions":          "表單回覆",
+	"vote.resultsViewTexts":            "查看文字提交",
+	"vote.resultsToggleHint":           "點擊展開或收起文字回覆明細",
+	"vote.resultsOptions":              "投票結果",
+	"vote.resultsVotes":                "票",
+	"vote.export":                      "匯出 CSV",
+	"vote.resultsEmpty":                "還沒有人參與，快來分享吧～",
+
+	// 匿名投票參與頁
+	"vote.inlineTitle":                 "投票",
+	"vote.page.by":                     "發起的投票",
+	"vote.page.goVote":                 "去投票",
+	"vote.page.notStarted":             "未開始",
+	"vote.page.notStartedHint":         "該投票尚未開始，敬請期待～",
+	"vote.page.ended":                  "已結束",
+	"vote.page.endedHint":              "該投票已結束",
+	"vote.page.active":                 "進行中",
+	"vote.page.participated":           "已參與",
+	"vote.page.loginRequired":          "該投票僅限註冊用戶參與，請先登入。",
+	"vote.page.anonymousHint":          "該投票允許匿名參與，你的身分不會被記錄（同一裝置最多可參與 1 次）。",
+	"vote.page.submit":                 "提交投票",
+	"vote.page.alreadyVoted":           "你已參與過該投票，感謝參與！",
+	"vote.page.resultsTitle":           "投票結果",
+	"vote.page.totalVotes":             "總參與",
+	"vote.page.avgRating":              "平均分",
+	"vote.page.avgRank":                "平均排名",
+	"vote.page.optionColumn":           "選項",
+	"vote.page.ratingLabel":            "請評分",
+	"vote.page.ratingUnit":             "分",
+	"vote.page.rankHint":               "請為每個選項填寫 1-N 的排名（數字越小越靠前，不可重複）",
+	"vote.page.rankPlaceholder":        "排名",
+	"vote.page.multipleHint":           "可多選",
+	"vote.page.customOption":           "補充選項（可選）",
+	"vote.page.customPlaceholder":      "填寫你心中的其他選項",
+	"vote.page.customOther":            "其他",
+	"vote.page.customFieldPlaceholder": "填寫自訂選項…",
+	"vote.page.customStats":            "自訂補充選項",
+	"vote.page.formCount":              "已收到回覆",
+	"vote.page.ownerManage":            "管理此投票（僅你可見結果）",
+
+	// 單份投票的定量收集
+	"vote.formQuotaLimit":          "收集上限（份）",
+	"vote.formQuotaHint":           "0 表示不限制；收集到指定份數後自動結束該投票。",
+	"vote.flash.notFound":          "該投票不存在或已失效",
+	"vote.flash.notPublished":      "該投票尚未發布",
+	"vote.flash.archived":          "該投票已歸檔，無法參與",
+	"vote.flash.ended":             "該投票已結束",
+	"vote.flash.notStarted":        "該投票尚未開始",
+	"vote.flash.success":           "投票成功！感謝參與",
+	"vote.err.noChoice":            "請至少選擇一個選項",
+	"vote.err.tooManyChoices":      "最多只能選擇 %d 個選項",
+	"vote.err.pickOne":             "請選擇一個選項",
+	"vote.err.invalidOption":       "存在無效的選項",
+	"vote.err.optionDuplicate":     "選項不能重複選擇",
+	"vote.err.ratingRequired":      "請給出 1-10 分的評分",
+	"vote.err.rankRequired":        "請為每個選項填寫 1-%d 的排名",
+	"vote.err.rankDuplicate":       "排名不能重複",
+	"vote.err.fieldRequired":       "請填寫「%s」",
+	"vote.err.fieldCustomRequired": "請填寫「%s」的自訂選項",
+	"vote.err.fieldCustomTooLong":  "「%s」的自訂選項不能超過 %d 字",
+	"vote.err.fieldInvalidOption":  "「%s」的選項無效",
+	"vote.err.fieldConfigError":    "「%s」選項配置錯誤",
+	"vote.err.fieldRankIncomplete": "請填寫「%s」的完整排名",
+	"vote.err.fieldRankRange":      "「%s」排名必須是 1-%d 之間的數字",
+	"vote.err.fieldRankDuplicate":  "「%s」排名不能重複",
+	"vote.err.fieldTooLong":        "「%s」超出字數限制（最多 %d 字）",
+	"vote.err.fieldNotNumber":      "「%s」必須是數字",
+	"vote.err.fieldRating":         "「%s」請給出 1-10 分的評分",
+	"vote.err.unknownType":         "未知的投票類型",
+	"vote.err.customTooLong":       "自訂選項不能超過 %d 字",
+	"vote.err.blockWords":          "提交內容中包含了投票發起人設定的屏蔽詞，無法提交",
+	"vote.err.serialize":           "提交內容序列化失敗",
+	"captcha.error":                "驗證碼錯誤",
+	"captcha.errEmpty":             "驗證碼不能為空",
+	"captcha.errFormat":            "驗證碼格式錯誤，請重新整理後重試",
+	"captcha.errAnswerFormat":      "驗證碼答案格式錯誤",
+	"captcha.errExpired":           "驗證碼已過期，請重新整理後重試",
+	"captcha.errService":           "驗證碼服務異常，請稍後再試",
+	"captcha.errAnswerWrong":       "驗證碼答案錯誤",
+	"censor.unavailable":           "內容審核服務暫時不可用，請稍後再試",
+
+	// 功能管理：提問 / 私聊 / 投票 的開關、定時開關與定量收集
+	"admin.tabAccount":            "用戶設定",
+	"admin.featuresHint":          "在「提問 / 私聊 / 投票」面板中管理各功能的開關、開放時段與收集上限；達到上限後對應功能自動關閉。",
+	"admin.featuresEntry":         "設定",
+	"admin.featureHint.question":  "關閉後訪客無法提交新提問；達到收集上限後自動停止接收（含私密提問）。",
+	"admin.featureHint.chat":      "關閉後訪客無法發起新的私聊；已有會話不受影響。",
+	"admin.featureHint.vote":      "關閉後提問箱頁不再展示投票板塊，訪客也無法參與你的投票。單份投票可在編輯頁單獨設定收集上限。",
+	"admin.featureEnabled":        "啟用該功能",
+	"admin.featureOpenAt":         "定時開放",
+	"admin.featureCloseAt":        "定時關閉",
+	"admin.featureTimeHint":       "留空表示不限制；開放時間之前、關閉時間之後該功能均不可用。",
+	"admin.featureSchedule":       "循環定時（每週循環）",
+	"admin.featureScheduleStart":  "每日開始",
+	"admin.featureScheduleEnd":    "每日結束",
+	"admin.featureScheduleHint":   "勾選每週固定開放日並設定每日時間段，按週循環生效；全部留空表示不啟用。只填開放日（不填時間）表示該天全天開放；只填時間（不勾選任何日）表示每天該時段開放。",
+	"admin.featureMode":           "收集模式",
+	"admin.featureModeAlways":     "長期開放",
+	"admin.featureModeWindow":     "定時收集",
+	"admin.featureModeRecurring":  "循環定時",
+	"admin.featureModeHint":       "長期開放：不限時間，保持開放直到手動關閉；定時收集：一次性開放 / 關閉時間視窗；循環定時：每週固定開放日循環生效。三種模式互斥，儲存時未選模式的設定將被清空。",
+	"admin.featureQuotaLimit":     "收集上限（條 / 份）",
+	"admin.featureQuotaHint":      "0 表示不限制；累計收集達到上限後自動關閉，重設計數後可開啟下一輪。",
+	"admin.featureQuotaCount":     "已收集",
+	"admin.featureQuotaUnlimited": "不限制",
+	"admin.featureQuotaResetAt":   "上次重設：",
+	"admin.featureResetQuota":     "重設計數",
+	"admin.featureSave":           "儲存該功能設定",
+
+	// 功能管理：狀態與提示
+	"feature.name.question":        "提問",
+	"feature.name.chat":            "私聊",
+	"feature.name.vote":            "投票",
+	"feature.statusOpen":           "進行中",
+	"feature.status.disabled":      "已關閉",
+	"feature.status.not_started":   "未開始",
+	"feature.status.ended":         "已結束",
+	"feature.status.quota_reached": "已達上限",
+	"feature.saved":                "功能設定已儲存",
+	"feature.errTime":              "%s 的時間格式不正確，請使用日期時間選擇器",
+	"feature.errTimeRange":         "%s 的定時關閉時間必須晚於定時開放時間",
+	"feature.errQuota":             "%s 的收集上限需為 0 到 1000000 之間的整數",
+	"feature.errInvalid":           "未知的功能類型",
+	"feature.quotaReset":           "%s 的收集計數已重設",
+	"feature.errScheduleHalf":      "%s 的循環定時開始與結束時間必須同時填寫",
+	"feature.errScheduleTime":      "%s 的循環定時時間格式不正確，請使用時間選擇器",
+	"feature.errScheduleRange":     "%s 的循環定時結束時間必須晚於開始時間",
+
+	// 功能關閉時對訪客的提示
+	"feature.disabled.question":      "提問箱主人已關閉提問功能",
+	"feature.disabled.chat":          "該提問箱未開啟私聊功能",
+	"feature.disabled.vote":          "該提問箱已關閉投票功能",
+	"feature.not_started.question":   "提問功能尚未開放",
+	"feature.not_started.chat":       "私聊功能尚未開放",
+	"feature.not_started.vote":       "投票功能尚未開放",
+	"feature.ended.question":         "提問功能已結束收集",
+	"feature.ended.chat":             "私聊功能已結束",
+	"feature.ended.vote":             "投票功能已結束",
+	"feature.quota_reached.question": "提問功能已達到收集上限",
+	"feature.quota_reached.chat":     "私聊功能已達到收集上限",
+	"feature.quota_reached.vote":     "投票功能已達到收集上限",
+
+	// 認證：訪客可見的提示（P0）
+	"auth.errBadCredential":   "郵箱或密碼錯誤",
+	"auth.errUserNotFound":    "使用者不存在",
+	"auth.errEmailFrequent":   "郵件發送太頻繁，請稍後再試",
+	"auth.errEmailFailed":     "郵件發送失敗，請稍後再試",
+	"auth.errCodeExpired":     "驗證碼已過期",
+	"auth.errPasswordChanged": "密碼修改成功",
+	"auth.errLoginRequired":   "請先登入",
+	"auth.errDuplicateEmail":  "該郵箱已被註冊",
+	"auth.errDuplicateDomain": "該個性網域已被使用",
+
+	// 提問箱頁：訪客可見（P0）
+	"question.errWrongPassword":     "密碼錯誤",
+	"question.errAskPasswordWrong":  "提問密碼錯誤",
+	"question.errLoginRequired":     "提問箱的主人設定了僅註冊使用者才能提問，請先登入。",
+	"question.errSelfChat":          "不能給自己發起私聊",
+	"question.errBlockedChat":       "你已被對方封鎖，無法發起私聊",
+	"question.errChatDailyLimit":    "你今日已達發送上限（%d則），請明天再試",
+	"question.errDuplicateSubmit":   "偵測到重複提交，請稍後再試",
+	"question.errImageTooLarge":     "圖片檔案大小不能大於 5Mb",
+	"question.errUploadImageFailed": "上傳圖片失敗",
+	"question.errBlockWords":        "提問內容包含了提問箱主人設定的屏蔽詞，發送失敗",
+	"question.errAnsweredLocked":    "已回答的問題不能標記為未讀",
+	"question.flash.chatSent":       "私聊請求已發送！你可以透過以下連結查看對話：%s",
+	"question.flash.answered":       "回答發布成功！",
+	"question.flash.operated":       "操作成功",
+	"question.flash.markedRead":     "已標記為已讀",
+	"question.flash.markedUnread":   "已標記為未讀",
+
+	// 追問：訪客/箱主可見（P0）
+	"followup.errNoPermission": "無權操作",
+	"followup.errNotAnswered":  "問題尚未被回答，暫時不能追問",
+	"followup.errLimit":        "每條提問最多追問 %d 次，已達上限",
+	"followup.errWaitReply":    "請等待主人回覆上一條追問後再繼續追問",
+	"followup.errNotFound":     "追問不存在",
+	"followup.flash.sent":      "追問發送成功！",
+	"followup.flash.answered":  "回答成功！",
+
+	// 後台設定：箱主可見（P1）
+	"admin.flash.profileUpdated":    "更新個人資訊成功",
+	"admin.flash.chatUpdated":       "私聊設定更新成功",
+	"admin.flash.pagePwdOff":        "已關閉頁面密碼存取",
+	"admin.flash.pagePwdUpdated":    "頁面存取密碼已更新",
+	"admin.flash.askPwdOff":         "已關閉提問密碼",
+	"admin.flash.askPwdUpdated":     "提問密碼已更新",
+	"admin.flash.tagsTooMany":       "標籤不能超過 5 個",
+	"admin.flash.tagsUpdated":       "更新標籤成功",
+	"admin.flash.tagTooLong":        "每個標籤不能超過 5 個字元：%s",
+	"admin.flash.blockWordsTooMany": "屏蔽詞不能超過 10 個",
+	"admin.flash.blockWordTooLong":  "屏蔽詞長度不能超過 10 個字元：%s",
+	"admin.flash.harassmentUpdated": "更新防騷擾設定成功",
+	"admin.flash.blockWordsUpdated": "屏蔽詞已更新",
+	"admin.flash.deactivated":       "您的帳號已停用，感謝您使用 狼的提問箱。期待未來還能再見 👋🏻",
+	"admin.export.errUser":          "匯出失敗：獲取使用者資訊失敗",
+	"admin.export.errQuestion":      "匯出失敗：獲取問題資訊失敗",
+
+	// 投票管理：箱主可見（P1）
+	"vote.err.invalidID":                 "無效的投票 ID",
+	"vote.err.notExist":                  "投票不存在",
+	"vote.err.noPermission":              "無權操作該投票",
+	"vote.err.type":                      "未知的投票類型",
+	"vote.err.titleRequired":             "請填寫投票標題",
+	"vote.err.titleTooLong":              "投票標題不能超過 100 字",
+	"vote.err.visibility":                "未知的可見性設定",
+	"vote.err.voterScope":                "未知的投票範圍設定",
+	"vote.err.showResult":                "未知的結果展示設定",
+	"vote.err.timeRange":                 "結束時間必須晚於開始時間",
+	"vote.err.quota":                     "收集上限需為 0 到 1000000 之間的整數",
+	"vote.err.optionsTooFew":             "請至少新增 2 個選項",
+	"vote.err.optionsFormat":             "選項資料格式錯誤",
+	"vote.err.optionTooLong":             "單個選項內容不能超過 %d 字",
+	"vote.err.maxChoicesExceed":          "最多可選數量不能超過選項總數",
+	"vote.err.fieldsTooFew":              "請至少新增 1 個表單欄位",
+	"vote.err.fieldsFormat":              "表單欄位資料格式錯誤",
+	"vote.err.fieldsTooMany":             "表單欄位不能超過 50 個",
+	"vote.err.fieldType":                 "存在未知的表單欄位類型",
+	"vote.err.fieldLabelMissing":         "第 %d 個欄位缺少標籤",
+	"vote.err.fieldLabelTooLong":         "第 %d 個欄位的標籤不能超過 100 字",
+	"vote.err.fieldLabelDuplicate":       "欄位標籤「%s」重複，請使用不同的標籤",
+	"vote.err.fieldMaxLength":            "第 %d 個欄位的字數上限需在 0-2000 之間",
+	"vote.err.fieldReservedOption":       "第 %d 個欄位（%s）的選項內容包含保留值，請更換",
+	"vote.err.fieldOptionsTooFew":        "第 %d 個欄位（%s）請至少填寫 1 個選項",
+	"vote.err.fieldRankTooFew":           "第 %d 個欄位（%s）排序題至少需要 2 個選項",
+	"vote.err.fieldSerialize":            "欄位選項序列化失敗",
+	"vote.err.editClosed":                "已結束或歸檔的投票不允許編輯",
+	"vote.err.publishDraftOnly":          "只有草稿狀態的投票可以發布",
+	"vote.err.closePublishedOnly":        "只有進行中的投票可以結束",
+	"vote.err.publishTitleRequired":      "請先填寫投票標題再發布",
+	"vote.err.publishFormFieldsRequired": "表單類型投票至少需要 1 個欄位",
+	"vote.err.publishOptionsRequired":    "選項投票至少需要 2 個選項",
+	"vote.err.optionUpdateFailed":        "選項更新失敗，請重試",
+	"vote.err.fieldUpdateFailed":         "表單欄位更新失敗，請重試",
+	"vote.flash.published":               "投票已發布！分享連結：%s",
+	"vote.flash.updated":                 "投票資訊已更新（進行中的投票不可修改類型與選項）",
+	"vote.flash.draftSaved":              "已儲存到草稿",
+	"vote.flash.closed":                  "投票已結束",
+	"vote.flash.deleted":                 "投票已刪除",
+	"vote.err.timeFormat":                "時間格式不正確，請使用日期時間選擇器",
+	"vote.err.maxChoicesLimit":           "最多可選數量不能超過 20",
+	"vote.err.descriptionTooLong":        "投票描述不能超過 5000 字",
+	"profile.err.avatarTooLarge":         "頭像檔案太大，最大支援 2MB",
+	"profile.err.backgroundTooLarge":     "背景圖檔案太大，最大支援 2MB",
+	"profile.err.newPasswordTooShort":    "新密碼長度不能少於 8 位",
+	"profile.err.badOldPassword":         "舊密碼輸入錯誤",
+	"admin.export.errCreateExcel":        "匯出失敗：建立Excel檔案失敗",
+	"admin.export.errWriteExcel":         "匯出失敗：寫入Excel檔案失敗",
+
+	// profile 設定頁 UI 重構：卡片分區 / 頭像背景裁切 / 改密強制登出
+	"profile.card.basic":             "基本資料",
+	"profile.card.avatarBg":          "頭像與背景",
+	"profile.card.qr":                "二維碼樣式",
+	"profile.card.password":          "修改密碼",
+	"profile.avatarCropHint":         "裁切框已鎖定為 1:1 正方形",
+	"profile.backgroundCropHint":     "裁切框已鎖定為 16:9 寬螢幕",
+	"profile.cropTitle":              "裁切圖片",
+	"profile.cropConfirm":            "確認裁切",
+	"profile.err.avatarRatio":        "頭像圖片必須為 1:1 正方形，請裁切後再上傳",
+	"profile.err.backgroundRatio":    "背景圖片必須為 16:9 寬高比，請裁切後再上傳",
+	"profile.flash.passwordChanged":  "密碼修改成功，已登出，請使用新密碼重新登入",
+	"profile.pwdNote":                "儲存後目前工作階段立即失效，需使用新密碼重新登入",
+	"profile.pickAvatar":             "更換頭像",
+	"profile.pickBackground":         "更換背景",
+	"profile.saveBasic":              "儲存基本資料",
+	"profile.saveMedia":              "儲存頭像與背景",
+	"profile.savePassword":           "確認修改密碼",
+	"profile.saveQR":                 "儲存 QR Code 樣式",
+	"profile.saveSocial":             "儲存社交連結",
+	"profile.err.cropLibUnavailable": "圖片裁切元件載入失敗，請重新整理頁面後重試",
+
+	// 驗證碼 JSON 介面：前端消費（P2）
+	"captcha.json.badRequest": "請求格式錯誤",
+	"captcha.json.idRequired": "驗證碼 ID 不能為空",
+	"captcha.json.genFailed":  "生成驗證碼失敗",
+	"chat.errDeletedByOwner":  "該私聊對話已被對方刪除。",
+	"chat.errBlockedView":     "你已被對方拉黑，無法查看該私聊",
+	"chat.errEmpty":           "消息不能為空",
+	"chat.errTooLong":         "消息內容過長，請控制在 %d 字以內",
+	"chat.errConvDeletedSend": "該對話已被刪除，無法發送消息",
+	"chat.errBlockedSend":     "你已被對方拉黑，無法發送私信",
+	"chat.errBlockWords":      "訊息中包含了提問箱主人設定的屏蔽詞，無法傳送",
+	"chat.errDailyLimit":      "你今日已達發送上限（%d條），請明天再試",
+	"chat.errLimitReached":    "對話已達到上限，無法發送新消息",
+	"chat.errChatClosed":      "該箱主已關閉私聊功能，無法發送消息",
+	"chat.errImageTooLarge":   "圖片大小不能超過 %dMB",
+	"chat.errUploadFailed":    "圖片上傳失敗，請稍後重試",
+	"chat.errNoPermission":    "無權執行此操作",
+	"chat.flash.sent":         "消息發送成功",
+	"chat.flash.deleted":      "私聊對話已刪除",
+	"chat.flash.operated":     "操作成功",
+	"image.errTooLarge":       "圖片尺寸過大，最大支援 %d×%d 像素，請壓縮後重新上傳",
+	"internal.errFlash":       "服務內部錯誤，請稍後重試。",
+	"internal.errServer":      "伺服器內部錯誤",
+	"home.errStats":           "獲取統計資訊失敗",
+	"pixel.errPath":           "非法的請求路徑",
+	"proxy.errNotFound":       "頁面不存在",
+	"proxy.errInternal":       "服務網關內部錯誤",
+	"explore.errRandomUser":   "獲取隨機用戶失敗",
+	// 表单校验
+	"form.answer.content":               "回答內容不能為空",
+	"form.answer.contentTooLong":        "回答內容不能超過 %d 個字元",
+	"form.email.required":               "請填寫有效的電子郵件地址",
+	"form.followup.answer":              "追問回答不能為空",
+	"form.followup.answerTooLong":       "追問回答不能超過 %d 個字元",
+	"form.followup.content":             "追問內容不能為空",
+	"form.followup.contentTooLong":      "追問內容不能超過 %d 個字元",
+	"form.login.password":               "請輸入密碼",
+	"form.profile.backgroundimagealpha": "請填寫 QR Code 背景透明度",
+	"form.profile.colorHex":             "請填寫 7 位十六進制顏色代碼（含 #）",
+	"form.profile.dotscale":             "請填寫 QR Code 點大小",
+	"form.profile.intro":                "個人介紹不能為空，且不超過 100 個字元",
+	"form.profile.linkMax":              "主頁連結長度不能超過 30 個字元",
+	"form.profile.name":                 "暱稱不能為空，且不超過 20 個字元",
+	"form.profile.newPassword":          "新密碼長度不能超過 30 個字元",
+	"form.profile.passwordMax":          "密碼長度不能超過 30 個字元",
+	"form.question.content":             "問題內容不能為空",
+	"form.question.contentTooLong":      "問題內容不能超過 %d 個字元",
+	"form.question.receiveReplyEmail":   "請填寫有效的電子郵件地址以接收回覆",
+	"form.recaptcha":                    "請完成人機驗證",
+	"form.recover.newPassword":          "請設定 8 至 30 位的新密碼",
+	"form.recover.repeatPassword":       "兩次輸入的新密碼不一致",
+	"form.register.domain":              "個性網域只能包含字母、數字與底線，長度為 3 至 20 位",
+	"form.register.email":               "請填寫有效的電子郵件地址（不超過 100 個字元）",
+	"form.register.name":                "暱稱不能為空，且不超過 20 個字元",
+	"form.register.password":            "請設定 8 至 30 位的密碼",
+	"form.register.recaptcha":           "無法人機驗證，請重新整理頁面或更換網路後重試",
+	"form.register.repeatPassword":      "兩次輸入的密碼不一致",
+}
diff --git a/internal/i18n/i18n.go b/internal/i18n/i18n.go
new file mode 100644
index 0000000..3f3cf8d
--- /dev/null
+++ b/internal/i18n/i18n.go
@@ -0,0 +1,133 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+// Package i18n 提供多语言翻译支持，支持简体中文、繁体中文、英文、日语四种语言。
+package i18n
+
+import (
+	"fmt"
+	"strings"
+)
+
+// Language 语言代码常量。
+const (
+	LangZhCN = "zh-CN" // 简体中文
+	LangZhTW = "zh-TW" // 繁體中文
+	LangEn   = "en"    // English
+	LangJa   = "ja"    // 日本語
+
+	Default = LangZhCN
+)
+
+// LangInfo 描述一种支持的语言。
+type LangInfo struct {
+	Code string // 语言代码，如 "zh-CN"
+	Name string // 语言自身名称，如 "简体中文" / "繁體中文" / "English" / "日本語"
+}
+
+// supported 支持的语语言列表，顺序即切换按钮展示顺序。
+var supported = []LangInfo{
+	{Code: LangZhCN, Name: "简体中文"},
+	{Code: LangZhTW, Name: "繁體中文"},
+	{Code: LangEn, Name: "English"},
+	{Code: LangJa, Name: "日本語"},
+}
+
+// Supported 返回全部支持的语言列表。
+func Supported() []LangInfo {
+	out := make([]LangInfo, len(supported))
+	copy(out, supported)
+	return out
+}
+
+// Resolve 规范化语言代码：支持返回对应代码，未知代码回退到默认语言。
+func Resolve(lang string) string {
+	lang = strings.TrimSpace(lang)
+	if lang == "" {
+		return Default
+	}
+	switch strings.ToLower(lang) {
+	case "zh-cn", "zh_cn", "zh":
+		return LangZhCN
+	case "zh-tw", "zh_tw", "zh-hant", "zh_hant", "zh-hk", "zh_hk", "zh_mo", "tw":
+		return LangZhTW
+	case "en", "en-us", "en_us", "en-gb":
+		return LangEn
+	case "ja", "ja-jp", "ja_jp":
+		return LangJa
+	}
+	return Default
+}
+
+// Name 返回语言代码对应的显示名。
+func Name(lang string) string {
+	lang = Resolve(lang)
+	for _, l := range supported {
+		if l.Code == lang {
+			return l.Name
+		}
+	}
+	return "简体中文"
+}
+
+// dictionary 翻译字典：语言代码 -> (key -> 文案)。
+// 文案中的 %s 等占位符由 T 函数按传入参数填充。
+var dictionary = map[string]map[string]string{
+	LangZhCN: zhCNDict,
+	LangZhTW: zhTWDict,
+	LangEn:   enDict,
+	LangJa:   jaDict,
+}
+
+// T 返回指定语言下 key 对应的翻译文案，支持 fmt 风格参数填充。
+// 若 key 不存在，回退顺序：指定语言 -> 简体中文 -> 返回 key 本身，
+// 方便开发期发现缺失词条。
+func T(lang, key string, args ...interface{}) string {
+	lang = Resolve(lang)
+	text := lookup(lang, key)
+	if text == "" {
+		text = lookup(LangZhCN, key)
+	}
+	if text == "" {
+		return key
+	}
+	if len(args) > 0 {
+		text = fmt.Sprintf(text, args...)
+	}
+	return text
+}
+
+// FeatureClosedMessage 返回功能被关闭时面向访客的提示文案。
+// feature 取值见 db.FeatureQuestion / db.FeatureChat / db.FeatureVote；
+// reason 为空串表示功能可用，此时返回空串（调用方应先用 Reason 判断是否可用）。
+//
+// 放在 i18n 而非 db 包，避免 i18n 反向依赖数据层。
+func FeatureClosedMessage(lang, feature, reason string) string {
+	if reason == "" {
+		return ""
+	}
+	return T(lang, "feature."+reason+"."+feature)
+}
+
+// FeatureName 返回功能的显示名称。
+func FeatureName(lang, feature string) string {
+	return T(lang, "feature.name."+feature)
+}
+
+// FeatureStatusText 返回管理页展示的功能状态文案。
+func FeatureStatusText(lang, reason string) string {
+	if reason == "" {
+		return T(lang, "feature.statusOpen")
+	}
+	return T(lang, "feature.status."+reason)
+}
+
+func lookup(lang, key string) string {
+	if dict, ok := dictionary[lang]; ok {
+		if text, ok := dict[key]; ok {
+			return text
+		}
+	}
+	return ""
+}
diff --git a/internal/i18n/i18n_test.go b/internal/i18n/i18n_test.go
new file mode 100644
index 0000000..b1db901
--- /dev/null
+++ b/internal/i18n/i18n_test.go
@@ -0,0 +1,76 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package i18n
+
+import (
+	"testing"
+)
+
+// TestDictionaryComplete 校验四种语言的字典 key 完全一致，防止漏翻译。
+func TestDictionaryComplete(t *testing.T) {
+	ref := dictionary[LangZhCN]
+	langs := []string{LangZhTW, LangEn, LangJa}
+
+	for _, lang := range langs {
+		dict := dictionary[lang]
+		if len(dict) != len(ref) {
+			t.Errorf("%s: 词条数量 %d != 简体中文 %d", lang, len(dict), len(ref))
+		}
+		for key := range ref {
+			if _, ok := dict[key]; !ok {
+				t.Errorf("%s: 缺少词条 %q", lang, key)
+			}
+		}
+		for key := range dict {
+			if _, ok := ref[key]; !ok {
+				t.Errorf("%s: 多出简体中文没有的词条 %q", lang, key)
+			}
+		}
+	}
+}
+
+func TestResolve(t *testing.T) {
+	cases := map[string]string{
+		"":        LangZhCN,
+		"zh-cn":   LangZhCN,
+		"zh":      LangZhCN,
+		"zh-TW":   LangZhTW,
+		"zh-Hant": LangZhTW,
+		"en":      LangEn,
+		"en-US":   LangEn,
+		"ja":      LangJa,
+		"ja-JP":   LangJa,
+		"fr":      LangZhCN, // 未知回退
+		"  En  ":  LangEn,   // 自动去除首尾空白
+		"zh_cn":   LangZhCN,
+		"zh_tw":   LangZhTW,
+		"zh_hk":   LangZhTW, // 香港繁体（下划线变体）
+	}
+	for in, want := range cases {
+		if got := Resolve(in); got != want {
+			t.Errorf("Resolve(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestT(t *testing.T) {
+	if got := T(LangZhCN, "nav.explore"); got != "探索" {
+		t.Errorf("zh-CN nav.explore = %q", got)
+	}
+	if got := T(LangEn, "nav.explore"); got != "Explore" {
+		t.Errorf("en nav.explore = %q", got)
+	}
+	if got := T(LangJa, "nav.explore"); got != "探索" {
+		t.Errorf("ja nav.explore = %q", got)
+	}
+	// 参数填充
+	if got := T(LangEn, "auth.recover.greeting", "admin"); got != "admin, you are resetting your password:" {
+		t.Errorf("en auth.recover.greeting with arg = %q", got)
+	}
+	// 未知 key 回退返回 key 本身
+	if got := T(LangEn, "no.such.key"); got != "no.such.key" {
+		t.Errorf("unknown key = %q", got)
+	}
+}
diff --git a/internal/imagecheck/imagecheck.go b/internal/imagecheck/imagecheck.go
new file mode 100644
index 0000000..3ded87a
--- /dev/null
+++ b/internal/imagecheck/imagecheck.go
@@ -0,0 +1,81 @@
+// Package imagecheck 提供图片尺寸校验，用于在上传/解码前拦截"解压炸弹"。
+package imagecheck
+
+import (
+	"errors"
+	"fmt"
+	"image"
+	_ "image/gif"
+	_ "image/jpeg"
+	_ "image/png"
+	"io"
+	"math"
+)
+
+// maxImageSide 是单边最大像素，MaxImagePixels 为其平方。
+const maxImageSide = 4096
+
+// MaxImageSide 导出单边最大像素，供上层在错误提示中向用户展示具体限制。
+const MaxImageSide = maxImageSide
+
+// MaxImagePixels 限制解码后的最大像素总量（4096×4096），用于拦截"解压炸弹"：
+// 超大纯色 PNG/GIF 压缩后体积很小，但 image.Decode 会按宽×高分配内存导致 OOM。
+const MaxImagePixels = maxImageSide * maxImageSide
+
+// ErrImageTooLarge 表示图片像素总量超过 MaxImagePixels，
+// 是所有"图片尺寸超限"的统一错误，供各上传入口识别并展示统一文案。
+var ErrImageTooLarge = errors.New(fmt.Sprintf(
+	"图片尺寸过大，最大支持 %d×%d 像素，请压缩后重新上传",
+	maxImageSide, maxImageSide,
+))
+
+// CheckPixelLimit 仅读取图片头部（image.DecodeConfig）校验宽高与像素总量，
+// 在完整解码前拦截超大图片，避免内存耗尽。
+//
+// 说明：对 GIF 同样适用——image.DecodeConfig 对 GIF 只读取逻辑屏幕宽高（不解码帧），
+// 成本极低；但大逻辑屏幕的 GIF 在后续 image.Decode 时仍会按屏幕尺寸分配内存，故必须校验。
+//
+// 注意：该方法会读取（消耗）传入的 reader，调用方需自行重建/复位 reader。
+func CheckPixelLimit(r io.Reader) error {
+	cfg, _, err := image.DecodeConfig(r)
+	if err != nil {
+		return err
+	}
+	if cfg.Width <= 0 || cfg.Height <= 0 {
+		return nil
+	}
+	if int64(cfg.Width)*int64(cfg.Height) > MaxImagePixels {
+		return ErrImageTooLarge
+	}
+	return nil
+}
+
+// ErrBadAspectRatio 表示图片宽高比不符合用途要求（如头像必须 1:1、背景必须 16:9）。
+// 由 storage 在头像/背景上传入口校验后返回，route 层负责映射为对应语言的提示文案。
+var ErrBadAspectRatio = errors.New("image aspect ratio does not meet the requirement")
+
+// DefaultAspectTolerance 是宽高比允许的绝对偏差。
+// 客户端裁剪输出即为精确比例，此处仅用于拦截绕过裁剪直传的明显不符图片，
+// 因此使用窄容差（±0.01）；宽高比越界（如 4:3 传成 16:9）会稳定触发拒绝。
+const DefaultAspectTolerance = 0.01
+
+// CheckAspectRatio 仅读取图片头部校验宽高比是否接近 wantW:wantH（绝对偏差 ≤ tolerance）。
+// 与 CheckPixelLimit 一致：只做 DecodeConfig 级轻量检查，不解码全图。
+// 注意：该方法会读取（消耗）传入的 reader，调用方需自行重建/复位 reader。
+func CheckAspectRatio(r io.Reader, wantW, wantH float64, tolerance float64) error {
+	if wantW <= 0 || wantH <= 0 {
+		return nil
+	}
+	cfg, _, err := image.DecodeConfig(r)
+	if err != nil {
+		return err
+	}
+	if cfg.Width <= 0 || cfg.Height <= 0 {
+		return nil
+	}
+	actual := float64(cfg.Width) / float64(cfg.Height)
+	if math.Abs(actual-wantW/wantH) > tolerance {
+		return ErrBadAspectRatio
+	}
+	return nil
+}
diff --git a/internal/imagecheck/imagecheck_test.go b/internal/imagecheck/imagecheck_test.go
new file mode 100644
index 0000000..0f383e3
--- /dev/null
+++ b/internal/imagecheck/imagecheck_test.go
@@ -0,0 +1,126 @@
+package imagecheck
+
+import (
+	"bytes"
+	"encoding/binary"
+	"errors"
+	"image"
+	"image/color"
+	"image/png"
+	"testing"
+)
+
+// buildGIFHeader 构造仅含文件头与逻辑屏幕描述符的最小 GIF（无像素数据），
+// 用于让 image.DecodeConfig 读取出宽高。GIF 无 CRC，构造简单可靠。
+func buildGIFHeader(t *testing.T, width, height uint16) []byte {
+	t.Helper()
+	var buf bytes.Buffer
+	buf.WriteString("GIF89a")
+	// Logical Screen Descriptor: width(2 LE) + height(2 LE) + packed(1) + bgcolor(1) + aspect(1)
+	if err := binary.Write(&buf, binary.LittleEndian, width); err != nil {
+		t.Fatalf("write width: %v", err)
+	}
+	if err := binary.Write(&buf, binary.LittleEndian, height); err != nil {
+		t.Fatalf("write height: %v", err)
+	}
+	buf.Write([]byte{0x00, 0x00, 0x00}) // 无全局颜色表
+	return buf.Bytes()
+}
+
+func TestCheckPixelLimit_NormalPNG(t *testing.T) {
+	img := image.NewRGBA(image.Rect(0, 0, 100, 100))
+	for x := 0; x < 100; x++ {
+		for y := 0; y < 100; y++ {
+			img.Set(x, y, color.RGBA{R: 255, A: 255})
+		}
+	}
+	var buf bytes.Buffer
+	if err := png.Encode(&buf, img); err != nil {
+		t.Fatalf("encode png: %v", err)
+	}
+	if err := CheckPixelLimit(bytes.NewReader(buf.Bytes())); err != nil {
+		t.Fatalf("normal image should pass, got %v", err)
+	}
+}
+
+func TestCheckPixelLimit_AtLimit(t *testing.T) {
+	// 恰好等于上限 4096×4096，应通过（校验为严格大于才拒绝）。
+	data := buildGIFHeader(t, 4096, 4096)
+	if err := CheckPixelLimit(bytes.NewReader(data)); err != nil {
+		t.Fatalf("4096×4096 should pass, got %v", err)
+	}
+}
+
+func TestCheckPixelLimit_TooLarge(t *testing.T) {
+	// 4096×4097 超过上限，应拒绝并返回统一错误。
+	data := buildGIFHeader(t, 4096, 4097)
+	err := CheckPixelLimit(bytes.NewReader(data))
+	if err == nil {
+		t.Fatal("oversized image should be rejected, got nil")
+	}
+	if !errors.Is(err, ErrImageTooLarge) {
+		t.Fatalf("expected ErrImageTooLarge, got %v", err)
+	}
+}
+
+func TestCheckPixelLimit_InvalidData(t *testing.T) {
+	err := CheckPixelLimit(bytes.NewReader([]byte("this is not an image")))
+	if err == nil {
+		t.Fatal("invalid data should error, got nil")
+	}
+	if errors.Is(err, ErrImageTooLarge) {
+		t.Fatal("invalid data should not be classified as ErrImageTooLarge")
+	}
+}
+
+// encodePNG 生成指定宽高的纯色 PNG，供比例校验测试使用。
+func encodePNG(t *testing.T, width, height int) []byte {
+	t.Helper()
+	img := image.NewRGBA(image.Rect(0, 0, width, height))
+	var buf bytes.Buffer
+	if err := png.Encode(&buf, img); err != nil {
+		t.Fatalf("encode png: %v", err)
+	}
+	return buf.Bytes()
+}
+
+func TestCheckAspectRatio_Pass(t *testing.T) {
+	// 1920×1080 精确 16:9
+	if err := CheckAspectRatio(bytes.NewReader(encodePNG(t, 1920, 1080)), 16, 9, DefaultAspectTolerance); err != nil {
+		t.Fatalf("1920×1080 should pass 16:9, got %v", err)
+	}
+	// 1:1 正方形
+	if err := CheckAspectRatio(bytes.NewReader(encodePNG(t, 512, 512)), 1, 1, DefaultAspectTolerance); err != nil {
+		t.Fatalf("512×512 should pass 1:1, got %v", err)
+	}
+	// 容差内的微小偏差（1281×720 ≈ 1.779，仍属 16:9）
+	if err := CheckAspectRatio(bytes.NewReader(encodePNG(t, 1281, 720)), 16, 9, DefaultAspectTolerance); err != nil {
+		t.Fatalf("1281×720 should pass within tolerance, got %v", err)
+	}
+}
+
+func TestCheckAspectRatio_Reject(t *testing.T) {
+	// 4:3 直传背景图应被拒绝
+	err := CheckAspectRatio(bytes.NewReader(encodePNG(t, 800, 600)), 16, 9, DefaultAspectTolerance)
+	if err == nil {
+		t.Fatal("800×600 should be rejected as 16:9")
+	}
+	if !errors.Is(err, ErrBadAspectRatio) {
+		t.Fatalf("expected ErrBadAspectRatio, got %v", err)
+	}
+	// 竖长条不能当头像
+	if err := CheckAspectRatio(bytes.NewReader(encodePNG(t, 300, 500)), 1, 1, DefaultAspectTolerance); err == nil {
+		t.Fatal("300×500 should be rejected as 1:1")
+	}
+}
+
+func TestCheckAspectRatio_InvalidData(t *testing.T) {
+	// 无法解码的数据不应误判为比例不符
+	err := CheckAspectRatio(bytes.NewReader([]byte("this is not an image")), 1, 1, DefaultAspectTolerance)
+	if err == nil {
+		t.Fatal("invalid data should error, got nil")
+	}
+	if errors.Is(err, ErrBadAspectRatio) {
+		t.Fatal("invalid data should not be classified as ErrBadAspectRatio")
+	}
+}
diff --git a/internal/mail/mail.go b/internal/mail/mail.go
new file mode 100644
index 0000000..ab59511
--- /dev/null
+++ b/internal/mail/mail.go
@@ -0,0 +1,146 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package mail
+
+import (
+	"bytes"
+	"crypto/tls"
+	"embed"
+	"fmt"
+	"html/template"
+	"strings"
+	"time"
+
+	"github.com/pkg/errors"
+	"gopkg.in/gomail.v2"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/templates"
+)
+
+func SendNewQuestionMail(email, domain string, questionID uint, questionContent string, token string) error {
+	params := map[string]string{
+		"link":     fmt.Sprintf("%s/_/%s/%d?t=%s", conf.App.ExternalURL, domain, questionID, token),
+		"question": questionContent,
+	}
+	return sendTemplateMail(email, "【狼的提问箱】您有一个新的提问", templates.FS, "mail/new-question.html", params)
+}
+
+func SendNewQuestionMailToUser(email, domain string, questionID uint, questionContent string, token string) error {
+	params := map[string]string{
+		"link":     fmt.Sprintf("%s/_/%s/%d?t=%s", conf.App.ExternalURL, domain, questionID, token),
+		"question": questionContent,
+	}
+	return sendTemplateMail(email, "【狼的提问箱】您发送了一个新的提问", templates.FS, "mail/new-question-to-user.html", params)
+}
+
+func SendNewAnswerMail(email, domain string, questionID uint, question, answer string, token string) error {
+	params := map[string]string{
+		"link":     fmt.Sprintf("%s/_/%s/%d?t=%s", conf.App.ExternalURL, domain, questionID, token),
+		"question": question,
+		"answer":   answer,
+	}
+	return sendTemplateMail(email, "【狼的提问箱】您的提问有了回复", templates.FS, "mail/new-answer.html", params)
+}
+
+func SendPasswordRecoveryMail(email, code string) error {
+	params := map[string]string{
+		"link":  fmt.Sprintf("%s/recover-password?code=%s", conf.App.ExternalURL, code),
+		"email": email,
+	}
+	return sendTemplateMail(email, "【狼的提问箱】账号密码找回", templates.FS, "mail/password-recovery.html", params)
+}
+
+// SendNewFollowUpMail 通知提问箱主人：有人对某条已回答的提问进行了追问。
+// 链接无需 token，主人登录后即可查看。
+func SendNewFollowUpMail(email, domain string, questionID uint, questionContent string, followUpContent string) error {
+	params := map[string]string{
+		"link":     fmt.Sprintf("%s/_/%s/%d", conf.App.ExternalURL, domain, questionID),
+		"question": questionContent,
+		"followup": followUpContent,
+	}
+	return sendTemplateMail(email, "【狼的提问箱】您的提问有了追问", templates.FS, "mail/new-follow-up.html", params)
+}
+
+// SendNewConversationMail 通知有新私聊发起（使用 token 而非 conversationID）
+func SendNewConversationMail(email, askerName, domain string, token string, firstMessage string) error {
+	params := map[string]string{
+		"link":    fmt.Sprintf("%s/_/%s/chat/%s", conf.App.ExternalURL, domain, token),
+		"asker":   askerName,
+		"content": firstMessage,
+	}
+	return sendTemplateMail(email, "【狼的提问箱】有人发起了私聊", templates.FS, "mail/new-conversation.html", params)
+}
+
+// SendNewMessageMail 通知私聊中有新消息（使用 token 而非 conversationID）
+func SendNewMessageMail(email, senderName, domain string, token string, content string) error {
+	params := map[string]string{
+		"link":    fmt.Sprintf("%s/_/%s/chat/%s", conf.App.ExternalURL, domain, token),
+		"sender":  senderName,
+		"content": content,
+	}
+	return sendTemplateMail(email, "【狼的提问箱】私聊新消息", templates.FS, "mail/new-message.html", params)
+}
+
+// SendNewVoteSubmissionMail 通知箱主：表单投票收到新回复（链接指向管理后台结果页）。
+func SendNewVoteSubmissionMail(email, voteTitle string, voteID uint) error {
+	params := map[string]string{
+		"link":  fmt.Sprintf("%s/user/votes/%d/results", conf.App.ExternalURL, voteID),
+		"title": voteTitle,
+	}
+	return sendTemplateMail(email, "【狼的提问箱】您的投票收到了新回复", templates.FS, "mail/new-vote.html", params)
+}
+
+// SendSecurityAlertMail 发送安全告警：检测到疑似批量扫描/探测并触发自动封禁时通知管理员。
+// provider 为来源 IP 的网络归属标签（见 internal/security/ipinfo），proxied 表示
+// IP 属于 CDN/WAF/代理网络（此时封禁出口 IP 可能无法拦截真实攻击者，邮件中额外提示）。
+func SendSecurityAlertMail(ip, provider string, proxied bool, samplePaths []string, durationMinutes int) error {
+	proxyHint := ""
+	if proxied {
+		proxyHint = "1"
+	}
+	params := map[string]string{
+		"ip":         ip,
+		"provider":   provider,
+		"proxy_hint": proxyHint,
+		"paths":      strings.Join(samplePaths, "、"),
+		"duration":   fmt.Sprintf("%d", durationMinutes),
+		"time":       time.Now().Format("2006-01-02 15:04:05"),
+	}
+	return sendTemplateMail(conf.Security.SecurityAlertEmail, "【狼的提问箱】检测到疑似批量扫描，已自动封禁 IP", templates.FS, "mail/security-alert.html", params)
+}
+
+func sendTemplateMail(email, title string, templateFS embed.FS, templatePath string, params map[string]string) error {
+	var content bytes.Buffer
+	t, err := template.ParseFS(templateFS, templatePath)
+	if err != nil {
+		return errors.Wrap(err, "parse template file")
+	}
+	params["year"] = time.Now().Format("2006")
+	if err := t.Execute(&content, params); err != nil {
+		return errors.Wrap(err, "execute template")
+	}
+	return sendMail(email, title, content.String())
+}
+
+func sendMail(to, title, content string) error {
+	m := gomail.NewMessage()
+	m.SetHeader("From", fmt.Sprintf("TamaBox <%s>", conf.Mail.Account))
+	m.SetHeader("To", to)
+	m.SetHeader("Subject", title)
+	m.SetBody("text/html", content)
+
+	d := gomail.NewDialer(
+		conf.Mail.SMTP,
+		conf.Mail.Port,
+		conf.Mail.Account,
+		conf.Mail.Password,
+	)
+	// 默认校验证书；仅当配置了 skip_tls_verify=true（自签名/内网 SMTP）时跳过。
+	if conf.Mail.SkipTLSVerify {
+		d.TLSConfig = &tls.Config{InsecureSkipVerify: true}
+	}
+	return d.DialAndSend(m)
+}
diff --git a/internal/mail/mail_alert_test.go b/internal/mail/mail_alert_test.go
new file mode 100644
index 0000000..65b6114
--- /dev/null
+++ b/internal/mail/mail_alert_test.go
@@ -0,0 +1,59 @@
+package mail
+
+import (
+	"bytes"
+	"html/template"
+	"testing"
+
+	"github.com/tamakyi/TamaBox/templates"
+)
+
+// TestSecurityAlertTemplateRenders 保证 security-alert.html 模板可解析，
+// 且新增的「网络归属 / 代理网络提示」字段在参数齐全时正确渲染、
+// proxy_hint 为空时不渲染提示块。
+func TestSecurityAlertTemplateRenders(t *testing.T) {
+	tmpl, err := template.ParseFS(templates.FS, "mail/security-alert.html")
+	if err != nil {
+		t.Fatalf("parse template: %v", err)
+	}
+
+	base := map[string]string{
+		"ip":       "203.0.113.7",
+		"provider": "Cloudflare（CDN）",
+		"paths":    "/admin、/.env",
+		"duration": "15",
+		"time":     "2026-09-08 12:00:00",
+		"year":     "2026",
+	}
+
+	// 1. 代理网络命中：应有归属行 + 代理提示
+	var withHint bytes.Buffer
+	params := cloneParams(base)
+	params["proxy_hint"] = "1"
+	if err := tmpl.Execute(&withHint, params); err != nil {
+		t.Fatalf("execute with proxy_hint: %v", err)
+	}
+	out := withHint.String()
+	for _, want := range []string{"203.0.113.7", "网络归属", "Cloudflare（CDN）", "代理网络"} {
+		if !bytes.Contains([]byte(out), []byte(want)) {
+			t.Errorf("rendered mail missing %q", want)
+		}
+	}
+
+	// 2. 普通网络：不应出现代理提示块
+	var noHint bytes.Buffer
+	if err := tmpl.Execute(&noHint, cloneParams(base)); err != nil {
+		t.Fatalf("execute without proxy_hint: %v", err)
+	}
+	if bytes.Contains(noHint.Bytes(), []byte("代理网络")) {
+		t.Errorf("proxy hint rendered without proxy_hint param")
+	}
+}
+
+func cloneParams(src map[string]string) map[string]string {
+	dst := make(map[string]string, len(src))
+	for k, v := range src {
+		dst[k] = v
+	}
+	return dst
+}
diff --git a/internal/route/autoban.go b/internal/route/autoban.go
new file mode 100644
index 0000000..03a3942
--- /dev/null
+++ b/internal/route/autoban.go
@@ -0,0 +1,45 @@
+package route
+
+import (
+	"net/http"
+
+	"github.com/flamego/flamego"
+
+	"github.com/tamakyi/TamaBox/internal/security/autoban"
+	"github.com/tamakyi/TamaBox/internal/shared"
+)
+
+// autobanMiddleware 自动封禁中间件：挂载在静态黑名单之后、业务路由之前。
+//   - 已封禁 IP 直接 403，不再进入业务
+//   - 敏感路径命中 → 计入窗口统计（达到阈值触发临时封禁 + 邮件告警）
+//   - 真正的 404 探测由 f.NotFound 处理器单独计数（见 route.go），
+//     不再把业务性的"302 → /"（语言切换 / 登出 / 投票不存在 / 黑名单跳转等）误判为扫描。
+//   - 核心检测逻辑见 internal/security/autoban（可独立测试）；告警发送函数由本层注入。
+func autobanMiddleware(b *autoban.Banner) flamego.Handler {
+	return func(ctx flamego.Context) {
+		// 经 shared.LimitKey 归一化后再计数与判定：IPv4 原样，IPv6 聚合到 /64。
+		// 否则攻击者可在单个 /64 内轮换地址，使每个键只命中一次而永不触发阈值。
+		// 记录与判定必须使用同一个键，否则封禁将无法命中。
+		ip := shared.LimitKey(shared.ResolveClientIP(ctx.Request().Request))
+		if ip == "" {
+			return
+		}
+		if b.IsBanned(ip) {
+			ctx.ResponseWriter().WriteHeader(http.StatusForbidden)
+			_, _ = ctx.ResponseWriter().Write([]byte("403 Forbidden"))
+			return
+		}
+
+		path := ctx.Request().URL.Path
+		kind := autoban.KindNone
+		if autoban.IsSensitivePath(path) {
+			kind = autoban.KindSensitive
+		}
+		if kind != autoban.KindNone {
+			defer b.Record(ip, path, kind)
+		}
+
+		// 让下游业务路由先执行，敏感路径的计数延后到响应返回后记录。
+		ctx.Next()
+	}
+}
diff --git a/internal/route/bodylimit.go b/internal/route/bodylimit.go
new file mode 100644
index 0000000..a931e45
--- /dev/null
+++ b/internal/route/bodylimit.go
@@ -0,0 +1,54 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package route
+
+import (
+	"net/http"
+
+	"github.com/flamego/flamego"
+
+	"github.com/tamakyi/TamaBox/internal/form"
+)
+
+// requestBodyLimitMiddleware 在任何业务代码读取请求体之前，全局封顶单次请求体总大小，
+// 上限与 form.Bind 共用 form.MaxRequestBodySize（12 MiB），单一事实来源。
+//
+// 为什么需要全局层（而不是只依赖 form.Bind 内部限制）：
+//  1. 走 form.Bind 的路由中，Bind 内 MaxBytesReader 的执行顺序晚于 Contexter 组级
+//     CSRF 校验 —— flamego/csrf 的 Validate 在请求缺少 X-CSRF-Token 头时通过
+//     FormValue("_csrf") 惰性解析整包 body（multipart 超过 32 MiB 内存阈值后无上限
+//     落盘临时文件），校验失败写出的 400 又发生在路由级限流之前。攻击者无需有效
+//     CSRF token、也不受限流约束，即可持续 POST 超大 multipart 打满磁盘。
+//  2. chat /send、vote /submit 等不走 form.Bind 的入口此前完全没有请求体上限。
+//
+// 挂载于 internal/route/route.go 的 f.Use 链（autoban 之后、所有 Group 之前），
+// 因此任何后续解析（CSRF FormValue、form.Bind、业务 FormValue）都发生在受限 reader 上。
+// 合法最大单请求约为 8 MiB 单图（storage.MaxUploadBytes）+ 表单开销，12 MiB 不会误伤。
+func requestBodyLimitMiddleware() flamego.Handler {
+	return func(ctx flamego.Context) {
+		req := ctx.Request()
+
+		// 无 body 的方法不处理（避免对静态资源等无谓开销）。
+		switch req.Method {
+		case http.MethodPost, http.MethodPut, http.MethodPatch:
+		default:
+			return
+		}
+
+		// Content-Length 明确超限时直接 413 快速失败，不进入解析流程。
+		// （chunked 或未知长度请求的 ContentLength 为 0/-1，走下方 MaxBytesReader 惰性封顶。）
+		if req.ContentLength > form.MaxRequestBodySize {
+			http.Error(ctx.ResponseWriter(), http.StatusText(http.StatusRequestEntityTooLarge), http.StatusRequestEntityTooLarge)
+			return
+		}
+
+		// 其余情况：用 MaxBytesReader 包一层。MaxBytesReader 在读取超过上限时令后续
+		// Read 报错，使 ParseForm / ParseMultipartForm 失败 —— 超大 body 不会落盘或读入内存。
+		// 注意：c.Request() 返回 flamego 的包装类型，其 Body 是方法而非字段，
+		// 必须取内嵌的 *http.Request 才能替换 Body（与 internal/form/form.go 同款写法）。
+		httpReq := req.Request
+		httpReq.Body = http.MaxBytesReader(ctx.ResponseWriter(), httpReq.Body, form.MaxRequestBodySize)
+	}
+}
diff --git a/internal/route/bodylimit_test.go b/internal/route/bodylimit_test.go
new file mode 100644
index 0000000..a6ca88a
--- /dev/null
+++ b/internal/route/bodylimit_test.go
@@ -0,0 +1,81 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package route
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/flamego/flamego"
+
+	"github.com/tamakyi/TamaBox/internal/form"
+)
+
+// TestRequestBodyLimitEnforced 是 P1-1（请求体 12MiB 上限必须在任何解析之前全局生效）
+// 的回归测试。
+//
+// 背景：此前 MaxBytesReader 只装在 form.Bind（路由级），但 Contexter 组级 CSRF 校验
+// （无 X-CSRF-Token 头时经 FormValue("_csrf") 惰性解析整包 body）先于 Bind 执行，
+// 超大 multipart 会在路由级限制生效前无上限落盘临时文件耗尽磁盘；chat /send、
+// vote /submit 等不走 Bind 的入口更是完全没有上限。修复为全局中间件
+// requestBodyLimitMiddleware（挂载于 f.Use 链，先于所有 Group/CSRF）。
+//
+// 本测试验证三件事（用内存 flamego 实例，无需 DB/Redis）：
+//  1. 合法请求（≤8MiB 单图上限 + 表单开销）不被误伤 → 200；
+//  2. Content-Length 明确超限 → 中间件直接 413 快速失败，不进入 handler；
+//  3. chunked/未知长度超限（绕过 Content-Length 预检）→ MaxBytesReader 在读超限时报错，
+//     服务端拒绝，而非默默读入/落盘后 200。
+func TestRequestBodyLimitEnforced(t *testing.T) {
+	f := flamego.New()
+	// 与 internal/route/route.go 一致：全局 Use 挂载先于任何路由/组 handler。
+	f.Use(requestBodyLimitMiddleware())
+	f.Post("/echo", func(ctx flamego.Context) {
+		body, err := io.ReadAll(ctx.Request().Request.Body)
+		if err != nil {
+			// MaxBytesReader 超限读报错：服务端拒绝，不得返回 200。
+			ctx.ResponseWriter().WriteHeader(http.StatusRequestEntityTooLarge)
+			return
+		}
+		ctx.ResponseWriter().WriteHeader(http.StatusOK)
+		_, _ = ctx.ResponseWriter().Write(body)
+	})
+	ts := httptest.NewServer(f)
+	defer ts.Close()
+
+	post := func(payload []byte, chunked bool) int {
+		req, _ := http.NewRequest(http.MethodPost, ts.URL+"/echo", bytes.NewReader(payload))
+		req.ContentLength = int64(len(payload))
+		if chunked {
+			req.ContentLength = -1 // 强制 chunked，绕过 Content-Length 预检
+		}
+		resp, err := http.DefaultClient.Do(req)
+		if err != nil {
+			t.Fatalf("POST failed: %v", err)
+		}
+		defer func() { _ = resp.Body.Close() }()
+		_, _ = io.Copy(io.Discard, resp.Body)
+		return resp.StatusCode
+	}
+
+	// 1. 合法：8MiB（≈单图上限 storage.MaxUploadBytes + 表单开销）→ 必须放行。
+	legal := bytes.Repeat([]byte{'a'}, 8<<20)
+	if code := post(legal, false); code != http.StatusOK {
+		t.Errorf("合法 8MiB 请求被拒绝：got %d, want 200", code)
+	}
+
+	// 2. Content-Length 明确超限 → 413（中间件预检，不进入 handler）。
+	huge := bytes.Repeat([]byte{'b'}, form.MaxRequestBodySize+1)
+	if code := post(huge, false); code != http.StatusRequestEntityTooLarge {
+		t.Errorf("Content-Length 超限请求未被 413：got %d, want 413", code)
+	}
+
+	// 3. chunked 超限（无 Content-Length，必须靠 MaxBytesReader 惰性封顶）→ 413。
+	if code := post(huge, true); code != http.StatusRequestEntityTooLarge {
+		t.Errorf("chunked 超限请求未被拒绝：got %d, want 413", code)
+	}
+}
diff --git a/internal/route/chat/chat_handler.go b/internal/route/chat/chat_handler.go
new file mode 100644
index 0000000..982d846
--- /dev/null
+++ b/internal/route/chat/chat_handler.go
@@ -0,0 +1,412 @@
+package chat
+
+import (
+	stdctx "context"
+	"fmt"
+	"mime/multipart"
+	"net/http"
+	"time"
+	"unicode/utf8"
+
+	"github.com/flamego/cache"
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/context"
+	"github.com/tamakyi/TamaBox/internal/db"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+	"github.com/tamakyi/TamaBox/internal/imagecheck"
+	"github.com/tamakyi/TamaBox/internal/mail"
+	"github.com/tamakyi/TamaBox/internal/security/censor"
+	"github.com/tamakyi/TamaBox/internal/shared"
+	"github.com/tamakyi/TamaBox/internal/storage"
+)
+
+const (
+	MaxMessageImageSize = 5 * 1024 * 1024 // 5MB
+)
+
+func ConversationPage(ctx context.Context) {
+	domain := ctx.Param("domain")
+	token := ctx.Param("token")
+
+	pageUser, err := db.Users.GetByDomain(ctx.Request().Context(), domain)
+	if err != nil {
+		ctx.Redirect("/")
+		return
+	}
+
+	conv, err := db.Conversations.GetByToken(ctx.Request().Context(), token)
+	if err != nil {
+		ctx.Redirect("/")
+		return
+	}
+
+	if conv.IsDeletedByOwner {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "chat.errDeletedByOwner"))
+		ctx.Redirect("/_/" + domain)
+		return
+	}
+
+	// 纵深防御：私聊对话只能由其所属提问箱（domain 对应的真实属主）的页面访问。
+	// 否则攻击者可用其它 domain 构造访问，使下方拉黑判定用到错误的主体，绕过真实属主的拉黑。
+	if conv.OwnerID != pageUser.ID {
+		ctx.Redirect("/")
+		return
+	}
+
+	isOwner := ctx.IsLogged && ctx.User.ID == conv.OwnerID
+	isAsker := ctx.IsLogged && ctx.User.ID == conv.AskerID
+	if !isOwner && !isAsker {
+		ctx.Redirect("/")
+		return
+	}
+
+	// 提问者检查是否被对方（对话真实属主）拉黑
+	if isAsker {
+		blocked, err := db.Users.IsUserBlocked(ctx.Request().Context(), conv.OwnerID, conv.AskerID)
+		if err != nil {
+			logrus.WithError(err).Error("Failed to check block status for asker")
+		}
+		if blocked {
+			ctx.SetErrorFlash(i18n.T(ctx.Lang(), "chat.errBlockedView"))
+			ctx.Redirect("/_/" + domain)
+			return
+		}
+	}
+
+	// 检查是否已拉黑对方（仅对被提问者有效，以对话真实属主为准）
+	var isBlocked bool
+	if isOwner {
+		blocked, err := db.Users.IsUserBlocked(ctx.Request().Context(), conv.OwnerID, conv.AskerID)
+		if err != nil {
+			logrus.WithError(err).Error("Failed to check block status")
+		}
+		isBlocked = blocked
+	}
+
+	messages, err := db.Messages.GetByConversationID(ctx.Request().Context(), conv.ID, nil)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to get messages")
+		ctx.SetInternalError()
+		return
+	}
+
+	// 获取所有消息的图片（被拉黑时不显示对方图片）
+	var messageImageMap map[uint][]*db.MessageImage
+	if !(isOwner && isBlocked) {
+		msgIDs := make([]uint, 0, len(messages))
+		for _, msg := range messages {
+			msgIDs = append(msgIDs, msg.ID)
+		}
+		messageImageMap, err = db.MessageImages.GetByMessageIDs(ctx.Request().Context(), msgIDs)
+		if err != nil {
+			logrus.WithError(err).Error("Failed to get message images")
+			messageImageMap = make(map[uint][]*db.MessageImage)
+		}
+	} else {
+		messageImageMap = make(map[uint][]*db.MessageImage)
+	}
+
+	ctx.Data["PageUser"] = pageUser
+	ctx.Data["Conversation"] = conv
+	ctx.Data["Messages"] = messages
+	ctx.Data["MessageImages"] = messageImageMap
+	ctx.Data["IsOwner"] = isOwner
+	ctx.Data["IsAsker"] = isAsker
+	ctx.Data["IsBlocked"] = isBlocked
+	// 单条消息字数上限，供发送 / 回复 textarea 的 maxlength 与后端校验同源
+	// （conf.Limits.ChatMessageLen，[limits] 配置段）
+	ctx.Data["ChatMessageLimit"] = conf.Limits.ChatMessageLen
+	ctx.Data["CanSend"] = !conv.IsClosed && !conv.IsDeletedByOwner &&
+		((isOwner && conv.MessageCount < conv.MaxMessages) || (isAsker && conv.MessageCount < conv.MaxMessages && !isBlocked))
+	ctx.Success("chat/conversation")
+}
+
+func SendMessage(ctx context.Context, cache cache.Cache) {
+	domain := ctx.Param("domain")
+	token := ctx.Param("token")
+	content := ctx.Request().FormValue("content")
+
+	// 处理图片上传
+	var imageFile multipart.File
+	var imageHeader *multipart.FileHeader
+	imageFile, imageHeader, err := ctx.Request().FormFile("image")
+	if err != nil && err != http.ErrMissingFile {
+		logrus.WithError(err).Error("Failed to read uploaded image")
+	}
+	if imageFile != nil {
+		defer imageFile.Close()
+	}
+
+	// 内容与图片至少有一个
+	if content == "" && imageFile == nil {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "chat.errEmpty"))
+		ctx.Redirect(fmt.Sprintf("/_/%s/chat/%s", domain, token))
+		return
+	}
+
+	// 内容长度限制（上限取自 conf.Limits.ChatMessageLen，[limits] 配置段）
+	if utf8.RuneCountInString(content) > conf.Limits.ChatMessageLen {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "chat.errTooLong", conf.Limits.ChatMessageLen))
+		ctx.Redirect(fmt.Sprintf("/_/%s/chat/%s", domain, token))
+		return
+	}
+
+	pageUser, err := db.Users.GetByDomain(ctx.Request().Context(), domain)
+	if err != nil {
+		ctx.Redirect("/")
+		return
+	}
+
+	conv, err := db.Conversations.GetByToken(ctx.Request().Context(), token)
+	if err != nil {
+		ctx.Redirect("/")
+		return
+	}
+
+	if conv.IsDeletedByOwner {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "chat.errConvDeletedSend"))
+		ctx.Redirect(fmt.Sprintf("/_/%s/chat/%s", domain, token))
+		return
+	}
+
+	isOwner := ctx.IsLogged && ctx.User.ID == conv.OwnerID
+	isAsker := ctx.IsLogged && ctx.User.ID == conv.AskerID
+	if !isOwner && !isAsker {
+		ctx.Redirect("/")
+		return
+	}
+
+	// 提问者发送时检查拉黑与每日限制
+	if isAsker {
+		blocked, err := db.Users.IsUserBlocked(ctx.Request().Context(), pageUser.ID, ctx.User.ID)
+		if err != nil {
+			logrus.WithError(err).Error("Failed to check block")
+		}
+		if blocked {
+			ctx.SetErrorFlash(i18n.T(ctx.Lang(), "chat.errBlockedSend"))
+			ctx.Redirect(fmt.Sprintf("/_/%s/chat/%s", domain, token))
+			return
+		}
+
+		// 箱主全局屏蔽词（提问/私聊/投票共用一份词表）：对方发给我的消息命中即拦截。
+		// 仅拦对方 → 箱主方向：我回复对方的内容不受自己设置的屏蔽词限制。
+		if content != "" {
+			if _, hit := shared.BlockWordHit(pageUser.BlockWords, content); hit {
+				ctx.SetErrorFlash(i18n.T(ctx.Lang(), "chat.errBlockWords"))
+				ctx.Redirect(fmt.Sprintf("/_/%s/chat/%s", domain, token))
+				return
+			}
+		}
+
+		if pageUser.DailyMessageLimit > 0 {
+			todayCount, err := db.Users.CountTodayMessagesFromUser(ctx.Request().Context(), pageUser.ID, ctx.User.ID)
+			if err != nil {
+				logrus.WithError(err).Error("Failed to count today messages")
+			}
+			if todayCount >= int64(pageUser.DailyMessageLimit) {
+				ctx.SetErrorFlash(i18n.T(ctx.Lang(), "chat.errDailyLimit", pageUser.DailyMessageLimit))
+				ctx.Redirect(fmt.Sprintf("/_/%s/chat/%s", domain, token))
+				return
+			}
+		}
+	}
+
+	if conv.IsClosed || conv.MessageCount >= conv.MaxMessages {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "chat.errLimitReached"))
+		ctx.Redirect(fmt.Sprintf("/_/%s/chat/%s", domain, token))
+		return
+	}
+
+	// 私聊功能开关：发送前重新校验箱主私聊功能是否仍开启（创建会话时已查过，
+	// 但箱主可能在会话中途关闭私聊，此时应阻止继续发消息）。
+	chatState := db.FeatureStateOf(ctx.Request().Context(), conv.OwnerID, db.FeatureChat)
+	if !chatState.Open {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "chat.errChatClosed"))
+		ctx.Redirect(fmt.Sprintf("/_/%s/chat/%s", domain, token))
+		return
+	}
+
+	// 图片大小限制
+	if imageHeader != nil && imageHeader.Size > MaxMessageImageSize {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "chat.errImageTooLarge", MaxMessageImageSize/(1024*1024)))
+		ctx.Redirect(fmt.Sprintf("/_/%s/chat/%s", domain, token))
+		return
+	}
+
+	// 上传图片（如有）
+	var imageURL string
+	if imageFile != nil {
+		uploadedURL, err := storage.UploadPictureToS3(imageFile, imageHeader)
+		if err != nil {
+			if errors.Is(err, imagecheck.ErrImageTooLarge) {
+				ctx.SetErrorFlash(i18n.T(ctx.Lang(), "image.errTooLarge", imagecheck.MaxImageSide, imagecheck.MaxImageSide))
+			} else {
+				logrus.WithError(err).Error("Failed to upload image")
+				ctx.SetErrorFlash(i18n.T(ctx.Lang(), "chat.errUploadFailed"))
+			}
+			ctx.Redirect(fmt.Sprintf("/_/%s/chat/%s", domain, token))
+			return
+		}
+		imageURL = uploadedURL
+	}
+
+	// 内容安全检测（仅文本）
+	if content != "" {
+		censorResponse, err := censor.Text(ctx.Request().Context(), content)
+		if err != nil {
+			// 审核源全部不可用：fail-closed，拒绝发送而非免审放行。
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to censor text")
+			ctx.SetErrorFlash(i18n.T(ctx.Lang(), "censor.unavailable"))
+			ctx.Redirect(fmt.Sprintf("/_/%s/chat/%s", domain, token))
+			return
+		}
+		if !censorResponse.Pass {
+			ctx.SetErrorFlash(censorResponse.ErrorMessage())
+			ctx.Redirect(fmt.Sprintf("/_/%s/chat/%s", domain, token))
+			return
+		}
+	}
+
+	// 原子地递增消息计数：真正的上限检查点（先于消息落库，防止超额消息写入）。
+	// 并发场景（对话双方同时发送）下，仅当 message_count < max 时才 +1 成功。
+	ok, err := db.Conversations.IncrementMessageCountIfBelow(ctx.Request().Context(), conv.ID, conv.MaxMessages)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to increment message count")
+		ctx.SetInternalErrorFlash()
+		ctx.Redirect(fmt.Sprintf("/_/%s/chat/%s", domain, token))
+		return
+	}
+	if !ok {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "chat.errLimitReached"))
+		ctx.Redirect(fmt.Sprintf("/_/%s/chat/%s", domain, token))
+		return
+	}
+
+	// 创建消息
+	msg, err := db.Messages.Create(ctx.Request().Context(), db.CreateMessageOptions{
+		ConversationID: conv.ID,
+		SenderID:       ctx.User.ID,
+		Content:        content,
+	})
+	if err != nil {
+		// 计数已递增但消息落库失败：回滚计数，避免占用配额
+		if rerr := db.Conversations.DecrementMessageCount(ctx.Request().Context(), conv.ID); rerr != nil {
+			logrus.WithContext(ctx.Request().Context()).WithError(rerr).Error("Failed to rollback message count")
+		}
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to create message")
+		ctx.SetInternalErrorFlash()
+		ctx.Redirect(fmt.Sprintf("/_/%s/chat/%s", domain, token))
+		return
+	}
+
+	// 保存图片记录（如有）
+	if imageURL != "" {
+		if _, err := db.MessageImages.Create(ctx.Request().Context(), db.CreateMessageImageOptions{
+			MessageID: msg.ID,
+			URL:       imageURL,
+			FileName:  imageHeader.Filename,
+			FileSize:  imageHeader.Size,
+		}); err != nil {
+			logrus.WithError(err).Error("Failed to save message image")
+		}
+	}
+
+	// 达到上限时关闭对话（幂等，多实例同时执行也安全）
+	if err := db.Conversations.MaybeClose(ctx.Request().Context(), conv.ID, conv.MaxMessages); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to maybe close conversation")
+	}
+
+	senderName := ctx.User.Name
+	shared.SafeGo(func() {
+		var recipientEmail string
+		if isOwner {
+			asker, err := db.Users.GetByID(stdctx.Background(), conv.AskerID)
+			if err == nil {
+				recipientEmail = asker.Email
+			}
+		} else {
+			owner, err := db.Users.GetByID(stdctx.Background(), conv.OwnerID)
+			if err == nil {
+				recipientEmail = owner.Email
+			}
+		}
+		if recipientEmail == "" {
+			return
+		}
+
+		// 邮件节流：同一收件人 5 分钟内最多一封通知，防止刷屏导致邮件轰炸。
+		notifyKey := "chat-notify:" + recipientEmail
+		if _, err := cache.Get(stdctx.Background(), notifyKey); err == nil {
+			return
+		}
+
+		if err := mail.SendNewMessageMail(recipientEmail, senderName, pageUser.Domain, token, content); err != nil {
+			logrus.WithContext(stdctx.Background()).WithError(err).Error("Failed to send new message mail")
+			return
+		}
+		_ = cache.Set(stdctx.Background(), notifyKey, time.Now(), 5*time.Minute)
+	})
+
+	ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "chat.flash.sent"))
+	ctx.Redirect(fmt.Sprintf("/_/%s/chat/%s", domain, token))
+}
+
+func DeleteConversation(ctx context.Context) {
+	token := ctx.Param("token")
+
+	conv, err := db.Conversations.GetByToken(ctx.Request().Context(), token)
+	if err != nil {
+		ctx.Redirect("/user/questions")
+		return
+	}
+
+	if !ctx.IsLogged || ctx.User.ID != conv.OwnerID {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "chat.errNoPermission"))
+		ctx.Redirect("/user/questions")
+		return
+	}
+
+	if err := db.Conversations.MarkDeletedByOwner(ctx.Request().Context(), conv.ID); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to mark conversation deleted")
+		ctx.SetInternalErrorFlash()
+		ctx.Redirect("/user/questions")
+		return
+	}
+
+	ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "chat.flash.deleted"))
+	ctx.Redirect("/user/questions")
+}
+
+// ToggleBlockUser 拉黑/取消屏蔽
+func ToggleBlockUser(ctx context.Context) {
+	token := ctx.Param("token")
+
+	conv, err := db.Conversations.GetByToken(ctx.Request().Context(), token)
+	if err != nil {
+		ctx.Redirect("/user/questions")
+		return
+	}
+
+	if !ctx.IsLogged || ctx.User.ID != conv.OwnerID {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "chat.errNoPermission"))
+		ctx.Redirect("/user/questions")
+		return
+	}
+
+	blocked, _ := db.Users.IsUserBlocked(ctx.Request().Context(), conv.OwnerID, conv.AskerID)
+	if blocked {
+		err = db.Users.UnblockUser(ctx.Request().Context(), conv.OwnerID, conv.AskerID)
+	} else {
+		err = db.Users.BlockUser(ctx.Request().Context(), conv.OwnerID, conv.AskerID)
+	}
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to toggle block")
+		ctx.SetInternalErrorFlash()
+	} else {
+		ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "chat.flash.operated"))
+	}
+	ctx.Redirect(fmt.Sprintf("/_/%s/chat/%s", ctx.Param("domain"), token))
+}
diff --git a/internal/route/csrf_binding_test.go b/internal/route/csrf_binding_test.go
new file mode 100644
index 0000000..4a0c504
--- /dev/null
+++ b/internal/route/csrf_binding_test.go
@@ -0,0 +1,120 @@
+package route
+
+import (
+	"net/http"
+	"net/http/cookiejar"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/flamego/csrf"
+	"github.com/flamego/flamego"
+	"github.com/flamego/session"
+)
+
+// TestCSRFTokenBoundToUserSession 是 P1-1 的回归测试：CSRF token 必须绑定到登录用户的
+// 会话键（CSRFUserSessionKey = "uid"），而非 flamego/csrf 默认的 "userID"。
+//
+// 背景：flamego/csrf 的校验是无状态 HMAC 重算（token = HMAC(secret, id:action:ts)，不与
+// session 内存储的 token 比对）。一旦 SessionKey 与登录时写入的会话键（login.go 中的
+// Session.Set("uid", ...)）不一致，token 内绑定的 id 恒为 "0"，任意匿名访客从公开 /login
+// 页面取到的 token 对所有已登录用户均有效 —— CSRF 退化为全站公开常量，跨站请求伪造可自由发起。
+//
+// 本测试用内存会话（无需数据库）重放「会话 B 携带会话 A 的 token 提交」这一跨会话复用攻击：
+//   - 会话 A（已登录 uid=42）携带自己的 token 提交 → 必须通过（200）；
+//   - 会话 B（匿名）携带会话 A 的 token 跨会话提交 → 必须被拒绝（400）。
+//
+// 若 CSRFUserSessionKey 被误改回 "userID"，第二项断言会失败，CI 即报警。
+func TestCSRFTokenBoundToUserSession(t *testing.T) {
+	const secret = "test-secret-for-csrf-regression"
+
+	f := flamego.New()
+	f.Use(session.Sessioner(session.Options{
+		Initer: session.MemoryIniter(),
+		Cookie: session.CookieOptions{
+			HTTPOnly: true,
+			SameSite: http.SameSiteLaxMode,
+		},
+	}))
+	// 仅当请求带 X-Test-Login 头时才把 uid=42 写入会话，模拟「已登录用户」。
+	// 该中间件必须排在 csrf 之前，使 token 在生成时即绑定到 uid。
+	f.Use(func(ctx flamego.Context, s session.Session) {
+		if ctx.Request().Header.Get("X-Test-Login") != "" {
+			s.Set(CSRFUserSessionKey, uint(42))
+		}
+	})
+	f.Use(csrf.Csrfer(csrf.Options{
+		Secret:     secret,
+		Header:     "X-CSRF-Token",
+		SessionKey: CSRFUserSessionKey,
+		SetHeader:  true, // 便于测试从响应头取出 token
+	}))
+
+	// 受保护路由：仅当 CSRF 校验通过才返回 200；失败由 csrf.Error 写 400。
+	f.Post("/protected", func(ctx flamego.Context, x csrf.CSRF) {
+		x.Validate(ctx)
+		// 校验失败时 x.Validate 已写入 400；此处 Write 在已写 400 时仅追加 body，
+		// 状态保持 400；校验通过时此处隐式返回 200。
+		ctx.ResponseWriter().Write([]byte("ok"))
+	})
+	// 生成 token 的 GET 路由（token 在 GET 时生成，与真实应用一致）。
+	f.Get("/token", func(ctx flamego.Context) {
+		ctx.ResponseWriter().Write([]byte("ok"))
+	})
+
+	ts := httptest.NewServer(f)
+	defer ts.Close()
+
+	newClient := func() *http.Client {
+		jar, err := cookiejar.New(nil)
+		if err != nil {
+			t.Fatalf("cookiejar.New: %v", err)
+		}
+		return &http.Client{Jar: jar}
+	}
+
+	getToken := func(client *http.Client, login bool) string {
+		req, _ := http.NewRequest(http.MethodGet, ts.URL+"/token", nil)
+		if login {
+			req.Header.Set("X-Test-Login", "1")
+		}
+		resp, err := client.Do(req)
+		if err != nil {
+			t.Fatalf("GET /token: %v", err)
+		}
+		defer resp.Body.Close()
+		tok := resp.Header.Get("X-CSRF-Token")
+		if tok == "" {
+			t.Fatalf("GET /token 未返回 X-CSRF-Token（Csrfer SetHeader 应已启用）")
+		}
+		return tok
+	}
+
+	postProtected := func(client *http.Client, token string) int {
+		req, _ := http.NewRequest(http.MethodPost, ts.URL+"/protected", nil)
+		if token != "" {
+			req.Header.Set("X-CSRF-Token", token)
+		}
+		resp, err := client.Do(req)
+		if err != nil {
+			t.Fatalf("POST /protected: %v", err)
+		}
+		defer resp.Body.Close()
+		return resp.StatusCode
+	}
+
+	// 会话 A：已登录用户（uid=42）。
+	clientA := newClient()
+	tokenA := getToken(clientA, true)
+
+	// 同一会话携带自己的 token 提交 —— 必须通过（200）。
+	if code := postProtected(clientA, tokenA); code != http.StatusOK {
+		t.Fatalf("会话 A 携带自身 token 提交，期望 200，实际 %d（修复后不应被拒绝）", code)
+	}
+
+	// 会话 B：匿名访客，跨会话复用会话 A 的 token 提交 —— 必须被拒绝（400）。
+	// 这是 P1-1 的核心回归点：token 绑定了 uid=42，会话 B 的 id 为 "0"，HMAC 重算不匹配。
+	clientB := newClient()
+	if code := postProtected(clientB, tokenA); code != http.StatusBadRequest {
+		t.Fatalf("会话 B 跨会话复用会话 A 的 token，期望 400，实际 %d（CSRF 绑定失效！）", code)
+	}
+}
diff --git a/internal/route/gzip.go b/internal/route/gzip.go
new file mode 100644
index 0000000..78917d9
--- /dev/null
+++ b/internal/route/gzip.go
@@ -0,0 +1,150 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package route
+
+import (
+	"bufio"
+	"compress/gzip"
+	"errors"
+	"net"
+	"net/http"
+	"strings"
+)
+
+// GzipHandler 返回一个压缩中间件，用于包装 http.Handler。
+// 它对可压缩的响应（HTML / CSS / JS / JSON 等文本类型）做 gzip 压缩，
+// 自动跳过图片、视频、字体等已经压缩过的格式。
+//
+// 由于 flamego 的 Context 无法替换底层 ResponseWriter，这里采用在
+// http.Server 最外层包装 Handler 的方式，保证对所有响应（含静态文件）生效。
+func GzipHandler(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// 客户端不支持 gzip 时直接透传
+		if !strings.Contains(r.Header.Get("Accept-Encoding"), "gzip") {
+			next.ServeHTTP(w, r)
+			return
+		}
+
+		gw := &gzipResponseWriter{
+			ResponseWriter: w,
+			gz:             gzip.NewWriter(w),
+		}
+		defer func() {
+			// 只有真正写入过 body 才关闭 gzip 流，避免 302/204 等
+			// 无 body 响应被追加空的 gzip 尾块
+			if gw.compress && gw.wrote {
+				_ = gw.gz.Close()
+			}
+		}()
+		next.ServeHTTP(gw, r)
+	})
+}
+
+// gzipResponseWriter 包装 http.ResponseWriter，在 WriteHeader 时根据
+// Content-Type 决定是否启用 gzip，保持接口兼容（Flusher / Hijacker / Pusher）。
+type gzipResponseWriter struct {
+	http.ResponseWriter
+	gz          *gzip.Writer
+	compress    bool
+	wrote       bool
+	wroteHeader bool
+}
+
+// WriteHeader 记录状态码，并根据 Content-Type 决定是否压缩。
+// 由于 Content-Encoding 改变后 Content-Length 不再准确，需要删除该头。
+func (w *gzipResponseWriter) WriteHeader(status int) {
+	if w.wroteHeader {
+		return
+	}
+	w.wroteHeader = true
+
+	// 无实体响应（204 No Content / 304 Not Modified）不应附加 Content-Encoding。
+	if status == http.StatusNoContent || status == http.StatusNotModified {
+		w.ResponseWriter.WriteHeader(status)
+		return
+	}
+
+	if shouldCompressContentType(w.Header().Get("Content-Type")) {
+		w.compress = true
+		w.Header().Del("Content-Length")
+		w.Header().Set("Content-Encoding", "gzip")
+		w.Header().Add("Vary", "Accept-Encoding")
+	}
+	w.ResponseWriter.WriteHeader(status)
+}
+
+// Write 写入响应体。若尚未 WriteHeader（handler 依赖 net/http 自动嗅探
+// Content-Type 的情况），先用首个字节块探测类型再决策。
+func (w *gzipResponseWriter) Write(b []byte) (int, error) {
+	if !w.wroteHeader {
+		ct := w.Header().Get("Content-Type")
+		if ct == "" {
+			ct = http.DetectContentType(b)
+			// 将嗅探到的类型写回响应头，使 WriteHeader 的压缩判定能正确生效
+			// （否则空 Content-Type 会被判定为"不压缩"，导致本应压缩的纯文本响应未压缩）。
+			w.Header().Set("Content-Type", ct)
+		}
+		w.WriteHeader(http.StatusOK)
+	}
+	if w.compress {
+		w.wrote = true
+		return w.gz.Write(b)
+	}
+	return w.ResponseWriter.Write(b)
+}
+
+// Flush 转发底层 Flusher，并在压缩模式下先刷新 gzip 缓冲。
+func (w *gzipResponseWriter) Flush() {
+	if w.compress && w.gz != nil {
+		_ = w.gz.Flush()
+	}
+	if f, ok := w.ResponseWriter.(http.Flusher); ok {
+		f.Flush()
+	}
+}
+
+// Hijack 转发底层 Hijacker，保持对 WebSocket 等升级协议兼容。
+func (w *gzipResponseWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+	if h, ok := w.ResponseWriter.(http.Hijacker); ok {
+		return h.Hijack()
+	}
+	return nil, nil, errors.New("gzipResponseWriter: hijacking not supported")
+}
+
+// Push 转发 HTTP/2 Server Push（如果底层支持）。
+func (w *gzipResponseWriter) Push(target string, opts *http.PushOptions) error {
+	if p, ok := w.ResponseWriter.(http.Pusher); ok {
+		return p.Push(target, opts)
+	}
+	return http.ErrNotSupported
+}
+
+// shouldCompressContentType 判断响应 Content-Type 是否值得压缩。
+// 空类型、二进制图片/视频/音频/字体等已压缩格式直接跳过。
+func shouldCompressContentType(ct string) bool {
+	ct = strings.ToLower(strings.TrimSpace(ct))
+	if ct == "" {
+		return false
+	}
+
+	// SVG 是文本格式，值得压缩；其余图片格式已是压缩格式
+	if strings.HasPrefix(ct, "image/") {
+		return strings.Contains(ct, "svg")
+	}
+	// 视频 / 音频 / 字体已是压缩格式
+	if strings.HasPrefix(ct, "video/") || strings.HasPrefix(ct, "audio/") ||
+		strings.HasPrefix(ct, "font/") {
+		return false
+	}
+	// 已知压缩或二进制格式
+	switch ct {
+	case "application/zip", "application/gzip", "application/x-7z-compressed",
+		"application/x-rar-compressed", "application/pdf",
+		"application/vnd.ms-fontobject", "application/wasm",
+		"application/octet-stream", "application/x-protobuf", "application/grpc":
+		return false
+	}
+	return true
+}
diff --git a/internal/route/indexnow_route_test.go b/internal/route/indexnow_route_test.go
new file mode 100644
index 0000000..0b1c3e6
--- /dev/null
+++ b/internal/route/indexnow_route_test.go
@@ -0,0 +1,63 @@
+package route
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/flamego/flamego"
+
+	"github.com/tamakyi/TamaBox/static"
+)
+
+// TestIndexNowKeyFileRoute 验证 IndexNow 密钥文件路由：能匹配含点号的路径段并返回 embed 内容，
+// 同时拒绝路径穿越与非法文件名。
+//
+// 背景：flamego 的 Static 中间件 Prefix 为 "/static"，不会接管 /index-now/，若缺少本路由，
+// 请求会落到 f.NotFound 被 302 重定向到首页，搜索引擎的密钥校验必然失败。
+func TestIndexNowKeyFileRoute(t *testing.T) {
+	f := flamego.NewWithLogger(io.Discard)
+	f.Get("/index-now/{key}", func(c flamego.Context) {
+		key := c.Param("key")
+		if !indexNowKeyPattern.MatchString(key) {
+			c.ResponseWriter().WriteHeader(http.StatusNotFound)
+			return
+		}
+		fs, err := static.FS.Open("index-now/" + key)
+		if err != nil {
+			c.ResponseWriter().WriteHeader(http.StatusNotFound)
+			return
+		}
+		defer func() { _ = fs.Close() }()
+		c.ResponseWriter().Header().Set("Content-Type", "text/plain; charset=utf-8")
+		_, _ = io.Copy(c.ResponseWriter(), fs)
+	})
+
+	cases := []struct {
+		path    string
+		want    int
+		wantKey bool
+	}{
+		{"/index-now/66e5e0911b0941f2ba7dbfbbd961e9be.txt", 200, true},
+		{"/index-now/..%2frobots.txt", 404, false},                          // 路径穿越（编码斜杠）
+		{"/index-now/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.txt", 404, false},     // 合法格式但文件不存在
+		{"/index-now/../../robots.txt", 404, false},                         // 路径穿越（原始）
+		{"/index-now/66e5e0911b0941f2ba7dbfbbd961e9be.txt.exe", 404, false}, // 后缀不符
+	}
+	for _, tc := range cases {
+		req := httptest.NewRequest(http.MethodGet, tc.path, nil)
+		w := httptest.NewRecorder()
+		f.ServeHTTP(w, req)
+		body := w.Body.String()
+		got := w.Code
+		if got != tc.want {
+			t.Errorf("%s -> status %d, want %d (body=%q)", tc.path, got, tc.want, body)
+			continue
+		}
+		if tc.wantKey && body != "66e5e0911b0941f2ba7dbfbbd961e9be" {
+			t.Errorf("%s -> body %q, want key content", tc.path, body)
+		}
+		t.Logf("%-56s -> %d %q", tc.path, got, body)
+	}
+}
diff --git a/internal/route/ipblacklist.go b/internal/route/ipblacklist.go
new file mode 100644
index 0000000..f683126
--- /dev/null
+++ b/internal/route/ipblacklist.go
@@ -0,0 +1,87 @@
+package route
+
+import (
+	"net"
+	"net/http"
+	"strings"
+
+	"github.com/flamego/flamego"
+	"github.com/sirupsen/logrus"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/shared"
+)
+
+// ipBlacklistMiddleware returns a Flamego handler that checks the client's IP
+// against a configurable blacklist. When a blacklisted IP is detected, the
+// request is redirected (HTTP 302) to the configured redirect URL.
+//
+// Supports exact IP matching and CIDR notation (e.g. "192.168.1.0/24").
+// The client IP is resolved by checking X-Real-IP, X-Forwarded-For, then
+// falling back to the raw RemoteAddr.
+func ipBlacklistMiddleware() flamego.Handler {
+	raw := strings.TrimSpace(conf.Security.IPBlacklist)
+	if raw == "" {
+		return func(ctx flamego.Context) {}
+	}
+
+	// Pre-parse all entries into exact IPs and CIDR networks.
+	type cidrEntry struct{ ipNet *net.IPNet }
+	exact := make(map[string]bool)
+	cidrs := make([]cidrEntry, 0)
+
+	for _, entry := range strings.Split(raw, ",") {
+		entry = strings.TrimSpace(entry)
+		if entry == "" {
+			continue
+		}
+		// Try CIDR first.
+		if _, ipNet, err := net.ParseCIDR(entry); err == nil {
+			cidrs = append(cidrs, cidrEntry{ipNet: ipNet})
+			logrus.Infof("IP blacklist: CIDR %s added", entry)
+			continue
+		}
+		// Fall back to exact IP.
+		if ip := net.ParseIP(entry); ip != nil {
+			exact[ip.String()] = true
+			logrus.Infof("IP blacklist: exact IP %s added", ip.String())
+			continue
+		}
+		logrus.Warnf("IP blacklist: skipping invalid entry %q", entry)
+	}
+
+	if len(exact) == 0 && len(cidrs) == 0 {
+		return func(ctx flamego.Context) {}
+	}
+
+	redirectURL := strings.TrimSpace(conf.Security.IPBlacklistRedirectURL)
+	if redirectURL == "" {
+		logrus.Warn("IP blacklist is configured but ip_blacklist_redirect_url is empty")
+	}
+
+	return func(ctx flamego.Context) {
+		clientIP := shared.ResolveClientIP(ctx.Request().Request)
+		if clientIP == "" {
+			return
+		}
+
+		// Exact match first (O(1)).
+		if exact[clientIP] {
+			logrus.WithField("ip", clientIP).Info("IP blacklist: exact match, redirecting")
+			ctx.Redirect(redirectURL, http.StatusFound)
+			return
+		}
+
+		// CIDR match (O(n), n is typically small).
+		parsed := net.ParseIP(clientIP)
+		if parsed != nil {
+			for _, e := range cidrs {
+				if e.ipNet.Contains(parsed) {
+					logrus.WithField("ip", clientIP).Infof("IP blacklist: CIDR %s match, redirecting", e.ipNet)
+					ctx.Redirect(redirectURL, http.StatusFound)
+					return
+				}
+			}
+		}
+	}
+}
diff --git a/internal/route/ratelimit.go b/internal/route/ratelimit.go
new file mode 100644
index 0000000..c27fe19
--- /dev/null
+++ b/internal/route/ratelimit.go
@@ -0,0 +1,183 @@
+package route
+
+import (
+	"fmt"
+	"net/http"
+	"sync"
+	"time"
+
+	"github.com/flamego/flamego"
+	"github.com/flamego/session"
+
+	"github.com/tamakyi/TamaBox/internal/shared"
+	"github.com/tamakyi/TamaBox/route/vote"
+)
+
+// rateLimiter provides a simple in-memory rate limiter using a sliding window.
+type rateLimiter struct {
+	mu       sync.Mutex
+	visitors map[string][]time.Time
+	limit    int
+	window   time.Duration
+}
+
+// ---------- 全局清理 ----------
+//
+// 所有 rateLimiter 实例注册到全局注册表，由单个常驻 goroutine 统一清理，
+// 避免每个中间件实例各自启动一个永久 goroutine（旧实现会随路由数量线性泄漏 goroutine）。
+
+var (
+	rateLimitersMu   sync.Mutex
+	rateLimiters     = make(map[*rateLimiter]struct{})
+	rateLimiterClean sync.Once
+)
+
+func registerRateLimiter(rl *rateLimiter) {
+	rateLimitersMu.Lock()
+	rateLimiters[rl] = struct{}{}
+	rateLimitersMu.Unlock()
+
+	// 仅启动一次全局清理循环
+	rateLimiterClean.Do(func() {
+		go func() {
+			for {
+				time.Sleep(5 * time.Minute)
+				rateLimitersMu.Lock()
+				for rl := range rateLimiters {
+					rl.cleanup()
+				}
+				rateLimitersMu.Unlock()
+			}
+		}()
+	})
+}
+
+func newRateLimiter(limit int, window time.Duration) *rateLimiter {
+	rl := &rateLimiter{
+		visitors: make(map[string][]time.Time),
+		limit:    limit,
+		window:   window,
+	}
+	registerRateLimiter(rl)
+	return rl
+}
+
+func (rl *rateLimiter) allow(ip string) bool {
+	rl.mu.Lock()
+	defer rl.mu.Unlock()
+
+	// 恶意伪造 X-Forwarded-For 可撑爆 visitors map，超过阈值时快速清理
+	// 窗口内无活动的 key（其最新时间戳已过期）
+	if len(rl.visitors) > 10000 {
+		cutoff2 := time.Now().Add(-rl.window)
+		for ip, ts := range rl.visitors {
+			if len(ts) == 0 || ts[len(ts)-1].Before(cutoff2) {
+				delete(rl.visitors, ip)
+			}
+		}
+	}
+
+	now := time.Now()
+	cutoff := now.Add(-rl.window)
+
+	times := rl.visitors[ip]
+	// Remove expired entries.
+	valid := times[:0]
+	for _, t := range times {
+		if t.After(cutoff) {
+			valid = append(valid, t)
+		}
+	}
+
+	if len(valid) >= rl.limit {
+		rl.visitors[ip] = valid
+		return false
+	}
+
+	valid = append(valid, now)
+	rl.visitors[ip] = valid
+	return true
+}
+
+func (rl *rateLimiter) cleanup() {
+	rl.mu.Lock()
+	defer rl.mu.Unlock()
+
+	cutoff := time.Now().Add(-rl.window)
+	for ip, times := range rl.visitors {
+		valid := times[:0]
+		for _, t := range times {
+			if t.After(cutoff) {
+				valid = append(valid, t)
+			}
+		}
+		if len(valid) == 0 {
+			delete(rl.visitors, ip)
+		} else {
+			rl.visitors[ip] = valid
+		}
+	}
+}
+
+// rateLimitMiddleware returns a Flamego handler that applies rate limiting.
+// limit: max requests per window; window: time window duration.
+//
+// 匿名 / 登录分级限流：登录用户（session 中存在 uid）使用 3 倍额度，
+// 未登录访客使用基础额度。分级使用独立限流器统计，互不污染。
+func rateLimitMiddleware(limit int, window time.Duration) flamego.Handler {
+	anonymousRL := newRateLimiter(limit, window)
+	loggedRL := newRateLimiter(limit*3, window)
+
+	return func(ctx flamego.Context, s session.Session) {
+		// 统一通过 shared.ResolveClientIP 解析，trust_proxy=false 时忽略伪造的代理头。
+		// 再经 shared.LimitKey 归一化：IPv4 原样，IPv6 聚合到 /64，
+		// 防止在单个 /64 内轮换海量地址绕过阈值（详见 LimitKey 注释）。
+		ip := shared.LimitKey(shared.ResolveClientIP(ctx.Request().Request))
+
+		rl := anonymousRL
+		if _, ok := s.Get("uid").(uint); ok {
+			rl = loggedRL
+		}
+
+		if !rl.allow(ip) {
+			ctx.ResponseWriter().WriteHeader(http.StatusTooManyRequests)
+			_, _ = ctx.ResponseWriter().Write([]byte("Too many requests. Please try again later."))
+			return
+		}
+	}
+}
+
+// voteSubmitRateLimitMiddleware 对投票提交同时执行两层限流：
+// 匿名身份层按 token 计数，IP 层使用更高阈值作为批量换 token 的风控兜底。
+// 这样共享公网出口的多个匿名浏览器不会共享低阈值，同时仍能限制异常突发流量。
+func voteSubmitRateLimitMiddleware(limit int, window time.Duration) flamego.Handler {
+	anonymousTokenRL := newRateLimiter(limit, window)
+	loggedUserRL := newRateLimiter(limit*3, window)
+	anonymousIPRL := newRateLimiter(limit*10, window)
+
+	tooMany := func(ctx flamego.Context) {
+		ctx.ResponseWriter().WriteHeader(http.StatusTooManyRequests)
+		_, _ = ctx.ResponseWriter().Write([]byte("Too many requests. Please try again later."))
+	}
+
+	return func(ctx flamego.Context, s session.Session) {
+		r := ctx.Request().Request
+		if uid, ok := s.Get("uid").(uint); ok && uid > 0 {
+			if !loggedUserRL.allow(fmt.Sprintf("user:%d", uid)) {
+				tooMany(ctx)
+			}
+			return
+		}
+
+		// 匿名请求始终经过高阈值 IP 兜底；共享出口下每个有效 token 仍独立计数。
+		// IP 键同样经 LimitKey 聚合，避免 IPv6 轮换绕过兜底阈值。
+		if !anonymousIPRL.allow("ip:" + shared.LimitKey(shared.ResolveClientIP(r))) {
+			tooMany(ctx)
+			return
+		}
+		key := vote.VoterTokenRateLimitKey(r)
+		if key != "" && !anonymousTokenRL.allow("token:"+key) {
+			tooMany(ctx)
+		}
+	}
+}
diff --git a/internal/route/ratelimit_test.go b/internal/route/ratelimit_test.go
new file mode 100644
index 0000000..81f84c3
--- /dev/null
+++ b/internal/route/ratelimit_test.go
@@ -0,0 +1,27 @@
+package route
+
+import (
+	"testing"
+	"time"
+)
+
+func TestVoteSubmitRateLimitKeysSeparateSharedIPUsers(t *testing.T) {
+	tokenRL := newRateLimiter(1, time.Minute)
+	ipRL := newRateLimiter(2, time.Minute)
+
+	// Two devices behind one public IP use different signed token keys.
+	if !tokenRL.allow("token:device-a") || !tokenRL.allow("token:device-b") {
+		t.Fatal("different voter tokens should have independent limits")
+	}
+	if tokenRL.allow("token:device-a") {
+		t.Fatal("the same voter token should be limited independently")
+	}
+
+	// The shared IP is only a high-threshold fallback, not a one-vote identity.
+	if !ipRL.allow("ip:203.0.113.10") || !ipRL.allow("ip:203.0.113.10") {
+		t.Fatal("shared IP should allow multiple normal submissions")
+	}
+	if ipRL.allow("ip:203.0.113.10") {
+		t.Fatal("IP fallback should still stop an abnormal burst")
+	}
+}
diff --git a/internal/route/route.go b/internal/route/route.go
new file mode 100644
index 0000000..5a2ab9a
--- /dev/null
+++ b/internal/route/route.go
@@ -0,0 +1,447 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package route
+
+import (
+	"encoding/gob"
+	"io"
+	"net/http"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/flamego/cache"
+	cacheRedis "github.com/flamego/cache/redis"
+	"github.com/flamego/csrf"
+	"github.com/flamego/flamego"
+	"github.com/flamego/recaptcha"
+	"github.com/flamego/session"
+	"github.com/flamego/session/mysql"
+	sessionRedis "github.com/flamego/session/redis"
+	"github.com/flamego/template"
+	"github.com/sirupsen/logrus"
+
+	"github.com/tamakyi/TamaBox/internal/captcha"
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/context"
+	"github.com/tamakyi/TamaBox/internal/form"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+	"github.com/tamakyi/TamaBox/internal/mail"
+	"github.com/tamakyi/TamaBox/internal/route/chat" // 私聊路由
+	"github.com/tamakyi/TamaBox/internal/security/autoban"
+	"github.com/tamakyi/TamaBox/internal/security/ipinfo"
+	"github.com/tamakyi/TamaBox/internal/shared"
+	templatepkg "github.com/tamakyi/TamaBox/internal/template"
+	"github.com/tamakyi/TamaBox/route"
+	"github.com/tamakyi/TamaBox/route/auth"
+	"github.com/tamakyi/TamaBox/route/pixel"
+	"github.com/tamakyi/TamaBox/route/question"
+	"github.com/tamakyi/TamaBox/route/service"
+	"github.com/tamakyi/TamaBox/route/user"
+	"github.com/tamakyi/TamaBox/route/vote"
+	"github.com/tamakyi/TamaBox/static"
+	"github.com/tamakyi/TamaBox/templates"
+)
+
+// indexNowKeyPattern 限制 IndexNow 密钥文件名的合法形态：32 位小写十六进制 + ".txt"。
+// 用于防止把路由参数直接拼进 embed FS 路径时发生路径穿越（如 "../robots.txt"）。
+var indexNowKeyPattern = regexp.MustCompile(`^[0-9a-f]{32}\.txt$`)
+
+// CSRFUserSessionKey 是 CSRF token 绑定的会话键，必须与登录时写入的会话键一致
+// （见 route/auth/login.go 中 ctx.Session.Set("uid", ...)）。flamego/csrf 默认使用
+// "userID"，若不与之对齐，token 的 id 恒为 "0"，任意匿名访客从公开页面取到的 token
+// 对全部已登录用户均有效，CSRF 退化为全站公开常量。
+//
+// 本常量同时被 csrf_binding_test.go 引用，作为单一事实来源：一旦被误改，回归测试会在
+// CI 失败，避免修复悄悄倒退。
+const CSRFUserSessionKey = "uid"
+
+// securityHeaders adds security-related HTTP headers to every response.
+func securityHeaders() flamego.Handler {
+	return func(ctx flamego.Context) {
+		w := ctx.ResponseWriter()
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+		w.Header().Set("X-Frame-Options", "DENY")
+		w.Header().Set("X-XSS-Protection", "1; mode=block")
+		w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
+		// HSTS：仅当站点以 https 对外提供服务时下发，避免 http 部署下把用户锁死在 https。
+		if strings.HasPrefix(conf.App.ExternalURL, "https") {
+			w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
+		}
+	}
+}
+
+func New() *flamego.Flame {
+	f := flamego.Classic()
+	if conf.App.Production {
+		flamego.SetEnv(flamego.EnvTypeProd)
+	}
+
+	// 自动封禁实例：整个请求链路共享同一个，供中间件与 f.NotFound 复用，
+	// 避免对业务性 302→/（语言切换、登出、投票不存在等）误判为路径扫描。
+	// 404 是否参与统计由 ban_track_notfound 控制（默认 false：正常业务一律放行，
+	// 仅敏感扫描路径计数封禁，见 conf.Security.BanTrackNotFound）。
+	ab := autoban.New(autoban.Options{
+		Enabled:            conf.Security.EnableAutoBan,
+		TrackNotFound:      conf.Security.BanTrackNotFound,
+		ThresholdSensitive: conf.Security.BanThresholdSensitive,
+		Threshold404:       conf.Security.BanThreshold404,
+		Window:             time.Duration(conf.Security.BanWindowSeconds) * time.Second,
+		Duration:           time.Duration(conf.Security.BanDurationMinutes) * time.Minute,
+		AlertEmail:         conf.Security.SecurityAlertEmail,
+		// 告警发送前先离线识别来源 IP 的网络归属（CDN/云厂商/WAF，零外部请求），
+		// 识别失败不影响告警发送（ipinfo.Lookup 内部已折叠错误）。
+		SendAlert: func(ip string, paths []string, durationMinutes int) error {
+			provider, proxied := ipinfo.Lookup(ip)
+			return mail.SendSecurityAlertMail(ip, provider, proxied, paths, durationMinutes)
+		},
+	})
+	// 需要输出详细日志时配置如下
+	// if conf.App.Production {
+	//   	flamego.SetEnv(flamego.EnvTypeProd)
+	// }
+
+	templateFS, err := template.EmbedFS(templates.FS, ".", []string{".html"})
+	if err != nil {
+		logrus.WithError(err).Fatal("Failed to embed templates file system")
+	}
+
+	gob.Register(time.Time{})
+	gob.Register(context.Flash{})
+	gob.Register(captcha.StoredAnswer{})
+	var sessionStorage interface{}
+	initer := session.MemoryIniter()
+	if conf.Database.DSN != "" {
+		initer = mysql.Initer()
+		sessionStorage = mysql.Config{
+			DSN:      conf.Database.DSN,
+			Lifetime: 7 * 24 * time.Hour,
+		}
+	}
+	if conf.Redis.Addr != "" {
+		initer = sessionRedis.Initer()
+		sessionStorage = sessionRedis.Config{
+			Options: &sessionRedis.Options{
+				Addr:     conf.Redis.Addr,
+				Password: conf.Redis.Password,
+				DB:       1,
+			},
+			Lifetime: 7 * 24 * time.Hour,
+		}
+	}
+	sessioner := session.Sessioner(session.Options{
+		Initer: initer,
+		Config: sessionStorage,
+		// 显式声明 cookie 安全属性，不依赖库默认值：
+		//   - HTTPOnly：禁止 JS 读取，降低 XSS 窃取会话的风险
+		//   - SameSite=Lax：阻断经典跨站表单 POST（CSRF 的主要防线之一）
+		//   - Secure：仅在站点以 https 对外服务时下发，避免 http 本地开发下 cookie 不生效。
+		//     缺失 Secure 时，HSTS 尚未落地的首次访问可被主动 MITM 诱导明文请求窃取会话。
+		Cookie: session.CookieOptions{
+			HTTPOnly: true,
+			SameSite: http.SameSiteLaxMode,
+			Secure:   strings.HasPrefix(conf.App.ExternalURL, "https"),
+		},
+	})
+
+	f.Use(flamego.Static(flamego.StaticOptions{
+		FileSystem: http.FS(static.FS),
+		Prefix:     "/static",
+		// 静态资源随二进制发布，内容变更需重新部署；1 天缓存是安全折中
+		CacheControl: func() string {
+			return "public, max-age=86400"
+		},
+	}))
+
+	f.Use(securityHeaders())
+	f.Use(ipBlacklistMiddleware())
+	f.Use(autobanMiddleware(ab))
+	// 全局请求体上限：必须在任何会读取 body 的中间件（尤其 Contexter 内的 CSRF 校验）
+	// 之前执行，否则超大 multipart 会在 Bind 的路由级限制生效前落盘临时文件耗尽磁盘。
+	f.Use(requestBodyLimitMiddleware())
+
+	reqUserSignOut := context.Toggle(&context.ToggleOptions{UserSignOutRequired: true})
+	reqUserSignIn := context.Toggle(&context.ToggleOptions{UserSignInRequired: true})
+
+	f.Group("", func() {
+		f.Get("/", route.Home)
+		f.Get("/pixel", reqUserSignIn, pixel.Index)
+		f.Get("/sponsor", route.Sponsor)
+		f.Get("/change-logs", route.ChangeLogs)
+		f.Get("/about-me", route.AboutMe)
+		f.Get("/robots.txt", func(c context.Context) {
+			fs, err := static.FS.Open("robots.txt")
+			if err != nil {
+				c.ResponseWriter().WriteHeader(404)
+				return
+			}
+			defer func() { _ = fs.Close() }()
+			c.ResponseWriter().Header().Set("Content-Type", "text/plain; charset=utf-8")
+			c.ResponseWriter().Header().Set("Cache-Control", "public, max-age=86400")
+			_, _ = io.Copy(c.ResponseWriter(), fs)
+		})
+		f.Get("/favicon.ico", func(c context.Context) {
+			fs, _ := static.FS.Open("favicon.ico")
+			defer func() { _ = fs.Close() }()
+			c.ResponseWriter().Header().Set("Content-Type", "image/x-icon")
+			c.ResponseWriter().Header().Set("Cache-Control", "public, max-age=86400")
+			_, _ = io.Copy(c.ResponseWriter(), fs)
+		})
+
+		f.Get("/sitemap.xml", func(c context.Context) {
+			fs, err := static.FS.Open("sitemap.xml")
+			if err != nil {
+				c.ResponseWriter().WriteHeader(404)
+				return
+			}
+			defer func() { _ = fs.Close() }()
+			c.ResponseWriter().Header().Set("Content-Type", "application/xml")
+			c.ResponseWriter().Header().Set("Content-Type", "text/xml; charset=utf-8")
+			c.ResponseWriter().Header().Set("Cache-Control", "public, max-age=86400")
+			_, _ = io.Copy(c.ResponseWriter(), fs)
+		})
+
+		f.Get("/llms.txt", func(c context.Context) {
+			fs, err := static.FS.Open("llms.txt")
+			if err != nil {
+				c.ResponseWriter().WriteHeader(404)
+				return
+			}
+			defer func() { _ = fs.Close() }()
+			c.ResponseWriter().Header().Set("Content-Type", "text/plain; charset=utf-8")
+			c.ResponseWriter().Header().Set("Cache-Control", "public, max-age=86400")
+			_, _ = io.Copy(c.ResponseWriter(), fs)
+		})
+
+		f.Get("/llms-full.txt", func(c context.Context) {
+			fs, err := static.FS.Open("llms-full.txt")
+			if err != nil {
+				c.ResponseWriter().WriteHeader(404)
+				return
+			}
+			defer func() { _ = fs.Close() }()
+			c.ResponseWriter().Header().Set("Content-Type", "text/plain; charset=utf-8")
+			c.ResponseWriter().Header().Set("Cache-Control", "public, max-age=86400")
+			_, _ = io.Copy(c.ResponseWriter(), fs)
+		})
+
+		// IndexNow 密钥文件：static/index-now/<32 位十六进制>.txt，供 Bing / Yandex / Seznam
+		// 等支持 IndexNow 的搜索引擎校验站点所有权（提交 URL 时的 keyLocation 指向此处）。
+		// ⚠️ flamego 的 Static 中间件 Prefix 为 "/static"，不会接管本路径，必须在此显式注册，
+		// 否则请求会落到 f.NotFound 被 302 重定向到首页，搜索引擎校验必然失败。
+		// 文件名用 indexNowKeyPattern 严格白名单校验，避免路径穿越读取 embed FS 内其它文件。
+		f.Get("/index-now/{key}", func(c context.Context) {
+			key := c.Param("key")
+			if !indexNowKeyPattern.MatchString(key) {
+				c.ResponseWriter().WriteHeader(http.StatusNotFound)
+				return
+			}
+			fs, err := static.FS.Open("index-now/" + key)
+			if err != nil {
+				c.ResponseWriter().WriteHeader(http.StatusNotFound)
+				return
+			}
+			defer func() { _ = fs.Close() }()
+			c.ResponseWriter().Header().Set("Content-Type", "text/plain; charset=utf-8")
+			c.ResponseWriter().Header().Set("Cache-Control", "public, max-age=86400")
+			_, _ = io.Copy(c.ResponseWriter(), fs)
+		})
+
+		f.Group("", func() {
+			f.Combo("/register").Get(auth.Register).Post(form.Bind(form.Register{}), rateLimitMiddleware(10, 1*time.Minute), auth.RegisterAction)
+			f.Combo("/login").Get(auth.Login).Post(form.Bind(form.Login{}), rateLimitMiddleware(20, 1*time.Minute), auth.LoginAction)
+			f.Combo("/forgot-password").Get(auth.ForgotPassword).Post(form.Bind(form.ForgotPassword{}), rateLimitMiddleware(5, 5*time.Minute), auth.ForgotPasswordAction)
+			f.Combo("/recover-password").Get(auth.RecoverPassword).Post(form.Bind(form.RecoverPassword{}), auth.RecoverPasswordAction)
+		}, reqUserSignOut)
+
+		// 页面密码验证路由（独立于密码保护中间件）；限流防爆破
+		f.Combo("/_/{domain}/password").Get(question.PasswordPage).Post(rateLimitMiddleware(10, 1*time.Minute), question.VerifyPagePassword)
+
+		// 独立的分享图路由（不经过 Pager 中间件，直接返回图片）
+		// 注意：仍挂载 question.Pager，页面设置了密码时必须先通过密码验证，
+		// 否则分享图会绕过页面密码保护（与单题分享图行为一致）。
+		f.Group("/_/{domain}", func() {
+			f.Get("/share-card", question.ShareCard)
+		}, question.Pager)
+
+		f.Group("/_/{domain}", func() {
+			f.Combo("").Get(question.List).Post(form.Bind(form.NewQuestion{}), rateLimitMiddleware(30, 1*time.Minute), question.New)
+			f.Group("/{questionID}", func() {
+				f.Get("", question.Item)
+				f.Get("/share-card", question.QuestionShareCard)
+				f.Post("/delete", question.Delete)
+				f.Post("/set-private", question.SetPrivate)
+				f.Post("/set-public", question.SetPublic)
+				f.Post("/pin", question.TogglePin)
+				f.Post("/read", question.SetRead)
+				f.Post("/unread", question.SetUnread)
+				f.Post("/answer", reqUserSignIn, form.Bind(form.PublishAnswerQuestion{}), question.PublishAnswer)
+				f.Post("/follow-up", form.Bind(form.PublishFollowUpQuestion{}), question.PublishFollowUp)
+				f.Post("/follow-up/{followUpID}/answer", reqUserSignIn, form.Bind(form.AnswerFollowUpQuestion{}), question.AnswerFollowUp)
+			}, question.Questioner)
+
+			// 新增：私聊路由（需要登录，使用 Token 标识对话）
+			f.Group("/chat/{token}", func() {
+				f.Get("", chat.ConversationPage)
+				f.Post("/send", rateLimitMiddleware(20, 1*time.Minute), chat.SendMessage)
+				f.Post("/delete", chat.DeleteConversation)
+				f.Post("/block", chat.ToggleBlockUser)
+			}, reqUserSignIn)
+		}, question.Pager) // Pager 中间件已内置页面密码检查
+
+		f.Get("/explore", user.Explore)
+
+		// 匿名投票参与端（公开）：token 链接入口
+		f.Group("/vote/{token}", func() {
+			f.Get("", vote.Page)
+			// 提交限流优先按登录用户/签名 vote_fp 计数，IP 仅作高阈值兜底，避免共享出口误伤。
+			f.Post("/submit", voteSubmitRateLimitMiddleware(20, 1*time.Minute), vote.Submit)
+		})
+
+		// 公开页语言切换：把语言偏好写入 session（由 session 中间件随其 cookie 一并持久化）
+		// 后跳回原页面。此前写独立 lang cookie 会被 session 中间件的 Set-Cookie 整体覆盖而失效，
+		// 故改为托管在 session 中。仅允许站内相对路径，防开放重定向。
+		f.Get("/i18n/{lang}", func(c context.Context) {
+			lang := i18n.Resolve(c.Param("lang"))
+			// 写入 session，避免被 session 中间件的 Set-Cookie 覆盖（匿名用户也走 session 中间件）。
+			c.Session.Set("lang", lang)
+			to := c.Query("to")
+			// 仅允许站内相对路径，防开放重定向：
+			// 拒绝空、非 "/" 开头、以 "//" 开头的协议相对路径，以及含反斜杠/控制字符的变体。
+			if to == "" || !strings.HasPrefix(to, "/") ||
+				strings.HasPrefix(to, "//") || strings.ContainsAny(to, "\\\x00\r\n\t") {
+				to = "/"
+			}
+			c.Redirect(to)
+		})
+
+		// 算数验证码 API（仅在 captcha_type = "math" 时生效，但路由本身不依赖中间件）
+		// 加限流：防止匿名脚本无限生成/轮询爆破（答案本身对客户端可见，限流是主要节流手段）。
+		f.Get("/api/captcha/generate", rateLimitMiddleware(20, 1*time.Minute), captcha.GenerateHandler)
+		f.Post("/api/captcha/verify", rateLimitMiddleware(20, 1*time.Minute), captcha.VerifyHandler)
+
+		f.Group("/user", func() {
+			f.Get("/questions", user.QuestionList)
+
+			// 匿名投票管理（箱主侧）
+			f.Group("/votes", func() {
+				f.Get("", user.VoteList)
+				f.Get("/new", user.VoteNew)
+				f.Post("", rateLimitMiddleware(10, 1*time.Minute), user.VoteCreate)
+				f.Get("/{voteID}/edit", user.VoteEdit)
+				f.Post("/{voteID}", rateLimitMiddleware(10, 1*time.Minute), user.VoteUpdate)
+				f.Post("/{voteID}/publish", user.VotePublish)
+				f.Post("/{voteID}/close", user.VoteClose)
+				f.Post("/{voteID}/delete", user.VoteDelete)
+				f.Get("/{voteID}/results", user.VoteResults)
+				f.Get("/{voteID}/preview", user.VotePreview)
+				// 导出为只读操作（幂等、无副作用），用 GET 链接下载，避免表单提交
+				f.Get("/{voteID}/export", user.VoteExportCSV)
+			})
+
+			f.Group("/profile", func() {
+				f.Get("", user.Profile)
+				f.Post("/update", form.Bind(form.UpdateProfile{}), rateLimitMiddleware(10, 1*time.Minute), user.UpdateProfile)
+				f.Post("/export", user.ExportProfile)
+				f.Post("/export-json", user.ExportProfileJSON)
+				f.Combo("/deactivate").Get(user.DeactivateProfile).Post(user.DeactivateProfileAction)
+
+				f.Post("/update-page-password", form.Bind(form.UpdatePagePassword{}), rateLimitMiddleware(10, 1*time.Minute), user.UpdatePagePassword)
+				f.Post("/update-ask-password", form.Bind(form.UpdateAskPassword{}), rateLimitMiddleware(10, 1*time.Minute), user.UpdateAskPassword)
+
+				f.Post("/update-chat-settings", user.UpdateChatSettings)
+
+				// 功能管理（提问 / 私聊 / 投票 的开关、定时开关与定量收集）：
+				// 不单独开页面，作为账号设置页的三个面板，保存后回跳到对应面板。
+				f.Group("/features", func() {
+					f.Post("/update", rateLimitMiddleware(20, 1*time.Minute), user.FeaturesUpdate)
+					f.Post("/reset-quota", rateLimitMiddleware(20, 1*time.Minute), user.FeatureResetQuota)
+				})
+			})
+			// 防骚扰设置：注册限制（harassment/update）与全局屏蔽词（blockwords/update）
+			// 拆为两个独立入口。屏蔽词在提问/私聊/投票三个设置面板共用一份，保存后经
+			// ?tab= 参数回跳到来源面板。
+			f.Post("/harassment/update", form.Bind(form.UpdateHarassment{}), user.UpdateHarassment)
+			f.Post("/blockwords/update", form.Bind(form.UpdateBlockWords{}), user.UpdateBlockWords)
+			f.Post("/tags/update", form.Bind(form.UpdateTags{}), user.UpdateTags)
+			// Logout 必须用 POST：GET 会留下 CSRF 风险（第三方图片/链接可触发退出登录）
+			f.Post("/logout", auth.Logout)
+		}, reqUserSignIn)
+
+		f.Group("/api/v1", func() {
+			f.Group("/user", func() {
+				f.Get("", reqUserSignIn, user.ProfileAPI)
+				f.Group("/{domain}", func() {
+					f.Group("/questions", func() {
+						f.Get("", rateLimitMiddleware(60, 1*time.Minute), question.ListAPI)
+					})
+				})
+			})
+			// 像素追踪代理：仅暴露只读 GET（f.Any 会放行写方法，曾有 CSRF 豁免 + 写方法放行的风险），
+			// 并加限流防止被用作高频打点通道。
+			f.Get("/pixel/{**}", reqUserSignIn, rateLimitMiddleware(30, 1*time.Minute), pixel.Proxy)
+			// 服务反代仅暴露只读 GET：本网关是把已登录用户的请求转发到配置好的内部服务，
+			// 不应允许任意写方法，避免被用作对内网后端的越权操作入口。
+			f.Get("/service/{**}", reqUserSignIn, service.Proxy)
+			f.Get("/explore/random", rateLimitMiddleware(60, 1*time.Minute), user.RandomRecommend)
+			// 首页"提问箱信息统计"公开接口（服务端 30 分钟缓存），供前端定时刷新
+			f.Get("/site-stats", rateLimitMiddleware(60, 1*time.Minute), route.SiteStatsAPI)
+		}, context.APIEndpoint)
+	},
+		cache.Cacher(cache.Options{
+			Initer: cacheRedis.Initer(),
+			Config: cacheRedis.Config{
+				Options: &cacheRedis.Options{
+					Addr:     conf.Redis.Addr,
+					Password: conf.Redis.Password,
+					DB:       0,
+				},
+			},
+		}),
+		recaptcha.V3(
+			recaptcha.Options{
+				Secret: conf.Recaptcha.ServerKey,
+				VerifyURL: func() recaptcha.VerifyURL {
+					if conf.Recaptcha.TurnstileStyle {
+						return "https://challenges.cloudflare.com/turnstile/v0/siteverify"
+					}
+					return recaptcha.VerifyURLGlobal
+				}(),
+			},
+		),
+		sessioner,
+		csrf.Csrfer(csrf.Options{
+			Secret: conf.Server.XSRFKey,
+			Header: "X-CSRF-Token",
+			// ⚠️ 必须与 route/auth/login.go 中 ctx.Session.Set("uid", ...) 的 key 一致。
+			// flamego/csrf 默认 SessionKey 为 "userID"，若不显式指定，s.Get("userID")
+			// 恒为 nil，token 内绑定的 id 恒为 "0" —— 由于校验是无状态 HMAC 重算
+			// （不与 session 中存储的 token 比对），这会导致任意匿名访客从公开的
+			// /login 页面取到的 token 对所有已登录用户均有效，CSRF 退化为全站公开常量。
+			// 回归测试见 route/csrf_binding_test.go（引用 CSRFUserSessionKey）。
+			SessionKey: CSRFUserSessionKey,
+		}),
+		template.Templater(template.Options{
+			FileSystem: templateFS,
+			FuncMaps:   templatepkg.FuncMap(),
+		}),
+		context.Contexter(),
+	)
+	f.NotFound(func(ctx flamego.Context) {
+		// 真正的 404 探测在此记录（仅此处，不把业务 302→/ 误判为扫描）。
+		// 注意：flamego 的 NotFound 会先写入 404 状态再 Redirect 到 "/"，
+		// 因此这里在 Redirect 之前记录，确保状态为 404。
+		// 键必须与 autobanMiddleware 中的 IsBanned/Record 保持一致（同样经 LimitKey 聚合），
+		// 否则 404 计数会记在另一个键上，导致封禁永不生效。
+		// ⚠️ 该 404 计数受 ban_track_notfound 配置控制，默认关闭（正常业务一律放行，
+		// 仅敏感扫描路径计数封禁）；Record 内部对未开启的 KindNotFound 直接忽略。
+		if ip := shared.LimitKey(shared.ResolveClientIP(ctx.Request().Request)); ip != "" {
+			ab.Record(ip, ctx.Request().URL.Path, autoban.KindNotFound)
+		}
+		ctx.Redirect("/")
+	})
+
+	return f
+}
diff --git a/internal/security/autoban/autoban.go b/internal/security/autoban/autoban.go
new file mode 100644
index 0000000..c970939
--- /dev/null
+++ b/internal/security/autoban/autoban.go
@@ -0,0 +1,298 @@
+// Package autoban 提供 fail2ban 风格的自动临时封禁：检测批量扫描/探测特征后
+// 临时封禁来源 IP，并可回调发送告警。纯标准库实现，便于独立测试与复用。
+package autoban
+
+import (
+	"strings"
+	"sync"
+	"time"
+)
+
+// 探测事件类型
+const (
+	KindNone      = 0 // 无探测特征
+	KindSensitive = 1 // 命中敏感路径
+	KindNotFound  = 2 // 404 响应（未命中敏感路径）
+)
+
+// 默认阈值/窗口（Options 未配置或为 0 时兜底）。
+const (
+	DefaultWindowSeconds      = 60
+	DefaultDurationMinutes    = 15
+	DefaultThresholdSensitive = 10
+	DefaultThreshold404       = 20
+	pathSampleMax             = 6
+)
+
+// Options 自动封禁配置。
+type Options struct {
+	Enabled bool
+	// TrackNotFound 是否把 KindNotFound（未注册路径的 404）计入封禁统计。
+	// 默认 false：正常业务路径一律放行，仅敏感扫描特征路径参与计数封禁，
+	// 避免共享出口下正常访问被 404 探测连坐误伤（详见 conf.Security.BanTrackNotFound）。
+	TrackNotFound      bool
+	ThresholdSensitive int                                                        // 窗口内敏感路径命中次数
+	Threshold404       int                                                        // 窗口内 404 次数
+	Window             time.Duration                                              // 统计窗口
+	Duration           time.Duration                                              // 封禁时长
+	AlertEmail         string                                                     // 告警收件人（留空不发送）
+	SendAlert          func(ip string, paths []string, durationMinutes int) error // 告警发送函数（nil 则不发送）
+}
+
+// sensitivePaths 常见后台/配置/漏洞探测路径特征（忽略大小写，完整段前缀匹配）。
+// 注意：前缀匹配抓不到 //xxx/wp-includes/wlwmanifest.xml 这类"目录枚举变体"（敏感段
+// 出现在路径中部），需要与 sensitiveFragments（任意位置子串）配合使用。
+var sensitivePaths = []string{
+	"/admin", "/wp-admin", "/wp-login.php", "/wp-content", "/wordpress",
+	"/administrator", "/manager", "/cpanel", "/plesk",
+	"/.env", "/.git", "/.aws", "/.ssh", "/.svn", "/.hg", "/.htaccess",
+	"/config", "/configuration", "/backup", "/database", "/db",
+	"/actuator", "/swagger", "/api-docs", "/openapi", "/v2/api-docs",
+	"/phpmyadmin", "/pma", "/mysql", "/server-status", "/server-info",
+	"/shell", "/webshell", "/cmd", "/eval", "/hack", "/shell.php",
+	"/login.php", "/admin.php", "/index.php", "/console", "/vendor",
+}
+
+// sensitiveFragments 任意位置命中即算敏感的"强指纹"（忽略大小写，子串匹配）。
+// 与 sensitivePaths 互补：捕获 /<枚举前缀>/wp-includes/wlwmanifest.xml、//wp/xmlrpc.php
+// 等前缀匹配失效的变体。仅收录业务 URL 空间（/、/_/、/user、/api/v1、/vote、/explore、
+// /i18n、/static…）绝不可能出现的 WordPress 特征，确保不误伤正常路径。
+var sensitiveFragments = []string{
+	"/wp-includes/", "/wp-json/", "/wp-cron.php", "/wp-trackback.php",
+	"/wp-admin", "/wp-content", "/wp-login.php", "/wlwmanifest.xml",
+	"/xmlrpc.php", "/wordpress",
+}
+
+type probeEvent struct {
+	at   time.Time
+	kind int
+}
+
+type probeStat struct {
+	events    []probeEvent
+	sensitive int
+	notFound  int
+	paths     []string // 命中路径样本（告警用）
+}
+
+// Banner 自动封禁器。方法并发安全。
+type Banner struct {
+	mu sync.Mutex
+
+	probes  map[string]*probeStat
+	banned  map[string]time.Time
+	alerted map[string]bool
+
+	thresholdSensitive int
+	threshold404       int
+	trackNotFound      bool
+	window             time.Duration
+	duration           time.Duration
+	alertEmail         string
+	sendAlert          func(ip string, paths []string, durationMinutes int) error
+	enabled            bool
+}
+
+// New 按配置创建封禁器并注册全局清理。
+func New(opts Options) *Banner {
+	window := opts.Window
+	if window <= 0 {
+		window = DefaultWindowSeconds * time.Second
+	}
+	duration := opts.Duration
+	if duration <= 0 {
+		duration = DefaultDurationMinutes * time.Minute
+	}
+	sensitive := opts.ThresholdSensitive
+	if sensitive <= 0 {
+		sensitive = DefaultThresholdSensitive
+	}
+	notFound := opts.Threshold404
+	if notFound <= 0 {
+		notFound = DefaultThreshold404
+	}
+	b := &Banner{
+		probes:             make(map[string]*probeStat),
+		banned:             make(map[string]time.Time),
+		alerted:            make(map[string]bool),
+		thresholdSensitive: sensitive,
+		threshold404:       notFound,
+		trackNotFound:      opts.TrackNotFound,
+		window:             window,
+		duration:           duration,
+		alertEmail:         strings.TrimSpace(opts.AlertEmail),
+		sendAlert:          opts.SendAlert,
+		enabled:            opts.Enabled,
+	}
+	register(b)
+	return b
+}
+
+// Record 记录一次探测事件，达到阈值时封禁 IP 并触发一次告警。
+func (b *Banner) Record(ip, path string, kind int) {
+	if !b.enabled || ip == "" || kind == KindNone {
+		return
+	}
+	// 404 计数默认关闭（正常业务路径一律放行，仅敏感扫描特征参与封禁）：
+	// 只有显式开启 TrackNotFound 时才把未注册路径的 404 计入统计。
+	if kind == KindNotFound && !b.trackNotFound {
+		return
+	}
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	now := time.Now()
+	cutoff := now.Add(-b.window)
+
+	st := b.probes[ip]
+	if st == nil {
+		st = &probeStat{}
+		b.probes[ip] = st
+	}
+
+	// 滚动清理过期事件并重算计数
+	valid := st.events[:0]
+	sensitive, notFound := 0, 0
+	for _, e := range st.events {
+		if e.at.After(cutoff) {
+			valid = append(valid, e)
+			if e.kind == KindSensitive {
+				sensitive++
+			} else if e.kind == KindNotFound {
+				notFound++
+			}
+		}
+	}
+	valid = append(valid, probeEvent{at: now, kind: kind})
+	if kind == KindSensitive {
+		sensitive++
+	} else {
+		notFound++
+	}
+	st.events = valid
+	st.sensitive = sensitive
+	st.notFound = notFound
+	if len(st.paths) < pathSampleMax && path != "" {
+		st.paths = append(st.paths, path)
+	}
+
+	if sensitive < b.thresholdSensitive && notFound < b.threshold404 {
+		return
+	}
+
+	// 已达阈值：封禁（已在封禁中则跳过）
+	if until, ok := b.banned[ip]; ok && until.After(now) {
+		return
+	}
+	until := now.Add(b.duration)
+	b.banned[ip] = until
+
+	// 告警（每 IP 仅一次）
+	if b.alertEmail != "" && b.sendAlert != nil && !b.alerted[ip] {
+		b.alerted[ip] = true
+		sample := append([]string{}, st.paths...)
+		dur := int(b.duration.Minutes())
+		go func() {
+			_ = b.sendAlert(ip, sample, dur)
+		}()
+	}
+}
+
+// IsBanned 判断 IP 是否处于封禁期；到期自动解除。
+func (b *Banner) IsBanned(ip string) bool {
+	if !b.enabled || ip == "" {
+		return false
+	}
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if until, ok := b.banned[ip]; ok {
+		if until.After(time.Now()) {
+			return true
+		}
+		delete(b.banned, ip)
+	}
+	return false
+}
+
+// IsSensitivePath 判断路径是否命中敏感探测特征（忽略大小写）。
+// 命中条件：① 与 sensitivePaths 完整段前缀匹配（/admin、/.env 等）；
+// ② 包含 sensitiveFragments 强指纹子串（wp-includes/xmlrpc.php 等 WordPress 探测面，
+//
+//	覆盖 // 双斜杠与目录枚举变体）。
+func IsSensitivePath(p string) bool {
+	lower := strings.ToLower(p)
+	for _, s := range sensitivePaths {
+		if lower == s || strings.HasPrefix(lower, s+"/") {
+			return true
+		}
+	}
+	for _, f := range sensitiveFragments {
+		if strings.Contains(lower, f) {
+			return true
+		}
+	}
+	return false
+}
+
+// ---------- 全局注册与清理 ----------
+
+var (
+	bannersMu   sync.Mutex
+	banners     = make(map[*Banner]struct{})
+	bannersOnce sync.Once
+)
+
+func register(b *Banner) {
+	bannersMu.Lock()
+	banners[b] = struct{}{}
+	bannersMu.Unlock()
+
+	bannersOnce.Do(func() {
+		go func() {
+			for {
+				time.Sleep(2 * time.Minute)
+				bannersMu.Lock()
+				for b := range banners {
+					b.cleanup()
+				}
+				bannersMu.Unlock()
+			}
+		}()
+	})
+}
+
+// cleanup 定期清理过期探测记录与已到期封禁（防止内存膨胀）。
+func (b *Banner) cleanup() {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	now := time.Now()
+	cutoff := now.Add(-b.window)
+
+	for ip, st := range b.probes {
+		if len(st.events) == 0 || st.events[len(st.events)-1].at.Before(cutoff) {
+			delete(b.probes, ip)
+			continue
+		}
+		valid := st.events[:0]
+		sensitive, notFound := 0, 0
+		for _, e := range st.events {
+			if e.at.After(cutoff) {
+				valid = append(valid, e)
+				if e.kind == KindSensitive {
+					sensitive++
+				} else if e.kind == KindNotFound {
+					notFound++
+				}
+			}
+		}
+		st.events = valid
+		st.sensitive = sensitive
+		st.notFound = notFound
+	}
+	for ip, until := range b.banned {
+		if !until.After(now) {
+			delete(b.banned, ip)
+		}
+	}
+}
diff --git a/internal/security/autoban/autoban_test.go b/internal/security/autoban/autoban_test.go
new file mode 100644
index 0000000..490bf0c
--- /dev/null
+++ b/internal/security/autoban/autoban_test.go
@@ -0,0 +1,157 @@
+package autoban
+
+import (
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func newTestBanner(thresholdSensitive, threshold404 int, window, duration time.Duration, alertEmail string, alertCalls *int64) *Banner {
+	return New(Options{
+		Enabled:            true,
+		TrackNotFound:      true, // 测试 helper 显式开启 404 跟踪，覆盖两种计数的既有用例
+		ThresholdSensitive: thresholdSensitive,
+		Threshold404:       threshold404,
+		Window:             window,
+		Duration:           duration,
+		AlertEmail:         alertEmail,
+		SendAlert: func(ip string, paths []string, dur int) error {
+			if alertCalls != nil {
+				atomic.AddInt64(alertCalls, 1)
+			}
+			return nil
+		},
+	})
+}
+
+func TestSensitiveThreshold(t *testing.T) {
+	b := newTestBanner(2, 5, time.Minute, time.Minute, "", nil)
+	b.Record("1.2.3.4", "/admin", KindSensitive)
+	if b.IsBanned("1.2.3.4") {
+		t.Fatal("should not be banned before reaching threshold")
+	}
+	b.Record("1.2.3.4", "/.env", KindSensitive)
+	if !b.IsBanned("1.2.3.4") {
+		t.Fatal("expected ban after reaching sensitive threshold")
+	}
+}
+
+func TestNotFoundThreshold(t *testing.T) {
+	b := newTestBanner(10, 3, time.Minute, time.Minute, "", nil)
+	for i := 0; i < 3; i++ {
+		b.Record("5.6.7.8", "/random-"+string(rune('a'+i)), KindNotFound)
+	}
+	if !b.IsBanned("5.6.7.8") {
+		t.Fatal("expected ban after reaching 404 threshold")
+	}
+}
+
+func TestNotFoundTrackDisabledByDefault(t *testing.T) {
+	// 默认（TrackNotFound=false）下 404 不参与统计：正常业务路径一律放行，
+	// 仅敏感扫描路径仍计数封禁——防止共享出口下正常访问被 404 探测连坐误伤。
+	b := New(Options{Enabled: true, ThresholdSensitive: 1, Threshold404: 1, Window: time.Minute, Duration: time.Minute})
+	for i := 0; i < 5; i++ {
+		b.Record("7.7.7.7", "/random-"+string(rune('a'+i)), KindNotFound)
+	}
+	if b.IsBanned("7.7.7.7") {
+		t.Fatal("404 events must not accumulate when TrackNotFound is false")
+	}
+	b.Record("7.7.7.7", "/.env", KindSensitive)
+	if !b.IsBanned("7.7.7.7") {
+		t.Fatal("sensitive events must still ban even when 404 tracking is off")
+	}
+}
+
+func TestWindowExpiry(t *testing.T) {
+	b := newTestBanner(2, 5, 50*time.Millisecond, time.Minute, "", nil)
+	b.Record("1.1.1.1", "/admin", KindSensitive)
+	time.Sleep(80 * time.Millisecond) // 事件滑出窗口
+	b.Record("1.1.1.1", "/.env", KindSensitive)
+	if b.IsBanned("1.1.1.1") {
+		t.Fatal("events outside the window must not accumulate")
+	}
+}
+
+func TestDurationExpiry(t *testing.T) {
+	b := newTestBanner(1, 5, time.Minute, 60*time.Millisecond, "", nil)
+	b.Record("2.2.2.2", "/admin", KindSensitive)
+	if !b.IsBanned("2.2.2.2") {
+		t.Fatal("expected ban")
+	}
+	time.Sleep(100 * time.Millisecond) // 封禁到期
+	if b.IsBanned("2.2.2.2") {
+		t.Fatal("ban should expire after duration")
+	}
+}
+
+func TestAlertOncePerIP(t *testing.T) {
+	var calls int64
+	b := newTestBanner(1, 5, time.Minute, time.Minute, "admin@example.com", &calls)
+	b.Record("9.9.9.9", "/wp-admin", KindSensitive)
+	b.Record("9.9.9.9", "/.git", KindSensitive) // 已在封禁中，不应重复告警
+	b.Record("9.9.9.9", "/config", KindSensitive)
+
+	// sendAlert 异步调用，轮询等待最多 500ms
+	deadline := time.Now().Add(500 * time.Millisecond)
+	for atomic.LoadInt64(&calls) == 0 && time.Now().Before(deadline) {
+		time.Sleep(10 * time.Millisecond)
+	}
+	if got := atomic.LoadInt64(&calls); got != 1 {
+		t.Fatalf("expected exactly 1 alert, got %d", got)
+	}
+}
+
+func TestDisabled(t *testing.T) {
+	b := New(Options{Enabled: false})
+	b.Record("3.3.3.3", "/admin", KindSensitive)
+	if b.IsBanned("3.3.3.3") {
+		t.Fatal("disabled auto-ban must not ban")
+	}
+}
+
+func TestDefaults(t *testing.T) {
+	b := New(Options{Enabled: true}) // 全部走默认值
+	if b.thresholdSensitive != DefaultThresholdSensitive || b.threshold404 != DefaultThreshold404 {
+		t.Fatalf("default thresholds wrong: %d/%d", b.thresholdSensitive, b.threshold404)
+	}
+	if b.window != DefaultWindowSeconds*time.Second || b.duration != DefaultDurationMinutes*time.Minute {
+		t.Fatalf("default window/duration wrong: %v/%v", b.window, b.duration)
+	}
+	if b.trackNotFound {
+		t.Fatal("404 tracking must be disabled by default")
+	}
+}
+
+func TestIsSensitivePath(t *testing.T) {
+	cases := []struct {
+		path string
+		want bool
+	}{
+		{"/admin", true},
+		{"/admin/panel", true},
+		{"/WP-ADMIN", true},
+		{"/.env", true},
+		{"/user/questions", false},
+		{"/vote/abc123", false},
+		{"/administratorx", false}, // 前缀必须完整段匹配，避免误伤
+		// 目录枚举 / 双斜杠变体（wlwmanifest 扫描）：前缀匹配漏网，片段匹配兜底
+		{"//wp/wp-includes/wlwmanifest.xml", true},
+		{"//news/wp-includes/wlwmanifest.xml", true},
+		{"//2018/wp-includes/wlwmanifest.xml", true},
+		{"//shop/wp-includes/wlwmanifest.xml", true},
+		{"//test/xmlrpc.php", true},
+		{"/blog/wp-json/", true},
+		{"/wp-content/uploads/evil.php", true},
+		// 业务路径不得被片段匹配误伤
+		{"/_/tamakyi", false},
+		{"/_/admin6", false},
+		{"/api/v1/question/abc123", false},
+		{"/explore/tags/golang", false},
+		{"/i18n/zh-CN", false},
+	}
+	for _, c := range cases {
+		if got := IsSensitivePath(c.path); got != c.want {
+			t.Errorf("IsSensitivePath(%q) = %v, want %v", c.path, got, c.want)
+		}
+	}
+}
diff --git a/internal/security/censor/aliyun.go b/internal/security/censor/aliyun.go
new file mode 100644
index 0000000..c86154f
--- /dev/null
+++ b/internal/security/censor/aliyun.go
@@ -0,0 +1,194 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package censor
+
+import (
+	"context"
+	"encoding/json"
+	"sync"
+	"time"
+
+	"github.com/aliyun/alibaba-cloud-sdk-go/services/green"
+	"github.com/pkg/errors"
+)
+
+type AliyunTextCensor struct {
+	accessKey, accessKeySecret string
+}
+
+func NewAliyunTextCensor(accessKey, accessKeySecret string) *AliyunTextCensor {
+	return &AliyunTextCensor{
+		accessKey:       accessKey,
+		accessKeySecret: accessKeySecret,
+	}
+}
+
+// 包级复用的 green.Client：审核请求高频且密钥在启动后不变，
+// 用 sync.Once 懒加载一次并设置超时，避免每次审核都重建连接与对象。
+var (
+	aliyunGreenOnce   sync.Once
+	aliyunGreenClient *green.Client
+	aliyunGreenErr    error
+)
+
+func (c *AliyunTextCensor) getClient() (*green.Client, error) {
+	aliyunGreenOnce.Do(func() {
+		aliyunGreenClient, aliyunGreenErr = green.NewClientWithAccessKey("cn-shanghai", c.accessKey, c.accessKeySecret)
+		if aliyunGreenErr == nil {
+			aliyunGreenClient.SetConnectTimeout(5 * time.Second)
+			aliyunGreenClient.SetReadTimeout(10 * time.Second)
+		}
+	})
+	return aliyunGreenClient, aliyunGreenErr
+}
+
+type AliyunTextCensorResponse struct {
+	Code int `json:"code"`
+	Data []struct {
+		Code            int    `json:"code"`
+		Content         string `json:"content"`
+		FilteredContent string `json:"filteredContent"`
+		Msg             string `json:"msg"`
+		Results         []struct {
+			Details []struct {
+				Contexts []struct {
+					Context   string `json:"context"`
+					Positions []struct {
+						EndPos   int `json:"endPos"`
+						StartPos int `json:"startPos"`
+					} `json:"positions"`
+				} `json:"contexts"`
+				Label string `json:"label"`
+			} `json:"details"`
+			Label      string  `json:"label"`
+			Rate       float64 `json:"rate"`
+			Scene      string  `json:"scene"`
+			Suggestion string  `json:"suggestion"`
+		} `json:"results"`
+		TaskId string `json:"taskId"`
+	} `json:"data"`
+	Msg       string `json:"msg"`
+	RequestId string `json:"requestId"`
+}
+
+func (r *AliyunTextCensorResponse) IsPass() bool {
+	if len(r.Data) == 0 || len(r.Data[0].Results) == 0 {
+		return false
+	}
+
+	// ⚠️ Right now, we allow `review` and `pass` to pass the censor.
+	// 任一 scene 判定为 block 即不通过（此前只检查首个 result，存在漏审）。
+	for _, result := range r.Data[0].Results {
+		if result.Suggestion == "block" {
+			return false
+		}
+	}
+	return true
+}
+
+// Censor censors text with Aliyun API.
+// https://developer.qiniu.com/censor/7260/api-text-censor
+func (c *AliyunTextCensor) Censor(_ context.Context, text string) (*TextCensorResponse, error) {
+	client, err := c.getClient()
+	if err != nil {
+		return nil, errors.Wrap(err, "new client with access key")
+	}
+
+	content, err := json.Marshal(
+		map[string]interface{}{
+			"scenes": []string{"antispam"},
+			"tasks": []map[string]interface{}{
+				{"content": text},
+			},
+		},
+	)
+	if err != nil {
+		return nil, errors.Wrap(err, "marshal content")
+	}
+
+	req := green.CreateTextScanRequest()
+	req.SetContent(content)
+	resp, err := client.TextScan(req)
+	if err != nil {
+		return nil, errors.Wrap(err, "text scan")
+	}
+
+	if !resp.IsSuccess() {
+		return nil, errors.New("response is not success")
+	}
+
+	return AliyunTextCensorParser(resp.GetHttpContentBytes())
+}
+
+func (*AliyunTextCensor) String() string {
+	return "aliyun"
+}
+
+func AliyunTextCensorParser(raw []byte) (*TextCensorResponse, error) {
+	var responseJSON AliyunTextCensorResponse
+	if err := json.Unmarshal(raw, &responseJSON); err != nil {
+		return nil, errors.Wrap(err, "unmarshal response")
+	}
+
+	if len(responseJSON.Data) == 0 {
+		return nil, errors.New("response data is empty")
+	}
+
+	var hint string
+	var label string
+	var confidence float64
+	for _, result := range responseJSON.Data[0].Results {
+		if result.Label == "normal" {
+			continue
+		}
+
+		// Get the first context as the hint, forbidden type, confidence.
+		for _, detail := range result.Details {
+			for _, context := range detail.Contexts {
+				hint = context.Context
+			}
+		}
+
+		label = result.Label
+		confidence = result.Rate
+		break
+	}
+
+	return &TextCensorResponse{
+		SourceName:    "aliyun",
+		Pass:          responseJSON.IsPass(),
+		ForbiddenType: formatAliyunForbiddenType(label),
+		Hint:          hint,
+		Confidence:    confidence,
+		RawResponse:   raw,
+	}, nil
+}
+
+func formatAliyunForbiddenType(typ string) ForbiddenType {
+	switch typ {
+	case "spam":
+		return ForbiddenTypeSpam
+	case "ad":
+		return ForbiddenTypeAd
+	case "politics":
+		return ForbiddenTypePolitics
+	case "terrorism":
+		return ForbiddenTypeTerrorism
+	case "abuse":
+		return ForbiddenTypeAbuse
+	case "porn":
+		return ForbiddenTypePorn
+	case "flood":
+		return ForbiddenTypeFlood
+	case "contraband":
+		return ForbiddenTypeContraband
+	case "meaningless":
+		return ForbiddenTypeMeaningless
+	case "harmful":
+		return ForbiddenTypeHarmful
+	default:
+		return ""
+	}
+}
diff --git a/internal/security/censor/censor.go b/internal/security/censor/censor.go
new file mode 100644
index 0000000..d6b5cc4
--- /dev/null
+++ b/internal/security/censor/censor.go
@@ -0,0 +1,96 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package censor
+
+import (
+	"context"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/db"
+)
+
+var (
+	censorCacheNoMoreThan = 31 * 24 * time.Hour // 1 month
+)
+
+// Text checks the text for sensitive content.
+// It will save the censor log to the database and invoke the callback function.
+func Text(ctx context.Context, text string) (*TextCensorResponse, error) {
+	if !conf.Security.EnableTextCensor {
+		return &TextCensorResponse{Pass: true}, nil
+	}
+
+	var responses []*TextCensorResponse
+
+	for _, censor := range []TextCensor{
+		//No, we need to use qiniu's API.
+		NewQiniuTextCensor(conf.App.QiniuAccessKey, conf.App.QiniuAccessSecret),
+		NewAliyunTextCensor(conf.App.AliyunAccessKey, conf.App.AliyunAccessKeySecret),
+	} {
+		sourceName := censor.String()
+
+		// Try to get the censor from the database log.
+		censorLog, err := db.CensorLogs.GetByText(ctx, sourceName, text, time.Now().Add(-censorCacheNoMoreThan))
+		if err != nil {
+			if !errors.Is(err, db.ErrCensorLogsNotFound) {
+				logrus.WithContext(ctx).WithError(err).Error("Failed to get censor log")
+			}
+		} else {
+			raw := censorLog.RawResponse
+			// We got the previous censor log cache, seems like we saved money for the API call.
+			switch censorLog.SourceName {
+			case "qiniu":
+				// HACK: Qiniu's API response is not accurate, so we need to check the text again with aliyun API.
+				response, err := QiniuTextCensorParser(raw)
+				if err == nil {
+					if response.Pass {
+						return response, nil
+					}
+
+					responses = append(responses, response) // If the text is not passed, we need to check it with aliyun API.
+					continue
+				}
+
+			case "aliyun":
+				return AliyunTextCensorParser(raw)
+
+			default:
+				logrus.WithContext(ctx).WithField("censor_source", censorLog.SourceName).Error("Unknown censor source")
+			}
+		}
+
+		// response, err := censor.Censor(ctx, text)
+                censorText := RemoveTrustedURL(text)
+                response, err := censor.Censor(ctx, censorText)
+		if err != nil {
+			logrus.WithContext(ctx).WithError(err).WithField("censor_source", sourceName).Error("Failed to censor text")
+			continue
+		}
+		responses = append(responses, response)
+
+		// Save the censor log to the database.
+		if err := db.CensorLogs.Create(ctx, db.CreateCensorLogOptions{
+			SourceName:  sourceName,
+			Input:       text,
+			Pass:        response.Pass,
+			RawResponse: response.RawResponse,
+		}); err != nil {
+			logrus.WithContext(ctx).WithError(err).Error("Failed to save censor log")
+		}
+
+		if response.Pass {
+			return response, nil
+		}
+	}
+
+	if len(responses) == 0 {
+		return nil, errors.New("no censor source available")
+	}
+	return responses[len(responses)-1], nil
+}
diff --git a/internal/security/censor/qiniu.go b/internal/security/censor/qiniu.go
new file mode 100644
index 0000000..22e876c
--- /dev/null
+++ b/internal/security/censor/qiniu.go
@@ -0,0 +1,178 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package censor
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/qiniu/go-sdk/v7/auth"
+	"github.com/samber/lo"
+)
+
+type QiniuTextCensor struct {
+	accessKey, accessSecret string
+}
+
+func NewQiniuTextCensor(accessKey, accessSecret string) *QiniuTextCensor {
+	return &QiniuTextCensor{
+		accessKey:    accessKey,
+		accessSecret: accessSecret,
+	}
+}
+
+type QiniuTextCensorResponse struct {
+	Code    int    `json:"code"`
+	Message string `json:"message"`
+	Result  struct {
+		Suggestion string `json:"suggestion"`
+		Scenes     struct {
+			Antispam struct {
+				Suggestion string `json:"suggestion"`
+				Details    []struct {
+					Label    string  `json:"label"`
+					Score    float64 `json:"score"`
+					Contexts []struct {
+						Context   string `json:"context"`
+						Positions []struct {
+							StartPos int `json:"startPos"`
+							EndPos   int `json:"endPos"`
+						} `json:"positions"`
+					} `json:"contexts"`
+				} `json:"details"`
+			} `json:"antispam"`
+		} `json:"scenes"`
+	} `json:"result"`
+}
+
+func (r *QiniuTextCensorResponse) IsPass() bool {
+	for _, detail := range r.Result.Scenes.Antispam.Details {
+		label := detail.Label
+
+		// These are absolutely not allowed to display to users.
+		blockedLabels := []string{"politics", "terrorism", "porn"}
+		if lo.Contains(blockedLabels, label) {
+			return false
+		}
+	}
+
+	// ⚠️ Right now, we allow `review` and `pass` to pass the censor.
+	return r.Result.Scenes.Antispam.Suggestion != "block"
+}
+
+// Censor censors text with Qiniu API.
+// https://developer.qiniu.com/censor/7260/api-text-censor
+func (c *QiniuTextCensor) Censor(ctx context.Context, text string) (*TextCensorResponse, error) {
+	var bodyBuffer bytes.Buffer
+	if err := json.NewEncoder(&bodyBuffer).Encode(map[string]interface{}{
+		"data": map[string]interface{}{
+			"text": text,
+		},
+		"params": map[string]interface{}{
+			"scenes": []string{"antispam"},
+		},
+	}); err != nil {
+		return nil, errors.Wrap(err, "encode request body")
+	}
+
+	request, err := http.NewRequest(http.MethodPost, "https://ai.qiniuapi.com/v3/text/censor", &bodyBuffer)
+	if err != nil {
+		return nil, errors.Wrap(err, "new request")
+	}
+	request = request.WithContext(ctx)
+
+	credentials := auth.New(c.accessKey, c.accessSecret)
+	token, err := credentials.SignRequestV2(request)
+	if err != nil {
+		return nil, errors.Wrap(err, "sign request")
+	}
+	request.Header.Set("Authorization", "Qiniu "+token)
+
+	// 带超时：避免七牛审核服务无响应时请求永久挂起，拖垮提问/回答流程
+	client := http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(request)
+	if err != nil {
+		return nil, errors.Wrap(err, "do request")
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	bodyBytes, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, errors.Wrap(err, "read body")
+	}
+
+	if resp.StatusCode/100 != 2 {
+		return nil, errors.Errorf("unexpected error code: %d, response body: %s", resp.StatusCode, string(bodyBytes))
+	}
+
+	return QiniuTextCensorParser(bodyBytes)
+}
+
+func (*QiniuTextCensor) String() string {
+	return "qiniu"
+}
+
+func QiniuTextCensorParser(raw []byte) (*TextCensorResponse, error) {
+	var responseJSON QiniuTextCensorResponse
+	if err := json.Unmarshal(raw, &responseJSON); err != nil {
+		return nil, errors.Wrap(err, "decode response body")
+	}
+
+	var hint string
+	var detailKey string
+	var confidence float64
+	for _, detail := range responseJSON.Result.Scenes.Antispam.Details {
+		if detail.Label == "normal" {
+			continue
+		}
+
+		// Get the first context as the hint, forbidden type, confidence.
+		for _, context := range detail.Contexts {
+			hint = context.Context
+		}
+		detailKey = detail.Label
+		confidence = detail.Score
+		break
+	}
+
+	return &TextCensorResponse{
+		SourceName:    "qiniu",
+		Pass:          responseJSON.IsPass(),
+		ForbiddenType: formatQiniuForbiddenType(detailKey),
+		Hint:          hint,
+		Confidence:    confidence,
+		RawResponse:   raw,
+	}, nil
+}
+
+func formatQiniuForbiddenType(typ string) ForbiddenType {
+	switch typ {
+	case "spam":
+		return ForbiddenTypeSpam
+	case "ad":
+		return ForbiddenTypeAd
+	case "politics":
+		return ForbiddenTypePolitics
+	case "terrorism":
+		return ForbiddenTypeTerrorism
+	case "abuse":
+		return ForbiddenTypeAbuse
+	case "porn":
+		return ForbiddenTypePorn
+	case "flood":
+		return ForbiddenTypeFlood
+	case "contraband":
+		return ForbiddenTypeContraband
+	case "meaningless":
+		return ForbiddenTypeMeaningless
+	default:
+		return ""
+	}
+}
diff --git a/internal/security/censor/text.go b/internal/security/censor/text.go
new file mode 100644
index 0000000..b4ebb6a
--- /dev/null
+++ b/internal/security/censor/text.go
@@ -0,0 +1,121 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package censor
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"strings"
+)
+
+type ForbiddenType string
+
+const (
+	ForbiddenTypeSpam        ForbiddenType = "spam"
+	ForbiddenTypeAd          ForbiddenType = "ad"
+	ForbiddenTypePolitics    ForbiddenType = "politics"
+	ForbiddenTypeTerrorism   ForbiddenType = "terrorism"
+	ForbiddenTypeAbuse       ForbiddenType = "abuse"
+	ForbiddenTypePorn        ForbiddenType = "porn"
+	ForbiddenTypeFlood       ForbiddenType = "flood"
+	ForbiddenTypeContraband  ForbiddenType = "contraband"
+	ForbiddenTypeMeaningless ForbiddenType = "meaningless"
+	ForbiddenTypeHarmful     ForbiddenType = "harmful"
+)
+
+func (f ForbiddenType) String() string {
+	return map[ForbiddenType]string{
+		ForbiddenTypeSpam:        "含垃圾信息",
+		ForbiddenTypeAd:          "广告",
+		ForbiddenTypePolitics:    "涉政",
+		ForbiddenTypeTerrorism:   "暴恐",
+		ForbiddenTypeAbuse:       "辱骂",
+		ForbiddenTypePorn:        "色情",
+		ForbiddenTypeFlood:       "灌水",
+		ForbiddenTypeContraband:  "违禁",
+		ForbiddenTypeMeaningless: "无意义",
+		ForbiddenTypeHarmful:     "不良场景",
+	}[f]
+}
+
+type TextCensorResponse struct {
+	SourceName    string          `json:"source_name"`
+	Pass          bool            `json:"pass"`
+	ForbiddenType ForbiddenType   `json:"forbidden_type"`
+	Hint          string          `json:"hint"`
+	Confidence    float64         `json:"confidence"`
+	RawResponse   json.RawMessage `json:"raw_response"`
+}
+
+func (r *TextCensorResponse) ToJSON() []byte {
+	jsonBytes, _ := json.Marshal(r)
+	return jsonBytes
+}
+
+func (r *TextCensorResponse) ErrorMessage() string {
+	errorMessage := "内容安全检查不通过"
+	if r.ForbiddenType != "" {
+		errorMessage += fmt.Sprintf(" [%s]", r.ForbiddenType.String())
+	}
+	if r.Hint != "" {
+		errorMessage += fmt.Sprintf("，相关标签：%q", r.Hint)
+	}
+	return errorMessage
+}
+
+type TextCensor interface {
+	Censor(ctx context.Context, text string) (*TextCensorResponse, error)
+	String() string
+}
+
+var TrustedHosts = []string{
+	"xhslink.com", // 小红书
+	"weibo.com",   // 微博
+	"b23.tv",      // Bilibili
+	"acfun.cn",
+	"aixifan.com",
+	"github.com",
+	// 自有域名：旧域 tama.guru 保留至 2026-12 到期前的过渡期结束，
+	// 期间用户分享的旧链接仍需视为可信（不被判为广告）；新域 shiroko.one 为主域。
+	"tama.guru",
+	"shiroko.one",
+	"337845818.best",
+	"x.com",
+	"bilibili.com",
+}
+
+// RemoveTrustedURL removes the trusted URL from the text,
+// in order to bypass the URL censoring.
+// 仅当可信域名后紧跟路径分隔符（/ ? #）或位于字符串结尾时才视为可信，
+// 避免 github.com.evil.tld 被朴素替换误判为 github.com 之子域而漏审。
+func RemoveTrustedURL(str string) string {
+	for _, host := range TrustedHosts {
+		for _, protocol := range []string{"http://", "https://"} {
+			needle := protocol + host
+			var b strings.Builder
+			rest := str
+			for {
+				idx := strings.Index(rest, needle)
+				if idx < 0 {
+					b.WriteString(rest)
+					break
+				}
+				b.WriteString(rest[:idx])
+				after := rest[idx+len(needle):]
+				if len(after) == 0 || after[0] == '/' || after[0] == '?' || after[0] == '#' {
+					// 可信域名边界：跳过该前缀，从域名之后继续（域名本身被移除，不进入审核）。
+					rest = after
+				} else {
+					// 非可信域名边界（如 github.com.evil）：保留前缀，从其后继续扫描。
+					b.WriteString(needle)
+					rest = after
+				}
+			}
+			str = b.String()
+		}
+	}
+	return str
+}
diff --git a/internal/security/censor/text_test.go b/internal/security/censor/text_test.go
new file mode 100644
index 0000000..3a7911a
--- /dev/null
+++ b/internal/security/censor/text_test.go
@@ -0,0 +1,29 @@
+// Copyright 2025 E99p1ant. All rights reserved.
+ // Use of this source code is governed by a MIT-style
+ // license that can be found in the LICENSE file.
+ 
+ package censor
+ 
+ import (
+ 	"testing"
+ 
+ 	"github.com/stretchr/testify/assert"
+ )
+ 
+ func TestRemoveTrustedURL(t *testing.T) {
+ 	for _, tc := range []struct {
+ 		name string
+ 		text string
+ 		want string
+ 	}{
+ 		{name: "empty string", text: "", want: ""},
+ 		{name: "normal", text: "你喜欢看什么书？", want: "你喜欢看什么书？"},
+ 		{name: "xiaohongshu", text: `59 茄酱发布了一篇小红书笔记，快来看吧！ 😆 jk14SBf2G75FTW2 😆 http://xhslink.com/a/WYaQ6Tjn86Hab，复制本条信息，打开【小红书】App查看精彩内容！`, want: `59 茄酱发布了一篇小红书笔记，快来看吧！ 😆 jk14SBf2G75FTW2 😆 /a/WYaQ6Tjn86Hab，复制本条信息，打开【小红书】App查看精彩内容！`},
+ 		{name: "weibo", text: `TK 发微博啦~ https://weibo.com/1401527553/5144129806795225 真好看！`, want: `TK 发微博啦~ /1401527553/5144129806795225 真好看！`},
+ 	} {
+ 		t.Run(tc.name, func(t *testing.T) {
+ 			got := RemoveTrustedURL(tc.text)
+ 			assert.Equal(t, tc.want, got)
+ 		})
+ 	}
+ }
\ No newline at end of file
diff --git a/internal/security/ipinfo/ipinfo.go b/internal/security/ipinfo/ipinfo.go
new file mode 100644
index 0000000..8a291f2
--- /dev/null
+++ b/internal/security/ipinfo/ipinfo.go
@@ -0,0 +1,84 @@
+// Package ipinfo 识别 IP 的网络归属（CDN / 云厂商 / WAF）。
+// 基于 projectdiscovery/cdncheck 的离线签名（编译期嵌入，上游每周更新指纹），
+// 判定过程零外部网络请求，适合 1C1G 小型服务器与告警链路使用。
+// 当前用于安全告警邮件：展示扫描来源的网络归属，帮助管理员判断告警严重性。
+package ipinfo
+
+import (
+	"fmt"
+	"net"
+	"strings"
+	"sync"
+
+	"github.com/projectdiscovery/cdncheck"
+)
+
+var (
+	clientOnce sync.Once
+	client     *cdncheck.Client
+)
+
+// getClient 懒加载判定客户端（签名数据编译期嵌入，New 无错误返回）。
+func getClient() *cdncheck.Client {
+	clientOnce.Do(func() {
+		client = cdncheck.New()
+	})
+	return client
+}
+
+// Lookup 判定 IP 的网络归属。
+// 返回：
+//   - label：展示用标签，如 "Cloudflare（CDN）"、"亚马逊（云厂商）"；
+//     未命中返回 "未识别（普通网络）"，输入非法或判定出错返回 "识别失败"。
+//   - proxied：IP 是否属于 CDN/WAF/代理网络（用于提示"封禁可能无法拦截真实来源"）。
+//
+// 任何内部错误都被折叠为展示标签，不向调用方传播——告警链路不应因归属识别失败而中断。
+func Lookup(ipStr string) (label string, proxied bool) {
+	ip := net.ParseIP(strings.TrimSpace(ipStr))
+	if ip == nil {
+		return "识别失败（IP 格式异常）", false
+	}
+
+	matched, value, itemType, err := getClient().Check(ip)
+	if err != nil {
+		return "识别失败", false
+	}
+	if !matched || value == "" {
+		return "未识别（普通网络）", false
+	}
+
+	return fmt.Sprintf("%s（%s）", title(value), typeLabel(itemType)), true
+}
+
+// typeLabel 将 cdncheck 的 itemType 翻译为中文展示。
+func typeLabel(itemType string) string {
+	switch itemType {
+	case "cdn":
+		return "CDN"
+	case "waf":
+		return "WAF"
+	case "cloud":
+		return "云厂商"
+	default:
+		return "未知类型"
+	}
+}
+
+// acronymProviders 需要保持全大写的提供商缩写（cdncheck 返回全小写，如 aws → AWS）。
+var acronymProviders = map[string]bool{
+	"aws": true, "gcp": true, "oci": true, "gds": true, "ovh": true,
+}
+
+// title 将提供商名转为展示形式：缩写全大写（aws → AWS），其余首字母大写
+// （cloudflare → Cloudflare）。
+func title(s string) string {
+	if s == "" {
+		return s
+	}
+	lower := strings.ToLower(s)
+	if acronymProviders[lower] {
+		return strings.ToUpper(lower)
+	}
+	r := []rune(lower)
+	return strings.ToUpper(string(r[0])) + string(r[1:])
+}
diff --git a/internal/security/ipinfo/ipinfo_test.go b/internal/security/ipinfo/ipinfo_test.go
new file mode 100644
index 0000000..2e6e505
--- /dev/null
+++ b/internal/security/ipinfo/ipinfo_test.go
@@ -0,0 +1,27 @@
+package ipinfo
+
+import "testing"
+
+// TestLookupInvalidIP 非法输入必须折叠为展示标签且不 panic，proxied 恒为 false。
+func TestLookupInvalidIP(t *testing.T) {
+	for _, in := range []string{"", "not-an-ip", "999.1.1.1", "  "} {
+		label, proxied := Lookup(in)
+		if proxied {
+			t.Errorf("Lookup(%q) proxied = true, want false", in)
+		}
+		if label == "" {
+			t.Errorf("Lookup(%q) label is empty, want a fallback label", in)
+		}
+	}
+}
+
+// TestLookupReturnsLabel 合法 IP 应返回非空标签且不 panic（不锁定具体归属，
+// 避免上游签名快照更新导致测试抖动）。
+func TestLookupReturnsLabel(t *testing.T) {
+	for _, in := range []string{"1.1.1.1", "8.8.8.8", "2606:4700:4700::1111"} {
+		label, _ := Lookup(in)
+		if label == "" {
+			t.Errorf("Lookup(%q) label is empty", in)
+		}
+	}
+}
diff --git a/internal/shared/blockword.go b/internal/shared/blockword.go
new file mode 100644
index 0000000..2606be6
--- /dev/null
+++ b/internal/shared/blockword.go
@@ -0,0 +1,26 @@
+package shared
+
+import "strings"
+
+// BlockWordHit 检查文本是否命中箱主设置的屏蔽词表（逗号分隔），返回首个命中的词。
+//
+// 屏蔽词语义为「箱主防骚扰词表」：提问、私聊（对方发给我的消息）与投票提交的
+// 开放文本都应经过同一份词表过滤，因此把判定收敛到本函数供各入口复用，
+// 与账号设置页保存时使用的同一 CSV 格式（半角逗号分隔、已去重、去空白）。
+//
+// 存储层可能残留历史脏数据（多余空白 / 空项），这里解析时统一 TrimSpace 并跳过空项。
+func BlockWordHit(blockWordsCSV, text string) (word string, hit bool) {
+	if blockWordsCSV == "" || text == "" {
+		return "", false
+	}
+	for _, w := range strings.Split(blockWordsCSV, ",") {
+		w = strings.TrimSpace(w)
+		if w == "" {
+			continue
+		}
+		if strings.Contains(text, w) {
+			return w, true
+		}
+	}
+	return "", false
+}
diff --git a/internal/shared/blockword_test.go b/internal/shared/blockword_test.go
new file mode 100644
index 0000000..c9737b8
--- /dev/null
+++ b/internal/shared/blockword_test.go
@@ -0,0 +1,32 @@
+package shared
+
+import "testing"
+
+func TestBlockWordHit(t *testing.T) {
+	cases := []struct {
+		name  string
+		words string // CSV 词表
+		text  string
+		word  string
+		hit   bool
+	}{
+		{name: "empty list", words: "", text: "广告", word: "", hit: false},
+		{name: "empty text", words: "广告", text: "", word: "", hit: false},
+		{name: "single hit", words: "广告,spam", text: "请勿发广告", word: "广告", hit: true},
+		{name: "second word hit", words: "广告,spam", text: "buy now spam!", word: "spam", hit: true},
+		{name: "no hit", words: "广告,spam", text: "你好呀", word: "", hit: false},
+		{name: "dirty csv trims space", words: " 广告 , spam ", text: "这是广告", word: "广告", hit: true},
+		{name: "dirty csv empty items skipped", words: "广告,,,spam", text: "spam again", word: "spam", hit: true},
+		{name: "substring semantics", words: "抽奖", text: "参与抽奖活动", word: "抽奖", hit: true},
+		{name: "chinese word bytes safe", words: "屏蔽", text: "你被屏蔽了吗", word: "屏蔽", hit: true},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			gotWord, gotHit := BlockWordHit(c.words, c.text)
+			if gotHit != c.hit || gotWord != c.word {
+				t.Fatalf("BlockWordHit(%q, %q) = (%q, %v), want (%q, %v)",
+					c.words, c.text, gotWord, gotHit, c.word, c.hit)
+			}
+		})
+	}
+}
diff --git a/internal/shared/duplicate.go b/internal/shared/duplicate.go
new file mode 100644
index 0000000..db647b9
--- /dev/null
+++ b/internal/shared/duplicate.go
@@ -0,0 +1,94 @@
+package shared
+
+import (
+	"crypto/md5"
+	"encoding/hex"
+	"strings"
+	"sync"
+	"time"
+)
+
+// DuplicateBlocker 阻止同一来源（IP + 内容指纹）在窗口期内的重复提交，
+// 用于拦截刷屏 / 重复轰炸提问。
+//
+// 实现：内存 map，key = normalizedIP + "|" + contentHash，值为首次提交时间。
+// 窗口期内再次提交相同内容返回 false（拒绝）。
+//
+// 内存安全：条数超过 50000 时先清理过期项；窗口外的 key 由后台清理循环定时移除。
+type DuplicateBlocker struct {
+	mu      sync.Mutex
+	items   map[string]time.Time
+	window  time.Duration
+	maxItem int
+}
+
+// NewDuplicateBlocker 创建拦截器并启动后台清理循环。
+// 注意：每个实例会启动一个常驻 goroutine，应用内应使用包级单例 DuplicateGuard，
+// 不要为每次请求创建新实例。
+func NewDuplicateBlocker(window time.Duration) *DuplicateBlocker {
+	d := &DuplicateBlocker{
+		items:   make(map[string]time.Time),
+		window:  window,
+		maxItem: 50000,
+	}
+	go func() {
+		for {
+			time.Sleep(10 * time.Minute)
+			d.cleanup()
+		}
+	}()
+	return d
+}
+
+// Allow 判断 key（IP+内容）是否允许提交：
+//   - 窗口期内已存在相同 key → 返回 false（重复，拒绝）
+//   - 否则记录并返回 true
+func (d *DuplicateBlocker) Allow(key string) bool {
+	now := time.Now()
+	cutoff := now.Add(-d.window)
+
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	if t, ok := d.items[key]; ok && t.After(cutoff) {
+		return false
+	}
+
+	// 超限时先清理过期项，避免恶意构造大量 key 撑爆内存
+	if len(d.items) >= d.maxItem {
+		for k, t := range d.items {
+			if !t.After(cutoff) {
+				delete(d.items, k)
+			}
+		}
+		// 仍超限则整体放弃写入（宁可放行也不撑爆内存）
+		if len(d.items) >= d.maxItem {
+			return true
+		}
+	}
+
+	d.items[key] = now
+	return true
+}
+
+func (d *DuplicateBlocker) cleanup() {
+	cutoff := time.Now().Add(-d.window)
+	d.mu.Lock()
+	for k, t := range d.items {
+		if !t.After(cutoff) {
+			delete(d.items, k)
+		}
+	}
+	d.mu.Unlock()
+}
+
+// DuplicateKey 生成拦截 key：规范化 IP + 内容 MD5。
+func DuplicateKey(ip, content string) string {
+	ip = NormalizeIP(ip)
+	sum := md5.Sum([]byte(strings.TrimSpace(content)))
+	return ip + "|" + hex.EncodeToString(sum[:])
+}
+
+// DuplicateGuard 全局限流实例：同 IP 在 5 分钟内提交相同内容会被拒绝。
+// 阈值合理：正常用户几乎不可能在 5 分钟内提交两条完全一致的提问。
+var DuplicateGuard = NewDuplicateBlocker(5 * time.Minute)
diff --git a/internal/shared/goutil.go b/internal/shared/goutil.go
new file mode 100644
index 0000000..cd93c3e
--- /dev/null
+++ b/internal/shared/goutil.go
@@ -0,0 +1,20 @@
+package shared
+
+import (
+	"github.com/sirupsen/logrus"
+)
+
+// SafeGo 在独立 goroutine 中执行 fn 并捕获 panic，防止任一 goroutine
+// panic 未恢复导致整个进程崩溃（Go 默认行为：未恢复的 panic 终止进程）。
+//
+// 用法：shared.SafeGo(func() { ... })
+func SafeGo(fn func()) {
+	go func() {
+		defer func() {
+			if r := recover(); r != nil {
+				logrus.WithField("panic", r).Error("goroutine panic recovered")
+			}
+		}()
+		fn()
+	}()
+}
diff --git a/internal/shared/ip.go b/internal/shared/ip.go
new file mode 100644
index 0000000..b5c7f2c
--- /dev/null
+++ b/internal/shared/ip.go
@@ -0,0 +1,176 @@
+package shared
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+	"strings"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+)
+
+// NormalizeIP 规范化 IP 字符串：
+//   - 去除两端空白
+//   - 剥离端口（"1.2.3.4:8080" / "[::1]:8080"）
+//   - 校验合法性，非法返回空串
+//   - IPv4-mapped IPv6（::ffff:1.2.3.4）归一为 IPv4，便于黑名单/限流精确匹配
+func NormalizeIP(s string) string {
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return ""
+	}
+	if h, _, err := net.SplitHostPort(s); err == nil {
+		s = h
+	}
+	ip := net.ParseIP(s)
+	if ip == nil {
+		return ""
+	}
+	if v4 := ip.To4(); v4 != nil {
+		return v4.String()
+	}
+	return ip.String()
+}
+
+// LimitKey 把客户端 IP 归一化为「限流 / 自动封禁」用的聚合键。
+//
+//   - IPv4：原样返回（每个地址独立计数）。
+//   - IPv6：掩码到 /64 前缀后返回，形如 "2001:db8:1:2::/64"。
+//
+// 为什么 IPv6 必须聚合：单个住宅或隧道 IPv6 分配通常就是一个 /64（2^64 个地址）。
+// 若以完整地址作键，攻击者每次请求换一个源地址即可让每个键只命中一次，
+// 使限流与 autoban 的阈值永远无法触发，同时海量键还会持续膨胀内存。
+// /64 是 IPv6 的最小实际分配单位，按此聚合可在不误伤正常用户的前提下堵住绕过。
+//
+// ⚠️ 仅用于限流 / 封禁计数。IP 黑名单必须继续使用精确匹配（见 ipblacklist.go），
+// 不要套用本函数，否则会把整个 /64 段一并拉黑。
+func LimitKey(ip string) string {
+	parsed := net.ParseIP(ip)
+	if parsed == nil {
+		// 无法解析时原样返回，保持调用方行为可预期（空串由调用方自行判断）。
+		return ip
+	}
+	if v4 := parsed.To4(); v4 != nil {
+		return v4.String()
+	}
+	return parsed.Mask(net.CIDRMask(64, 128)).String() + "/64"
+}
+
+// trustedProxyNets 缓存解析后的可信代理网段（conf.Init 之后由 InitTrustedProxies 填充）。
+var trustedProxyNets []*net.IPNet
+
+// InitTrustedProxies 解析 conf.Security.TrustedProxies（逗号分隔的 IP / CIDR 列表），
+// 仅限“你自己的”反向代理/负载均衡基础设施（例如本机 nginx 的 127.0.0.1、私有网络 LB），
+// 在 conf.Init 之后调用一次。列表为空时，X-Forwarded-For / X-Real-IP 永不被信任。
+//
+// 设计目标：避免维护 Cloudflare / EdgeOne 等上游 CDN 的庞大 CIDR 清单。
+// 站点若架在 CDN 后，应配合 Cloudflare Tunnel / Authenticated Origin Pull（Cloudflare）或
+// 防火墙仅放行回源网段（Cloudflare / EdgeOne）锁定源站只接受 CDN 连接，此时
+// CF-Connecting-IP / EO-Client-IP 即为权威客户端 IP，无需任何 CIDR 白名单。
+func InitTrustedProxies() error {
+	trustedProxyNets = nil
+	for _, raw := range strings.Split(conf.Security.TrustedProxies, ",") {
+		item := strings.TrimSpace(raw)
+		if item == "" {
+			continue
+		}
+		ipnet, err := parseTrustedProxy(item)
+		if err != nil {
+			return fmt.Errorf("parse trusted_proxies entry %q: %w", item, err)
+		}
+		trustedProxyNets = append(trustedProxyNets, ipnet)
+	}
+	return nil
+}
+
+// parseTrustedProxy 接受单 IP（自动补 /32 或 /128）或 CIDR。
+func parseTrustedProxy(s string) (*net.IPNet, error) {
+	if ip := net.ParseIP(s); ip != nil {
+		if ip4 := ip.To4(); ip4 != nil {
+			return &net.IPNet{IP: ip4, Mask: net.CIDRMask(32, 32)}, nil
+		}
+		return &net.IPNet{IP: ip, Mask: net.CIDRMask(128, 128)}, nil
+	}
+	_, ipnet, err := net.ParseCIDR(s)
+	if err != nil {
+		return nil, err
+	}
+	return ipnet, nil
+}
+
+// isTrustedProxy 判断给定 IP 是否落在可信代理清单内。
+func isTrustedProxy(ipStr string) bool {
+	ip := net.ParseIP(ipStr)
+	if ip == nil {
+		return false
+	}
+	for _, n := range trustedProxyNets {
+		if n.Contains(ip) {
+			return true
+		}
+	}
+	return false
+}
+
+// ResolveClientIP 统一解析客户端真实 IP，供速率限制、IP 黑名单与审计记录共用。
+//
+// 解析策略（不依赖上游 CDN 的庞大 CIDR 清单）：
+//  1. 未开启 TrustProxy：一切以 TCP 对端 RemoteAddr 为准（不可伪造）。
+//  2. 开启 TrustProxy：
+//     a. 优先信任 CDN 权威客户端头：CF-Connecting-IP（Cloudflare）→ EO-Client-IP
+//     （腾讯 EdgeOne）。这类头只能由对应 CDN 边缘按真实客户端写入，前提是源站已锁定
+//     为仅接受这些 CDN 的回源连接（攻击者无法直连源站伪造）。
+//     b. 仅当 TCP 对端落在 trusted_proxies（你自己的基础设施）内时，才解析
+//     X-Forwarded-For / X-Real-IP，并从右向左剥离已知可信跳数取原始客户端。
+//     c. 否则回退到 RemoteAddr，绝不信任客户端自行提供的头。
+//
+// ⚠️ 若 trust_proxy = true 但源站仍可被人直连（未用 Tunnel / 未锁源站），攻击者可自行
+// 发送 CF-Connecting-IP / EO-Client-IP 头，此时本函数会信任之。因此生产开启 trust_proxy
+// 时，务必配合「Cloudflare Tunnel / Authenticated Origin Pull / 防火墙仅放行 CDN 回源
+// 网段」等手段锁定源站，使伪造头无法抵达应用。
+//
+// 双 CDN 部署（境内 EdgeOne + 境外 Cloudflare）的额外约束：
+// 若回源请求携带对方 CDN 的权威头（经 EdgeOne 回源的请求带 CF-Connecting-IP、经
+// Cloudflare 回源的请求带 EO-Client-IP），攻击者即可借道另一家伪造身份，绕过限流 /
+// 自动封禁 / 单 IP 投票限制，或嫁祸他人。因此必须：① 防火墙仅放行两家 CDN 的回源网段；
+// ② 在各家 CDN 的规则引擎中删除入站请求里「对方 CDN」的权威头，使每个请求最终只携带
+// 自己所在 CDN 的头（操作步骤见 outputs/edgeone-cloudflare-dual-cdn-guide.md）。
+// Cloudflare 侧因 CF-Connecting-IP 恒被覆盖，且用 Transform Rule 删掉 EO-Client-IP 即可；
+// EdgeOne 侧用规则引擎删掉 CF-Connecting-IP 即可。
+func ResolveClientIP(r *http.Request) string {
+	if !conf.Security.TrustProxy {
+		return NormalizeIP(r.RemoteAddr)
+	}
+
+	// (a) CDN 权威客户端头：CF-Connecting-IP（Cloudflare）优先，其次 EO-Client-IP（腾讯
+	// EdgeOne，等效于 CF-Connecting-IP 的权威头，回源时由 EdgeOne 边缘写入客户端真实 IP）。
+	if cfIP := NormalizeIP(r.Header.Get("CF-Connecting-IP")); cfIP != "" {
+		return cfIP
+	}
+	if eoIP := NormalizeIP(r.Header.Get("EO-Client-IP")); eoIP != "" {
+		return eoIP
+	}
+
+	// (b)/(c) 仅当 TCP 对端是受信代理时才解析 XFF/X-Real-IP。
+	remote := NormalizeIP(r.RemoteAddr)
+	if isTrustedProxy(remote) {
+		if forwarded := strings.TrimSpace(r.Header.Get("X-Forwarded-For")); forwarded != "" {
+			// 从右向左取第一个非可信代理跳：客户端的真实 IP。
+			parts := strings.Split(forwarded, ",")
+			for i := len(parts) - 1; i >= 0; i-- {
+				hop := NormalizeIP(parts[i])
+				if hop == "" {
+					continue
+				}
+				if !isTrustedProxy(hop) {
+					return hop
+				}
+			}
+		}
+		if realIP := NormalizeIP(r.Header.Get("X-Real-IP")); realIP != "" {
+			return realIP
+		}
+	}
+
+	return remote
+}
diff --git a/internal/shared/ip_test.go b/internal/shared/ip_test.go
new file mode 100644
index 0000000..17fcaa1
--- /dev/null
+++ b/internal/shared/ip_test.go
@@ -0,0 +1,127 @@
+package shared
+
+import (
+	"net/http/httptest"
+	"testing"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+)
+
+func TestResolveClientIPCloudflareHeader(t *testing.T) {
+	oldTrustProxy := conf.Security.TrustProxy
+	defer func() { conf.Security.TrustProxy = oldTrustProxy }()
+	conf.Security.TrustProxy = true
+
+	r := httptest.NewRequest("GET", "https://example.com/", nil)
+	r.RemoteAddr = "192.0.2.10:443"
+	r.Header.Set("CF-Connecting-IP", "198.51.100.20")
+	r.Header.Set("X-Real-IP", "198.51.100.30")
+	if got := ResolveClientIP(r); got != "198.51.100.20" {
+		t.Fatalf("ResolveClientIP() = %q, want Cloudflare client IP", got)
+	}
+}
+
+func TestResolveClientIPIgnoresHeadersWithoutTrust(t *testing.T) {
+	oldTrustProxy := conf.Security.TrustProxy
+	defer func() { conf.Security.TrustProxy = oldTrustProxy }()
+	conf.Security.TrustProxy = false
+
+	r := httptest.NewRequest("GET", "https://example.com/", nil)
+	r.RemoteAddr = "192.0.2.10:443"
+	r.Header.Set("CF-Connecting-IP", "198.51.100.20")
+	r.Header.Set("EO-Client-IP", "198.51.100.99")
+	if got := ResolveClientIP(r); got != "192.0.2.10" {
+		t.Fatalf("ResolveClientIP() = %q, want remote address", got)
+	}
+}
+
+// TestResolveClientIPEdgeOneHeader 验证腾讯 EdgeOne 的权威客户端头 EO-Client-IP
+// 在 TrustProxy=true 时被信任（双 CDN 部署：境内 EdgeOne 回源不带 CF-Connecting-IP）。
+func TestResolveClientIPEdgeOneHeader(t *testing.T) {
+	oldTrustProxy := conf.Security.TrustProxy
+	defer func() { conf.Security.TrustProxy = oldTrustProxy }()
+	conf.Security.TrustProxy = true
+
+	r := httptest.NewRequest("GET", "https://example.com/", nil)
+	r.RemoteAddr = "203.0.113.44:443" // 模拟 EdgeOne 边缘回源
+	r.Header.Set("EO-Client-IP", "198.51.100.99")
+	r.Header.Set("X-Forwarded-For", "203.0.113.99")
+	if got := ResolveClientIP(r); got != "198.51.100.99" {
+		t.Fatalf("ResolveClientIP() = %q, want EdgeOne client IP", got)
+	}
+}
+
+// TestResolveClientIPPrefersCloudflareOverEdgeOne 锁定权威头的优先级：
+// 两个头并存（配置遗漏剥离规则时的异常态）时以 CF-Connecting-IP 为准，行为可预期。
+func TestResolveClientIPPrefersCloudflareOverEdgeOne(t *testing.T) {
+	oldTrustProxy := conf.Security.TrustProxy
+	defer func() { conf.Security.TrustProxy = oldTrustProxy }()
+	conf.Security.TrustProxy = true
+
+	r := httptest.NewRequest("GET", "https://example.com/", nil)
+	r.RemoteAddr = "203.0.113.44:443"
+	r.Header.Set("CF-Connecting-IP", "198.51.100.20")
+	r.Header.Set("EO-Client-IP", "198.51.100.99")
+	if got := ResolveClientIP(r); got != "198.51.100.20" {
+		t.Fatalf("ResolveClientIP() = %q, want Cloudflare client IP", got)
+	}
+}
+
+// TestResolveClientIPEdgeOneInvalidFallsBack 验证 EO-Client-IP 为非法值时
+// 不 panic 且回退到 RemoteAddr（与 CF-Connecting-IP 的健壮性一致）。
+func TestResolveClientIPEdgeOneInvalidFallsBack(t *testing.T) {
+	oldTrustProxy := conf.Security.TrustProxy
+	defer func() { conf.Security.TrustProxy = oldTrustProxy }()
+	conf.Security.TrustProxy = true
+
+	r := httptest.NewRequest("GET", "https://example.com/", nil)
+	r.RemoteAddr = "203.0.113.44:443"
+	r.Header.Set("EO-Client-IP", "not-an-ip")
+	if got := ResolveClientIP(r); got != "203.0.113.44" {
+		t.Fatalf("ResolveClientIP() = %q, want remote address fallback", got)
+	}
+}
+
+// TestLimitKey 是 P1-4 的回归测试：限流 / 自动封禁用的聚合键必须
+//   - IPv4：原样返回（每地址独立计数）；
+//   - IPv6：掩码到 /64（防止单 /64 内轮换海量地址绕过阈值、并避免键无限膨胀）；
+//   - 非法输入：原样返回，保持调用方行为可预期。
+func TestLimitKey(t *testing.T) {
+	cases := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{"ipv4 passthrough", "203.0.113.10", "203.0.113.10"},
+		{"ipv4-mapped collapses to v4", "::ffff:203.0.113.10", "203.0.113.10"},
+		{"ipv6 aggregated to /64", "2001:db8:1:2:3:4:5:6", "2001:db8:1:2::/64"},
+		// LimitKey 假定输入已由 ResolveClientIP 归一化（已剥离端口）。若误传入带端口的
+		// 字符串，ParseIP 失败会原样透传 —— 这是防御性约定，需锁定以免行为漂移。
+		{"ipv4 with port passes through", "203.0.113.10:8080", "203.0.113.10:8080"},
+		{"ipv6 with port passes through", "[2001:db8:1:2:3:4:5:6]:443", "[2001:db8:1:2:3:4:5:6]:443"},
+		{"invalid input passthrough", "not-an-ip", "not-an-ip"},
+		{"empty passthrough", "", ""},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := LimitKey(tc.in); got != tc.want {
+				t.Fatalf("LimitKey(%q) = %q, want %q", tc.in, got, tc.want)
+			}
+		})
+	}
+}
+
+// TestLimitKeyIPv6SamePrefixCollapses 验证：同一 /64 内任意两台主机应聚合到同一键，
+// 不同 /64 必须落到不同键 —— 这是限速 / 封禁抗 IPv6 轮换绕过的核心不变量。
+func TestLimitKeyIPv6SamePrefixCollapses(t *testing.T) {
+	a := LimitKey("2001:db8:1:2:3:4:5:6")
+	b := LimitKey("2001:db8:1:2:ff:fe::1") // 同一 /64，仅主机位不同
+	if a != b {
+		t.Fatalf("同一 /64 内地址应聚合到同一键，got %q vs %q", a, b)
+	}
+
+	c := LimitKey("2001:db8:1:3:3:4:5:6") // 不同 /64
+	if a == c {
+		t.Fatalf("不同 /64 应落到不同键，两者均为 %q", a)
+	}
+}
diff --git a/internal/shared/multidial.go b/internal/shared/multidial.go
new file mode 100644
index 0000000..003de3e
--- /dev/null
+++ b/internal/shared/multidial.go
@@ -0,0 +1,61 @@
+package shared
+
+import (
+	"context"
+	"errors"
+	"net"
+)
+
+// DialFirstReachable 对一组已通过安全校验的候选 IP 并发拨号，返回最先成功建立的连接。
+//
+// 适用场景：SSRF 防护型出站客户端。调用方先解析域名并过滤内网地址，再以 IP 字面量拨号
+// （无二次解析，免疫 DNS rebinding），本函数负责多 IP 容错——避免固定拨单一 IP 时，
+// 恰好抽中不可达或被劣化的边缘节点（如 Cloudflare anycast 的个别边缘）导致请求稳定超时；
+// curl 等客户端默认会尝试多个 IP，因此这里保持同等的多 IP 能力。
+//
+// 成功路径会取消其余拨号并关闭任何已建立但落选的连接，避免泄漏；全部失败时返回第一个错误。
+// maxCandidates<=0 或大于候选数时按全部候选处理；ips 为空返回错误。
+func DialFirstReachable(ctx context.Context, dialer *net.Dialer, network string, ips []net.IP, port string, maxCandidates int) (net.Conn, error) {
+	if len(ips) == 0 {
+		return nil, errors.New("no candidates to dial")
+	}
+	if maxCandidates <= 0 || maxCandidates > len(ips) {
+		maxCandidates = len(ips)
+	}
+
+	dialCtx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	type dialResult struct {
+		conn net.Conn
+		err  error
+	}
+	results := make(chan dialResult, maxCandidates)
+	for _, ip := range ips[:maxCandidates] {
+		ip := ip
+		go func() {
+			conn, err := dialer.DialContext(dialCtx, network, net.JoinHostPort(ip.String(), port))
+			results <- dialResult{conn: conn, err: err}
+		}()
+	}
+
+	var firstErr error
+	remaining := maxCandidates
+	for remaining > 0 {
+		r := <-results
+		remaining--
+		if r.err == nil {
+			cancel() // 通知其余拨号尽快退出
+			for ; remaining > 0; remaining-- {
+				if extra := <-results; extra.err == nil && extra.conn != nil {
+					_ = extra.conn.Close()
+				}
+			}
+			return r.conn, nil
+		}
+		if firstErr == nil {
+			firstErr = r.err
+		}
+	}
+	return nil, firstErr
+}
diff --git a/internal/shared/multidial_test.go b/internal/shared/multidial_test.go
new file mode 100644
index 0000000..a35251e
--- /dev/null
+++ b/internal/shared/multidial_test.go
@@ -0,0 +1,127 @@
+package shared
+
+import (
+	"context"
+	"net"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+)
+
+// startLoopbackListener 在 127.0.0.1 上开一个监听并返回其端口（关闭由 t.Cleanup 托管）。
+func startLoopbackListener(t *testing.T) int {
+	t.Helper()
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	t.Cleanup(func() { _ = ln.Close() })
+	return ln.Addr().(*net.TCPAddr).Port
+}
+
+func testDialer() *net.Dialer {
+	return &net.Dialer{Timeout: 3 * time.Second, KeepAlive: 30 * time.Second}
+}
+
+// TestDialFirstReachablePicksReachableIP 验证多候选并发拨号会跳过不可达 IP、
+// 选中可达的那个（顺序上不可达在前也不影响结果）。
+func TestDialFirstReachablePicksReachableIP(t *testing.T) {
+	port := startLoopbackListener(t)
+
+	// 127.0.0.2 上没有任何监听 → 该候选必然拨号失败；
+	// 127.0.0.1:port 有监听 → 可达。把坏 IP 放前面，验证不受顺序影响。
+	conn, err := DialFirstReachable(context.Background(), testDialer(), "tcp",
+		[]net.IP{net.ParseIP("127.0.0.2"), net.ParseIP("127.0.0.1")}, strconv.Itoa(port), 6)
+	if err != nil {
+		t.Fatalf("DialFirstReachable returned error: %v", err)
+	}
+	if conn == nil {
+		t.Fatal("DialFirstReachable returned nil conn without error")
+	}
+	// 连接应落在可达的 127.0.0.1 上
+	remote := conn.RemoteAddr().(*net.TCPAddr)
+	if !remote.IP.Equal(net.ParseIP("127.0.0.1")) {
+		t.Fatalf("expected connection to 127.0.0.1, got %s", remote)
+	}
+	_ = conn.Close()
+}
+
+// TestDialFirstReachableAllFail 验证全部候选不可达时返回错误而非死等或空结果。
+func TestDialFirstReachableAllFail(t *testing.T) {
+	// 先开再关，拿到一个确定无监听的端口
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	closedPort := ln.Addr().(*net.TCPAddr).Port
+	_ = ln.Close()
+
+	start := time.Now()
+	conn, err := DialFirstReachable(context.Background(), testDialer(), "tcp",
+		[]net.IP{net.ParseIP("127.0.0.2"), net.ParseIP("127.0.0.1")}, strconv.Itoa(closedPort), 6)
+	if err == nil {
+		if conn != nil {
+			_ = conn.Close()
+		}
+		t.Fatal("expected error when all candidates unreachable, got nil")
+	}
+	if conn != nil {
+		_ = conn.Close()
+		t.Fatal("expected nil conn on total failure")
+	}
+	if elapsed := time.Since(start); elapsed > 15*time.Second {
+		t.Fatalf("all-fail path took too long: %v", elapsed)
+	}
+}
+
+// TestDialFirstReachableCtxCancel 验证父 context 取消后拨号立即返回（不泄漏、不死锁）。
+func TestDialFirstReachableCtxCancel(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel() // 拨号前已取消
+
+	start := time.Now()
+	conn, err := DialFirstReachable(ctx, testDialer(), "tcp",
+		[]net.IP{net.ParseIP("127.0.0.1")}, "81", 6)
+	if err == nil {
+		if conn != nil {
+			_ = conn.Close()
+		}
+		t.Fatal("expected error after context cancel, got nil")
+	}
+	if conn != nil {
+		_ = conn.Close()
+		t.Fatal("expected nil conn on cancelled context")
+	}
+	if !strings.Contains(err.Error(), "canceled") && !strings.Contains(err.Error(), "deadline") {
+		t.Fatalf("expected context cancellation error, got: %v", err)
+	}
+	if elapsed := time.Since(start); elapsed > 5*time.Second {
+		t.Fatalf("context cancel path took too long: %v", elapsed)
+	}
+}
+
+// TestDialFirstReachableEmptyCandidates 验证空候选返回错误而非 panic。
+func TestDialFirstReachableEmptyCandidates(t *testing.T) {
+	conn, err := DialFirstReachable(context.Background(), testDialer(), "tcp", nil, "80", 6)
+	if err == nil {
+		if conn != nil {
+			_ = conn.Close()
+		}
+		t.Fatal("expected error for empty candidates, got nil")
+	}
+}
+
+// TestDialFirstReachableMaxCandidatesCapped 验证 maxCandidates 截断候选数不会 panic。
+func TestDialFirstReachableMaxCandidatesCapped(t *testing.T) {
+	port := startLoopbackListener(t)
+	conn, err := DialFirstReachable(context.Background(), testDialer(), "tcp",
+		[]net.IP{net.ParseIP("127.0.0.1"), net.ParseIP("127.0.0.1")}, strconv.Itoa(port), 1)
+	if err != nil {
+		t.Fatalf("DialFirstReachable with capped candidates returned error: %v", err)
+	}
+	if conn == nil {
+		t.Fatal("DialFirstReachable returned nil conn without error")
+	}
+	_ = conn.Close()
+}
diff --git a/internal/shared/state.go b/internal/shared/state.go
new file mode 100644
index 0000000..27835ee
--- /dev/null
+++ b/internal/shared/state.go
@@ -0,0 +1,44 @@
+// Package shared 提供跨包共享的应用级状态。
+package shared
+
+import (
+	"sync"
+
+	"github.com/tamakyi/TamaBox/internal/i18n"
+)
+
+// AppState 保存应用级共享状态。
+//
+// 多语言体系（internal/i18n）对每个请求按 cookie / 用户配置逐请求解析语言，
+// 本类型只承担一个职责：站点默认语言（兜底值）。
+// 访客既无 lang cookie、登录用户也未配置语言时，使用 AppState 中的默认语言。
+type AppState struct {
+	mu   sync.RWMutex
+	lang string
+}
+
+// NewAppState 返回默认语言为 i18n.Default（简体中文）的应用状态。
+func NewAppState() *AppState {
+	return &AppState{lang: i18n.Default}
+}
+
+// SetLang 设置站点默认语言。
+// 内部统一走 i18n.Resolve 归一化（zh_hk / zh-hant / en-us 等变体都会映射到规范代码），
+// 未知语言代码自动回退到 i18n.Default，保证 lang 始终是字典可查的规范代码。
+func (s *AppState) SetLang(lang string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.lang = i18n.Resolve(lang)
+}
+
+// Lang 返回当前站点默认语言（始终为规范语言代码，如 "zh-CN" / "zh-TW" / "en" / "ja"）。
+func (s *AppState) Lang() string {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.lang
+}
+
+// App 是应用级共享状态单例。
+// 服务启动时（cmd/web.go）依据配置 default_lang 调用 App.SetLang 初始化；
+// 运行期也可由管理功能调用 SetLang 动态调整站点默认语言。
+var App = NewAppState()
diff --git a/internal/shared/state_test.go b/internal/shared/state_test.go
new file mode 100644
index 0000000..6593e12
--- /dev/null
+++ b/internal/shared/state_test.go
@@ -0,0 +1,77 @@
+package shared
+
+import (
+	"testing"
+	"time"
+
+	"github.com/tamakyi/TamaBox/internal/i18n"
+)
+
+func TestAppState_Default(t *testing.T) {
+	s := NewAppState()
+	if got := s.Lang(); got != i18n.Default {
+		t.Errorf("默认语言 = %q, 期望 %q", got, i18n.Default)
+	}
+}
+
+func TestAppState_SetLang_Normalize(t *testing.T) {
+	cases := []struct {
+		in   string
+		want string
+	}{
+		{"zh-CN", i18n.LangZhCN},
+		{"zh_CN", i18n.LangZhCN}, // 下划线变体
+		{"zh", i18n.LangZhCN},
+		{"zh-TW", i18n.LangZhTW},
+		{"zh_hk", i18n.LangZhTW}, // 港繁统一映射到繁体中文
+		{"zh-hant", i18n.LangZhTW},
+		{"en", i18n.LangEn},
+		{"en-US", i18n.LangEn},
+		{"ja", i18n.LangJa},
+		{"ja_JP", i18n.LangJa},
+		{"  En  ", i18n.LangEn}, // 自动去空白
+		{"fr", i18n.Default},    // 未知回退
+		{"", i18n.Default},      // 空值回退
+	}
+
+	for _, tc := range cases {
+		s := NewAppState()
+		s.SetLang(tc.in)
+		if got := s.Lang(); got != tc.want {
+			t.Errorf("SetLang(%q) 后 Lang() = %q, 期望 %q", tc.in, got, tc.want)
+		}
+	}
+}
+
+func TestAppState_Concurrent(t *testing.T) {
+	s := NewAppState()
+	const n = 100
+
+	// 并发读写，覆盖 RWMutex 的多读单写路径。
+	// 用 channel 计数替代 WaitGroup（部分受限环境对 WaitGroup 信号量支持异常）。
+	done := make(chan struct{}, n)
+	for i := 0; i < n; i++ {
+		go func(i int) {
+			defer func() { done <- struct{}{} }()
+			if i%2 == 0 {
+				s.SetLang("en")
+			} else {
+				_ = s.Lang()
+			}
+		}(i)
+	}
+	for i := 0; i < n; i++ {
+		select {
+		case <-done:
+		case <-time.After(10 * time.Second):
+			t.Fatalf("并发测试超时：仅 %d/%d 完成", i, n)
+		}
+	}
+}
+
+func TestApp_Singleton(t *testing.T) {
+	// 单例默认语言为 zh-CN
+	if App.Lang() != i18n.Default {
+		t.Errorf("App.Lang() = %q, 期望默认 %q", App.Lang(), i18n.Default)
+	}
+}
diff --git a/internal/stats/stats.go b/internal/stats/stats.go
new file mode 100644
index 0000000..cd02d33
--- /dev/null
+++ b/internal/stats/stats.go
@@ -0,0 +1,100 @@
+// Package stats 提供首页"提问箱信息统计"所需的全站公开聚合数据。
+//
+// 原本这些数据由 crontab 定时查询数据库、生成 question.count.txt 静态文件、
+// 再由前端 fetch 外部 URL 展示。改为程序内直接计算后，这里用进程内 30 分钟缓存
+// 吸收请求（节奏与原 crontab 一致），避免每个首页请求都打聚合查询到数据库。
+package stats
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/tamakyi/TamaBox/internal/db"
+)
+
+// View 全站公开统计展示模型。
+// 同时提供原始数值字段与已排版的多行文本 Text，便于服务端模板渲染与
+// 客户端定时刷新（/api/v1/site-stats）复用同一份内容。
+type View struct {
+	RegisteredUsers   int64  `json:"registered_users"`
+	TotalQuestions    int64  `json:"total_questions"`
+	AnsweredQuestions int64  `json:"answered_questions"`
+	LastQuestionAt    string `json:"last_question_at"`
+	LastAnswerAt      string `json:"last_answer_at"`
+	UpdatedAt         string `json:"updated_at"`
+	// Text 已按原 question.count.txt 格式排版好的多行文本，直接展示即可。
+	Text string `json:"text"`
+}
+
+// cacheTTL 缓存有效期，与原 crontab 生成文件的节奏保持一致（半小时）。
+const cacheTTL = 30 * time.Minute
+
+var (
+	mu       sync.Mutex
+	cached   *View
+	cachedAt time.Time
+)
+
+// Get 返回全站统计。进程内缓存 cacheTTL，过期后才重新查询数据库。
+func Get(ctx context.Context) (*View, error) {
+	mu.Lock()
+	if cached != nil && time.Since(cachedAt) < cacheTTL {
+		v := cached
+		mu.Unlock()
+		return v, nil
+	}
+	mu.Unlock()
+
+	userCount, err := db.Users.CountAll(ctx)
+	if err != nil {
+		return nil, err
+	}
+	qs, err := db.Questions.QuestionStats(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	v := &View{
+		RegisteredUsers:   userCount,
+		TotalQuestions:    qs.TotalQuestions,
+		AnsweredQuestions: qs.AnsweredQuestions,
+	}
+	if qs.LastQuestionAt != nil {
+		v.LastQuestionAt = qs.LastQuestionAt.Format("2006-01-02 15:04:05")
+	}
+	if qs.LastAnswerAt != nil {
+		v.LastAnswerAt = qs.LastAnswerAt.Format("2006-01-02 15:04:05")
+	}
+	v.UpdatedAt = time.Now().Format("2006-01-02 15:04:05")
+	v.Text = formatText(v)
+
+	mu.Lock()
+	cached = v
+	cachedAt = time.Now()
+	mu.Unlock()
+	return v, nil
+}
+
+// formatText 生成与原 question.count.txt 一致的多行展示文本。
+func formatText(v *View) string {
+	s := fmt.Sprintf("注册用户总数: %d\n全站问题总数: %d\n已获得回答的问题总数: %d",
+		v.RegisteredUsers, v.TotalQuestions, v.AnsweredQuestions)
+	if v.LastQuestionAt != "" {
+		s += "\n最后一个提问发生在: " + v.LastQuestionAt
+	}
+	if v.LastAnswerAt != "" {
+		s += "\n最后一个回答发生在: " + v.LastAnswerAt
+	}
+	s += "\n数据更新于:" + v.UpdatedAt
+	return s
+}
+
+// Invalidate 清空缓存，供需要立即刷新统计的场景调用（如管理后台手动触发）。
+func Invalidate() {
+	mu.Lock()
+	cached = nil
+	cachedAt = time.Time{}
+	mu.Unlock()
+}
diff --git a/internal/storage/client.go b/internal/storage/client.go
new file mode 100644
index 0000000..ab15ac3
--- /dev/null
+++ b/internal/storage/client.go
@@ -0,0 +1,81 @@
+package storage
+
+import (
+	"context"
+	"sync"
+
+	"github.com/aliyun/aliyun-oss-go-sdk/oss"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/pkg/errors"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+)
+
+var (
+	s3ClientOnce sync.Once
+	s3Client     *s3.Client
+	s3ClientErr  error
+
+	ossClientOnce sync.Once
+	ossBucket     *oss.Bucket
+	ossClientErr  error
+)
+
+// GetS3Client 返回共享的 S3 客户端（单例），避免每次上传重复创建。
+func GetS3Client() (*s3.Client, error) {
+	s3ClientOnce.Do(func() {
+		if conf.Upload.ImageEndpoint == "" {
+			s3ClientErr = errors.New("S3 endpoint not configured")
+			return
+		}
+
+		r2Resolver := aws.EndpointResolverWithOptionsFunc(func(service, region string, options ...interface{}) (aws.Endpoint, error) {
+			return aws.Endpoint{
+				URL:               conf.Upload.ImageEndpoint,
+				HostnameImmutable: true,
+				Source:            aws.EndpointSourceCustom,
+			}, nil
+		})
+
+		cfg, err := config.LoadDefaultConfig(context.Background(),
+			config.WithEndpointResolverWithOptions(r2Resolver),
+			config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(
+				conf.Upload.ImageAccessID,
+				conf.Upload.ImageAccessSecret,
+				"",
+			)),
+			config.WithRegion("auto"),
+		)
+		if err != nil {
+			s3ClientErr = errors.Wrap(err, "load S3 config")
+			return
+		}
+		s3Client = s3.NewFromConfig(cfg)
+	})
+	return s3Client, s3ClientErr
+}
+
+// GetOSSBucket 返回共享的 OSS Bucket（单例）。
+func GetOSSBucket() (*oss.Bucket, error) {
+	ossClientOnce.Do(func() {
+		if conf.Upload.AliyunEndpoint == "" {
+			ossClientErr = errors.New("OSS endpoint not configured")
+			return
+		}
+		client, err := oss.New(conf.Upload.AliyunEndpoint, conf.Upload.AliyunAccessID, conf.Upload.AliyunAccessSecret)
+		if err != nil {
+			ossClientErr = errors.Wrap(err, "new OSS client")
+			return
+		}
+		bucket, err := client.Bucket(conf.Upload.AliyunBucket)
+		if err != nil {
+			ossClientErr = errors.Wrap(err, "get OSS bucket")
+			return
+		}
+		ossBucket = bucket
+	})
+	return ossBucket, ossClientErr
+}
diff --git a/internal/storage/oss.go b/internal/storage/oss.go
new file mode 100644
index 0000000..1517dfa
--- /dev/null
+++ b/internal/storage/oss.go
@@ -0,0 +1,66 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package storage
+
+import (
+	"fmt"
+	"io"
+	"mime/multipart"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/thanhpk/randstr"
+	"github.com/wuhan005/gadget"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+)
+
+// UploadPictureToOSS upload user's avatar or background image to OSS.
+// It returns the uploaded asset URL.
+func UploadPictureToOSS(file multipart.File, _ *multipart.FileHeader) (string, error) {
+	// 读取文件头，校验是否为图片
+	header := make([]byte, 512)
+	n, err := file.Read(header)
+	if err != nil && err != io.EOF {
+		return "", errors.Wrap(err, "read file header")
+	}
+	if n == 0 {
+		return "", errors.New("empty file")
+	}
+	if !isSupportedImage(header[:n]) {
+		return "", errors.New("不支持的文件格式，仅允许 JPEG、PNG、GIF、WebP 图片")
+	}
+	// 重置文件指针
+	if _, err := file.Seek(0, io.SeekStart); err != nil {
+		return "", errors.Wrap(err, "seek file")
+	}
+
+	// 获取共享 OSS bucket
+	bucket, err := GetOSSBucket()
+	if err != nil {
+		return "", errors.Wrap(err, "get OSS bucket")
+	}
+
+	now := time.Now()
+	year := now.Year()
+	month := int(now.Month())
+	day := now.Day()
+
+	key := fmt.Sprintf("%s%d/%02d/%02d/%s", PictureKeyPrefix, year, month, day, randstr.Hex(15))
+
+	if err := gadget.Retry(5, func() error {
+		if err := bucket.PutObject(key, file); err != nil {
+			return errors.Wrap(err, "put object")
+		}
+		return nil
+	}); err != nil {
+		return "", errors.Wrap(err, "retry 5 times")
+	}
+
+	if conf.Upload.AliyunBucketCDNHost != "" {
+		return fmt.Sprintf("https://%s/%s", conf.Upload.AliyunBucketCDNHost, key), nil
+	}
+	return fmt.Sprintf("https://%s.%s/%s", conf.Upload.AliyunBucket, conf.Upload.AliyunEndpoint, key), nil
+}
diff --git a/internal/storage/picture.go b/internal/storage/picture.go
new file mode 100644
index 0000000..02c81b6
--- /dev/null
+++ b/internal/storage/picture.go
@@ -0,0 +1,13 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package storage
+
+const PictureKeyPrefix = "picture/"
+
+// MaxAvatarSize is the max avatar size which is 2MB.
+const MaxAvatarSize = 2 * 1024 * 1024
+
+// MaxBackgroundSize is the max background size which is 2MB.
+const MaxBackgroundSize = 2 * 1024 * 1024
diff --git a/internal/storage/s3.go b/internal/storage/s3.go
new file mode 100644
index 0000000..7de1aaf
--- /dev/null
+++ b/internal/storage/s3.go
@@ -0,0 +1,282 @@
+// Copyright 2024 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package storage
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"image"
+	_ "image/gif"
+	_ "image/jpeg"
+	_ "image/png"
+	"io"
+	"mime/multipart"
+	"os"
+	"os/exec"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/chai2010/webp"
+	"github.com/disintegration/imaging"
+	"github.com/pkg/errors"
+	"github.com/thanhpk/randstr"
+	"github.com/wuhan005/gadget"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/imagecheck"
+)
+
+// MaxUploadBytes 是单次图片上传的内存读取上限（8MB）。
+// 调用方虽在 HTTP 层对 fileHeader.Size 做了校验，但该值可被客户端伪造，
+// 因此在读取前用 io.LimitReader 兜底，避免超大文件将内存撑爆（DoS）。
+const MaxUploadBytes = 8 * 1024 * 1024
+
+// aspect 约束一次上传的宽高比（wantW:wantH，容差 DefaultAspectTolerance）。
+// 头像固定 1:1、页面背景固定 16:9：客户端裁剪后即为精确比例，
+// 服务端复校验用于拦截绕过前端直接 POST 的越界图片。
+type aspect struct {
+	W, H float64
+}
+
+func (a *aspect) check(data []byte) error {
+	if a == nil {
+		return nil
+	}
+	return imagecheck.CheckAspectRatio(bytes.NewReader(data), a.W, a.H, imagecheck.DefaultAspectTolerance)
+}
+
+// UploadAvatarToS3 上传头像：除通用校验/转换外强制 1:1 宽高比。
+func UploadAvatarToS3(file multipart.File, fileHeader *multipart.FileHeader) (string, error) {
+	return uploadPictureToS3(file, fileHeader, &aspect{W: 1, H: 1})
+}
+
+// UploadBackgroundToS3 上传页面背景：除通用校验/转换外强制 16:9 宽高比。
+func UploadBackgroundToS3(file multipart.File, fileHeader *multipart.FileHeader) (string, error) {
+	return uploadPictureToS3(file, fileHeader, &aspect{W: 16, H: 9})
+}
+
+// UploadPictureToS3 上传通用图片到 Cloudflare R2，自动转换为 WebP（动画 GIF 可选转换）
+func UploadPictureToS3(file multipart.File, fileHeader *multipart.FileHeader) (string, error) {
+	return uploadPictureToS3(file, fileHeader, nil)
+}
+
+// uploadPictureToS3 是上传管线实现：读入 → 魔数 → （可选）比例校验 → 像素总量校验
+// → 解码 → WebP 转换 → 落盘 R2。avatar/background 的固定比例校验复用同一管线，
+// 仅通过 aspect 参数区分，避免为一种用途复制一套上传代码。
+func uploadPictureToS3(file multipart.File, fileHeader *multipart.FileHeader, asp *aspect) (string, error) {
+	// 1. 限制读取大小，防止超大上传撑爆内存（DoS）。
+	//    先用 LimitReader 截断到 MaxUploadBytes+1 字节；若实际读到的字节数超过上限则直接拒绝。
+	limited := io.LimitReader(file, MaxUploadBytes+1)
+	fileData, err := io.ReadAll(limited)
+	if err != nil {
+		return "", errors.Wrap(err, "read file data")
+	}
+	if int64(len(fileData)) > MaxUploadBytes {
+		return "", errors.New("uploaded file is too large")
+	}
+
+	// 2. 校验文件魔数，仅允许 JPEG / PNG / GIF / WebP
+	if !isSupportedImage(fileData) {
+		return "", errors.New("unsupported file type: not a valid image")
+	}
+
+	// 2.5 用途宽高比校验（头像 1:1 / 背景 16:9），绕过前端裁剪的直传在此被拦截
+	if err := asp.check(fileData); err != nil {
+		return "", err
+	}
+
+	fileReader := bytes.NewReader(fileData)
+
+	// 3. 解码前先校验像素总量（防解压炸弹），再解码图片获取格式；解码失败则直接返回错误。
+	if err := imagecheck.CheckPixelLimit(bytes.NewReader(fileData)); err != nil {
+		return "", err
+	}
+
+	_, format, err := image.Decode(fileReader)
+	if err != nil {
+		return "", errors.Wrap(err, "image decode failed, file may be corrupted")
+	}
+
+	var uploadData []byte
+	var contentType string
+
+	// 重置 reader，以便后续可能的 resize 操作
+	if _, err := fileReader.Seek(0, io.SeekStart); err != nil {
+		return "", errors.Wrap(err, "reset reader")
+	}
+
+	// 4. 根据格式进行转换或直接使用原图
+	switch format {
+	case "gif":
+		webpData, err := convertGifToAnimatedWebP(fileData)
+		if err != nil {
+			// 转换失败则回退到原始 GIF
+			uploadData = fileData
+			contentType = "image/gif"
+		} else {
+			uploadData = webpData
+			contentType = "image/webp"
+		}
+	default:
+		// 静态图片（JPEG / PNG / WebP 等）转换为静态 WebP
+		webpData, err := ConvertStaticImageToWebP(fileReader)
+		if err != nil {
+			// 转换失败时回退到原始图片
+			uploadData = fileData
+			contentType = mimeTypeFromFormat(format)
+		} else {
+			uploadData = webpData
+			contentType = "image/webp"
+		}
+	}
+
+	// 5. 生成存储路径（无后缀名）
+	now := time.Now()
+	year := now.Year()
+	month := int(now.Month())
+	day := now.Day()
+	key := fmt.Sprintf("%s%d/%02d/%02d/%s", PictureKeyPrefix, year, month, day, randstr.Hex(15))
+
+	// 6. 获取共享 S3 客户端
+	client, err := GetS3Client()
+	if err != nil {
+		return "", errors.Wrap(err, "get S3 client")
+	}
+
+	// 7. 上传到 R2
+	if err := gadget.Retry(5, func() error {
+		_, err := client.PutObject(context.Background(), &s3.PutObjectInput{
+			Bucket:        aws.String(conf.Upload.ImageBucket),
+			Key:           aws.String(key),
+			Body:          bytes.NewReader(uploadData),
+			ContentLength: aws.Int64(int64(len(uploadData))),
+			ContentType:   aws.String(contentType),
+			// key 为 picture/日期/随机hex，内容不可变 → 可安全启用 immutable 强缓存，
+			// 避免每次页面加载都回源校验（曾导致头像/二维码 logo 每次重新下载）。
+			CacheControl: aws.String("public, max-age=31536000, immutable"),
+		})
+		return err
+	}); err != nil {
+		return "", errors.Wrap(err, "put object after retry")
+	}
+
+	// 8. 返回 CDN URL
+	return fmt.Sprintf("https://%s/%s", conf.Upload.ImageBucketCDNHost, key), nil
+}
+
+// ConvertStaticImageToWebP 将静态图片（JPEG/PNG等）转换为 WebP 格式
+// 限制最大宽度为 1920px，保持比例
+func ConvertStaticImageToWebP(r io.Reader) ([]byte, error) {
+	// 先整体读入并校验像素总量（防解压炸弹），再完整解码。
+	data, err := io.ReadAll(r)
+	if err != nil {
+		return nil, errors.Wrap(err, "read image")
+	}
+	if err := imagecheck.CheckPixelLimit(bytes.NewReader(data)); err != nil {
+		return nil, errors.Wrap(err, "check image pixel limit")
+	}
+
+	img, _, err := image.Decode(bytes.NewReader(data))
+	if err != nil {
+		return nil, errors.Wrap(err, "decode image")
+	}
+
+	maxWidth := 1920
+	if img.Bounds().Dx() > maxWidth {
+		img = imaging.Resize(img, maxWidth, 0, imaging.Lanczos)
+	}
+
+	buf := new(bytes.Buffer)
+	if err := webp.Encode(buf, img, &webp.Options{Quality: 80}); err != nil {
+		return nil, errors.Wrap(err, "webp encode")
+	}
+	return buf.Bytes(), nil
+}
+
+// convertGifToAnimatedWebP 将 GIF 文件数据转换为动画 WebP（需要系统安装 cwebp 工具）
+// 如果 cwebp 不可用，返回错误，调用方应回退到原始 GIF
+func convertGifToAnimatedWebP(gifData []byte) ([]byte, error) {
+	_, err := exec.LookPath("cwebp")
+	if err != nil {
+		return nil, errors.New("cwebp not found in PATH")
+	}
+
+	tmpGif, err := os.CreateTemp("", "input_*.gif")
+	if err != nil {
+		return nil, errors.Wrap(err, "create temp gif")
+	}
+	defer os.Remove(tmpGif.Name())
+	if _, err := tmpGif.Write(gifData); err != nil {
+		return nil, errors.Wrap(err, "write temp gif")
+	}
+	tmpGif.Close()
+
+	tmpWebp, err := os.CreateTemp("", "output_*.webp")
+	if err != nil {
+		return nil, errors.Wrap(err, "create temp webp")
+	}
+	defer os.Remove(tmpWebp.Name())
+	tmpWebp.Close()
+
+	cmd := exec.Command("cwebp", "-q", "80", "-mixed", "-mt", "-quiet", tmpGif.Name(), "-o", tmpWebp.Name())
+	if err := cmd.Run(); err != nil {
+		return nil, errors.Wrap(err, "run cwebp")
+	}
+
+	webpData, err := os.ReadFile(tmpWebp.Name())
+	if err != nil {
+		return nil, errors.Wrap(err, "read webp output")
+	}
+	return webpData, nil
+}
+
+// mimeTypeFromFormat 根据图片格式返回 MIME 类型
+func mimeTypeFromFormat(format string) string {
+	switch format {
+	case "jpeg":
+		return "image/jpeg"
+	case "png":
+		return "image/png"
+	case "gif":
+		return "image/gif"
+	case "webp":
+		return "image/webp"
+	default:
+		return "application/octet-stream"
+	}
+}
+
+// isSupportedImage 通过文件头魔数判断是否为支持的图片格式
+func isSupportedImage(data []byte) bool {
+	if len(data) < 4 {
+		return false
+	}
+
+	// JPEG: FF D8 FF
+	if data[0] == 0xFF && data[1] == 0xD8 && data[2] == 0xFF {
+		return true
+	}
+
+	// PNG: 89 50 4E 47
+	if bytes.Equal(data[:4], []byte{0x89, 0x50, 0x4E, 0x47}) {
+		return true
+	}
+
+	// GIF: GIF87a / GIF89a
+	if len(data) >= 6 {
+		if bytes.Equal(data[:6], []byte("GIF87a")) || bytes.Equal(data[:6], []byte("GIF89a")) {
+			return true
+		}
+	}
+
+	// WebP: RIFF ... WEBP
+	if len(data) >= 12 && bytes.Equal(data[:4], []byte("RIFF")) && bytes.Equal(data[8:12], []byte("WEBP")) {
+		return true
+	}
+
+	return false
+}
diff --git a/internal/template/date_pattern.go b/internal/template/date_pattern.go
new file mode 100644
index 0000000..8199fd1
--- /dev/null
+++ b/internal/template/date_pattern.go
@@ -0,0 +1,50 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package template
+
+import (
+	"time"
+)
+
+// DateFormat pattern rules.
+var datePatterns = []string{
+	// year
+	"Y", "2006", // A full numeric representation of a year, 4 digits   Examples: 1999 or 2003
+	"y", "06", // A two digit representation of a year   Examples: 99 or 03
+
+	// month
+	"m", "01", // Numeric representation of a month, with leading zeros 01 through 12
+	"n", "1", // Numeric representation of a month, without leading zeros   1 through 12
+	"M", "Jan", // A short textual representation of a month, three letters Jan through Dec
+	"F", "January", // A full textual representation of a month, such as January or March   January through December
+
+	// day
+	"d", "02", // Day of the month, 2 digits with leading zeros 01 to 31
+	"j", "2", // Day of the month without leading zeros 1 to 31
+
+	// week
+	"D", "Mon", // A textual representation of a day, three letters Mon through Sun
+	"l", "Monday", // A full textual representation of the day of the week  Sunday through Saturday
+
+	// time
+	"g", "3", // 12-hour format of an hour without leading zeros    1 through 12
+	"G", "15", // 24-hour format of an hour without leading zeros   0 through 23
+	"h", "03", // 12-hour format of an hour with leading zeros  01 through 12
+	"H", "15", // 24-hour format of an hour with leading zeros  00 through 23
+
+	"a", "pm", // Lowercase Ante meridiem and Post meridiem am or pm
+	"A", "PM", // Uppercase Ante meridiem and Post meridiem AM or PM
+
+	"i", "04", // Minutes with leading zeros    00 to 59
+	"s", "05", // Seconds, with leading zeros   00 through 59
+
+	// time zone
+	"T", "MST",
+	"P", "-07:00",
+	"O", "-0700",
+
+	// RFC 2822
+	"r", time.RFC1123Z,
+}
diff --git a/internal/template/markdown.go b/internal/template/markdown.go
new file mode 100644
index 0000000..deeee2f
--- /dev/null
+++ b/internal/template/markdown.go
@@ -0,0 +1,265 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package template
+
+import (
+	"bytes"
+	stdhtml "html"
+	"html/template"
+	"regexp"
+	"strings"
+
+	"github.com/russross/blackfriday/v2"
+	"golang.org/x/net/html"
+)
+
+// blockEndTags 与 reBlockEndBrList：删除块级元素闭合标签紧前的 <br>。
+// HardLineBreak 会把块级元素末尾的换行也渲染成 <br>，产生多余空行；
+// 这里仅清除末尾的 <br>（可含中间空白），行内真正的换行保留。
+// 注意：RE2 不支持 lookahead，故对每个闭合标签单独编译。
+var blockEndTags = []string{
+	"</li>", "</p>", "</h1>", "</h2>", "</h3>", "</h4>", "</h5>", "</h6>",
+	"</blockquote>", "</pre>", "</div>",
+}
+
+var reBlockEndBrList = func() []*regexp.Regexp {
+	res := make([]*regexp.Regexp, 0, len(blockEndTags))
+	for _, tag := range blockEndTags {
+		// 捕获闭合标签本身，替换时用 $1 保留
+		res = append(res, regexp.MustCompile(`<br>[ \t\r\n]*(`+regexp.QuoteMeta(tag)+`)`))
+	}
+	return res
+}()
+
+// reBlankLines 压缩连续换行为单个换行（MarkdownToPlainText 提取时块级/br 会产生多个 \n）。
+var reBlankLines = regexp.MustCompile(`\n{2,}`)
+
+// PlainText 渲染 Markdown 为纯文本并压缩连续空行为单个换行，
+// 供列表/摘要等紧凑展示场景使用（保留文字与换行，不显示 Markdown 符号与排版）。
+func PlainText(markdown string) string {
+	if strings.TrimSpace(markdown) == "" {
+		return ""
+	}
+	return reBlankLines.ReplaceAllString(MarkdownToPlainText(markdown), "\n")
+}
+
+// MarkdownToHTML 将 Markdown 渲染为安全的 HTML 片段（供模板直接输出）。
+//
+// 安全性：先用 blackfriday 渲染，再经白名单过滤器清洗：
+//   - 只保留常用排版标签与属性（a[href]/img[src,alt,title] 等）
+//   - 丢弃 script / style / iframe / object / embed / form 等危险标签
+//   - href/src 仅允许 http/https/mailto，其余一律去除
+//   - 剥离所有 on* 事件属性
+//
+// 这样既支持 Markdown 排版，又不会引入存储型 XSS。
+func MarkdownToHTML(markdown string) template.HTML {
+	if strings.TrimSpace(markdown) == "" {
+		return ""
+	}
+
+	raw := blackfriday.Run([]byte(markdown),
+		// CommonExtensions 提供标准 Markdown；HardLineBreak 让「回车」直接换行（<br>），
+		// 无需行尾双空格（对非技术用户更友好）。
+		blackfriday.WithExtensions(blackfriday.CommonExtensions|blackfriday.HardLineBreak),
+	)
+
+	cleaned := sanitizeHTML(raw)
+	// 清除块级元素末尾的冗余 <br>（保留闭合标签，见 reBlockEndBrList 注释）
+	for _, re := range reBlockEndBrList {
+		cleaned = re.ReplaceAllString(cleaned, "$1")
+	}
+	return template.HTML(cleaned)
+}
+
+// MarkdownToPlainText 将 Markdown 渲染为纯文本（剥离所有标记符号与 HTML 标签），
+// 供分享图绘制、摘要等纯文本场景使用。块级元素之间以换行分隔（调用方可按需折叠）。
+func MarkdownToPlainText(markdown string) string {
+	if strings.TrimSpace(markdown) == "" {
+		return ""
+	}
+	raw := blackfriday.Run([]byte(markdown),
+		blackfriday.WithExtensions(blackfriday.CommonExtensions|blackfriday.HardLineBreak),
+	)
+	return extractPlainText(raw)
+}
+
+// blockElements 提取纯文本时需在其后补换行的块级元素。
+var blockElements = map[string]bool{
+	"p": true, "div": true, "h1": true, "h2": true, "h3": true, "h4": true,
+	"h5": true, "h6": true, "ul": true, "ol": true, "li": true,
+	"blockquote": true, "pre": true, "table": true, "tr": true,
+}
+
+// extractPlainText 遍历 HTML token，只保留文本内容，块级元素与 <br> 后补换行。
+func extractPlainText(raw []byte) string {
+	var out strings.Builder
+	tokenizer := html.NewTokenizer(bytes.NewReader(raw))
+	for {
+		tt := tokenizer.Next()
+		switch tt {
+		case html.ErrorToken:
+			return out.String()
+		case html.TextToken:
+			out.WriteString(string(tokenizer.Text()))
+		case html.StartTagToken, html.SelfClosingTagToken:
+			name := strings.ToLower(tokenizer.Token().Data)
+			if name == "br" {
+				out.WriteString("\n")
+			}
+		case html.EndTagToken:
+			name := strings.ToLower(tokenizer.Token().Data)
+			if blockElements[name] {
+				out.WriteString("\n")
+			}
+		}
+	}
+}
+
+// 允许的标签集合。
+var allowedTags = map[string]bool{
+	"p": true, "br": true, "hr": true, "div": true, "span": true,
+	"strong": true, "em": true, "b": true, "i": true, "u": true, "s": true,
+	"code": true, "pre": true, "blockquote": true,
+	"ul": true, "ol": true, "li": true,
+	"h1": true, "h2": true, "h3": true, "h4": true, "h5": true, "h6": true,
+	"a": true, "img": true, "table": true, "thead": true, "tbody": true,
+	"tr": true, "th": true, "td": true, "del": true, "ins": true,
+	// font 仅用于彩色文字（color 属性单独校验），无脚本能力，已废弃但浏览器仍支持
+	"font": true,
+}
+
+// sanitizeHTML 白名单过滤：遍历 token，重建安全 HTML。
+func sanitizeHTML(raw []byte) string {
+	var out bytes.Buffer
+	tokenizer := html.NewTokenizer(bytes.NewReader(raw))
+
+	for {
+		tt := tokenizer.Next()
+		switch tt {
+		case html.ErrorToken:
+			return out.String()
+		case html.TextToken:
+			// Tokenizer.Text returns unescaped text. Escape it again before
+			// rebuilding HTML, otherwise input such as &lt;script&gt; can become
+			// executable markup in the template.HTML result.
+			out.WriteString(stdhtml.EscapeString(string(tokenizer.Text())))
+		case html.StartTagToken, html.SelfClosingTagToken:
+			// SelfClosingTagToken 覆盖 `<br />` 这类自闭合写法（blackfriday 的硬换行即此形式），
+			// 漏掉会导致 <br> 被丢弃、换行失效。
+			writeSanitizedTag(&out, tokenizer.Token(), false)
+		case html.EndTagToken:
+			writeSanitizedTag(&out, tokenizer.Token(), true)
+		}
+	}
+}
+
+func writeSanitizedTag(out *bytes.Buffer, tok html.Token, isEnd bool) {
+	name := strings.ToLower(tok.Data)
+	if !allowedTags[name] {
+		return
+	}
+
+	if isEnd {
+		out.WriteString("</" + name + ">")
+		return
+	}
+
+	// 反向 tabnabbing 防护：a 标签若使用 target="_blank"，强制附带 rel="noopener noreferrer"。
+	hasTargetBlank := false
+	if name == "a" {
+		for _, attr := range tok.Attr {
+			if strings.ToLower(attr.Key) == "target" && strings.TrimSpace(attr.Val) == "_blank" {
+				hasTargetBlank = true
+				break
+			}
+		}
+	}
+
+	out.WriteString("<" + name)
+	for _, attr := range tok.Attr {
+		key := strings.ToLower(attr.Key)
+		val := strings.TrimSpace(attr.Val)
+
+		// 过滤事件属性与危险属性
+		if strings.HasPrefix(key, "on") {
+			continue
+		}
+		// font 标签仅允许 color 属性，且值需通过颜色校验（防属性注入）
+		if name == "font" {
+			if key != "color" || !safeColorValue(val) {
+				continue
+			}
+			out.WriteString(` color="` + stdhtml.EscapeString(val) + `"`)
+			continue
+		}
+		switch key {
+		case "href", "src":
+			if !safeURL(val) {
+				continue
+			}
+		case "target":
+			// target 仅对 a 标签允许，且仅允许 _blank
+			if name != "a" || val != "_blank" {
+				continue
+			}
+		case "rel":
+			// 若存在 target="_blank"，忽略用户提供的 rel，统一由下方输出 noopener noreferrer
+			if hasTargetBlank {
+				continue
+			}
+		case "class", "alt", "title", "width", "height", "colspan", "rowspan", "start":
+			// 保留有限的白名单属性（已移除 style，防止 CSS 注入 / 外联跟踪）
+		default:
+			continue
+		}
+
+		out.WriteString(" " + stdhtml.EscapeString(key) + `="` + stdhtml.EscapeString(val) + `"`)
+	}
+	if hasTargetBlank {
+		out.WriteString(` rel="noopener noreferrer"`)
+	}
+	out.WriteString(">")
+}
+
+// safeColorValue 校验颜色值：仅允许颜色名 / #hex / rgb() / rgba() / hsl() 等形式，
+// 拒绝分号、引号、尖括号、斜杠、冒号等可能用于属性注入或 CSS 逃逸的字符。
+func safeColorValue(v string) bool {
+	if v == "" || len(v) > 40 {
+		return false
+	}
+	for _, r := range v {
+		switch {
+		case r >= 'a' && r <= 'z', r >= 'A' && r <= 'Z', r >= '0' && r <= '9':
+			continue
+		case strings.ContainsRune("#,() .%", r):
+			continue
+		default:
+			return false
+		}
+	}
+	return true
+}
+
+// safeURL 仅允许 http/https/mailto 协议（含站内相对路径），拒绝 javascript: 等危险协议。
+func safeURL(u string) bool {
+	lower := strings.ToLower(strings.TrimSpace(u))
+
+	// 必须先于下面的 "/" 前缀判断：协议相对 URL（//evil.com）同样以 "/" 开头，
+	// 若不单独拦截会被误判为站内相对路径，从而绕过"仅 http/https/mailto"的白名单本意，
+	// 使 markdown 中的 [x](//evil.com) 渲染成指向外站的链接（钓鱼 / 外链埋点）。
+	// 反斜杠变体（\\evil.com、/\evil.com）在部分浏览器中等价于 //，一并拒绝。
+	if strings.HasPrefix(lower, "//") || strings.HasPrefix(lower, `\\`) ||
+		strings.HasPrefix(lower, `/\`) {
+		return false
+	}
+
+	if strings.HasPrefix(lower, "http://") || strings.HasPrefix(lower, "https://") ||
+		strings.HasPrefix(lower, "mailto:") || strings.HasPrefix(lower, "/") ||
+		strings.HasPrefix(lower, "./") || strings.HasPrefix(lower, "../") ||
+		strings.HasPrefix(lower, "#") {
+		return true
+	}
+	return false
+}
diff --git a/internal/template/markdown_test.go b/internal/template/markdown_test.go
new file mode 100644
index 0000000..8ea1af0
--- /dev/null
+++ b/internal/template/markdown_test.go
@@ -0,0 +1,171 @@
+package template
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestMarkdownToHTML_Basic(t *testing.T) {
+	cases := []struct {
+		name string
+		in   string
+		want string // 必须包含
+	}{
+		{"bold", "**bold**", "<strong>bold</strong>"},
+		{"italic", "*italic*", "<em>italic</em>"},
+		{"link", "[baidu](https://baidu.com)", `href="https://baidu.com"`},
+		{"list", "- item1\n- item2", "<li>item1</li>"},
+		{"code", "`code`", "<code>code</code>"},
+		{"newline", "line1\nline2", "<br>"},
+		{"font-red", `<font color="red">文本</font>`, `<font color="red">文本</font>`},
+		{"font-hex", `<font color="#ff0000">红</font>`, `<font color="#ff0000">红</font>`},
+		{"font-rgb", `<font color="rgb(255,0,0)">红</font>`, `<font color="rgb(255,0,0)">红</font>`},
+		{"font-mixed", `**粗体** 和 <font color="blue">蓝</font>`, `<font color="blue">蓝</font>`},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := string(MarkdownToHTML(tc.in))
+			if !strings.Contains(got, tc.want) {
+				t.Errorf("MarkdownToHTML(%q) = %q, 期望包含 %q", tc.in, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestMarkdownToHTML_XSS(t *testing.T) {
+	cases := []string{
+		`&lt;script&gt;alert(1)&lt;/script&gt;`,
+		`&amp;lt;script&amp;gt;alert(1)&amp;lt;/script&amp;gt;`,
+		`<script>alert(1)</script>`,
+		`<img src=x onerror=alert(1)>`,
+		`[x](javascript:alert(1))`,
+		`<a href="javascript:alert(1)">x</a>`,
+		`<iframe src="https://evil.com"></iframe>`,
+		"<svg onload=alert(1)>",
+		`<div onclick="alert(1)">x</div>`,
+		`<style>body{display:none}</style>`,
+	}
+	for _, in := range cases {
+		got := string(MarkdownToHTML(in))
+		if strings.Contains(got, "<script") || strings.Contains(got, " onerror") ||
+			strings.Contains(got, " onclick") || strings.Contains(got, " onload") ||
+			strings.Contains(got, "<iframe") || strings.Contains(got, "javascript:") ||
+			strings.Contains(got, "<style") || strings.Contains(got, "<svg") {
+			t.Errorf("XSS 防护失败: 输入 %q 输出 %q", in, got)
+		}
+	}
+}
+
+// TestMarkdownToHTML_FontColorInjection font 的 color 属性只放行合法颜色值，
+// 注入尝试必须被丢弃（标签保留但 color 属性被剥离，且不产生新属性）。
+func TestMarkdownToHTML_FontColorInjection(t *testing.T) {
+	cases := []struct {
+		name string
+		in   string
+		want string // 输出必须包含（剥离后仅剩文本）
+	}{
+		{"css-inject", `<font color="red;position:fixed">x</font>`, "x"},
+		{"quote-inject", `<font color="red" onclick="alert(1)">x</font>`, "x"},
+		{"url-inject", `<font color="url(javascript:alert(1))">x</font>`, "x"},
+		{"onattr-inject", `<font color="x" style="background:url(javascript:1)">x</font>`, "x"},
+		{"long-value", `<font color="` + strings.Repeat("a", 50) + `">x</font>`, "x"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := string(MarkdownToHTML(tc.in))
+			if !strings.Contains(got, tc.want) {
+				t.Errorf("输出 %q 应包含 %q", got, tc.want)
+			}
+			// 注入的 color 值不得出现
+			for _, evil := range []string{";", "position:", "onclick", "javascript:", "<font color=\"red\" onclick", "<font color=\"x\" style"} {
+				if strings.Contains(got, evil) {
+					t.Errorf("注入残留: %q 包含 %q", got, evil)
+				}
+			}
+		})
+	}
+}
+
+func TestMarkdownToHTML_Empty(t *testing.T) {
+	if got := string(MarkdownToHTML("")); got != "" {
+		t.Errorf("空输入应输出空串, got %q", got)
+	}
+}
+
+func TestMarkdownToPlainText(t *testing.T) {
+	cases := []struct {
+		name string
+		in   string
+		want string // 必须包含（忽略换行折叠）
+	}{
+		{"plain", "你好世界", "你好世界"},
+		{"bold", "**粗体**", "粗体"},
+		{"font", `<font color="red">红字</font>`, "红字"},
+		{"link", "[百度](https://baidu.com)", "百度"},
+		{"code", "`code`", "code"},
+		{"list", "- 第一项\n- 第二项", "第一项"},
+		{"block", "# 标题\n内容", "标题"},
+		{"mixed", "问题：**重要** 详情 <font color=\"blue\">蓝</font>", "重要"},
+		{"empty", "", ""},
+		// 危险标签被剥离：script 的内容是纯文本（绘制无风险），img 自闭合无文本则输出空
+		{"xss-script", "<script>alert(1)</script>", "alert(1)"},
+		{"xss-img", `<img src=x onerror=alert(1)>`, ""},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := strings.Join(strings.Fields(MarkdownToPlainText(tc.in)), " ")
+			if tc.want == "" {
+				if got != "" {
+					t.Errorf("MarkdownToPlainText(%q) = %q, 期望空", tc.in, got)
+				}
+				return
+			}
+			if !strings.Contains(got, tc.want) {
+				t.Errorf("MarkdownToPlainText(%q) = %q, 期望包含 %q", tc.in, got, tc.want)
+			}
+			// 输出不得残留任何标签（< 必须被剥离）
+			if strings.Contains(got, "<") {
+				t.Errorf("MarkdownToPlainText(%q) = %q, 不应包含标签字符", tc.in, got)
+			}
+		})
+	}
+}
+
+// TestSafeURL 是 P2-1 的回归测试：markdown 链接白名单必须拒绝协议相对 URL
+// （//evil.com 等），否则会被误判为站内相对路径而渲染成指向外站的钓鱼 / 外链埋点链接。
+// 同时验证 javascript:/data:/ftp: 等危险协议与大小写变体均被拒绝，http/https/mailto
+// 与站内相对路径被放行。
+func TestSafeURL(t *testing.T) {
+	allow := []string{
+		"https://example.com",
+		"http://example.com",
+		"HTTPS://EXAMPLE.COM", // 大小写不敏感
+		"mailto:foo@bar.com",
+		"/path/to/page",
+		"./relative",
+		"../up",
+		"#fragment",
+	}
+	for _, u := range allow {
+		if !safeURL(u) {
+			t.Errorf("safeURL(%q) = false, 期望放行", u)
+		}
+	}
+
+	deny := []string{
+		"//evil.com",          // 协议相对 URL（核心回归点）
+		`\\evil.com`,          // 反斜杠变体
+		`/\evil.com`,          // 反斜杠变体
+		"javascript:alert(1)", // 危险协议
+		"JavaScript:alert(1)", // 大小写变体
+		"data:text/html,<script>",
+		"ftp://example.com",
+		"", // 空串
+	}
+	for _, u := range deny {
+		if safeURL(u) {
+			t.Errorf("safeURL(%q) = true, 期望拒绝", u)
+		}
+	}
+}
+
diff --git a/internal/template/minify.go b/internal/template/minify.go
new file mode 100644
index 0000000..b20591d
--- /dev/null
+++ b/internal/template/minify.go
@@ -0,0 +1,119 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package template
+
+import (
+	"bytes"
+	"embed"
+	"io/fs"
+	"path/filepath"
+	"regexp"
+
+	"github.com/flamego/template"
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+	"github.com/tdewolff/minify/v2"
+	"github.com/tdewolff/minify/v2/css"
+	"github.com/tdewolff/minify/v2/html"
+	"github.com/tdewolff/minify/v2/js"
+)
+
+var _ template.FileSystem = (*FileSystem)(nil)
+
+type file struct {
+	name string
+	data []byte
+	ext  string
+}
+
+func (f *file) Name() string          { return f.name }
+func (f *file) Data() ([]byte, error) { return f.data, nil }
+func (f *file) Ext() string           { return f.ext }
+
+type FileSystem struct {
+	files []template.File
+}
+
+func (fs *FileSystem) Files() []template.File { return fs.files }
+
+// getExt returns the extension of given name, prefixed with the dot (".").
+// 必须用 filepath.Ext：取最后一个点之后的部分。
+// 旧的 strings.Index 实现会把 "foo.bar.html" 的扩展名误判为 ".bar.html"，
+// 导致模板名截取错误（如 "foo" 丢失子目录结构）。
+func getExt(name string) string {
+	return filepath.Ext(name)
+}
+
+func Minify(embedFS embed.FS, dir string, allowedExtensions []string) (*FileSystem, error) {
+	var beforeSize, afterSize int64
+
+	var files []template.File
+	m := minify.New()
+	m.AddFunc("text/html", html.Minify)
+	m.AddFunc("text/css", css.Minify)
+	m.AddFuncRegexp(regexp.MustCompile(`^(application|text)/(x-)?(java|ecma)script$`), js.Minify)
+
+	err := fs.WalkDir(embedFS, dir, func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if d.IsDir() {
+			return nil
+		}
+
+		relpath, err := filepath.Rel(dir, path)
+		if err != nil {
+			return errors.Wrap(err, "get relative path")
+		}
+
+		ext := getExt(relpath)
+		for _, allowed := range allowedExtensions {
+			if ext != allowed {
+				continue
+			}
+
+			data, err := embedFS.ReadFile(path)
+			if err != nil {
+				return errors.Wrap(err, "read")
+			}
+			beforeSize += int64(len(data))
+
+			var buf bytes.Buffer
+			switch filepath.Ext(path) {
+			case ".html":
+				if err := html.Minify(m, &buf, bytes.NewReader(data), nil); err != nil {
+					return errors.Wrap(err, "minify html")
+				}
+			default:
+				buf = *bytes.NewBuffer(data)
+			}
+			afterSize += int64(buf.Len())
+
+			name := filepath.ToSlash(relpath[:len(relpath)-len(ext)])
+			files = append(files,
+				&file{
+					name: name,
+					data: buf.Bytes(),
+					ext:  ext,
+				},
+			)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, errors.Wrap(err, "walk")
+	}
+
+	logrus.WithFields(logrus.Fields{
+		"before_size": beforeSize,
+		"after_size":  afterSize,
+		"ratio":       float64(afterSize) / float64(beforeSize),
+	}).Info("Minify succeeded")
+
+	return &FileSystem{
+		files: files,
+	}, nil
+}
diff --git a/internal/template/template.go b/internal/template/template.go
new file mode 100644
index 0000000..ea787ef
--- /dev/null
+++ b/internal/template/template.go
@@ -0,0 +1,220 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package template
+
+import (
+	"encoding/json"
+	"fmt"
+	"html"
+	"html/template"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"gorm.io/datatypes"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+)
+
+var (
+	funcMap     []template.FuncMap
+	funcMapOnce sync.Once
+)
+
+func FuncMap() []template.FuncMap {
+	funcMapOnce.Do(func() {
+		funcMap = []template.FuncMap{map[string]interface{}{
+			"ICP": func() string {
+				return conf.App.ICP
+			},
+			"CommitSHA": func() string {
+				return conf.BuildCommit
+			},
+			"CommitSHAShort": func() string {
+				if len(conf.BuildCommit) > 7 {
+					return conf.BuildCommit[:7]
+				}
+				return conf.BuildCommit
+			},
+			"Date": func(t time.Time, format string) string {
+				replacer := strings.NewReplacer(datePatterns...)
+				format = replacer.Replace(format)
+				return t.Format(format)
+			},
+			"QuestionFormat": func(input string) template.HTML {
+				input = html.EscapeString(input)
+				input = strings.ReplaceAll(input, "\n", "</br>")
+				return template.HTML(input)
+			},
+			"AnswerFormat": func(input string) template.HTML {
+				input = html.EscapeString(input)
+				input = strings.ReplaceAll(input, "\n", "</br>")
+				return template.HTML(input)
+			},
+			// MarkdownFormat 将回答按 Markdown 渲染为安全 HTML（含白名单过滤，防 XSS）。
+			"MarkdownFormat": MarkdownToHTML,
+			// MarkdownPlainText 将 Markdown 渲染为纯文本（去标记符号、保留文字与换行、压缩空行），
+			// 供列表页等不希望展示大字号/彩色排版的场景使用。
+			"MarkdownPlainText": PlainText,
+			"SentryDSN": func() string {
+				return conf.App.SentryDSN
+			},
+			"ParsePublicURLs": func(input datatypes.JSON) string {
+				urls := make(map[string]string)
+				if err := json.Unmarshal(input, &urls); err != nil {
+					return ""
+				}
+				for _, url := range urls {
+					return url
+				}
+				return ""
+			},
+			"ImageBucketCDNHost": func() string {
+				return conf.Upload.ImageBucketCDNHost
+			},
+
+			"sub": func(a, b int) int {
+				return a - b
+			},
+			// dict 将键值对打包为 map，供 {{template "partial" (dict "Key" val ...)}} 向部分模板传参。
+			// 参数必须成对且键为字符串，否则返回错误（html/template 会将该错误作为执行错误抛出）。
+			"dict": func(values ...interface{}) (map[string]interface{}, error) {
+				if len(values)%2 != 0 {
+					return nil, fmt.Errorf("dict: odd number of arguments: %d", len(values))
+				}
+				d := make(map[string]interface{}, len(values)/2)
+				for i := 0; i < len(values); i += 2 {
+					key, ok := values[i].(string)
+					if !ok {
+						return nil, fmt.Errorf("dict: key at index %d is not a string", i)
+					}
+					d[key] = values[i+1]
+				}
+				return d, nil
+			},
+			"mod": func(a, b int) int {
+				if b == 0 {
+					return 0
+				}
+				return a % b
+			},
+			// loop 生成 1..n 的整数切片，用于模板中按数量 range（如评分 1-10）。
+			"loop": func(n int) []int {
+				if n <= 0 {
+					return []int{}
+				}
+				out := make([]int, n)
+				for i := 1; i <= n; i++ {
+					out[i-1] = i
+				}
+				return out
+			},
+			// hasDay 判断逗号分隔的周几列表（0=周日…6=周六，与 time.Weekday 一致）是否包含 wd。
+			// 用于功能管理页渲染循环定时的开放日复选框。
+			"hasDay": func(days string, wd int) bool {
+				for _, part := range strings.Split(days, ",") {
+					part = strings.TrimSpace(part)
+					if part == "" {
+						continue
+					}
+					n, err := strconv.Atoi(part)
+					if err == nil && n == wd {
+						return true
+					}
+				}
+				return false
+			},
+			// parseOptions 解析投票表单字段的 JSON 选项数组（select/radio/checkbox）。
+			"parseOptions": func(raw string) []string {
+				if raw == "" {
+					return []string{}
+				}
+				var out []string
+				if err := json.Unmarshal([]byte(raw), &out); err != nil {
+					return []string{}
+				}
+				return out
+			},
+			// percentOf 计算百分比（模板内无法做除法）。
+			"percentOf": func(part, total int64) int {
+				if total <= 0 {
+					return 0
+				}
+				return int(part * 100 / total)
+			},
+			// add 加法（模板序号 1-based 等场景）。
+			"add": func(a, b int) int {
+				return a + b
+			},
+			// fieldTypeLabel 返回表单字段类型的本地化名称（参与端题型标签）。
+			"fieldTypeLabel": func(lang, fieldType string) string {
+				key := map[string]string{
+					"text":     "vote.fieldTypeText",
+					"textarea": "vote.fieldTypeTextarea",
+					"select":   "vote.fieldTypeSelect",
+					"radio":    "vote.fieldTypeRadio",
+					"checkbox": "vote.fieldTypeCheckbox",
+					"number":   "vote.fieldTypeNumber",
+					"rating":   "vote.fieldTypeRating",
+					"rank":     "vote.fieldTypeRank",
+				}[fieldType]
+				if key == "" {
+					return ""
+				}
+				return i18n.T(lang, key)
+			},
+			// fieldTypeLabelClass 返回表单字段类型的标签配色（题型视觉区分）。
+			"fieldTypeLabelClass": func(fieldType string) string {
+				switch fieldType {
+				case "text", "textarea":
+					return "" // 默认灰
+				case "radio", "select":
+					return "uk-label-primary"
+				case "checkbox":
+					return "uk-label-success"
+				case "rating":
+					return "uk-label-warning"
+				case "rank":
+					return "uk-label-danger"
+				case "number":
+					return "uk-label-secondary"
+				default:
+					return ""
+				}
+			},
+			// toJSON 将值序列化为 JSON 并标记为安全的 JS 字面量。
+			// 必须用于 <script> 上下文中的 JSON 注入：template.HTML 会在 script 上下文中
+			// 被 html/template 按 JS 规则转义（引号被转义导致 JS 语法错误/值变成字符串），
+			// template.JS 则原样输出。
+			"toJSON": func(v interface{}) template.JS {
+				b, err := json.Marshal(v)
+				if err != nil {
+					return template.JS("[]")
+				}
+				return template.JS(b)
+			},
+			"Safe": Safe,
+			// 兼容小写别名：模板中历史遗留 {{safe ...}} 调用
+			"safe": Safe,
+
+			// i18n 模板函数：
+			// 模板用法：{{t .LangCode "key"}} 或 {{t .LangCode "key" .Arg}}
+			// 语言名：{{langName "zh-CN"}} → 简体中文
+			"t": func(lang, key string, args ...interface{}) string {
+				return i18n.T(lang, key, args...)
+			},
+			"langName": func(lang string) string {
+				return i18n.Name(lang)
+			},
+		}}
+	})
+	return funcMap
+}
+
+func Safe(raw string) template.HTML {
+	return template.HTML(raw)
+}
diff --git a/internal/tracing/config.go b/internal/tracing/config.go
new file mode 100644
index 0000000..b49b732
--- /dev/null
+++ b/internal/tracing/config.go
@@ -0,0 +1,62 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package tracing
+
+import (
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/propagation"
+	"go.opentelemetry.io/otel/trace"
+)
+
+// config is a group of options for this instrumentation.
+type config struct {
+	TracerProvider trace.TracerProvider
+	Propagators    propagation.TextMapPropagator
+}
+
+// Option applies an option value for a config.
+type Option interface {
+	apply(*config)
+}
+
+// newConfig returns a config configured with all the passed Options.
+func newConfig(opts []Option) *config {
+	c := &config{
+		Propagators:    otel.GetTextMapPropagator(),
+		TracerProvider: otel.GetTracerProvider(),
+	}
+	for _, o := range opts {
+		o.apply(c)
+	}
+	return c
+}
+
+type propagatorsOption struct{ p propagation.TextMapPropagator }
+
+func (o propagatorsOption) apply(c *config) {
+	if o.p != nil {
+		c.Propagators = o.p
+	}
+}
+
+// WithPropagators returns an Option to use the Propagators when extracting
+// and injecting trace context from HTTP requests.
+func WithPropagators(p propagation.TextMapPropagator) Option {
+	return propagatorsOption{p: p}
+}
+
+type tracerProviderOption struct{ tp trace.TracerProvider }
+
+func (o tracerProviderOption) apply(c *config) {
+	if o.tp != nil {
+		c.TracerProvider = o.tp
+	}
+}
+
+// WithTracerProvider returns an Option to use the TracerProvider when
+// creating a Tracer.
+func WithTracerProvider(tp trace.TracerProvider) Option {
+	return tracerProviderOption{tp: tp}
+}
diff --git a/internal/tracing/flamego.go b/internal/tracing/flamego.go
new file mode 100644
index 0000000..4520173
--- /dev/null
+++ b/internal/tracing/flamego.go
@@ -0,0 +1,62 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package tracing
+
+import (
+	"fmt"
+	"net/http"
+
+	"github.com/flamego/flamego"
+
+	"go.opentelemetry.io/otel/propagation"
+	semconv "go.opentelemetry.io/otel/semconv/v1.12.0"
+	oteltrace "go.opentelemetry.io/otel/trace"
+)
+
+// instrumentationName is the name of this instrumentation package.
+const instrumentationName = "github.com/tamakyi/TamaBox/internal/tracing"
+
+// Middleware returns a flamego Handler to trace requests to the server.
+func Middleware(service string, opts ...Option) flamego.Handler {
+	cfg := newConfig(opts)
+	tracer := cfg.TracerProvider.Tracer(
+		instrumentationName,
+		oteltrace.WithInstrumentationVersion("1.0.0"),
+	)
+	return func(res http.ResponseWriter, req *http.Request, c flamego.Context) {
+		savedCtx := c.Request().Request.Context()
+		defer func() {
+			c.Request().Request = c.Request().Request.WithContext(savedCtx)
+		}()
+
+		ctx := cfg.Propagators.Extract(savedCtx, propagation.HeaderCarrier(c.Request().Header))
+		opts := []oteltrace.SpanStartOption{
+			oteltrace.WithAttributes(semconv.NetAttributesFromHTTPRequest("tcp", c.Request().Request)...),
+			oteltrace.WithAttributes(semconv.EndUserAttributesFromHTTPRequest(c.Request().Request)...),
+			oteltrace.WithAttributes(semconv.HTTPServerAttributesFromHTTPRequest(service, "", c.Request().Request)...),
+			oteltrace.WithSpanKind(oteltrace.SpanKindServer),
+		}
+		// span 名只取 URL.Path，不含 query string：
+		// RequestURI 会把 ?t=<问题token>、找回密码 ?code= 等私密参数原样写入 trace。
+		spanName := c.Request().URL.Path
+		if spanName == "" {
+			spanName = fmt.Sprintf("HTTP %s route not found", c.Request().Method)
+		}
+		ctx, span := tracer.Start(ctx, spanName, opts...)
+		defer span.End()
+
+		// pass the span through the request context
+		c.Request().Request = c.Request().Request.WithContext(ctx)
+
+		// serve the request to the next middleware
+		c.Next()
+
+		status := c.ResponseWriter().Status()
+		attrs := semconv.HTTPAttributesFromHTTPStatusCode(status)
+		spanStatus, spanMessage := semconv.SpanStatusFromHTTPStatusCodeAndSpanKind(status, oteltrace.SpanKindServer)
+		span.SetAttributes(attrs...)
+		span.SetStatus(spanStatus, spanMessage)
+	}
+}
diff --git a/internal/tracing/tracing.go b/internal/tracing/tracing.go
new file mode 100644
index 0000000..6ae2638
--- /dev/null
+++ b/internal/tracing/tracing.go
@@ -0,0 +1,27 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package tracing
+
+import (
+	"github.com/pkg/errors"
+	"go.opentelemetry.io/otel"
+	stdout "go.opentelemetry.io/otel/exporters/stdout/stdouttrace"
+	"go.opentelemetry.io/otel/propagation"
+	sdktrace "go.opentelemetry.io/otel/sdk/trace"
+)
+
+func Init() (*sdktrace.TracerProvider, error) {
+	exporter, err := stdout.New(stdout.WithPrettyPrint())
+	if err != nil {
+		return nil, errors.Wrap(err, "create stdout exporter")
+	}
+	tp := sdktrace.NewTracerProvider(
+		sdktrace.WithSampler(sdktrace.AlwaysSample()),
+		sdktrace.WithBatcher(exporter),
+	)
+	otel.SetTracerProvider(tp)
+	otel.SetTextMapPropagator(propagation.NewCompositeTextMapPropagator(propagation.TraceContext{}, propagation.Baggage{}))
+	return tp, nil
+}
diff --git a/outputs/TamaBox-v4-code-review-2026-08-27.md b/outputs/TamaBox-v4-code-review-2026-08-27.md
new file mode 100644
index 0000000..3e6d000
--- /dev/null
+++ b/outputs/TamaBox-v4-code-review-2026-08-27.md
@@ -0,0 +1,113 @@
+# TamaBox-v4 完整代码审阅报告
+
+> 审阅时间：2026-08-27
+> 审阅对象：`TamaBox-v4-new-toupiao`（基于 NekoBox 的 Go 匿名问答 + 匿名投票 Web 应用，Flamego + GORM + MySQL/PostgreSQL + Redis）
+> 审阅范围：全项目 Go 源码（约 20.8k 行，86 个 internal 文件 + 21 个 route 文件 + cmd）、关键模板、路由/中间件、配置
+> 审阅方式：针对性精读（认证/会话、投票、私聊、提问、个人资料、Markdown 清洗、缓存、路由/中间件、限流）+ 全代码库自动化广度扫描 + 逐项复检历史报告（08-13 / 08-18 / 08-24 / 08-26）+ 核对 Flamego 框架源码确认中间件语义
+> 结论口径：仅就当前代码可直接确认的问题定性，未做全量编译/运行（本环境缺 CGO/libwebp 与测试数据库，与 08-26 报告一致）
+
+---
+
+## 一、总体结论
+
+**当前代码质量高、安全水位扎实，历史报告中的 P0/P1 缺陷已全部修复，未发现可阻断上线的 P0/P1 漏洞。** 剩余问题集中在 **健壮性 / 可扩展性（P2）** 与 **防御纵深缺口 / 易用性（P3）**，无直接可利用的高危漏洞。
+
+本项目在安全意识上明显优于一般同类项目：CSRF 全覆盖、会话密码版本失效、图片像素/解压炸弹防护、代理 SSRF 三处防护、内容审核 fail-closed、匿名投票复合唯一索引 + HMAC 签名指纹、SafeGo 防崩溃、私聊原子计数 + 回滚、CSV 公式注入防护等均已落地。
+
+---
+
+## 二、历史问题复检（相对 08-13 / 08-18 / 08-24 / 08-26）
+
+逐条核对后，**此前报告中列为 P0/P1/P2 的问题在当前代码中均已处理**：
+
+| 历史问题 | 状态 | 当前证据 |
+|---|---|---|
+| 真实云服务/数据库密钥入库 | 已知未处理 | 按用户要求保留（测试环境凭据），非本次新增 |
+| 图片解压炸弹（OOM） | ✅ 已修复 | `internal/imagecheck` 像素校验 + 三处解码入口接入 |
+| 6 位 token 可爆破 | ✅ 已缓解 | 投票 `LinkToken` 用 `randstr.String(12)`；私聊 `Conversation.Token` 6 位（旧约定，低风险） |
+| PostgreSQL schema 硬编码 | ✅ 已修复 | `fixPostgresSequences` 改用 `conf.Database.Schema` |
+| 密码修改后旧会话仍有效 | ✅ 已修复 | `PasswordVersion` + `authenticatedUser` 版本校验 |
+| 找回密码邮箱枚举 | ✅ 已修复 | 邮箱不存在也渲染统一「已发送」页 |
+| 内容审核 fail-open（08-24 P1-1 两处） | ✅ 已修复 | `question.go:136-149`、`page.go:317-329`、`page.go:444-458`、`route/vote/censorCheck` 均在 `err != nil` 时拒绝发布 |
+| 匿名 `vote_fp` Cookie 可伪造（08-26 P1-01） | ✅ 已修复 | `route/vote/vote.go:83-93` `validVoterToken` 做 HMAC 签名校验；`newVoterToken` 签名 |
+| Markdown 实体编码 XSS（08-26 P1-02） | ✅ 已修复 | `internal/template/markdown.go:147` `sanitizeHTML` 对 `TextToken` 调用 `html.EscapeString`；`markdown_test.go:35` 含 XSS 回归测试 |
+| 多选重复选项重复计票（08-26 P2-01） | ✅ 已修复 | `parseMultipleOptionIDs`（`vote.go:753-780`）用 `seen` 集合去重 |
+| `max_votes_per_fingerprint` 配置矛盾（08-26 P2-02） | 🟡 已缓解 | 业务规则固定为一人一票（`parseVoteMeta` 硬编码 `maxVotes=1`，UI 无控制）；但 DB 列与模板默认值仍残留（见 P3-5） |
+
+---
+
+## 三、新发现的问题（本次审阅）
+
+### P2（中危 / 健壮性·可扩展性）
+
+**P2-1 投票结果/CSV 全量加载所有提交记录（O(N) 内存+CPU）**
+`LoadResults`（`route/vote/vote.go:209`）对 multiple/rank/rating 类型，以及 `aggregateFormFieldStats` / `aggregateCustomStats` / `VoteResults` / `VoteExportCSV` 均使用 `db.VoteSubmissions.ListByVoteID(ctx, voteID, nil)`（无游标、无上限）把**全部提交记录载入内存**再逐条 `json.Unmarshal` 聚合。结果虽有 30s 进程内 TTL 缓存，但每个缓存窗口的首次计算对热门投票（数千~数万条）是一次性内存/CPU 尖峰。配合 P2-2 的灌票风险，可能放大为资源耗尽。
+**建议**：聚合逻辑下推 SQL（`COUNT ... GROUP BY option_id` 已有；rank/rating/form 应补 `SUM/AVG` 或分页流式聚合）；或限定单次加载行数上限并降级展示。
+
+**P2-2 匿名投票防刷阈值偏高 + 清 Cookie 可绕过 token 维度限流**
+`voteSubmitRateLimitMiddleware`（`internal/route/ratelimit.go:151`）对匿名用户：
+- IP 维度兜底 = `limit*10` = **200 次/分钟**；
+- token 维度 = `limit` = 20 次/分钟，但**仅当请求携带有效签名 `vote_fp` 时才计数**。
+
+若箱主关闭验证码（`RequireCaptcha=false`，DB 默认 `true` 但可由表单关闭），攻击者在每次提交时发送无效/清空 `vote_fp` Cookie，`ensureVoterToken` 会签发一个**全新的有效签名 token**，token 维度限流永不触发，仅 IP 维度 200/min 兜底生效 → 单 IP 每分钟可灌入最多 200 张真实票，污染结果统计。
+**建议**：匿名投票始终要求验证码（或行为验证码）；降低 IP 兜底阈值；或改为服务端持久化指纹（绑定 IP+UA 哈希）替代纯客户端 Cookie。
+
+### P3（低危 / 防御纵深·易用性）
+
+**P3-1 autoban 的 404 探测自动封禁失效**（经 Flamego 源码核实）
+`internal/route/autoban.go:46-58` 在 `defer` 中读取 `rw.Status()` 判断 404 探测并 `b.Record(KindNotFound)`。但 Flamego 的调度（`flamego@v1.9.4/context.go:190-229`）在**每个 handler 返回后、下游执行前**就运行 `defer`，且此时 `Written()==false`、`Status()==0`，因此 `KindNotFound` 分支**永远不触发**——404 探测型自动封禁形同虚设。敏感路径封禁（`KindSensitive`，在 defer 前同步设置）仍正常。
+**建议**：在 allow 分支显式调用 `ctx.Next()`，使 `defer` 在下游 handler 执行后才运行；或在 `NotFound` 钩子里直接统计 404 信号。
+
+**P3-2 进程内结果缓存跨实例不一致 + 新提交延迟最多 30s**
+`resultsCache` / `voteTextRepliesCache` 为单进程 TTL 缓存（`internal/cache/cache.go` 已确认 `sync.RWMutex` 并发安全）。多实例横向扩容时各实例独立缓存，结果会发散；且提交成功后未主动失效，参与者「投票后查看结果」最多延迟 30s 才反映自己的票。
+**建议**：多实例改用 Redis 共享缓存（项目已用 flamego/cache-redis）；或在 `VoteSubmissions.Create` 成功后删除对应 `vote.ID` 的结果缓存 key。
+
+**P3-3 死配置字段 `max_votes_per_fingerprint`**
+业务逻辑已固定为一人一票（`parseVoteMeta` 硬编码 `maxVotes=1`，UI 无控制项），但 `db.Votes.MaxVotesPerFingerprint` 列仍存在并被写入，`VoteNew` 仍设默认值 1。无功能影响，但易误导维护者以为可配置多票。
+**建议**：移除该列与模板默认值，或补 UI/文档明确「一人一票」。
+
+**P3-4 草稿/归档投票 POST `/vote/{token}/submit` 提示误导**
+`route/vote/vote.go:647-655`：`isVoteActive` 为 false 且非 ended 时统一提示「该投票尚未开始」。对 `draft`/`archived` 状态的投票（其链接本不该被提交），该提示不准确（实际应提示「不存在或已失效」）。
+**建议**：按 `vote.Status` 区分提示文案。
+
+**P3-5（信息项，非缺陷）已确认无误的点**
+- 复合唯一索引 `(vote_id,user_id)` / `(vote_id,voter_token)` 利用 MySQL/PG 的 NULL 不冲突语义正确实现一人一票；`VoteSubmissions.Create` 用 `isDuplicateKeyError` 将唯一冲突转为 `ErrVoteAlreadyVoted` 兜底 TOCTOU。
+- `db.User` 的 `Password`/`PasswordVersion`/`PagePassword`/`AskPassword` 均为 `json:"-"`，`ProfileAPI`（`ctx.JSON(ctx.User)`）与 `ExportProfileJSON` 均**不泄漏口令哈希**。
+- `resultsCache` 返回共享 `*Results` 指针，构造后未被变异，当前安全；属脆弱点（未来若在某 handler 内修改该对象会影响所有读者）。
+
+---
+
+## 四、改进方向（非缺陷，建议项）
+
+1. **聚合下推 SQL**：投票结果统计（rank/rating/form）改为数据库层聚合或分页流式处理，消除热门投票的内存/CPU 尖峰（对应 P2-1）。
+2. **匿名指纹防刷增强**：持久化指纹 + 始终验证码 + 更严格的 IP 阈值，替代纯客户端 Cookie（对应 P2-2）。
+3. **缓存失效与一致性**：提交成功后主动失效结果缓存；多实例用 Redis 共享（对应 P3-2）。
+4. **自动化测试补齐**：增加集成/E2E 用例覆盖——内容审核 fail-closed、并发一人一票（唯一索引兜底）、`vote_fp` 签名防伪造、SSRF 逐跳校验、CSV 公式注入、autoban 敏感路径封禁。
+5. **CI 质量门禁**：引入 `golangci-lint` + `govulncheck`；当前 `go test ./...` 因 CGO/libwebp 与未配置测试 DB 无法全绿，建议在带 C 工具链与测试库的预发布环境跑全量 `go test ./...`、`go vet ./...`、`govulncheck ./...`。
+6. **清理与一致性**：移除死配置 `max_votes_per_fingerprint`、修正草稿/归档投票提交提示、统一错误日志与监控指标（若干 `_ =`/忽略错误可改为显式 metric）。
+
+---
+
+## 五、审阅覆盖清单
+
+| 模块 | 审阅结论 |
+|---|---|
+| 认证/会话（`route/auth`、`internal/context/auth`、`internal/db/users`） | 密码版本失效、会话重生成到位；口令哈希 `json:"-"` 不泄漏 |
+| 投票参与端（`route/vote/vote.go`） | 一人一票（唯一索引+签名 token）、fail-closed 审核、CSRF、去重、限流到位；P2-1/P2-2 待优化 |
+| 投票管理端（`route/user/vote.go`） | `getOwnedVote` 全链路归属校验；草稿/发布分级正确；P3-4 提示待修 |
+| 私聊（`internal/route/chat`） | 原子计数+回滚、归属校验、fail-closed 审核、邮件节流，均正确 |
+| 提问（`route/question`） | 审核 fail-closed、token 访问控制、追问等待逻辑正确 |
+| Markdown 清洗（`internal/template/markdown.go`） | 实体编码 XSS 已修复（EscapeString） |
+| 缓存（`internal/cache`） | 并发安全（RWMutex）；P3-2 跨实例/失效待优化 |
+| 路由/中间件/限流（`internal/route`） | 限流/IP 封禁/自动封禁正确拦截（WriteHeader 即停链）；P3-1 autoban 404 探测失效 |
+| 个人资料/导出/停用（`route/user/profile.go`） | 仅操作 `ctx.User.ID`，无 IDOR；导出不泄漏口令 |
+| 模板 XSS 输出 | `QuestionFormat`/`AnswerFormat` 已 EscapeString；仅 CSRF token 用 `Safe`（服务端生成）|
+
+---
+
+## 六、优先级建议
+
+1. （可选，按需）P2-1 / P2-2：若投票功能面向公网且预计有热门投票，优先加固匿名防刷与结果聚合性能。
+2. P3-1：修正 autoban 404 探测（一行 `ctx.Next()` 改动，恢复防御纵深）。
+3. P3-2 ~ P3-4：随迭代清理，不阻塞上线。
+4. 上线前在完整 CI 环境跑全量测试与漏洞扫描，确认无回归。
diff --git a/outputs/TamaBox-v4-code-review-followup-2026-08-26.md b/outputs/TamaBox-v4-code-review-followup-2026-08-26.md
new file mode 100644
index 0000000..aea9dbe
--- /dev/null
+++ b/outputs/TamaBox-v4-code-review-followup-2026-08-26.md
@@ -0,0 +1,140 @@
+# TamaBox-v4 修复后代码复审报告
+
+- **复审时间**：2026-08-26
+- **审阅对象**：TamaBox-v4
+- **复审基线**：`outputs/TamaBox-v4-code-review-report-2026-08-26.md`
+- **复审范围**：上一轮 4 项确认问题的修复调用链、相关数据库模型、模板与回归测试；并对修复影响面做定向静态复查。
+- **结论口径**：本报告仅将能由当前代码直接确认的问题列为确认问题；环境限制与建议性事项单独列出。
+
+## 一、复审结论
+
+上一轮报告中的 4 项确认问题均已完成代码级修复，未发现原问题仍可沿原路径复现：
+
+| 原问题 | 复审结论 | 关键位置 |
+|---|---|---|
+| P1-01 匿名 `vote_fp` Cookie 可伪造 | **已修复** | `route/vote/vote.go:62-120, 691-700` |
+| P1-02 Markdown 实体编码导致 XSS | **已修复** | `internal/template/markdown.go:143-147` |
+| P2-01 多选重复选项可重复计票 | **已修复** | `route/vote/vote.go:232-247, 749-775, 802-809` |
+| P2-02 投票次数配置与一人一票约束矛盾 | **已修复** | `route/user/vote.go:199-202, 563-566`、`templates/user/vote-form.html:85-88` |
+
+本轮复审另发现并修复了一个由 P1-01 修复引入的兼容性问题：签名 token 长度为 108 字符，原数据库字段 `size:64` 不足，已调整为 `size:128`（`internal/db/vote_submissions.go:54-55`）。
+
+**当前代码级结论：未发现 P0/P1/P2 确认问题。**
+
+## 二、逐项复审证据
+
+### 1. P1-01：匿名指纹 Cookie 伪造与防刷绕过
+
+**状态：已修复。**
+
+- `newVoterToken` 生成 32 字节随机 nonce，格式为 `64 位十六进制 nonce + "." + HMAC-SHA256 签名`。
+- `signVoterToken` 使用 `conf.Server.XSRFKey` 作为服务端密钥；配置初始化已强制要求该密钥非空。
+- `validVoterToken` 检查分段数量、nonce 长度、十六进制格式，并使用 `hmac.Equal` 比较签名。
+- `ensureVoterToken` 对无效/伪造 Cookie 重新签发；`currentVoterToken` 对无效 Cookie 返回空值，不再将客户端任意字符串作为身份依据。
+- 匿名提交无论是否带有效 Cookie，均按投票维度执行 24 小时 IP 计数；当前一人一票策略下，同一投票同一 IP 窗口内最多接受一次匿名提交。
+- 数据库 `UNIQUE(vote_id, voter_token)` 仍作为有效 token 的最终并发防重兜底。
+
+**残余设计取舍**：IP 兜底会对 NAT、校园网、公司网络等共享出口产生误伤；这是保守防刷策略，不是身份伪造漏洞。若业务必须支持共享出口多人投票，应改用验证码、设备/行为风控或更细粒度限流，而不能取消服务端限流。
+
+### 2. P1-02：Markdown 实体编码 XSS
+
+**状态：已修复。**
+
+- `sanitizeHTML` 的 `html.TextToken` 分支现在对 tokenizer 已解码的文本调用 `html.EscapeString` 后再写入 `template.HTML`。
+- 因此 `&lt;script&gt;`、双重编码输入不会在重建 HTML 时重新变成可执行标签。
+- 标签、属性、URL 白名单逻辑保持有效；事件属性和危险协议仍被过滤。
+- 回归测试已覆盖实体编码、双重编码、script、事件属性、危险 URL、iframe、SVG、style 以及 font color 属性注入。
+
+### 3. P2-01：多选重复 option ID 重复计票
+
+**状态：已修复。**
+
+- `parseMultipleOptionIDs` 统一负责多选参数解析。
+- 解析时使用 `seen` 集合；同一 `option_id` 出现两次直接返回“选项不能重复选择”。
+- 同时校验空提交、最大选项数、选项归属和 `uint` 溢出，避免异常数值绕过校验。
+- `LoadResults` 的多选聚合层也对历史数据中的重复 option ID 做防御性去重，因此旧异常数据不会在每次结果计算中再次放大统计。
+- 新增测试覆盖正常多选、重复选项、超出上限、无效选项和整数溢出。
+
+### 4. P2-02：MaxVotesPerFingerprint 与数据库约束矛盾
+
+**状态：已修复。**
+
+- 当前数据模型明确采用一人一票：登录用户由 `UNIQUE(vote_id, user_id)` 约束，匿名用户由 `UNIQUE(vote_id, voter_token)` 与 IP 兜底共同保护。
+- 管理端解析不再信任旧页面或手工请求提交的 `max_votes_per_fingerprint`，统一按 `1` 保存。
+- 新建/编辑失败回填也固定显示 `1`；表单输入设置为 `readonly`、`max="1"`，避免继续传达可配置多票语义。
+- 四种语言的字段文案已改为明确的一人一票含义。
+
+## 三、本轮新增兼容性问题及修复
+
+签名 token 的组成长度为：64 字符 nonce + 1 个分隔符 + 43 字符 Raw Base64URL HMAC = **108 字符**。复审过程中确认原字段：
+
+```go
+VoterToken *string `gorm:"size:64;..."`
+```
+
+不足以存储完整 token，可能导致 MySQL 严格模式下匿名提交失败或 token 截断。现已改为：
+
+```go
+VoterToken *string `gorm:"size:128;uniqueIndex:idx_submission_token"`
+```
+
+并加入 token 长度回归断言。部署时依赖启动阶段的 GORM AutoMigrate 将字段扩容；上线前应在预生产数据库确认迁移结果和唯一索引状态。
+
+## 四、验证结果
+
+### 通过
+
+```text
+gofmt -d route/vote/vote.go route/vote/vote_stats_test.go route/user/vote.go \
+  internal/db/vote_submissions.go
+# 无输出，格式通过
+
+go test -count=1 ./route/vote ./internal/template ./templates ./internal/i18n \
+  ./internal/security/autoban ./internal/security/censor ./internal/imagecheck \
+  ./internal/shared ./internal/cache
+# 全部 PASS
+
+go vet ./route/vote ./internal/template ./templates ./internal/i18n
+# 无输出，检查通过
+```
+
+### 全量验证限制
+
+```text
+go test ./...
+go vet ./...
+```
+
+未能全绿，原因是当前环境已有的基础设施限制，不是本轮修复代码引入：
+
+1. `github.com/chai2010/webp@v1.4.0` 在当前 Windows 环境缺少 CGO/WebP 编译符号（如 `webpGetInfo`、`webpDecodeRGB`），导致 `internal/storage`、`route/question`、`route/user`、主程序等相关包无法完整编译。
+2. `internal/db` 测试未配置数据库类型，测试初始化报 `Unknown database type: ""`。
+
+因此仍需在生产同构的 Linux/CGO 构建环境，并配置测试数据库后执行：
+
+```text
+go test ./...
+go vet ./...
+govulncheck ./...
+```
+
+## 五、上线前建议
+
+1. 在预生产数据库执行/确认 AutoMigrate，确认 `vote_submissions.voter_token` 已扩容到至少 128 字符，且唯一索引仍存在。
+2. 使用两个不同匿名客户端验证：同一 IP 同一投票第二次提交被拦截；伪造 `vote_fp` 会被覆盖且不能绕过 IP 限制；正常匿名首次投票成功。
+3. 用真实浏览器验证实体编码文本仅以文字显示，不执行脚本；覆盖提问、回答、投票描述和结果页等 Markdown 输出点。
+4. 若站点存在大量共享出口，结合验证码或行为风控评估 IP 一票策略的误伤率。
+
+## 六、修改文件清单
+
+- `internal/template/markdown.go`
+- `internal/template/markdown_test.go`
+- `route/vote/vote.go`
+- `route/vote/vote_stats_test.go`
+- `route/user/vote.go`
+- `templates/user/vote-form.html`
+- `internal/db/vote_submissions.go`
+- `internal/i18n/dict_zh_cn.go`
+- `internal/i18n/dict_zh_tw.go`
+- `internal/i18n/dict_en.go`
+- `internal/i18n/dict_ja.go`
diff --git a/outputs/TamaBox-v4-code-review-report-2026-08-26.md b/outputs/TamaBox-v4-code-review-report-2026-08-26.md
new file mode 100644
index 0000000..23eff3b
--- /dev/null
+++ b/outputs/TamaBox-v4-code-review-report-2026-08-26.md
@@ -0,0 +1,105 @@
+# TamaBox-v4 代码逻辑与安全审阅报告
+
+- **审阅时间**：2026-08-26
+- **审阅对象**：`C:\Users\Tamakyi Gekka\Downloads\TamaBox-v4-backup-20260813-025725-release\TamaBox-v4-new-toupiao`
+- **审阅范围**：Go 后端、路由/中间件、投票与私聊业务、模板渲染与 Markdown 清洗、配置与测试
+- **审阅方式**：静态代码审阅、调用链回溯、关键路径输入校验检查、现有测试执行
+- **结论口径**：本报告只把能由当前代码直接确认的问题列为“确认问题”；无法在当前环境完整运行的部分单列为验证限制。
+
+## 一、总体结论
+
+当前版本已有较多安全加固（CSRF、会话密码版本、图片像素限制、代理 SSRF 防护、内容审核、投票提交唯一索引等），但仍发现 **4 项需要处理的确认问题**：
+
+- **P1：2 项**：匿名投票指纹 Cookie 可伪造绕过防刷；Markdown 清洗器存在实体编码导致的存储型 XSS。
+- **P2：2 项**：多选重复选项可被重复计数；“同一指纹可投次数”配置与数据库唯一索引/应用逻辑不一致，配置大于 1 时实际仍只能投 1 次。
+
+因此，当前不建议直接以“P0/P1 已全部清零”作为上线判断。至少应先修复两项 P1，并对投票防刷策略做明确取舍。
+
+## 二、确认问题清单
+
+### P1-01 🔴 匿名投票指纹 Cookie 未签名，可无限伪造绕过防刷
+
+| 项目 | 详情 |
+|---|---|
+| 位置 | `route/vote/vote.go:52-90`、`route/vote/vote.go:619-669` |
+| 触发条件 | 匿名投票，攻击者可自行发送任意 `vote_fp` Cookie 值 |
+| 证据 | `currentVoterToken` 直接返回 Cookie 值；`ensureVoterToken` 也只检查“是否存在”，未校验服务端签名或格式。匿名提交只有在 `currentVoterToken(ctx) == ""` 时才执行 IP 计数（`route/vote/vote.go:656-665`）。数据库唯一索引只约束同一 `vote_id + voter_token`，攻击者每次换一个伪造值即可创建一条新记录。 |
+| 影响 | 可绕过匿名投票的 IP 兜底与 Cookie 防重复机制，批量提交大量票；结果统计可被污染，验证码未开启时尤其明显。 |
+| 修复建议 | 不要把客户端 Cookie 当作可信身份。使用带 HMAC 的服务端签名 token（签名内容包含随机值、版本与过期时间），服务端拒绝无效/过期/格式异常 token；对匿名提交始终保留 IP/设备/行为限流，不应因 Cookie 存在而跳过 IP 保护。若需要强防刷，使用服务端持久化指纹或按投票维度的限速。 |
+
+### P1-02 🔴 Markdown 清洗器对实体编码文本未再次转义，存在存储型 XSS 路径
+
+| 项目 | 详情 |
+|---|---|
+| 位置 | `internal/template/markdown.go:95-117`，重点为 `internal/template/markdown.go:103-106` |
+| 触发条件 | 用户输入经过 Markdown 渲染后，文本中包含实体编码形式的 HTML，例如 `&lt;img src=x onerror=alert(1)&gt;`；该结果通过 `MarkdownToHTML` 以 `template.HTML` 输出。 |
+| 证据 | `html.Tokenizer.Text()` 返回“已解码”的文本（`golang.org/x/net/html` 文档/实现明确为 unescaped text）；当前 `extractPlainText` 在 `html.TextToken` 分支直接 `out.WriteString(string(tokenizer.Text()))`，未调用 `html.EscapeString`。因此实体编码可能重新变成原始 `<...>` 字符并被当作 HTML 输出。`MarkdownToHTML` 最终在第 73 行以 `template.HTML(cleaned)` 返回，形成危险输出路径。现有 `internal/template/markdown_test.go:35-54` 没有覆盖实体编码绕过。 |
+| 影响 | 提问、回答、投票描述等使用 Markdown 渲染的内容可能形成存储型 XSS；受影响页面上的访问者/登录用户可能执行攻击者脚本。 |
+| 修复建议 | 在 `sanitizeHTML` 的 `html.TextToken` 分支对 tokenizer 文本再次使用 `html.EscapeString` 后写入；或改用成熟且经过长期验证的 HTML sanitizer（如 bluemonday），并补充 `&lt;script&gt;...`、双重编码、属性上下文等回归测试。修复后检查所有 `template.HTML` 输出点。 |
+
+### P2-01 🟠 多选提交未拒绝重复选项 ID，可造成单次提交重复计票
+
+| 项目 | 详情 |
+|---|---|
+| 位置 | `route/vote/vote.go:741-758` |
+| 触发条件 | 对多选投票手工构造 POST，使 `option_ids` 重复，例如 `option_ids=12&option_ids=12`。 |
+| 证据 | 后端只检查 `len(ids) > v.MaxChoices`、选项 ID 是否存在，然后直接将每个 ID追加到 `chosen`；未使用 `seen` 集合去重。结果聚合 `route/vote/vote.go:203-223` 遍历 `data.Options`，每次出现都增加该选项计数。 |
+| 影响 | 一次提交可让同一选项被重复计数；若 `MaxChoices` 大于 1，可用重复值放大某选项票数，破坏统计可信度。 |
+| 修复建议 | 解析时维护 `seenOptionIDs`，重复 ID 直接拒绝或去重；同时在统计层对历史异常数据做防御性去重，并补充重复参数测试。 |
+
+### P2-02 🟠 “同一指纹可投次数”配置与实际实现矛盾
+
+| 项目 | 详情 |
+|---|---|
+| 位置 | `route/user/vote.go:199-205`、`route/vote/vote.go:619-669`、`internal/db/vote_submissions.go:49-55` |
+| 触发条件 | 箱主将 `max_votes_per_fingerprint` 设置为 2-100。 |
+| 证据 | 管理端允许并保存 1-100（`route/user/vote.go:199-205`）；但 `VoteSubmission` 定义了唯一索引 `UNIQUE(vote_id, voter_token)`，且提交前 `HasTokenVoted` 一旦已有记录就直接拒绝（`route/vote/vote.go:627-635`）。因此同一匿名指纹对同一投票始终只能提交一次。该配置只在“无 Cookie 时”的 IP 计数分支使用，无法实现其名称暗示的多次投票。 |
+| 影响 | 管理员配置与实际行为不一致；若业务预期允许同一指纹投多次，功能失效；若业务只允许一票，配置项会误导并使防刷策略难以理解。 |
+| 修复建议 | 二选一：①业务规则是一人一票，则把字段固定为 1、移除 2-100 UI 和相关逻辑；②业务确实需要多投，则去掉 `UNIQUE(vote_id, voter_token)`，改为服务端计数/窗口约束，并使预检、数据库约束、IP 兜底和结果策略统一。不要只改 UI。 |
+
+## 三、已检查且未发现确认问题的重点区域
+
+- **认证/会话**：登录成功后调用会话 ID 重生成；密码版本变更会使旧会话失效（`route/auth/login.go:64-74`、`internal/context/auth.go:26-30`）。
+- **CSRF**：Web POST 统一进入 CSRF 校验；注销已改为 POST；当前未发现可直接确认的高风险 CSRF 缺口。
+- **投票归属**：管理端通过 `getOwnedVote` 校验 `vote.UserID == ctx.User.ID`，结果查看、编辑、发布、关闭、删除、导出均复用该校验。
+- **SQL 注入**：业务查询主要使用参数绑定；本次检索未发现由用户输入直接拼接 SQL 的确认路径。
+- **远程图片代理**：域名白名单、私网 IP 拦截、重定向逐跳校验、固定解析 IP 拨号和响应体上限均已存在；仍建议后续补充集成测试。
+- **图片上传**：已在解码前检查像素上限，降低解压炸弹风险。
+- **Flash/模板普通文本**：`templates/base/alert.html` 使用普通模板转义；当前未发现历史报告所述的 FlashTip 原样 HTML 输出问题。
+
+## 四、验证结果与环境限制
+
+### 已通过
+
+```text
+go test ./internal/template ./route/vote ./templates ./internal/security/autoban \
+  ./internal/security/censor ./internal/imagecheck ./internal/shared ./internal/i18n
+PASS
+```
+
+### 完整测试未能作为全绿结论
+
+`go test ./...` 当前失败，主要原因是：
+
+1. 本机 CGO/WebP 依赖导致 `github.com/chai2010/webp` 编译错误（`webpGetInfo` 等符号缺失），进而使 `internal/storage`、`route/question`、`route/user`、主程序等包无法完整编译。
+2. `internal/db` 测试未配置数据库类型，多个测试报 `Unknown database type: ""`。
+
+上述失败不等同于本次发现的 P1/P2 已被测试覆盖；建议在带 C 工具链与测试数据库的 CI/预发布环境重新执行：
+
+```text
+go test ./...
+go vet ./...
+govulncheck ./...
+```
+
+## 五、修复优先级建议
+
+1. **P1-02**：先修 Markdown 清洗器实体编码绕过，并新增 XSS 回归测试。
+2. **P1-01**：改为服务端签名匿名 token；同时恢复匿名提交的稳定限流，不因客户端 Cookie 存在而完全跳过 IP/行为防刷。
+3. **P2-01**：多选参数去重 + 统计层防御性去重。
+4. **P2-02**：明确“一人一票”还是“同指纹多票”，统一数据库约束、应用预检、配置和 UI 文案。
+5. 在修复后使用真实测试数据库、启用 CGO 的构建环境重新跑全量测试与漏洞扫描。
+
+## 六、与历史报告的差异说明
+
+项目内已有的 `code-review-report-final.md` 将上一轮结论描述为“P0/P1 全部清零”。本次复审发现的 2 项 P1 与投票相关 P2 属于当前代码路径中仍存在的独立问题，因此不能直接沿用上一轮“全部清零”的结论；应以本报告的当前代码证据为准。
diff --git a/outputs/TamaBox-v4-feature-control-fix-review-2026-08-31.md b/outputs/TamaBox-v4-feature-control-fix-review-2026-08-31.md
new file mode 100644
index 0000000..7c522e9
--- /dev/null
+++ b/outputs/TamaBox-v4-feature-control-fix-review-2026-08-31.md
@@ -0,0 +1,144 @@
+# TamaBox-v4 功能管理修复 + 代码审阅报告
+
+- **日期**：2026-08-31（更新于同日 16:00，追加 §三 遗留项修复）
+- **范围**：4 个已报告问题的修复 + 全链路回归审阅 + 审阅发现项二次修复
+- **状态**：✅ 4 个问题已修复；✅ 审阅发现的 P1-2 / P2-1 已一并修复；仅剩已知边界 P2-2（时区约定，非 bug）
+
+---
+
+## 一、修复总览
+
+| # | 用户报告的问题 | 根因 | 修复 | 验证 |
+|---|---------------|------|------|------|
+| 1 | 🔴「开启该功能」取消勾选保存后自动恢复勾选 | `Enabled bool` 带 `gorm:"default:true"`，GORM 在 Create 时把零值 `false` 替换为默认值 `true` 写入（INSERT 值与 ON CONFLICT 的 `excluded.enabled` 都是 true） | 移除该标签，GORM 原样写入显式值 | 生成的 SQL 已确认写入 `false`；单元测试通过 |
+| 2 | 🟠 勾选「仅允许注册用户向我提问」后，二维码下仍显示「谁都可以以匿名的形式提问」 | `templates/question/list.html:165` 与 `question-not-found.html:86` 硬编码匿名文案，与 `HarassmentSetting` 无关 | 文案随设置联动：新增 `ask.registerOnly` 词条，`Pager` 注入 `RegisterOnlyAsk`，模板二选一 | 新增 3 个模板渲染测试 |
+| 3 | 🟠 功能关闭时只显示「提问功能尚未开放」，缺少上次关闭/下次开放时间 | 关闭提示仅有 `FeatureClosedMessage` 一行 | `FeatureState` 新增 `NextOpenAt` / `LastCloseAt`，关闭提示下追加两行时间信息 | 新增 2 个渲染测试 + 逻辑单元测试 |
+| 4 | 🟡 希望支持每周几 / 每天几点到几点循环开放 | 原模型只有一次性 `OpenAt/CloseAt` | 新增 `ScheduleDays`（周几列表）+ `ScheduleStart/End`（每日时段），`Evaluate` 综合判定 | 新增 20+ 个单元测试用例 |
+
+**验证结果**：`internal/db`、`internal/i18n`、`internal/template`、`templates`、`internal/shared`、`internal/security/censor` 全部测试通过；`go vet ./...` 无新增告警（仅 Windows 沙箱 webp CGO 缺库的已知噪音）；模板解析/跨引用/渲染测试全绿。
+
+---
+
+## 二、修复细节
+
+### 1. 问题 1 根因（P0，已修复）
+
+`internal/db/feature_control.go`：
+
+```go
+// 修复前（BUG）
+Enabled bool `gorm:"default:true"`
+
+// 修复后
+Enabled bool  // 不要加 default:true 标签（注释已标注原因）
+```
+
+**机制**：GORM 在 `Create` 时对带 `default` 标签的字段，若值为零值（`false`）会替换为 `DefaultValueInterface`（`true`）再写库。实测生成 SQL：
+
+```sql
+-- 修复前：Enabled=false 传入 → VALUES 里写入 true
+INSERT INTO feature_controls (..., enabled, ...) VALUES (..., true, ...)
+  ON CONFLICT (...) DO UPDATE SET enabled = excluded.enabled  -- 也是 true
+
+-- 修复后：Enabled=false 传入 → VALUES 里写入 false ✓
+INSERT INTO feature_controls (..., enabled, ...) VALUES (..., false, ...)
+```
+
+**连带修复**：`backfillFeatureControls` 为私聊（默认关闭）补行时同样会把 `false` 写成 `true`——即历史上所有私聊默认关闭的用户可能被静默开启。同一处修复同时解决。
+
+### 2. 问题 2（P1，已修复）
+
+- `route/question/page.go`：`Pager` 注入 `ctx.Data["RegisterOnlyAsk"] = pageUser.HarassmentSetting == register_only`。
+- `templates/question/list.html` / `question-not-found.html`：二维码下文案改为
+  `{{ if .RegisterOnlyAsk }}仅允许注册用户向TA提问{{ else }}谁都可以以匿名的形式提问{{ end }}`。
+- 新增 i18n 词条 `ask.registerOnly`（4 种语言）。
+
+### 3. 问题 3（P1，已修复）
+
+- `FeatureState` 新增 `NextOpenAt` / `LastCloseAt`（由 `Evaluate` 计算）。
+- `Pager` 格式化为 `AskNextOpenAtStr` / `AskLastCloseAtStr`。
+- `new-question-template.html` 在关闭提示下方追加：
+  - `下次开放时间：2026-09-02 10:00`（未开始 / 循环定时未来再开时）
+  - `上次关闭时间：2026-08-31 18:00`（曾经开放过时）
+- 手动关闭 / 定量上限两类与时间无关的状态不展示时间行。
+
+### 4. 问题 4（P1，新功能）
+
+**模型**（`feature_controls` 新增 3 列，`AutoMigrate` 自动加列）：
+
+| 列 | 语义 |
+|----|------|
+| `schedule_days` | 逗号分隔周几，`0=周日…6=周六`（与 `time.Weekday` 一致）；空 = 每天都开放 |
+| `schedule_start` / `schedule_end` | 每日时段 `HH:MM`；都为空 = 开放日全天 |
+
+**语义**：
+- 只填开放日 → 该天全天开放（每周循环）；只填时间 → 每天该时段开放；都填 → 按周循环的每日时段开放。
+- 与一次性 `OpenAt/CloseAt` **叠加（AND）**：一次性窗口是硬性外边界，循环定时仅在其内生效。
+- `Evaluate` 判定优先级：手动关闭 > 未到一次性开放 > 已过一次性关闭 > 不在循环窗口 > 定量上限。
+- 「下次开放时间」按日向前扫描 8 天（覆盖全部周几组合），与一次性窗口取交集。
+
+**UI**（`feature-control-form.html`）：新增「循环定时（每周循环）」区块——7 个开放日胶囊复选框 + 每日开始/结束 `time` 输入；「只填开放日=全天 / 只填时间=每天」提示写入 hint。
+
+**校验**（`route/user/features.go`）：开始/结束必须成对填写；`HH:MM` 合法；结束须晚于开始；开放日仅接受 0-6 并去重排序存储。
+
+---
+
+## 三、审阅发现的其他潜在问题
+
+### 🟠 P1-1 一次性时间解析的时区偏移（已修复）
+
+- 位置：`route/user/vote.go` `parseTimeInput`。
+- 问题：`time.Parse("2006-01-02T15:04", s)` 解析结果落在 **UTC**，而 `Evaluate` 用 `time.Now()`（服务器本地时区）比较——服务器非 UTC 时，「定时开放/关闭」与「投票起止」会整体偏移（如东八区偏移 8 小时）。
+- 修复：改用 `time.ParseInLocation(..., time.Local)`，与 `time.Now()` 比较基准一致。
+- 注意：修复前已保存的时间值按 UTC 解释，部署后若服务器本地时区非 UTC，历史设定会有一致性位移（UTC 服务器无感知）。
+
+### 🟠 P1-2 历史数据：旧版 backfill 可能已把私聊错误开启（✅ 已修复）
+
+- 位置：`internal/db/feature_control.go` 新增 `reconcileLegacyChatEnabled`（`db.Init` 中在 backfill 之后调用）。
+- 问题：旧版本（`Enabled gorm:"default:true"`）下，为 `allow_chat=false` 的用户补私聊行时，`false` 被写成 `true`，**私聊被被动开启**；且 `UpdateChatSettings` 会反向把 `users.allow_chat` 同步为 `true`，形成持久化。
+- 修复：启动期**幂等纠偏**，同时命中以下条件才复位（绝不误伤箱主配置过的行）：
+  - `feature='chat'` 且 `enabled=true`；
+  - 对应 `users.allow_chat=false`（箱主从未在面板开启私聊——开启会同步 allow_chat=true）；
+  - 该行无任何自定义配置（一次性时间为空、quota_limit=0、循环定时为空）；
+  - `updated_at <= created_at`（从未被面板保存过）。
+  - 命中即复位 `feature_controls.enabled=false` 并同步 `users.allow_chat=false`；每次启动只处理未修复行，直到清零，失败仅告警不阻断启动。
+- 说明：对于「allow_chat 已被旧同步逻辑改写为 true」的更深度历史污染，无法与箱主主动开启区分，不在自动纠偏范围内；如需处理请人工核对后按下方 SQL 定向调整：
+  ```sql
+  -- PostgreSQL（仅当确认某账号私聊被错误开启时，替换 <user_id>）
+  UPDATE feature_controls SET enabled = false WHERE feature = 'chat' AND user_id = <user_id>;
+  UPDATE users SET allow_chat = false WHERE id = <user_id>;
+  ```
+
+### 🟡 P2-1 `Vote.RequireCaptcha` 同类 GORM 陷阱（✅ 已修复）
+
+- 位置：`internal/db/votes.go` `RequireCaptcha bool`（原带 `gorm:"default:true"`）。
+- 问题：与问题 1 同源——若底层 `Votes.Create` 未来允许 `RequireCaptcha=false`，GORM 会把 `false` 替换为默认 `true`。
+- 修复：去掉 `default:true` 标签。业务层 `route/user/vote.go` 仍硬编码 `requireCaptcha := true`（决策 #3），**线上行为不变**；已同步更新 `votes_test.go` 的 `testVotesCreate` 断言（Create 未显式传参时按 `false` 落库，注释说明业务层强制 true）。实测生成的 SQL：显式 `true` 写入 `true`、未传写入 `false`。
+
+### 🟡 P2-2 循环定时的时区与跨日限制（已知边界，建议知晓）
+
+- 时段按**服务器本地时区**解释（与一次性时间一致）。若服务器与箱主时区不同，每日时段会整体偏移；如需支持，可后续增加箱主时区字段。
+- 不支持跨午夜的时段（如 22:00-02:00，结束必须晚于开始），校验会拦截并给出中文提示。
+- 「下次开放时间」扫描窗口为 8 天，覆盖任意周几组合；一次性窗口 >8 天的场景由一次性分支单独处理，不受影响。
+
+---
+
+## 四、回归检查（原问题是否复现 / 影响面）
+
+| 检查项 | 结果 |
+|--------|------|
+| 问题 1（开关复位）：`Save` 生成的 SQL 正确写入 `false`，ON CONFLICT 更新列含 `enabled` | ✅ |
+| 问题 2（文案）：匿名/注册专属两种状态的渲染测试 | ✅ 3 个用例通过 |
+| 问题 3（关闭信息）：未开始 / 已结束（永久）/ 循环定时三种关闭形态的模板渲染 | ✅ 2 个用例通过 |
+| 问题 4（循环定时）：14 组 Evaluate 判定 + 8 组 NextOpenAt/LastCloseAt 边界 | ✅ 全部通过 |
+| P1-2 纠偏：SELECT（带 `fc.` 别名）/ UPDATE（无前缀）生成的 PostgreSQL SQL 均正确；软删除行已过滤 | ✅ SQL 生成验证 |
+| P2-1 Vote：`Create(RequireCaptcha=true)` 写入 `true`、未传写入 `false`（不再被默认替换） | ✅ SQL 生成验证 + 断言更新 |
+| 模板：新增 `hasDay` 函数与 `printf` 组合无解析错误，全部模板解析/跨引用测试通过 | ✅ |
+| i18n：新增 12 个词条 × 4 语言齐全，无缺失（缺失会回退 zh-CN，但已全部补齐） | ✅ |
+| 代码质量：`gofmt` 干净、`go vet ./...` 无新增告警 | ✅ |
+| 存量行为：未改 `CanAsk` 计算、未改 `FeatureOpen` 语义、投票业务流（硬编码 requireCaptcha=true）不变 | ✅ |
+
+**部署提醒**：
+1. `feature_controls` 新增 3 列由 `AutoMigrate` 自动加列，无手工迁移；上线后在功能管理页重新保存一次各功能即可看到循环定时区块。
+2. 私聊纠偏为**启动期自动执行**：首次启动时若命中旧数据会输出 `Warn "私聊开关纠偏：旧版数据把未开启私聊的账号置为开启，已复位为关闭"`（附数量），属预期行为；未命中则无日志。
+3. `TestVotes` 等 DB 集成测试需在配置了 `DB_TYPE` 的 PostgreSQL/MySQL 环境运行（本地沙箱无凭据，未执行）；逻辑层测试已全部通过。
diff --git a/outputs/TamaBox-v4-keyset-pagination-timezone-incident-2026-09-05.md b/outputs/TamaBox-v4-keyset-pagination-timezone-incident-2026-09-05.md
new file mode 100644
index 0000000..9d1e75b
--- /dev/null
+++ b/outputs/TamaBox-v4-keyset-pagination-timezone-incident-2026-09-05.md
@@ -0,0 +1,146 @@
+# TamaBox 提问箱「加载更多」翻页重复事故复盘（时区偏移根因 + timestamptz 迁移修正）
+
+- **日期**：2026-09-05（排查 01:57–04:35 左右，约 2.5 小时闭环）
+- **影响范围**：线上 `box.tama.guru` 全部「提问箱历史」列表（单题页 `/_/{domain}/{id}` 与用户主页底部内嵌同一列表）
+- **最终结论**：两层缺陷叠加——① 服务端游标解析的时区偏移导致 keyset 分页失效（直接根因）；② 为根治而做的 timestamptz 迁移解释基准选错，导致存量时间整体 +8h（次生事故，已二次修正）
+- **状态**：✅ 全部修复并线上验证通过
+
+---
+
+## 一、现象与影响
+
+| 现象 | 影响 |
+|---|---|
+| 提问列表首屏 20 条加载完后「加载更多」按钮仍存在 | 点击后**追加与首页完全相同的内容** |
+| 按钮永不消失，可无限点击重复 | 用户困惑；若服务端异常则无限膨胀 DOM |
+
+线上 API 实测复现：携带首页返回的 `next_cursor` 再次请求，返回**完全相同的第 1 页 20 条**，`has_more=true`、游标不变。
+
+---
+
+## 二、关键环境事实（排查中确认）
+
+| 项 | 值 | 备注 |
+|---|---|---|
+| 线上 schema | `nekobox`（非 public，默认 search_path 找不到） | 首版诊断脚本"关系不存在"根因 |
+| `questions` 表 | `id numeric`(seq)、`user_id bigint`、`answer text`、`is_private/is_pinned/is_read boolean` | 与源码 GORM 模型基本一致 |
+| **时间列** | `created_at/updated_at/deleted_at = timestamp WITHOUT time zone`(6) | **与源码 AutoMigrate 默认 timestamptz 不一致**——本次两大事故的共同土壤 |
+| 实际含无时区时间列的表 | 仅 4 张：`questions / users / censor_logs / upload_images`（12 列） | 其余表（messages/conversations/votes 等）本为 timestamptz |
+| 服务端进程/会话时区 | Asia/Shanghai（+08:00） | 与无时区列叠加构成偏移 |
+| aoi 箱 | user_id=329，已答公开 38 条 | 与线上 API 总数一致 |
+
+分页链路：前端 `templates/question/history-template.html`（Alpine fetch）→ `route/question/page.go ListAPI` → `internal/db/questions.go GetByUserID`，PinFirst 复合键集游标 `<isPinned>.<UnixNano>.<id>`，排序 `is_pinned DESC, created_at DESC, id DESC`，`page_size=20` 多取 1 条探测 `has_more`。
+
+---
+
+## 三、排查时间线
+
+| 时间(约) | 事件 | 结果/判断 |
+|---|---|---|
+| 01:57–02:30 | 线上复现 + 全链路代码走查 | 前端模板与 0904 源码逐字符一致；排除 CDN 缓存（回源 MISS）；**服务端游标被无视** |
+| ~02:30 | 对照实验 | 任意格式游标均返回首页/个别怪异结果（空集、固定 6 条、38 条全量）——源码逻辑无法解释，疑似版本不一致 |
+| 02:39 | 产出 v1 PG 诊断脚本 | 用户执行报"关系不存在"→ 定位 schema=nekobox |
+| ~03:00 | 产出 v2 诊断脚本（search_path + 无时区列 + 时区诊断） | **DB 层洗清**：38 条 keyset 翻页不重不漏、无时区列读写文本对称、nano 指纹精确命中 |
+| ~03:10 | 首次部署 0904（含防重兜底）后复测 | **仍复现**——推翻"部署版本旧"假设 |
+| ~03:15 | 读 `parsePinCursor` 源码 + 本地 tz 实验 | 🔴 **真根因**：`time.Unix(0, nano)` 按服务器本地时区还原，+8h 墙钟发给无时区列比较恒真 → keyset 失效 |
+| ~03:25 | 修复 `.UTC()` + 编译测试 | `go build`/`go vet` PASS |
+| ~03:30 | 用户重新部署 | 线上翻页**38 条唯一收敛** ✓；非法/旧格式游标返回空+`has_more=false` ✓ |
+| ~03:40 | 克隆库 timestamptz 迁移全套验证 | epoch 前后 0 差异、指纹一致、翻页同款、回滚路径无损 |
+| 04:02 | 线上执行迁移 | 4 表 12 列转 timestamptz，验收 3.1–3.4 全绿（epoch 一致、残余 0） |
+| ~04:20 | 端到端验收 | 38 条唯一收敛 ✓，但**发现 created_at 文本从 Z 变 +08:00** |
+| 04:27 | 用户反馈「真实本地 00:01 的提问页面显示 08:01」 | 🟠 **次生事故确认**：迁移解释基准用错（见第五节） |
+| 04:30–04:35 | 克隆库验证反向修正 → 线上执行 → API 验收 | created_at 回到本地墙钟、`next_cursor` nano 变化、38 条收敛 ✓ |
+
+---
+
+## 四、直接根因（第一层）：游标解析时区偏移
+
+```go
+// 修改前（internal/db/questions.go parsePinCursor）
+return isPinned, time.Unix(0, nano), uint(idVal), true
+//                       ↑ 返回「服务器本地时区」的时间
+```
+
+**机制**：
+1. 服务端把某行 `created_at`（无时区列读出后带 UTC 标记）转 `UnixNano` 下发（nano = UTC 绝对时刻）。
+2. 解析时 `time.Unix(0, nano)` 返回 **Local（Asia/Shanghai）** 时间 → 墙钟数字 +8h（00:01 → 08:01）。
+3. 驱动把该参数发往 **无时区列** 比较时按墙钟直发 → `created_at < '2026-09-05 08:01:16'` 对库内全部 `00:xx` 行**恒为真** → keyset 条件退化为"全部行" → **永远返回第一页 + has_more=true → 无限重复**。
+4. 之前线上"空集 / 固定 6 条 / 38 条全量"等怪异现象，均为偏移后游标落在数据窗口不同位置的表现。
+
+**修复**：`time.Unix(0, nano)` → `time.Unix(0, nano).UTC()`（绝对时刻语义，与列值墙钟对齐）。同时补充两层防重兜底：
+
+| 文件 | 改动 |
+|---|---|
+| `internal/db/questions.go` `parsePinCursor` | `time.Unix(0, nano).UTC()` ← **根治一行**（附时区约定注释） |
+| `internal/db/questions.go` `GetByUserID` | 游标解析失败**不再静默回退首页**，返回空列表 → `has_more=false` 收敛 |
+| `internal/db/questions.go` `getBy`（旧路径） | 同步改为解析失败返回空，保持一致 |
+| `templates/question/history-template.html` | SSR/JS 条目都带 `data-qid`；点击时按已渲染 id 集合**过滤重复**，无新增即 `more=false` 隐藏按钮 |
+
+> 注：其余 `UnixNano` 用途（随机种子/文件名）无 keyset 风险，未受影响。
+
+---
+
+## 五、次生事故（第二层）：timestamptz 迁移基准选错，存量 +8h
+
+### 5.1 数据真实语义的判定
+
+存量无时区列存的是**上海本地墙钟**（如 `00:01:16` = 用户凌晨 00:01 提问）。证据：用户以现实锚点反馈"真实本地 00:01 的提问页面显示 08:01"。
+
+**此前 v2 诊断的认知盲区**：`DB 墙钟 == 线上 JSON Z 文本` 只能证明**读路径文本一致**——驱动把无时区列读出值标记为 UTC 输出，文本恰好等于库内墙钟数字，形成"读写对称"假象；它**不能证明**墙钟的世界语义是 UTC。而驱动写入无时区列时按进程本地墙钟落库 → 真实语义其实是**上海墙钟**。
+
+### 5.2 错误迁移及其后果
+
+首版迁移用 `USING created_at AT TIME ZONE 'UTC'`（把墙钟当 UTC 解释）→ 存量绝对时刻整体 **+8h** → 页面显示比真实晚 8 小时。迁移前页面显示"00:01"（无时区列按 UTC 直显，文本恰巧等于上海墙钟）反而是对的。
+
+### 5.3 反向修正
+
+```sql
+ALTER TABLE nekobox.questions
+  ALTER COLUMN created_at TYPE timestamptz
+  USING (created_at AT TIME ZONE 'UTC' AT TIME ZONE 'Asia/Shanghai');
+-- 净效果：绝对时刻 -8h；语义 = 原墙钟按 Asia/Shanghai 解释；与会话时区无关
+```
+
+克隆库整段演练通过后线上执行，API 验证：
+
+| 验证点 | 修正前（错误） | 修正后（正确） |
+|---|---|---|
+| 3089 会话显示 | `2026-09-05 08:01:16.678885+08` | `2026-09-05 00:01:16.678885+08` |
+| 3089 epoch | `1788566476678885000` | `1788537676678885000` |
+| 3109 | `08:49:38+08` | `00:49:38.648502+08` |
+| 2411 | `06-18 06:30:19+08` | `2026-06-17 22:30:19.615754+08` |
+| API `next_cursor` nano 段 | `0.1788566476678885000` | `0.1788537676678885000` |
+| 翻页收敛 | — | 38 条唯一 ✓ |
+
+---
+
+## 六、经验教训（预防清单）
+
+| 级别 | 教训 | 落地动作 |
+|---|---|---|
+| 🔴 P0 | **无时区时间列与带时区应用代码混用是事故土壤** | 代码约定：所有时间列应统一 timestamptz；任何 `time.Unix`/`time.Parse` 进 keyset/SQL 比较路径必须显式 `.UTC()` 并在注释写明约定 |
+| 🔴 P0 | **迁移解释基准必须先锚定数据真实语义**，不能只看"转换前后 epoch 一致" | 迁移前用 1–2 条**用户可确认真实时刻**的记录做锚点（如"这条我实际几点发的"），或写一条测试数据核对显示 |
+| 🟠 P1 | "DB 墙钟 == JSON 文本"不能证明世界语义 | 读路径文本一致 ≠ 写路径语义正确；需结合写入方（驱动对无时区列的落库行为）判断 |
+| 🟠 P1 | 线上行为无法用源码解释时，先怀疑**时区/列类型**再怀疑部署版本 | 本次"部署后仍复现"正是锁定 `.UTC()` 的关键转折 |
+| 🟡 P2 | psql `\i` 长输出会进分页器截断 | 运维长脚本建议开头 `\pset pager off`，或分段执行 |
+
+---
+
+## 七、脚本/文档产物清单（`outputs/`）
+
+| 文件 | 用途 | 状态 |
+|---|---|---|
+| `pg-cursor-pagination-diagnose.sql` | v1 诊断（默认 public schema，被 schema 问题阻住） | 已被 v2 取代 |
+| `pg-cursor-diagnose-v2-nekobox.sql` | v2 诊断（search_path=nekobox，洗清 DB 层） | 完成使命 |
+| `timestamptz-migration-online.sql` | 首版迁移（UTC 基准）——**含错误基准，勿复用** | ⚠️ 已被 fix-8h 修正 |
+| `timestamptz-migration-fix-8h.sql` | 反向修正（Asia/Shanghai 基准） | ✅ 线上已执行；**不可重跑**（会再 -8h） |
+| 本文档 | 事故复盘留档 | ✅ |
+
+## 八、最终状态与遗留建议
+
+- **线上已闭环**：翻页 38 条唯一收敛；存量时间回到真实本地墙钟；timestamptz 类型层根治，keyset 不再依赖进程时区。
+- **遗留建议（按需排期）**：
+  1. 页面强刷后人工抽查时间显示（SSR 与「加载更多」追加项应一致）。
+  2. 可选：应用层 JSON 序列化统一 `.UTC()` 输出 Z（若存在外部消费者依赖 UTC 文本）。
+  3. 本地克隆测试实例（127.0.0.1:5433）与 dump 副本已无用途，可清理。
+  4. 生产库 `DROP SCHEMA diag_test CASCADE;` 清理诊断快照表。
diff --git a/outputs/TamaBox-v4-remediation-2026-08-27.md b/outputs/TamaBox-v4-remediation-2026-08-27.md
new file mode 100644
index 0000000..90ae9d4
--- /dev/null
+++ b/outputs/TamaBox-v4-remediation-2026-08-27.md
@@ -0,0 +1,65 @@
+# TamaBox-v4 评审修复落地报告（2026-08-27）
+
+基于 `outputs/TamaBox-v4-code-review-2026-08-27.md` 的 P2/P3  findings，落实 4 项修复。
+改动遵循「最小、可读、可回滚」原则；每项均给出根因、改法、验证状态。
+
+---
+
+## 已落地（4 项）
+
+### P3-1 autoban 404 探测失效  ✅
+**文件**：`internal/route/autoban.go`
+**根因**：`autobanMiddleware` 内 `defer` 在该 handler **返回时**触发，而 Flamego `run()` 会在 handler 返回后自动推进链路，因此 `defer` 执行时下游路由尚未运行，`rw.Status()` 恒为 `0` → `KindNotFound` 分支永远进不去。敏感路径封禁因 `kind` 在 body 内同步置位，不受影响。
+**修复**：在 `defer` 之后、函数返回前加 `ctx.Next()`。经核对 `flamego@v1.9.4`：`Next()` 即 `c.index++; c.run()`，会把下游全部跑完并让 `c.index` 越过末尾，外层循环随后只「超调」一次即退出，**不会重复执行下游**。
+**验证**：`internal/security/autoban` 单测通过（安全核心逻辑）；`gofmt` 语法校验通过。
+
+### P3-4 草稿/归档提交提示误导  ✅
+**文件**：`route/vote/vote.go`（`Submit`，约 647 行）
+**根因**：`!isVoteActive` 仅二分「已结束 / 尚未开始」。草稿（`draft`）与归档（`archived`）状态均 `Status != published` 且通常无 `EndAt`，双双落入「尚未开始」，而重定向目标 `/vote/{LinkToken}` 本身会拦截草稿/归档 → 死循环式跳转。
+**修复**：按 `vote.Status` 精确分支：
+- `draft` → 「该投票尚未发布」
+- `archived` → 「该投票已归档，无法参与」
+- 其余：`isVoteEnded` → 「该投票已结束」/ 否则「该投票尚未开始」
+**验证**：`gofmt` 语法校验通过；状态常量 `db.VoteStatusDraft/Archived` 已核实存在。
+
+### P2-2 匿名投票强制验证码  ✅
+**方向**（用户拍板）：匿名投票始终要求验证码（或行为验证码）。
+**文件**：`route/vote/vote.go`（`Submit`）、`route/user/vote.go`（`parseVoteMeta` / `renderVoteFormWithInput`）、`templates/user/vote-form.html`
+**根因**：原逻辑 `if vote.RequireCaptcha` 仅在创建者开启验证码时才校验匿名提交；关闭后匿名用户清除 `vote_fp` Cookie 即可换签名 token 重复投票，仅剩 `limit*10` 的 IP 兜底。
+**修复**：
+1. `Submit` 匿名分支门槛由 `if vote.RequireCaptcha` 改为 `if conf.Recaptcha.CaptchaType != ""`——**只要全局配置了验证码，匿名提交一律校验**；未配置（无密钥部署）时不阻断，避免整崩。
+2. `parseVoteMeta`（草稿创建/编辑、发布中编辑三路共用的唯一 `require_captcha` 读取点）与 `renderVoteFormWithInput` 强制 `requireCaptcha := true`，使存储值与策略一致。
+3. 模板复选框置为 `checked disabled`，对 owner 明确「不可关闭」。
+**对齐既有决策**：`db.Votes.RequireCaptcha` gorm 默认 `true`，`votes_test.go:63` 断言「匿名验证码默认开启（决策 #3）」，i18n 即「匿名投票需通过验证码」。本修复使该决策不可被 UI 关闭。
+**验证**：`gofmt` 语法校验通过；`conf.Recaptcha.CaptchaType` 字段在 `internal/context/context.go:269` 已使用，类型无误。
+
+### P2-1 结果缓存写穿失效  ✅（务实版）
+**文件**：`internal/cache/cache.go`、`route/vote/vote.go`（`Submit`）
+**根因**：`LoadResults` 对 `multiple/rating/rank/form` 类型需 `ListByVoteID` 全量加载并在 Go 层逐条 `json.Unmarshal` 聚合（O(N)）；`resultsCache`（30s TTL）仅在过期时重算，新提交后结果页最多陈旧 30s，且每次窗口到期都要重算一次全量。
+**修复**：
+1. 给 `TTLCache` 新增 `Delete(key)` 方法。
+2. `Submit` 成功 `Create` 提交后调用 `resultsCache.Delete(strconv.FormatUint(vote.ID,10))`——**写穿式失效**：新投票后立即清除该投票结果缓存，结果页随即反映，且把 O(N) 重算成本收敛到「每次新投票一次」。
+**未做（需独立迁移）**：真正的 O(1) SQL 下推受限于选项选择结果存于 JSON `FormData` 大字段（跨 MySQL/PG 做 JSON 聚合既脆弱又依赖具体版本）。彻底消除 O(N) 需把选择项正态化到独立表（如 `vote_submission_selections(vote_id, submission_id, option_id)`），以 `GROUP BY option_id` 聚合。建议作为后续独立 schema 迁移评估，**不在本次改动内**。
+**验证**：`internal/cache` 单测通过（含新 `Delete`）；`gofmt` 语法校验通过。
+
+---
+
+## 本次未改（留作独立决策）
+
+- **P3-3 死配置 `MaxVotesPerFingerprint`**：全链路写死为 1、提交侧从不读取，属历史遗留。鉴于设计本意即「一人一票」，建议整体移除该字段与表单接线；涉及 DB schema 迁移，需你确认后再做。
+- **P3-2 进程内缓存跨实例陈旧**：`TTLCache` 为进程本地，多实例下清缓存不跨实例。可接受最终一致 / 缩短 TTL / 迁 Redis——架构决策，不急。
+
+---
+
+## 构建与验证状态
+
+- ✅ 语法：`gofmt -e -l` 对 4 个改动的 .go 文件均无报错。
+- ✅ 单元：`go test ./internal/security/autoban/... ./internal/cache/...` 全绿。
+- ⚠️ 全量构建受阻（**既有环境问题，非本次改动**）：`github.com/chai2010/webp` 依赖 libwebp 本机 C 库（CGO），当前沙箱缺该库，报 `undefined: webpGetInfo` 等。该依赖经传递链被 `route/vote`、`route/user`、`internal/route` 引入，故这几个包在本环境无法完整 `go build`。在带 libwebp 的 CI/Docker 环境中可正常构建。建议你在本地/CI 跑一次全量 `go build ./...` 与 `go test ./...` 做最终确认。
+
+## 改动文件清单
+- `internal/route/autoban.go`
+- `internal/cache/cache.go`
+- `route/vote/vote.go`
+- `route/user/vote.go`
+- `templates/user/vote-form.html`
diff --git a/outputs/admin6-cdn-check.png b/outputs/admin6-cdn-check.png
new file mode 100644
index 0000000..ce33c2d
Binary files /dev/null and b/outputs/admin6-cdn-check.png differ
diff --git a/outputs/admin6-snrat-check.png b/outputs/admin6-snrat-check.png
new file mode 100644
index 0000000..48850d4
Binary files /dev/null and b/outputs/admin6-snrat-check.png differ
diff --git a/outputs/autoban-false-positive-2026-09-05.md b/outputs/autoban-false-positive-2026-09-05.md
new file mode 100644
index 0000000..ba4db39
--- /dev/null
+++ b/outputs/autoban-false-positive-2026-09-05.md
@@ -0,0 +1,93 @@
+# autoban 自动封禁误伤诊断报告
+
+日期：2026-09-05 · 分析对象：`internal/security/autoban` + `internal/route/autoban.go` + `internal/shared/ip.go`
+
+## 一、当前配置与生效机制
+
+| 配置 | 你的值 | sample 默认 | 语义 |
+|---|---|---|---|
+| trust_proxy | true | true | 信任 CDN 权威头解析客户端 IP |
+| enable_auto_ban | true | true | 启用自动封禁 |
+| ban_threshold_sensitive | **10** | 10 | 窗口内敏感路径命中 ≥10 触发封禁 |
+| ban_threshold_404 | **20** | 20 | 窗口内 404 ≥20 触发封禁 |
+| ban_window_seconds | **10** | **60** | 统计窗口（滚动） |
+| ban_duration_minutes | 15 | 15 | 封禁时长 |
+
+**判定逻辑**（autoban.go Record / IsBanned）：
+- 每个请求按「归一化客户端 IP」计数（IPv4 原样；IPv6 聚合到 /64 → `LimitKey`）
+- 两类事件独立计数，`敏感≥10 OR 404≥20`（10s 滚动窗口内）任一达标 → 封禁该键 15 分钟
+- 已封禁键上所有后续请求直接 403
+
+**两个计数入口**（全站仅此两处）：
+1. 中间件 `autoban.go:39`：请求路径命中敏感词表（`/admin`、`/.env`、`/wp-admin`、`/config`、`/db`…共 39 条前缀）→ defer 计数
+2. `f.NotFound`（route.go:403）：一切未匹配路由 → 404 计数后 Redirect("/")
+
+## 二、排除项（已静态验证，非误伤来源）
+
+- ✅ **业务路由零碰撞**：全站注册路由 + 模板 77 个站内 URL 与 39 条敏感前缀**无一匹配**——正常页面打开不会误计敏感
+- ✅ favicon.ico / robots.txt / sitemap / llms 均有 embed handler，不产生 404
+- ✅ 404 处理器与业务性 302（语言切换/登出/投票不存在）已分离，不误计
+
+## 三、误伤根因（按可能性排序）
+
+### 🔴 P0-A：客户端 IP「键折叠」→ 多用户共享同一计数键（最可能）
+
+正常用户自己 10s 内绝不可能凑出 10 次敏感或 20 次 404（每秒 2 个 404 的强度），所以能误伤正常用户，**唯一机制是"别人的探测被记到了你的键上"**。trust_proxy=true 的解析链（ip.go ResolveClientIP）：
+
+1. 先看 `CF-Connecting-IP` / `EO-Client-IP`（权威头）
+2. 都没有 → 回退 `RemoteAddr`
+
+**折叠场景**：
+- 若 EO 回源**未开启/未注入** `EO-Client-IP`（需在 EO 控制台确认回源透传配置），国内请求全部回退到 **EO 边缘 IP（43.174.247.x 新加坡）** → 全体大陆用户共享一个键。扫描器也走同一边缘 → 任一扫描触发 → **全国用户 403 15 分钟**
+- 海外 CF tunnel：cloudflared 必注 `CF-Connecting-IP`，正常不折叠；但若异常缺失则回退 `127.0.0.1` → 所有海外用户共享同一键
+- sample 注释原话即为该坑："否则解析到的将是 Cloudflare 边缘 IP，自动封禁会误伤所有访客"
+
+**自检方法**：配置 `security_alert_email`，看封禁告警里的 IP —— 若出现 43.174.247.43 / 43.174.246.43 / 127.0.0.1 这类**非用户 IP**，即实锤折叠。
+
+### 🔴 P0-B：运营商 CGNAT / 共享出口连坐（国内常态）
+
+国内移动/联通/电信家宽普遍 NAT444，**成百上千真实用户共用一个公网 IPv4**。该池内任一被黑设备/扫描器探测你的站点（攻击者扫全网，你的 EO 域名是公网目标）→ 触发阈值 → 整个出口池 403 15 分钟。你本人被误伤大概率由此而来（你的出口 IP 里别人在扫站）。
+
+### 🟠 P1-C：IPv6 /64 聚合连坐
+
+`LimitKey` 将 IPv6 聚合到 /64。若运营商分配粒度粗（多户共 /64）或会话前缀抖动，同段邻居的探测会连坐你。相对少见，但配置了 IPv6 解析时存在。
+
+### 🟠 P1-D：双 CDN 权威头互信被伪造（定向误伤）
+
+若未按 `outputs/edgeone-cloudflare-dual-cdn-guide.md` 在两家 CDN 规则引擎删除"对方 CDN"的权威头，攻击者可伪造 `CF-Connecting-IP: <受害者IP>` 直连源站/借道 EO → 探测全部记到受害者头上 → **把任意人"定向打成 403"**。属攻击向量而非随机误伤，但同样表现为"我没干什么就 403"。
+
+## 四、修复建议（分级）
+
+### P0-① 先止血（纯配置，立即可做，无需改代码）
+```ini
+ban_window_seconds = 60          ; 10s 窗口对正常浏览太苛刻，回到默认
+ban_threshold_sensitive = 30     ; 敏感命中门槛抬高（真扫描 1s 内远超此值）
+ban_threshold_404 = 100          ; 404 门槛抬高（正常用户+偶发爬虫不会到）
+security_alert_email = <你的邮箱> ; 关键：先打开告警看封禁 IP，定位是否"键折叠"
+```
+> 窗口越短反而越难误伤，你已比默认更保守仍误伤 → 证明误伤不是参数敏感，而是**键共享**，调参只能缓解不能根治。
+
+### P0-② 确认并修复 IP 解析（治本，需查服务器/控制台）
+1. **源站侧**：抓一条真实请求，确认带没带 `EO-Client-IP` / `CF-Connecting-IP` 头（nginx access log 或临时 echo 头调试）
+   - EO 域名确认开启「回源客户端 IP 透传」；无则开
+2. **源站锁定**：防火墙仅放行两家 CDN 回源网段（sample 已警告；未锁定时任何人可直连伪造头）
+3. 双 CDN 按指南删对端权威头
+
+### P1-① 代码增强（需你批准后实施）
+| 项 | 改动 | 效果 |
+|---|---|---|
+| 登录用户豁免 | 有有效 session 的请求不计数/不封禁 | 管理员/正常登录用户永不误伤（扫描器无 cookie） |
+| 封禁日志 | 封禁时 logrus 打印 ip+路径样本+UA | 事后可归因，不再"黑盒" |
+| UA 特征二次确认 | 敏感命中要求 UA 缺浏览器特征才加速计数 | 降低误伤 |
+
+### P2 观察项
+- 若确认 P0-A 折叠实锤：可考虑对"CDN 边缘类"键整体排除（仅当 RemoteAddr 属于 CDN 且权威头缺失时才回退 RemoteAddr——需小改 ip.go）
+- 监控告警邮件中的封禁频率与 IP 类型分布
+
+## 五、证据清单（本次分析依据）
+- internal/security/autoban/autoban.go：阈值判定、窗口、清理
+- internal/route/autoban.go：中间件挂载、403 直接返回
+- internal/route/route.go:78-84、146、403：实例化、全局挂载、404 计数
+- internal/shared/ip.go：ResolveClientIP 信任链 + LimitKey /64 聚合 + 双 CDN 警告注释
+- conf/app.sample.ini：默认值与设计约束说明
+- 静态碰撞分析：业务路由/模板 URL × 敏感词表 = 零命中
diff --git a/outputs/avatar-qrcode-slow-2026-09-05.md b/outputs/avatar-qrcode-slow-2026-09-05.md
new file mode 100644
index 0000000..42e3334
--- /dev/null
+++ b/outputs/avatar-qrcode-slow-2026-09-05.md
@@ -0,0 +1,149 @@
+# 个人主页"头像 + 二维码加载慢 / 页面一直加载中"诊断报告
+
+> 日期：2026-09-05　｜　对象：`https://box.tama.guru/_/tamakyi`（个人主页 list.html）
+> 测速视角：南宁电信（真实大陆出口，与本机直连一致）
+
+---
+
+## 一、结论速览
+
+| 严重度 | 问题 | 一句话 |
+|---|---|---|
+| 🔴 P0 | **R2 图片全部无 `Cache-Control`** | 头像 Last-Modified 是当天 → 启发式缓存寿命 ≈ 0 → **每次**页面加载都重新走国际链路下载头像，这是"每次都很久"的直接原因 |
+| 🔴 P0 | R2 是纯 CF 国际链路 | 南宁电信实测每个 R2 资源 **0.78–1.4s**，是 snrat 大陆镜像（0.3s）的 **3–5 倍**；304 条件请求也要 **1.05s**（省不掉往返 RTT） |
+| 🟠 P1 | 二维码绘制依赖头像 `onload` | easy.qrcode 加载 logo 头像失败仅 `console.error`、**无任何降级** → 头像加载失败/超时 = 二维码永久空白 |
+| 🟠 P1 | 头像缓存键分裂 | 同一头像被拆成 `?og-image=1`（header icon/meta）与 `?v=2`（页面头像 + QR logo）两个缓存条目 → 一页下载 2 份 |
+| 🟠 P1 | 背景图 303KB 未压缩 PNG | `box_background.png` = 297KB，换设备/清缓存时首访要拉 297KB 的国际链路下载 |
+| 🟡 P2 | defer 统计脚本拖慢 DOMContentLoaded | vercount 实测中位 1.24s（波动至 2.7s）、mami 波动至 3.7s → 二维码初始化挂在 DOMContentLoaded，被一起拖慢 |
+
+---
+
+## 二、加载链路拆解（页面发生了什么）
+
+个人主页资源依赖（实测 61KB HTML）：
+
+```
+EO 动态页 HTML ........................ ~1.2s   （源站新加坡，已知架构上限）
+head 渲染阻塞 CSS：仅 uikit.min.css (snrat) .  ~0.5s
+   （waline CSS 已用 media=print 非阻塞，✅ 无问题）
+defer 脚本 ×10（下载完才触发 DOMContentLoaded）：
+   snrat: uikit/icons/dayjs/alpine/waline/jQuery   0.2–0.5s/个
+   R2:    time.box.js(1.6KB) + easy.qrcode(52KB)   ~0.9–1.0s/个
+   第三方: cn.vercount.one ~1.2s（波动 2.7s）、mami.tama.guru ~0.3s（波动 3.7s）
+头像 <img src=头像?v=2>（body 解析即并发） ...... ~1s（R2）
+背景 uk-img（UIkit 可见后加载） ............... ~1.4s（R2，297KB）
+favicon = 头像 URL ............................ ~1s（R2）
+二维码 boxqrimg：
+   DOMContentLoaded 后 easy.qrcode 初始化
+   → 先加载 logo=头像?v=2（onload 后才绘制）→ +0~1s
+```
+
+**首访体感：头像 ~2.2s、二维码 ~2.5–3.5s（R2 链路抖动时 5s+）**
+**二次访问：由于无 Cache-Control，头像/favicon 每次仍要 ~1s 重新下载 → 这就是"每次都慢、一直加载中"的体感来源。**
+
+浏览器"加载中"迟迟不退的构成：`load` 事件要等非懒加载图片（头像）完成；`DOMContentLoaded` 要等全部 10 个 defer 完成（含 R2 与第三方统计的最慢者）。两者都被 R2 + 统计脚本拖着。
+
+---
+
+## 三、证据链（均为 2026-09-05 实测）
+
+### 3.1 各资源耗时（南宁电信，3 次中位）
+
+| 资源 | Host | 中位耗时 | 备注 |
+|---|---|---|---|
+| jQuery / UIkit | cdnjs.snrat.com | **0.29s / 0.52s** | 大陆镜像，基准线 |
+| 头像 webp 27KB | r2.337845818.best | **0.91–1.05s** | |
+| easy.qrcode.min.js 52KB | r2.337845818.best | 0.96s | |
+| time.box.js 1.6KB | r2.337845818.best | 0.90s | 小文件也 0.9s = 纯 RTT 主导 |
+| 背景 box_background.png 297KB | r2.337845818.best | 1.39s | |
+| waline CSS | r2.337845818.best | 0.99s | |
+| vercount 统计 | cn.vercount.one | 1.24s（波动至 2.69s） | |
+| mami 统计 | mami.tama.guru | 0.31s（波动至 3.7s） | |
+
+### 3.2 决定性验证：R2 缓存头
+
+```
+头像/背景/图标/CSS 响应头：
+  Content-Type / ETag / Last-Modified 有
+  Cache-Control    ❌ 无
+  Expires          ❌ 无
+  cf-cache-status: DYNAMIC（CF 边缘不缓存，每次都回 R2 源）
+```
+
+- 头像 `Last-Modified: Sat, 05 Sep 2026 06:49:29 GMT` = **当天上传**
+- 按 RFC 7234 启发式缓存：freshness ≈ (当前时间 − Last-Modified) × 10% ≈ **0** → 浏览器每次**重新验证/下载**
+- 实测：带 `If-Modified-Since` 的 304 请求仍需 **1.05s**（RTT 无法通过 304 消除）
+- 对比：easy.qrcode.js / time.box.js 有 `max-age=2678400`（31 天强缓存）→ 它们二次访问是秒出的，唯独**图片类对象从未设置缓存头**
+
+> 上传代码 `internal/storage/s3.go` `PutObjectInput` 仅设置 `ContentType`，**从未设置 `CacheControl`** —— 已确认。
+
+### 3.3 easy.qrcode 头像 logo 逻辑（反编译 52KB 源）
+
+```js
+if (d.logo) {
+    var r = new Image;
+    r.onload  = function(){ 绘制(带头像logo) },     // ✅ 头像到了才画
+    r.onerror = function(a){ console.error(a) },    // ❌ 仅打日志，什么都不画
+    r.crossOrigin = d.crossOrigin;
+    r.src = d.logo;                                  // logo = 头像 URL
+}
+```
+
+**结论：二维码 = 同步等待 R2 头像图下载；头像失败/超时 → 二维码区域永久空白，页面没有任何降级提示。**
+
+### 3.4 头像 URL 在同一页面出现 3 个变体（缓存键分裂）
+
+| 出处 | URL | 浏览器行为 |
+|---|---|---|
+| header.html 646–648（icon/favicon） | `头像?og-image=1` | Chrome 请求 favicon |
+| header.html 642/644/649（og/twitter meta） | `头像?og-image=1` | 爬虫专用，浏览器不下载 |
+| list.html 4–6 + 页面头像 + QR logo | `头像?v=2` | 页面必下载 |
+
+`?og-image=1` 与 `?v=2` 是两个缓存键 → favicon 与页面头像各下载一次（同一天上传的头像，各自都 miss）。
+
+---
+
+## 四、优化建议
+
+### P0（改小、见效最大：解决"每次都慢"）
+
+**① R2 上传图片设置强缓存头（根因修复）**
+- 改 `internal/storage/s3.go` 上传处加 `CacheControl: aws.String("public, max-age=31536000, immutable")`
+- 图片 key = 日期 + 15 位随机串，**天然不可变** → `immutable` 完全安全
+- 存量对象（历史头像/背景）用 `wrangler r2 object` 或 S3 API 重打 metadata；或重传一次
+- **预期收益**：二次访问头像/favicon/QR logo 从 ~1s → **0ms（本地缓存直读）**，这是本次优化中体感变化最大的一项
+
+**② easy.qrcode 失败降级 + 两阶段绘制（防二维码空白）**
+- 改 remake 库 logo 分支：`onerror` 时改为**先画无 logo 二维码**（立即可扫），并 `onload` 时自动重绘带 logo 版
+- 或加超时（如 3s）兜底，避免头像悬挂时二维码永久空白
+- 参考实现方向：库内 `r.onerror = function(){ 降级绘制() }`，其中降级绘制即"无 logo 路径 `b()` + makeImage"
+
+### P1（进一步缩短首访）
+
+**③ 统一头像缓存键**
+- 确认 `?og-image=1` 无服务端语义（Go 代码中无处理，疑似历史遗留）后：header 的 icon/favicon 与 list.html 统一用同一 URL 形态（②落地强缓存后，`?v=2` 击穿历史污染缓存的目的已由 immutable+随机 key 取代，可逐步去掉 query）
+- 收益：每页少 1 次头像下载（favicon 与页面头像共享缓存条目）
+
+**④ 背景图压缩**
+- `box_background.png`（297KB）→ WebP（预计 ≤60KB），首访下载量降 ~5 倍；该图 2024-08 上传未再变，压缩一次长期受益
+
+**⑤ 统计脚本 async 化**
+- `cn.vercount.one/js`、`mami.tama.guru/tamami.js` 均非页面功能依赖 → 改 `async`（或 DOMContentLoaded 后再注入），不再拖慢 DOMContentLoaded → 二维码初始化提前
+
+### P2（结构性，可选）
+
+**⑥ 二维码区域骨架占位**：`#boxqrimg` 给 min-height + 轻提示（如"二维码生成中…"），避免空白感
+**⑦ waline 评论懒加载**：滚动到评论区再初始化（若评论非首屏核心）
+**⑧ 图片域加速（治本路线）**：R2 域名无法直接挂 EO，但可在 R2 域名前接 EO/大陆 CDN 回源 `r2.337845818.best`，把头像等图片链路从"CF 国际 ~1s"降到"EO 近大陆 ~0.2s"——与主站 EO 方案同理，属另一工程
+
+---
+
+## 五、建议落地批次
+
+| 批次 | 内容 | 风险 |
+|---|---|---|
+| 批 1（P0） | ① + ② | 低：加缓存头仅影响新上传；库改动影响 3 个模板的二维码渲染，需测试 profile/list/not-found |
+| 批 2（P1） | ③④⑤ | 低–中：③需先确认 og-image 语义 |
+| 批 3（P2） | ⑥⑦⑧ | 视需要 |
+
+> 参考实测：①落地后二次访问头像 0ms；②落地后即使头像失败，二维码 0.2s 内出现可扫 → 用户体感"加载中"消失。
diff --git a/outputs/cloudflare-origin-lockdown-guide.md b/outputs/cloudflare-origin-lockdown-guide.md
new file mode 100644
index 0000000..2b31d4d
--- /dev/null
+++ b/outputs/cloudflare-origin-lockdown-guide.md
@@ -0,0 +1,167 @@
+# Cloudflare 锁定源站 实操指南（配合 P0 修复）
+
+> 目标：让 `trust_proxy = true` 安全生效，同时**不维护 Cloudflare 庞大的 CIDR 清单**。
+> 代码侧（`internal/shared/ip.go`）已改为：优先信任 `CF-Connecting-IP`，仅在 TCP 对端落在
+> `trusted_proxies`（你自己的基础设施）时才解析 `X-Forwarded-For`/`X-Real-IP`。
+> 关键前提：**源站必须只能从 Cloudflare 抵达**，这样攻击者无法直连并伪造 `CF-Connecting-IP`。
+
+---
+
+## 0. 为什么必须锁源站
+
+上一轮的 P0 风险是：开启 `trust_proxy = true` 后，只要攻击者能**直连到源站 IP**，
+他就可以在请求里塞一个 `CF-Connecting-IP: 他想封的任意 IP`，应用会信以为真。
+后果：自动封禁、限流、IP 黑名单全部按**攻击者指定的 IP** 计数 → 可把正常访客（甚至你自己的 IP）打进黑名单。
+
+两种解法都不需要 Cloudflare CIDR 白名单，只是「让攻击者根本连不到源站 / 连到也过不了 TLS」：
+
+- **方案 A：Cloudflare Tunnel** —— 源站不开放任何公网入站端口，`cloudflared` 主动出站连 Cloudflare，
+  外网流量只走 CF→隧道→本地。攻击者不知道、也连不到源站 IP。**最省事，推荐。**
+- **方案 B：Authenticated Origin Pull（mTLS）** —— 源站要求 Cloudflare 回源时出示客户端证书，
+  没证书的直连在 TLS 握手阶段就被拒，连 HTTP 头都发不出来。保留你现有公网 IP/端口时选它。
+
+---
+
+## 1. 方案 A：Cloudflare Tunnel（推荐）
+
+### 1.1 原理
+源站防火墙只放行运维端口（如 22），**不对外开 80/443**。Cloudflare 边缘与源站上的
+`cloudflared` 之间建立一条持久出站隧道。访客的请求在 CF 边缘进入，经隧道到达本地
+`cloudflared`，再转发给监听在 `127.0.0.1` 的 TamaBox。CF 在边缘做 TLS，所以回源用 HTTP 即可。
+
+### 1.2 步骤
+1. **前提**：域名已在 Cloudflare（橙色云代理），源站能主动出网（TCP 443 出站）。
+2. **安装 cloudflared**（二选一）：
+   - Debian/Ubuntu：`sudo apt install cloudflared`（或官方 deb：`curl -fsSL https://pkg.cloudflare.com/cloudflared.deb | sudo dpkg -i -`）
+   - Docker：`docker pull cloudflare/cloudflared:latest`
+3. **登录授权**（浏览器选域）：`cloudflared tunnel login`
+4. **建隧道**：`cloudflared tunnel create tamabox`
+   记下输出的 tunnel ID 与 credentials 文件路径（默认 `~/.cloudflared/<id>.json`）。
+5. **写配置** `~/.cloudflared/config.yml`：
+   ```yaml
+   tunnel: <你的 tunnel id>
+   credentials-file: /root/.cloudflared/<id>.json
+   ingress:
+     - hostname: yourdomain.com        # 改成你的域名
+       service: http://127.0.0.1:8080  # 改成 TamaBox 实际监听地址（见 1.4）
+     - service: http_status:404
+   ```
+6. **绑定 DNS**（自动加 CNAME 到 Cloudflare）：`cloudflared tunnel route dns tamabox yourdomain.com`
+7. **常驻运行**：
+   - systemd：`sudo cloudflared service install` 然后 `sudo systemctl enable --now cloudflared`
+   - Docker：`docker run -d --name cf-tunnel --restart unless-stopped -v ~/.cloudflared:/root/.cloudflared cloudflare/cloudflared tunnel run`
+8. **收紧源站防火墙**：云安全组 / `iptables` 把 **80、443 的 0.0.0.0/0 入站全部删掉**，
+   只保留你的运维 IP 的 22。这样即便有人探测到源站 IP 也连不上。
+
+### 1.3 app.ini 配置 glue
+```ini
+[security]
+trust_proxy = true
+trusted_proxies = 127.0.0.1
+```
+说明：`cloudflared` 连的是本地，`ResolveClientIP` 看到的 TCP 对端就是 `127.0.0.1`；
+`CF-Connecting-IP` 由 Cloudflare 注入并经隧道透传，应用**优先采用它**，无需任何 CIDR。
+
+### 1.4 TamaBox 监听地址建议
+`conf/app.ini` 的 `[server] port = 80`。务必让程序**只绑本地**：
+- 若用 `tamabox.go` 里 `flamego.Classic()` 默认 `0.0.0.0`，请改成 `127.0.0.1:8080`（或你 tunnel 里写的端口），
+  双保险——即使防火墙漏配也不会对外暴露。
+- 改完重启 TamaBox。
+
+---
+
+## 2. 方案 B：Authenticated Origin Pull（mTLS）
+
+### 2.1 原理
+Cloudflare 回源时出示一张由 Cloudflare 私有 CA 签发的**客户端证书**；源站配置「要求并校验客户端证书」。
+ attackers 直接连源站 443 时，因为没有这张证书，TLS 握手直接失败，根本到不了 HTTP 层，
+ 自然无法发送 `CF-Connecting-IP`。**这步本身已足以挡住伪造，不需要 CIDR。**
+
+### 2.2 步骤
+1. **开启 AOP**：Cloudflare 控制台 → **SSL/TLS → Origin Server → Authenticated Origin Pulls** → 开启。
+2. **下载 Cloudflare Origin CA**（用于校验 CF 客户端证）：同一页底部
+   **Origin CA certificates → Create Certificate**（或下载根 CA 证书 `cloudflare_origin_ca.pem`），
+   保存到源站 `/etc/ssl/cloudflare/cf-origin-ca.pem`，权限 `600`。
+3. **落地方式二选一**：
+   - **B1（nginx 在前，最常见）** —— nginx 终止 TLS 并要求客户端证书：
+     ```nginx
+     server {
+         listen 443 ssl;
+         server_name yourdomain.com;
+
+         ssl_certificate     /etc/ssl/yourdom/fullchain.pem;  # 源站证书（可用 CF Origin CA 签发，或自有）
+         ssl_certificate_key /etc/ssl/yourdom/privkey.pem;
+         ssl_client_certificate /etc/ssl/cloudflare/cf-origin-ca.pem;  # Cloudflare 根 CA
+         ssl_verify_client on;          # 必须校验 Cloudflare 客户端证书
+         ssl_verify_depth 2;
+
+         location / {
+             proxy_pass http://127.0.0.1:8080;   # TamaBox 本地端口
+             proxy_set_header Host $host;
+             proxy_set_header CF-Connecting-IP $http_cf_connecting_ip;  # 透传给应用（优先采用）
+             proxy_set_header X-Real-IP $remote_addr;
+             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+         }
+     }
+     ```
+     `sudo nginx -t && sudo systemctl reload nginx`
+   - **B2（Go 直接对外 TLS，不用 nginx）** —— 让 TamaBox 监听 TLS 并强制客户端证书
+     （需改启动代码，示意）：
+     ```go
+     srv := &http.Server{
+         Addr:    ":443",
+         TLSConfig: &tls.Config{
+             ClientAuth: tls.RequireAndVerifyClientCert,
+             ClientCAs: cfCACertPool, // 载入 cf-origin-ca.pem
+         },
+     }
+     srv.ServeTLS(ln, "/etc/ssl/yourdom/fullchain.pem", "/etc/ssl/yourdom/privkey.pem")
+     ```
+4. **防火墙（可选加固）**：源站 443 只放行 Cloudflare 回源 IP。**但 AOP 的 mTLS 已挡住伪造，
+   CIDR 只是减少无效握手，可按需省略**——正好契合你「不想维护大 CIDR」的诉求。
+
+### 2.3 app.ini 配置 glue
+- 用 nginx（B1）：`trust_proxy = true`，`trusted_proxies = 127.0.0.1`
+  （nginx 在本地，TCP 对端 `127.0.0.1`）。`CF-Connecting-IP` 经 nginx 透传被应用优先采用；
+  即便没透传，XFF 由受信的 `127.0.0.1` 解析也能拿到真实 IP。
+- 用 Go 直连 TLS（B2）：`trust_proxy = true`，`trusted_proxies` 可留空
+  （TCP 对端就是 Cloudflare，`CF-Connecting-IP` 直接采用）。
+
+---
+
+## 3. 怎么选
+| 场景 | 选 |
+|------|----|
+| 单实例、怕配错、不想管证书/防火墙 | **方案 A（Tunnel）** |
+| 已有 nginx、必须保留公网 IP、希望源站也强制 TLS | **方案 B（AOP）** |
+
+---
+
+## 4. 验证（上线前务必做）
+1. **直连源站公网 IP 应失败**：
+   - A：`curl -I https://<源站IP>` 应超时 / 连接拒绝。
+   - B：`curl -I https://<源站IP>` 应 TLS 握手失败（`sslv3 alert handshake failure` 之类）。
+2. **经域名访问正常**：`curl -I https://yourdomain.com` 返回 200。
+3. **确认记录的是真实客户端 IP**：用不同网络访问，查看限流/统计/日志，
+   不应再是 Cloudflare 边缘 IP。
+4. **伪造头测试（仅限你自己的 IP）**：
+   `curl -H "CF-Connecting-IP: 1.2.3.4" https://yourdomain.com` —— 应用应忽略该头，记录你的真实 IP。
+5. **自动封禁仍生效**：连续触发 404 阈值，确认被封的是真实客户端 IP，不是 CF 边缘。
+
+---
+
+## 5. 注意事项
+- `trust_proxy = true` 一旦开启，**源站就必须锁定**，否则比 `false` 更危险
+  （应用会更信任客户端头）。代码注释已写明此约束。
+- Tunnel 下建议 TamaBox 监听 `127.0.0.1`（不要 `0.0.0.0`），双保险。
+- 隧道 credentials 与证书文件权限 `600`，**不要进 Git 仓库**。
+- 多实例 / 容器：把 `cloudflared` 跑在与 TamaBox 能直连的网络（同主机或同 docker 网络）。
+- 证书 / 隧道有有效期，纳入监控或自动续期（Cloudflare 证书默认较长，Tunnel 凭证基本免维护）。
+
+---
+
+## 6. 与代码的对应关系（便于回溯）
+- `internal/shared/ip.go`：`ResolveClientIP` 优先 `CF-Connecting-IP`，仅 `isTrustedProxy(remote)` 才解析 XFF。
+- `internal/conf/static.go`：`Security.TrustedProxies`（`trusted_proxies`）新字段。
+- `internal/cmd/web.go`：`conf.Init()` 后调用 `shared.InitTrustedProxies()` 解析清单。
+- `conf/app.sample.ini`：`trust_proxy` / `trusted_proxies` 注释已更新。
diff --git a/outputs/code-review-2026-08-28.md b/outputs/code-review-2026-08-28.md
new file mode 100644
index 0000000..5780f59
--- /dev/null
+++ b/outputs/code-review-2026-08-28.md
@@ -0,0 +1,178 @@
+# TamaBox-v4 整体代码审阅报告
+
+- **审阅日期**：2026-08-28
+- **审阅范围**：全仓（87 个 Go 文件 + 38 个 HTML 模板 + 配置/脚本）
+- **技术栈**：Flamego + GORM + PostgreSQL + Redis（1C1G 部署）
+- **方法**：4 个并行只读探索代理（架构 / 安全 / 性能 / 前端·代码质量）+ 关键高危项人工复核
+- **说明**：本报告为纯审阅，**未改动任何代码**。按你一贯的分阶段工作流，请选定优先级后我分批落地。
+
+---
+
+## 一、执行摘要
+
+整体健康度**良好**——安全工程成熟度高于同类项目：IDOR 越权、XSS 转义、SQL 注入三大高风险面均有系统化纵深防御；会话/CSRF/限流/SSRF/内容审核（fail-closed）均已落地。未发现会让线上立即崩溃或数据泄露的 P0 级事故。
+
+主要短板集中在：**配置防呆不足**（Salt 未校验）、**部署样例与结构体错位**（PostgreSQL 直接连库失败）、**少量数据层查询未分页/缺索引**、**一个暴露面偏宽的内部反代**、以及**架构债**（上帝文件、缺 service 层）。这些均为可规划修复的中等问题，无紧急止血项。
+
+| 维度 | 评分 | 一句话 |
+|------|------|--------|
+| 安全 | 🟢 良好 | 高风险面有纵深防御；残余项为中低危加固 |
+| 架构 | 🟡 中等 | 分层清晰但存在上帝文件、缺 service 层、配置防呆不足 |
+| 性能 | 🟢 良好 | 连接池/缓存/分页已调优；少量 N+1 与缺索引 |
+| 代码质量 | 🟢 良好 | 日志统一、测试有部分覆盖；魔法字符串与构建依赖待理 |
+| 前端/UX | 🟢 良好 | 模板写法规范、交互健全；少量体验增强空间 |
+
+---
+
+## 二、问题清单（按优先级）
+
+### 🔴 P0 — 部署前必须修复（防呆 / 阻断）
+
+**P0-1 密码 Salt 未做非空校验（高危防呆）**
+- 位置：`internal/db/password.go:25`、`password.go:55` 使用 `HmacSha1(password, conf.Server.Salt)`；`conf/conf.go` 仅校验 `external_url` 与 `xsrf_key`，**未校验 Salt**。
+- 影响：若部署沿用样例空盐（`app.sample.ini` 中 `salt = ""`），全站密码散列实际以空盐计算——相同密码产生相同哈希，且针对本站的离线字典/彩虹表攻击可行。
+- 建议：在 `conf.Init` 仿照 `xsrf_key` 增加 `if Server.Salt == "" { return error }`；并提供强随机默认值或启动即失败。
+
+**P0-2 配置样例与结构体字段不一致（部署即失败）**
+- 位置：`conf/app.sample.ini:36-42` 的 `[database]` 用 `address = "tcp(127.0.0.1:3306)"`；而结构体为 `type/host/port/name`（`internal/conf/static.go:58-63`），**缺 host/port/type**。
+- 影响：按样例部署时 `Database.Type` 为空 → 走 mysql 分支 → 生成非法 DSN `:@tcp(:0)/`，启动连库直接失败；PostgreSQL 用户也无法从样例获得正确字段。
+- 建议：样例补全 `type = postgres`、`host`、`port`、`name`、`user`、`password`、`ssl_mode`，使其与当前结构体一一对应。
+
+### 🟠 P1 — 应当修复（重要）
+
+**P1-1 `/api/v1/service` 反代可转发至内部后端（中危）**
+- 位置：`route/service/proxy.go:35-48`
+- 影响：登录用户可控 `**` 路径转发到配置后端，`httputil.ReverseProxy` 透传原始 Cookie/Header；若后端前缀泄露或配置为内网地址，可成为横向探测入口；且 `TLSInsecureSkipVerify` 可关闭证书校验。
+- 建议：白名单限定可转发子路径与方法；禁止转发敏感 Header；内网后端强制校验；补审计日志。
+
+**P1-2 导出接口 N+1 查询**
+- 位置：`route/user/profile.go:381-401`（循环内 `FollowUps.GetByQuestionID`/`UploadImages.GetByQuestionID`，每题 2 次）、`profile.go:426-449`（循环 `Messages.GetByConversationID`，每会话 1 次）。
+- 影响：大账号导出慢、占用 DB 连接。
+- 建议：改为 `IN (?)` 批量拉取后内存分组（与已有的 `GetFirstMessagesByConversationIDs` 窗口函数做法一致）。
+
+**P1-3 私信列表无分页（全量返回）**
+- 位置：`internal/db/conversation.go:145-161` `ListByOwner`/`ListByAsker` 无 LIMIT；调用处 `profile.go:419-422`、`chat` 列表。
+- 影响：私信多的用户一次拉全部会话与消息，内存/DB 压力大。
+- 建议：加 `LIMIT/OFFSET` 或按 `created_at DESC` 游标分页。
+
+**P1-4 高频查询缺复合索引**
+- `questions.asker_user_id`：`CREATE INDEX idx_questions_asker ON questions(asker_user_id);`（`questions.go:243`）
+- 箱主公开页：`CREATE INDEX idx_q_user_private_created ON questions(user_id, is_private, created_at);`（`questions.go:171-228`）
+- 探索页：`CREATE INDEX idx_users_showinhome_created ON users(show_in_home, created_at);`（`users.go:487-540`）
+- 投票热门：`CREATE INDEX idx_votes_status_vis_created ON votes(status, visibility, created_at);`（`votes.go:206-270`）
+- 消息每日计数：`CREATE INDEX idx_messages_sender_created ON messages(sender_id, created_at);`（`users.go:805`）
+- 会话消息排序：将单列 `conversation_id` 索引改为复合 `(conversation_id, created_at)`（`message.go:56`）
+
+**P1-5 changelog 仍走外部 fetch（引入外部依赖）**
+- 位置：`templates/change-logs.html:10` 从外部域名取 `tamabox.changelogs.json`，而本地已生成并提交 `tamabox.changelogs.json` 未被使用。
+- 影响：跨域依赖、外部不可达时 changelog 空白、可被篡改。
+- 建议：将 json 纳入 `static` embed，新增同源路由 `/changelogs.json`（或放入 static 目录直接 fetch 同源路径），去掉外部依赖。
+
+**P1-6 私密提问访问令牌熵值偏低（隐私/安全）**
+- 位置：`internal/db/questions.go:93`（`Token: randstr.String(6)`）
+- 影响：私密/未答提问与追问权仅靠 6 位随机串（约 62^6），结合 questionID 可枚举猜测，进而读取私密提问或冒用提问者身份发追问。
+- 建议：Token 提升至 ≥16 位随机串或直接用 UUIDv4。
+
+**P1-7 架构债：上帝文件 + 缺 service 层（可维护性，分阶段重构）**
+- 位置：`route/user/vote.go`(1289 行)、`route/vote/vote.go`(1036)、`route/question/share.go`(964)、`internal/db/users.go`(881)。
+- 影响：单文件同时承载 HTML 渲染、图片生成、DB 事务与业务判断，违反单一职责，难测试难维护；`route/*` 直接调 `db.*`，业务逻辑散布。
+- 建议：引入 `internal/service` 承载用例编排，handler 仅做请求解析/渲染；图片/分享卡生成抽到 `internal/render`。分阶段进行，不一次性大改。
+
+### 🟡 P2 — 可优化（锦上添花 / 技术债）
+
+- **webp CGO 硬依赖**（已知约束）：`internal/storage/s3.go:23` 与 `route/question/page.go:595` 直接 `import "github.com/chai2010/webp"`，链接阶段即需 libwebp，阻断 Windows/macOS 构建。你已在 Linux 解决，**不作为当前阻塞项**。建议用 `//go:build linux,cgo` 隔离为可选实现，未启用时走原图直传，消除跨平台构建门槛。
+- **魔法字符串**：提问过滤参数 `"all"/"public"/"private_question"` 散落 `route/user/question.go:58,121,171,174`、`form/question.go:17`，无编译期保护。建议抽 `QuestionFilter*` 常量（投票可见性已有先例 `internal/db/votes.go:43`）。
+- **会话 Cookie 未硬化**：`internal/route/route.go:92-95` 未设 `Secure/SameSite`。建议 `session.Options{Cookie:{Secure:true, SameSite:Lax}}`。
+- **PostgreSQL 无 TLS**：`internal/conf/db.go:16` 硬编码 `sslmode=disable`。建议加 `ssl_mode` 配置项，生产默认 `require`。
+- **限流为单进程内存**：`internal/route/ratelimit.go:17-100`，多实例可被分摊绕过；登录无失败锁定。建议改用 Redis 共享限流 + 失败阈值临时锁定。
+- **匿名身份服务端留存**：`internal/db/questions.go:64-72` 记录 `FromIP`；若承诺强匿名，应定期脱敏并明示隐私策略。
+- **邮件模板外链字体**：`templates/mail/*.html` 引用 `//fonts.loli.net`，离线/被墙时回退不可控。建议改用系统字体栈或自托管。
+- **遗留 .bak**：`templates/question/new-question-template.html.bak` 含硬编码中文，易与 i18n 正式版混淆。建议删除，由 git 管历史。
+- **无优雅退出**：`internal/cmd/web.go:82-94` 未注册 `signal.Notify`，重启会断连。建议加 SIGTERM + `server.Shutdown(ctx)`。
+- **路由包命名混乱**：顶层 `route` 与 `internal/route` 同名（无 import 循环，但易误读）。建议收口到 `internal/route/*`。
+- **首页统计缓存细节**：`internal/stats/stats.go:41-78` 进程内 30 分钟缓存合理，但过期瞬间并发重算、写后未 `Invalidate()`。建议 TTL 加抖动 + 写后失效。
+- **GetHotTags 全表 Pluck**：`internal/db/users.go:661-667`（已 60s 缓存）。大数据量建议 SQL 内聚合或限样本。
+- **搜索无分页**：`internal/db/questions.go:374` `SearchByUserID` 返回全部 LIKE 匹配。建议加 `LIMIT`。
+- **CSRF 对 `/api/v1/pixel/` 关闭**：`internal/context/context.go:170`。影响有限，建议仅限 GET 或补回校验。
+- **handler 级测试薄弱**：`route/question`、`route/user` 多依赖真实 DB/Redis，缺单测。建议补基于 `dbutil/testing.go` 的集成测试或 httptest mock。
+
+---
+
+## 三、已确认的良好实践（正面，保持）
+
+- **IDOR 防护到位**：提问删除/私密/回答经 `canDelete = 登录且为箱主`（`route/question/question.go:69`）及 `question.UserID==pageUser.ID` 双重校验；投票经 `getOwnedVote`（`route/user/vote.go:392`）；私聊经 `OwnerID/AskerID`（`chat_handler.go:52`）。
+- **XSS 转义到位**：`QuestionFormat/AnswerFormat` 走 `html.EscapeString`（`internal/template/template.go:46-55`）；Markdown 经白名单 sanitize；`toJSON` 依赖 `json.Marshal` 默认转义。
+- **SQL 注入为零**：全量 GORM 参数化；Raw 均用 `?` 占位（`message.go:91` 的 `IN ?`）。
+- **SSRF 防护**：`/proxy-image` 含域名白名单 + 私网 IP 拦截 + DNS rebinding 防护（`route/proxy.go:24-127`）。
+- **其他**：注册/登录/提问强制验证码；内容审核 fail-closed；登录会话再生防固定（`route/auth/login.go:66`）；开放跳转前缀校验防开放重定向。
+- **性能基础好**：模板启动解析缓存（`templates/embed.go`）、Gzip 全量接入（`internal/cmd/web.go:84`）、连接池按 1C1G 调优（MaxOpen=10）、批量反 N+1 已落地。
+- **Go 模板无运算符误用**：全仓 grep `!=`/`==`/`&&`/`||` 零命中，无启动 panic 风险；删除交互均有二次确认。
+
+---
+
+## 四、新功能与 UX 提升建议
+
+> 均考虑 1C1G 约束（不引入常驻重服务）；按"用户价值 / 实现成本"简评。
+
+| # | 建议 | 用户价值 | 成本 | 说明 |
+|---|------|---------|------|------|
+| F1 | **通知中心 + 邮件摘要聚合** | 高 | 中 | 提问箱核心体验是"收到提问"。站内通知列表 + 邮件可设每日/每周摘要开关，避免逐条邮件轰炸；与现有邮件体系复用。 |
+| F2 | **箱主治理面板** | 高 | 中 | 自定义提问箱简介/主题、开关"允许匿名/图片/投票"、屏蔽关键词、隐藏不当内容。提升箱主掌控感。 |
+| F3 | **前台举报入口** | 高 | 低-中 | 后台已有 fail-closed 审核，但面向用户的"举报不当提问/回答"按钮缺失；补前台入口 + 箱主一键隐藏。 |
+| F4 | **私密提问体验增强** | 中 | 中 | 追问流、已读状态、链接过期机制（配合 P1-6 令牌熵提升），让匿名双向对话更顺畅。 |
+| F5 | **探索/发现页增强** | 中 | 中 | 标签筛选、热门排序、按话题聚合（`GetHotTags` 已有数据），提升内容分发与留存。 |
+| F6 | **防刷与内容质量** | 中 | 中 | per-box 提问限流、垃圾链接/敏感词前端预检、重复内容检测（配合 P2 限流改造）。 |
+| F7 | **数据导出优化** | 中 | 低 | 支持 Markdown/PDF 导出，导出走批量查询（顺带修 P1-2 N+1），导出包隐私脱敏。 |
+| F8 | **移动端 PWA + 暗色模式** | 中 | 中 | 纯静态资源即可，1C1G 友好；显著提升移动端阅读与夜间体验。 |
+| F9 | **草稿与定时发布** | 低-中 | 中 | 私密回答存草稿、公开回答定时发布，降低发布压力。 |
+| F10 | **无障碍 a11y** | 低 | 低 | 键盘可达、aria 标签、对比度，提升专业度与合规。 |
+
+**优先推荐**：F1（通知中心）+ F2（箱主治理）+ F3（前台举报）组合——直接提升"收提问→治理→互动"的主链路体验，且不引入重型依赖。
+
+---
+
+## 五、建议的分阶段实施路径
+
+1. **阶段 0（本次部署前）**：P0-1、P0-2（防呆 + 样例对齐），半小时内可合。
+2. **阶段 1（安全/数据层）**：P1-1 反代收敛、P1-6 令牌熵、P1-2/P1-3 分页与 N+1、P1-4 建索引、P1-5 changelog 同源。
+3. **阶段 2（架构债）**：P1-7 引入 service 层，按模块分批抽离上帝文件（先 `route/question/share.go` 的图片/分享卡）。
+4. **阶段 3（体验增强）**：P2 各项 + 从 F1/F2/F3 启动新功能。
+
+---
+
+## 附：探索索引
+- 架构：`tamabox.go` → `cmd.Web` → `conf.Init` → `db.Init` → `route.New()`
+- 安全：IDOR/ XSS / SQLi / SSRF / 限流 / 会话 已逐项核验
+- 性能：连接池、缓存、分页、索引、changelog、统计
+- 前端：模板转义、partial、交互确认、webp 构建依赖、魔法字符串
+
+---
+
+## 六、实施进展
+
+### P0 已修复（2026-08-28）
+- **P0-1 Salt 校验**：`internal/conf/conf.go` 的 `Init` 在 `server` 段 MapTo 后新增 `if Server.Salt == "" { return error }`，空盐启动即失败，防止密码以空盐哈希（离线碰撞风险）。
+- **P0-2 配置样例对齐**：`conf/app.sample.ini` 的 `[database]` 段按 `Database` 结构体字段对齐（`type`/`host`/`port`/`name`/`schema`），去掉旧的不存在字段 `address`，默认 `type=postgres`、`port=5432`、`schema=public`。
+- **验证**：`go build ./internal/conf/...` 通过；临时测试（已清理）确认 ① 样例 database 段 MapTo 出 `type=postgres`/`port=5432`/`schema=public`；② 空 salt 时 `conf.Init` 返回 salt 错误；③ 非空 salt 时正常加载。
+- **重要陷阱**：`conf.Init` 使用 `IgnoreInlineComment: true`，行内 `;` 注释会被并入配置值——初次加的行内注释曾污染 `database.type` 与 `server.salt`（并使 Salt 校验失效），已全部改回整行注释。原 sample 大量行内注释存在同类系统性污染，建议后续统一改为整行注释（见 MEMORY.md 配置解析约定）。
+
+### P1 已修复（2026-08-28）
+- **P1-1 服务反代加固**：`route/service/proxy.go` 剥离转发的敏感 Header（Cookie / Authorization / X-* / Proxy-* / Host 等），并在转发前补审计日志（操作者、目标、路径、大小）；`internal/route/route.go` 将 `/service/{**}` 路由由 `f.Any`（任意方法）收敛为 `f.Get`（仅 GET），消除写方法经反代的安全面。`go build ./route/service/...` 通过。
+- **P1-2 导出接口 N+1 批量化**：`internal/db/follow_ups.go`、`upload_images.go`、`message.go` 新增 `GetByQuestionIDs` / `GetAllByConversationIDs` 批量方法（返回 `map[uint][]*T` 分组）；`route/user/profile.go` 的导出逻辑由"循环单查"改为"IN 查询 + 内存分组"，追问题/图片由每题 2 次、消息由每会话 1 次降为 3 次批量查询。`go build ./internal/db/...` 通过。
+- **P1-3 私信列表分页**：`internal/db/conversation.go` 的 `ListByOwner`/`ListByAsker` 增加 `limit, offset` 参数（导出仍传 `0,0` 取全量，行为不变），并新增 `CountByOwner`/`CountByAsker`；`route/user/question.go` 的「我收到的 / 我发起的」私聊列表接入游标分页（每页 50，复用 `buildQListPageURL` 保留筛选参数），模板 `templates/user/question-list.html` 增加真实总数头与「加载更多」链接。模板解析/渲染测试全部通过。**注意**：`route/user` 在 Windows 因 `github.com/chai2010/webp` 的 CGO 硬依赖无法编译（已知约束，最终在 Linux 完整构建）；逻辑已逐处类型核对无误。
+- **P1-4 高频查询补复合索引**：`internal/db/db.go` 在 `AutoMigrate` 之后调用 `ensureFrequentlyUsedIndexes`（仅 PostgreSQL），以 6 条 `CREATE INDEX IF NOT EXISTS` 幂等建索引：`idx_questions_asker_user_id`、`idx_questions_user_private_created`、`idx_users_show_in_home_created`、`idx_votes_status_visibility_created`、`idx_messages_sender_created`、`idx_messages_conversation_created`。不影响共享 Model，适合既有库。`go build ./internal/db/...` 通过。
+- **P1-5 changelog 同源化**：`dev/gen_changelog.py` 输出路径由根目录 `tamabox.changelogs.json` 改为 `static/tamabox.changelogs.json`；`static/fs.go` 的 `//go:embed` 纳入该文件；`templates/change-logs.html` 的 fetch 由外部域名 `api-direct.337845818.best/...` 改为同源 `/static/tamabox.changelogs.json`，并删除根目录旧副本。`go build ./static/...` + 模板解析测试通过。
+- **验证总览**：可本地构建的包（`internal/conf`、`internal/db`、`static`、`templates`）全部 `go build`/`go test` 通过；`gofmt -l` 对全部改动 Go 文件零输出（已 `gofmt -w` 归一化）；`route/service` 与 `route/user` 因 webp CGO 在 Windows 不可编，依项目约定留待 Linux/CI 完整构建。P1-6（令牌熵）、P1-7（service 层）未在本轮处理，列为后续阶段。
+
+### 回归核查（2026-08-28 16:2x）
+逐项复核 P0 + P1-1~P1-5 是否复现或引发新问题。**结论：7 处修复均完好、无复现、无回归。**
+- 验证手段：逐文件 grep 关键标记 + 读 proxy.go/route.go/question.go/profile.go/db.go 改动段 + `gofmt -l`/`go build`/`go vet ./internal/db`/模板解析渲染测试 + 核对 i18n 三语言键（zh_cn/ja/en）。
+- 构建结果：可本地编译包 `build` 退出码 0、`go vet` 0、模板测试 ok、`gofmt -l` 对 11 个改动文件零输出。
+- 各点确认：
+  - P0-1 Salt 非空校验在 conf.go:57；P0-2 样例 `[database]` 字段对齐且**无行内注释污染**（IgnoreInlineComment 陷阱未复发）。
+  - P1-1 反代剥离敏感头（proxy.go:66-80）+ 审计日志（92-99）+ route.go:292 收敛 `f.Get`。
+  - P1-2 三个 store 批量方法签名与实现齐全，profile.go 导出改用批量/分组。
+  - P1-3 私信分页：`ChatStats.received/initiated` 来自 `CountByOwner/CountByAsker` **真实总数**（非分页切片长度）；模板「加载更多」键 `qlist.loadMore` 三语言齐全；`strconv.FormatUint(uint64(...))` 类型错误已修。
+  - P1-4 6 条 `CREATE INDEX IF NOT EXISTS` 幂等、internal/db 编译通过。
+  - P1-5 静态前缀 `/static`（route.go:99）+ embed 含 json + 模板同源 fetch；根副本已删、无残留引用。
+- 一处措辞纠正（非缺陷）：P1-4 `ensureFrequentlyUsedIndexes` 实际**未做 dialect 门控**（无条件执行），但所用 DDL 为 PG 与 MySQL 8.0+ 均支持的 `CREATE INDEX IF NOT EXISTS` 可移植语法，对当前 PG 部署无影响；若将来接 MySQL 仍可用。
diff --git a/outputs/code-review-2026-08-31.md b/outputs/code-review-2026-08-31.md
new file mode 100644
index 0000000..d4b74f7
--- /dev/null
+++ b/outputs/code-review-2026-08-31.md
@@ -0,0 +1,132 @@
+# TamaBox-v4 整体功能与逻辑审阅报告
+
+- **审阅日期**：2026-08-31
+- **范围**：全仓库（route / internal / templates / conf）
+- **方法**：静态走查 + 编译验证（`go build` / `go vet` / 单元测试）+ 对每项高危结论做源码核对（trust but verify）
+- **结论概览**：核心架构扎实（路由/中间件/会话固定/回收令牌/配额原子递增/功能开关 Evaluate 逻辑均正确）。发现 **1 个 P0 级安全缺陷（IP 伪造绕过）、若干 P1 逻辑/安全/可用性问题、一批 P2 健壮性项**。无导致编译崩溃的致命代码错误。
+
+---
+
+## 0. 测试与构建验证结果
+
+| 项目 | 结果 |
+|---|---|
+| `go version` | go1.25.5 windows/amd64 |
+| `go build ./...` | ❌ 仅因 `internal/storage/s3.go` 依赖 `github.com/chai2010/webp`（CGO 缺 libwebp 本机库，沙箱限制，与既有约定一致）。**其余包均可独立编译** |
+| 核心包编译 | ✅ `internal/form internal/db internal/cache internal/i18n internal/captcha internal/security/* internal/context internal/conf internal/dbutil` 全部 OK |
+| `go vet`（上述包） | ✅ 无告警 |
+| 单元测试 | ✅ `internal/form` `internal/i18n` `internal/cache` `internal/security/autoban` 全部通过 |
+| DB 集成测试 | ⚠️ 需外部 PostgreSQL/MySQL（`DB_TYPE` 环境变量，沙箱无），未执行；`feature_control_test` 等需落库测试建议在有 DB 环境补跑 |
+
+> 说明：`gofmt -l` 发现 11 个文件未格式化（如 `internal/security/censor/text.go`、`internal/captcha/math.go`、`route/user/harassment.go` 等），建议 `gofmt -w` 统一。
+
+---
+
+## 🔴 P0 — 安全/可用阻断级
+
+### P0-1　反向代理 IP 信任可被伪造，限流/黑名单/自动封禁全线失效
+- **位置**：`internal/shared/ip.go:42-69`（`ResolveClientIP`）、被 `internal/route/ratelimit.go`、`autoban.go`、`ipblacklist.go` 共用
+- **问题**：当 `conf.Security.TrustProxy=true` 时，直接信任客户端发来的 `CF-Connecting-IP` / `X-Real-IP` / `X-Forwarded-For`，**不校验 `RemoteAddr` 是否属于可信代理 CIDR**。任何人都可伪造这些头。
+- **影响**：
+  1. 限速、IP 黑名单被完全绕过（每次请求换一个伪造 IP）；
+  2. 自动封禁（fail2ban）被反射利用——攻击者用伪造头把**任意受害者 IP** 打进黑名单，造成误封（含 CDN 出口 IP，可能误伤全站访客）。
+- **现实性**：`conf/app.sample.ini` 明确建议"站点在 Cloudflare 后且需自动封禁时必须设 `trust_proxy = true`"——这正是绝大多数生产部署，故该缺陷在生产可达。
+- **修复**：配置 `trusted_proxies` CIDR 列表；仅当 `RemoteAddr` 命中可信网段才读取代理头；`X-Forwarded-For` 自右向左剥离已确认的可信跳数后再取最左原始 IP。
+
+---
+
+## 🟠 P1 — 逻辑错误 / 漏洞 / 可用性
+
+### P1-1　会话 Cookie 缺 `Secure` / `SameSite`
+- **位置**：`internal/route/route.go:92-95`（`session.Options` 仅设 `Initer/Config`，无 `Cookie` 字段）
+- **影响**：生产经 TLS 反代时，会话 Cookie 不会标 `Secure`（明文链路可泄露）；未显式 `SameSite`。`conf.App.Production` 只切 Flamego 环境，不联动 Cookie 标志。
+- **修复**：按 `conf.App.ExternalURL` 是否 `https` 设 `Secure:true`；`SameSite:http.SameSiteLaxMode`（与既有 CSRF Token 协同）；`HttpOnly:true`。
+
+### P1-2　配置解析：行内 `;` 注释污染值，最坏导致启动崩溃
+- **位置**：`internal/conf/conf.go:25-27`（`IgnoreInlineComment:true`）+ `conf/app.sample.ini:5,11,12,16-28,54`
+- **问题**：该选项下 `key = val ; 注释` 的注释会被并入字段值。示例里 `trust_proxy = false   ; 是否信任…`、`ban_threshold_sensitive = 10 ; …` 等带行内注释。若把 sample 直接当 `app.ini` 用，`File.Section("security").MapTo(&Security)` 解析 bool/int 会因尾部中文注释失败 → **进程启动即崩溃**；`share_background` 这类字符串字段则会得到带注释的非法 URL。
+- **修复**：将 `IgnoreInlineComment` 改为 `false`（安全默认，`;` 重新开始注释），或全量清除 sample 中的行内注释（当前 sample 与其自身约定"禁用行内注释"矛盾）。
+
+### P1-3　本地算数验证码可被脚本自动解出 + 端点无节流
+- **位置**：`internal/captcha/math.go:195-212`（`GenerateHandler` 无限流）、`:148-159`（`VerifyOnly` 不消费、不计数）、`:49-55`（忽略 `rand.Int` 错误）
+- **问题**：验证码题目由服务端返回给客户端（如 `"23 × 7 ="`），答案对客户端完全可见，**任何脚本都能读题即算**——对机器人无实质阻挡；`/api/captcha/verify` 无节流且 `VerifyOnly` 不消费，可被无限轮询；`GenerateHandler` 无限流会导致会话条目无界膨胀（DoS）。
+- **影响**：匿名投票/提问的"唯一门槛"被自动化绕过；叠加 **P0-1** 的 IP 伪造，匿名刷票/刷提问几乎无成本。
+- **修复**：匿名提交改用语服务端校验的 Turnstile/recaptcha；或补 `/api/captcha/*` 限流 + 同 id 尝试 3 次即销毁；对 math 答案做常量时间比较。
+
+### P1-4　追问"等主人回复"仅客户端校验，服务端可绕过
+- **位置**：`route/question/follow_up.go:31-63`（`PublishFollowUp`）
+- **问题**：仅检查 `question.Answer != ""` 与 `count < 3`，**不校验上一条追问是否已被回答**（`waitingFollowUpReply` 只在模板隐藏表单，POST 不强制）。攻击者可连发满 3 条追问而不等主人回任一条。
+- **修复**：取该问题最新一条 follow-up，若 `Answer == ""` 直接拒绝（并复用 `CreateIfBelowLimit` 原子兜底）。
+
+### P1-5　内容审核"可信域名剥离"被绕过，钓鱼链接漏审
+- **位置**：`internal/security/censor/text.go:89-96`（`RemoveTrustedURL`）
+- **问题**：朴素 `strings.ReplaceAll("https://github.com", "")`。`https://github.com.evil.tld/phish` 会被剥成 `.evil.tld/phish`，恶意域名逃过 URL 审核。
+- **修复**：解析 URL 后按"精确 host 或受信 host 的子域"精确匹配，再决定是否跳过审核。
+
+### P1-6　密码校验：遗留 HMAC 比较非常量时间 + bcrypt 失败静默降级
+- **位置**：`internal/db/password.go:56`（`legacyHash == storedHash`）、`:24`（`GenerateFromPassword` 出错回退弱 HMAC-SHA1）
+- **问题**：遗留账户走 `==` 比较存在时序侧信道；bcrypt 出错时不返回错误，反而存一个弱 HMAC-SHA1 哈希（下次登录按 legacy 处理）， silently 削弱了密码存储强度。
+- **修复**：遗留分支改用 `subtle.ConstantTimeCompare`；bcrypt 失败直接 `return err`，不回退。建议 bcrypt cost 提到 12。
+
+### P1-7　删除内容不回退功能配额计数
+- **位置**：`internal/db/questions.go`（删除）、`internal/db/conversation.go:204`（`MarkDeletedByOwner`）
+- **问题**：达定量上限后，即便删除该提问/私聊，对应 `feature_controls.quota_count` 不 `-1`，功能仍显示 `quota_reached` 关闭，须箱主手动"重置计数"。
+- **修复**：删除时按功能类型调用 `FeatureControls.IncrementQuota(-1)`（注意软删除与并发）。
+
+### P1-8　自动封禁把合法 302 误判为探测
+- **位置**：`internal/route/autoban.go:51-53`
+- **问题**：把"302 → /"一律当扫描信号；但 `/i18n/{lang}` 切换、logout、黑名单跳转、投票不存在等都是 302→/。60s 内 20 次即 403 封 15 分钟，易误伤正常用户。
+- **修复**：仅在 `f.NotFound`（真正的 404）路径内计数，排除业务性 302。
+
+### P1-9　服务反代路径穿越 + 丢失 query + 无超时
+- **位置**：`route/service/proxy.go:37,59`
+- **问题**：`forwardPath` 未经 `path.Clean`，`/service/<prefix>/../../x` 可越过白名单前缀（白名单本身有效，无任意 SSRF/元数据风险）；丢失 `RawQuery`；每请求新建 `Transport` 且无超时。
+- **修复**：`Clean` 后再次校验仍以 `forwardURL.Path` 为前缀；透传 query；复用带超时的 `Transport`。
+
+### P1-10　`/api/v1/pixel/**` 豁免 CSRF + 放行写方法 + 无节流 + 响应头透传
+- **位置**：`internal/context/context.go:170`（CSRF 排除）、`internal/route/route.go:296`（`f.Any` + `reqUserSignIn`）
+- **问题**：该前缀跳过 CSRF 校验且 `f.Any` 放行 POST/PUT/DELETE；`path.Join("/api/", uri)` 可经 `..` 跳出 `/api`；上游 `Set-Cookie` 等响应头原样回传；无速率限制。
+- **修复**：强制 CSRF 或仅放行 GET；拒绝含 `..` 的路径；白名单放行响应头；补限流。
+
+---
+
+## 🟡 P2 — 健壮性与改进（建议项）
+
+| # | 位置 | 问题 | 建议 |
+|---|---|---|---|
+| P2-1 | `route/vote/vote.go:310` | 排序题统计 `json.Unmarshal(&data.Ranking,…)` 应为 `&data`，解析必失败且错误被忽略 | 改为 `&data` 并补单测验证 |
+| P2-2 | `route/vote/vote.go:48,343,776` | 结果缓存共享指针，且仅新提交失效（删提交/改选项不失效），多实例不一致 | 失效键扩展；或缓存按 vote 维度加版本号 |
+| P2-3 | `internal/db/vote_submissions.go:51-55` | 唯一索引不含 `deleted_at`：软删提交后统计归零却无法重投 | 唯一约束纳入 `deleted_at` 或改用业务去重 |
+| P2-4 | `internal/db/questions.go` | `Question.Token` 仅 6 位且无唯一索引约束说明，碰撞可越权看他人私密/未答提问 | 确认是否 `uniqueIndex`；不足则加长 |
+| P2-5 | `route/question/question.go` | 普通 `Delete` 不级联 `follow_ups`/`UploadImages`，留孤儿记录 | 软删时同步标记子表 |
+| P2-6 | `internal/db/users.go` | `CountTodayMessagesFromUser` 用 `CURRENT_DATE`（DB 时区），与 App 本地时区不符，每日私信上限窗口偏移 | 用 App 本地时区日期边界 |
+| P2-7 | `route/user/profile.go:337` | 导出 XLSX/CSV 时用户串直写单元格，含 `= + - @` 开头可在 Excel 执行公式（公式注入） | 单元格前加 `\t`/单引号或置文本格式 |
+| P2-8 | `internal/db/users.go:454` | 注册重复 email/domain 校验存在 TOCTOU，并发同值双过 `validate` | 包事务或友好去重（唯一索引兜底） |
+| P2-9 | `internal/route/gzip.go:75-80` | `ct` 求值后未用 → 未显式设 `Content-Type` 的响应永不压缩；204/304 仍加 `Content-Encoding` | 显式压缩判断 + 跳过无实体状态码 |
+| P2-10 | `internal/route/route.go:233` | `/i18n/{lang}` 仅拦 `//`，未拦 `/\` 反斜杠等价变体 | 归一化 `to` 后再校验 |
+| P2-11 | `internal/route/route.go` | 缺 HSTS；`lang` cookie 无 `Secure` | 加 `Strict-Transport-Security`；cookie `Secure` |
+| P2-12 | `internal/route/chat/chat_handler.go:122` | `SendMessage` 未重新校验 `FeatureChat.Open`（创建时查过，发消息漏查） | 发送前 `FeatureStateOf(FeatureChat).Open` 校验，或明确设计为既有会话豁免 |
+| P2-13 | `internal/db/questions.go` | 提问列表 `PinFirst` 与 `id<cursor` 游标冲突，置顶后"加载更多"会漏/重较新非置顶项 | 置顶与分页采用稳定排序键 |
+| P2-14 | `internal/captcha/math.go:49` | 忽略 `rand.Int` 返回错误，极端下 `.Int64()` 可能 nil 解引用 | 校验错误并 return |
+
+---
+
+## ✅ 已核对正确的关键点（信心项）
+
+- **私聊消息计数并发**：`IncrementMessageCountIfBelow`（`conversation.go:124`）使用原子条件更新 `WHERE message_count < max AND is_closed=false`，**无超额竞态**（经核实，非 agent 所报的竞态）。
+- **提问归属鉴权**：`Questioner` 中间件 + `SetPrivate/Delete/TogglePin/SetRead` 均以 `ctx.User.ID==pageUser.ID` 判定，无 IDOR。
+- **投票提交防绕过**：`Submit` 已校验 `FeatureVote.Open`、`isVoteActive`、已投（`HasUserVoted`/`HasTokenVoted`）+ 数据库唯一索引兜底；voter token 为 HMAC 签名。
+- **回收密码令牌**：64 位随机、24h 有效期、单次使用、绑定 `user.ID`，设计安全。
+- **会话固定**：登录后 `RegenerateID` 已做。
+- **配额计数**：`IncrementQuota` 原子 `quota_count + ?` + 并发补加重试，设计合理。
+- **启动健壮性**：`AutoMigrate` 前置去重、功能开关 backfill、旧版私聊零值陷阱纠偏，均为幂等且不阻断启动。
+
+---
+
+## 修复优先级建议
+
+1. **立即（P0）**：P0-1 反向代理 IP 信任校验。
+2. **本周（P1）**：P1-1 会话 Cookie 标志、P1-2 配置解析、P1-3 验证码策略（配合 P0-1）、P1-4 追问服务端校验、P1-5 审核域名绕过、P1-6 密码比较、P1-8 自动封禁误判、P1-10 pixel CSRF。
+3. **排期（P2）**：导出公式注入、统计 bug 单测、缓存一致性、时区等。
+
+> 注：outputs/ 下已有 2026-08-26/08-28 的历史审阅文档，本次为独立复检，新增/重申了 IP 伪造、审核 fail-closed、追问绕过、审核域名绕过、配置崩溃等项；其中 chat 消息计数竞态经核实**不存在**，已在历史结论中纠正。
diff --git a/outputs/code-review-2026-09-02-late-batch.md b/outputs/code-review-2026-09-02-late-batch.md
new file mode 100644
index 0000000..b4e70e2
--- /dev/null
+++ b/outputs/code-review-2026-09-02-late-batch.md
@@ -0,0 +1,138 @@
+# 代码审阅报告 —— 9-01 深夜加固批次（凌晨 02:11–02:23）
+
+- 审阅范围：`internal/shared/ip.go`、`internal/route/ratelimit.go`、`internal/route/autoban.go`、`internal/template/markdown.go`、`internal/form/form.go`，及 3 个测试（`ip_test.go`、`markdown_test.go`、`csrf_binding_test.go`）
+- 审阅方式：逐文件源码走查 + 交叉核对调用方契约（route.go 挂载点、login.go uid 键、ipblacklist 精确匹配、模板 FuncMap）+ **第三方库源码级语义核验**（flamego@v1.9.4 `run()`、flamego/csrf@v1.3.0 `Validate`、net/http 表单惰性解析）
+- 审阅日期：2026-09-02
+- 结论：**单个文件实现均正确、自洽，且有测试覆盖；但 form.go 的「请求体 12MiB 上限」因中间件执行顺序在真实链路上失效，属上一轮安全评审 P1-3「磁盘耗尽」未真正闭环；另有一处反序列化失败不中断业务链的通用缺陷。** 建议修复后再上线（本次仅审阅，未改码）。
+
+---
+
+## 一、🔴 P1-1　请求体 12MiB 上限实际失效：超大 multipart 仍可无节流落盘（磁盘耗尽 DoS 未闭环）
+
+**位置**：`internal/form/form.go:59-79`（上限安装点）、`internal/context/context.go:180-182`（CSRF 校验点）、`internal/route/route.go:372-388`（中间件注册顺序）
+
+### 问题
+`maxRequestBodySize` 的 `http.MaxBytesReader` 被安装在 **form.Bind 内（路由级 handler）**，但真实链路上 CSRF 校验（`Contexter` → `x.Validate(ctx)`）是 **组级中间件、先于一切路由级 handler 执行**：
+
+```
+安全头 → IP黑名单 → autoban → cache/recaptcha/session → csrf.Csrfer → templater
+      → Contexter（★ 此处对每个 POST 执行 csrf.Validate）
+      → form.Bind（★ 12MiB 上限到这一步才装上）→ rateLimit → 业务动作
+```
+
+而 flamego/csrf 的 `Validate` 取值顺序是**先读 Header，无 Header 时 `FormValue("_csrf")`**——后者会触发 net/http 的**整包惰性解析**：
+
+- multipart：`ParseMultipartForm(默认 32MiB 内存)`，超出部分**无上限落盘临时文件**；
+- 解析**发生在 token 校验之前**：即使不带/带错 CSRF token（随后被 400 拒绝），超大 body 也已被完整读入并落盘；
+- 该 400 由 `Contexter` 直接写出 → **响应已写、链路中断** → 路由级的 `rateLimitMiddleware` / autoban 计数**根本没机会执行**。
+
+即：对任意 POST 路由（公开提问框 `/_/{domain}`、`/vote/{token}/submit`、`/login` 等），攻击者**无需有效 CSRF token、不受限流约束**，持续 POST >32MiB 的 multipart body 即可无限写临时目录，1C1G 机器可在数分钟内被打满磁盘。form.go 注释中想防御的场景（匿名可达接口的磁盘耗尽）依然存在。
+
+> 补充：urlencoded 大 body 同理在 CSRF 阶段整体载入内存（无上限、无限流），为内存压力向量。
+
+### 修复建议（单点修复，可同时覆盖下文 P2-2）
+在**全局 `f.Use` 层**（`route.go:146` autobanMiddleware 之后即可）安装统一请求体上限，早于一切组级中间件与 body 解析：
+
+```go
+// internal/route/（建议独立文件 bodylimit.go）
+const maxRequestBodySize = 12 << 20 // 与 form.go 语义一致；如需多图余量可统一上调
+
+func requestBodyLimitMiddleware() flamego.Handler {
+    return func(ctx flamego.Context) {
+        req := ctx.Request().Request
+        req.Body = http.MaxBytesReader(ctx.ResponseWriter(), req.Body, maxRequestBodySize)
+    }
+}
+// route.go
+f.Use(autobanMiddleware(ab))
+f.Use(requestBodyLimitMiddleware()) // 必须在 Contexter 之前
+```
+
+- **取值论证**：合法单请求最大 body = 单张图片 ≤8MiB（`storage.MaxUploadBytes`，`internal/storage/s3.go:36`，且提问/回答只取 `f.Images[0]`）+ 表单字段/边界开销，远小于 12MiB；头像/背景 2MiB、私聊图 5MiB 均安全。12MiB 不会误伤合法提交。
+- 该中间件同时封住：form.Bind 路由（含 HTML 表单路径）、chat `/send`、vote `/submit`，以及 CSRF 自身触发的解析。form.go 内层 wrap 可保留（幂等，误差同源）或删除。
+- **回归测试建议**：仿 `route/csrf_binding_test.go` 增加路由级测试：向任一 POST 路由发送 Content-Length 超过上限的 multipart body，断言返回 4xx 且不落入业务（可借 `f.Post("/protected", ...)` 桩验证 body 未被读）。
+
+---
+
+## 二、🟠 P2-1　form.Bind 反序列化失败不阻断业务链：零值结构体进入业务动作
+
+**位置**：`internal/form/form.go:70-78`（失败分支仅 `c.Map(Error{...})` 后 `return`）
+
+### 问题
+flamego@v1.9.4 `run()`（`context.go:190-228`）的链语义是：**handler 返回后只要 `ResponseWriter().Written() == false`，就继续执行下一 handler**（没有「不调用 Next 即停链」的语义）。因此 Bind 解析失败分支只 `Map(Error)`、**不 `SetError` 也不写响应** → 后续业务动作**以零值结构体照常执行**，`ctx.HasError()` 恒为 false，govalid 校验被整体跳过。
+
+**触发面**：body 在 Bind 阶段解析失败（>12MiB、畸形编码）。HTML 表单提交的 body 在 CSRF 阶段已解析成功（Bind 幂等重解析不会失败），**实际只影响 Header 携带 CSRF token 的 JS/fetch 提交**（token 在头里时 CSRF 不解析 body，解析首次发生在 Bind）。匿名路由攻击者可自持「uid=0」的匿名 token 构造该请求。
+
+**各动作影响（按危害排序）**：
+
+| 动作 | 零值后果 | 二次防线 |
+|---|---|---|
+| `user.UpdateProfile`（`route/user/profile.go:66`） | `db.Users.Update` 用 **map 全字段无条件写**（`internal/db/users.go:336-357`）→ 昵称/简介/配色/社交链接被清空、`Notify` 置 `None`（**静默退订邮件通知**）；无任何错误提示 | 无验证码；仅限账户本人/持其 CSRF 的请求（自伤型数据丢失） |
+| `user.UpdatePagePassword` / `UpdateAskPassword`（`route/user/password.go:17,32`） | 这两个 handler **连 `HasError` 都不查**，直接 `f.Password`（空=清除密码）→ 反序列化失败等于「关闭页面/提问密码」，**防护被静默解除** | 仅本人（自伤型） |
+| 匿名 `question.New` / `PublishFollowUp`（`route/question/page.go:315`） | 零值内容绕过 govalid 与屏蔽词/长度校验进入业务；`New` 有验证码闸门兜底，`PublishFollowUp` **无验证码且该路由无限流** | 验证码开启时安全；站点关闭/未配验证码时可产生空内容垃圾数据 |
+| `auth.Register/Login/Forgot/Recover` | 零值走 DB 校验失败路径 | 验证码 + DB 唯一性 |
+
+### 修复建议（与既有 govalid 分支同构，改动最小）
+`internal/form/form.go:71,76` 两处失败分支，在 `c.Map(...)` 前补 `c.SetError(err)`（或本地化包装，如「请求内容不合法，请重试」）。`SetError` 会置 `HasError=true` 并写入 `Data["Error"]`（`internal/context/context.go:71-86`），所有动作的 `if ctx.HasError()` 分支随即生效（重渲染当前页并提示），与校验失败体验一致。
+
+```go
+if err := r.ParseForm(); err != nil {
+    c.SetError(err)
+    c.Map(Error{Category: ErrorCategoryDeserialization, Error: err})
+    return
+}
+```
+
+> 注意：`UpdatePagePassword`/`UpdateAskPassword` 本身不查 `HasError`（空密码=关防护是合法操作），若采用 SetError 方案需给这两个 handler 补一个 `if ctx.HasError() { ctx.Redirect(...); return }` 守卫，否则 SetError 后仍会往下写空密码。
+
+### 回归测试建议
+给 `internal/form`（或路由级）补用例：模拟 >12MiB 的 multipart body 经 Bind 后，断言 `HasError()==true`；若约束链上动作，断言动作未执行。
+
+---
+
+## 三、🟠 P2-2　chat `/send` 与 vote `/submit` 无任何请求体上限
+
+**位置**：`internal/route/chat/chat_handler.go:127-141`、`route/vote/vote.go:678+`；两路由均不走 `form.Bind`（`route.go:245,257` 直接挂 handler）。
+
+**问题**：`SendMessage` 用 `FormValue("content")`/`FormFile("image")`、`Submit` 用多个 `FormValue(...)` 惰性触发解析——在 Header token 路径下（CSRF 不预解析），首次解析发生在 **handler 内部、无 MaxBytesReader**：multipart 超 32MiB 落盘无上限。私聊图 5MiB 业务上限在**解析完成后**才检查（`chat_handler.go:233`）。
+
+**缓解因素**：chat `/send` 前置 `reqUserSignIn`（`route.go:248`）+ 20/min 限流；vote `/submit` 前置三层限流。故列为 P2。**采用 P1-1 的全局 body 上限方案后本项自动闭环**，无需单独改动。
+
+---
+
+## 四、✅ 确认无问题项（本批次核心实现 + 测试）
+
+| 文件 | 判定 | 依据 |
+|---|---|---|
+| `internal/shared/ip.go` | ✅ | 信任模型正确：`TrustProxy=off` 时仅取 `RemoteAddr`；on 时 CF-Connecting-IP → 可信代理 XFF 剥取。`LimitKey` IPv6 聚合 /64 防轮换绕过；注释明确「不得用于黑名单」——与 `ipblacklist.go` 的 exact/CIDR 匹配一致 |
+| `internal/route/ratelimit.go` | ✅ | 滑动窗口 + 全局注册表 `sync.Once` 单清理协程（修复旧版每实例泄漏）；visitors>10000 快速清理守卫；匿名/登录 3 倍分级独立计数；vote 三层限流键无冲突。登录判定 `s.Get("uid").(uint)` 与 login.go 写入类型一致 |
+| `internal/route/autoban.go` | ✅ | `LimitKey` 键与 `f.NotFound` 记录（`route.go:395`）一致，封禁可命中；403 直断（写响应即停链）；敏感路径 `defer Record` 于响应后计数；404 独立计数，避免业务 302→/ 误判 |
+| `internal/template/markdown.go` | ✅ | 白名单消毒 + `safeURL`（拒 `//`、`\`、`javascript:` 等）+ `safeColorValue`；`MarkdownToHTML`/`PlainText` 与模板 FuncMap 注册一致；测试覆盖 XSS/协议相对 URL/字体色注入 |
+| `csrf_binding_test.go` | ✅ | 守卫 `CSRFUserSessionKey="uid"` 与 login 绑定一致（误改回 "userID" 即失败）；会话 B 复用 A 的 token → 400 |
+| `ip_test.go` / `markdown_test.go` | ✅ | 覆盖充分（IPv4 透传、v4-mapped 折叠、/64 聚合、端口、非法/空；markdown 六类用例） |
+
+**次要观察（不改）**：`rateLimiter.allow()` 的 >10000 清理仅删「窗口内已无活动」键，活动大流量下 map 仍可增长——受 `LimitKey` 聚合 + 短窗口约束，实际可达量级（数万键 ≈ 数 MB）可接受，非回归。
+
+---
+
+## 五、✅ 修复实施记录（2026-09-02 夜，已落地并验证）
+
+> 上节为原评审建议（针对 02:11–02:23 深夜加固批次）。用户批准后已全部实施，P2-2 随 P1-1 自动闭环。**复核中发现原 P2-1 影响面比初判更大**：`UpdateHarassment` / `UpdateBlockWords` / `UpdateTags` 与两个 password handler 一样**不检查 `HasError`**，零值结构体会静默关闭防骚扰 / 清空屏蔽词 / 清空标签——一并纳入守卫。
+
+| 编号 | 改动文件 | 内容 | 验证 |
+|---|---|---|---|
+| P1-1 | `internal/route/bodylimit.go`（新增） | 全局 `requestBodyLimitMiddleware`：POST/PUT/PATCH 且 `ContentLength>12MiB` → 413 快速失败；其余用 `http.MaxBytesReader` 惰性封顶。挂载于 `f.Use` 链（autoban 之后、所有 Group 之前），先于 Contexter 内 CSRF 的整包惰性解析 | `go build -overlay` ✅ |
+| P1-1 | `internal/route/route.go` | `f.Use(requestBodyLimitMiddleware())`（autoban 之后） | 全模块编译 ✅ |
+| P1-1 | `internal/form/form.go` | `maxRequestBodySize` 导出为 `MaxRequestBodySize`（单一事实来源，供全局中间件引用） | `go vet` ✅ |
+| P1-1 | `internal/route/bodylimit_test.go`（新增） | 回归测试：合法 8MiB → 200；Content-Length 超限 → 413；chunked 超限（绕过预检）→ MaxBytesReader 拒绝 | `go test ./internal/route/` ✅ |
+| P2-1 | `internal/form/form.go` | 两个反序列化失败分支（ParseForm / ParseMultipartForm）补 `c.SetError(err)`——置位 HasError，使检查 HasError 的 action（含匿名提问/回答/追问）在零值结构体进入业务前早退 | 同上 |
+| P2-1 | `route/user/harassment.go` | 新增 `abortOnFormError` helper（HasError → 错误经 flash 转交 → redirect 中止）；`UpdateHarassment`、`UpdateBlockWords` 开头加守卫 | 同上 |
+| P2-1 | `route/user/tags.go` | `UpdateTags` 开头加守卫（防清空标签 + 关闭首页展示） | 同上 |
+| P2-1 | `route/user/password.go` | `UpdatePagePassword` / `UpdateAskPassword` 开头加守卫（防空密码静默解除页面/提问防护；govalid 超长密码此前也会绕过前端限制直接入库，一并拦截） | 同上 |
+| P2-2 | — | chat `/send`、vote `/submit` 已被全局中间件覆盖（超限时 CSRF/解析失败即拒），无需单独改动 | 见 P1-1 |
+
+**测试结果**（`go test -overlay=dev/overlay.json`）：`templates`、`internal/template`、`internal/form`、`internal/shared`、`internal/security/autoban`、`internal/security/censor`、`internal/route`（含新增 bodylimit 回归 + csrf_binding）全部 PASS；`go build ./...` 与 `go vet ./internal/... ./route/...` exit 0。
+
+---
+
+*附：本报告评审结论基于源码走查与依赖库源码语义核验；修复部分已于 2026-09-02 夜落地并通过 overlay 全模块编译 / vet / 相关包测试。*
diff --git a/outputs/domain-migration-box-shiroko-2026-09-06.md b/outputs/domain-migration-box-shiroko-2026-09-06.md
new file mode 100644
index 0000000..cb5d144
--- /dev/null
+++ b/outputs/domain-migration-box-shiroko-2026-09-06.md
@@ -0,0 +1,279 @@
+# box.tama.guru → box.shiroko.one 域名迁移方案（保 Bing 排名）
+
+> 日期：2026-09-06　｜　状态：方案待批准
+> 目标：在 tama.guru **不续费**（2026-12-24 到期）的约束下，把 box.tama.guru 迁移到 box.shiroko.one，最小化 Bing（及 Google）排名损失。
+
+---
+
+## 0. 决策记录（用户已拍板）
+
+| 决策点 | 选择 | 影响 |
+|---|---|---|
+| 过渡策略 | **不续费硬过渡** | 301 窗口 ≈ 现在→2026-12-24（约 3.5 个月） |
+| 新域形态 | **box.shiroko.one**（子域） | 根域 shiroko.one 留给导航页/blog 等未来用途 |
+| 引擎范围 | **Bing + Google 全套** | Site Move + GSC Change of Address + 双 sitemap + IndexNow |
+| umami | **一并迁走** → mami.shiroko.one | 统计不中断 |
+| 站群其余子域 | **一并迁移**（blog/chat/share/status → 同名 `.shiroko.one`） | 用户 2026-09-06 追加确认；footer 链接群与 home 文案内链全部换域 |
+| `/_/tamakyi` | **不保** | 从 sitemap 移除；robots 维持 `Disallow: /_/`（与 sitemap 自相矛盾的问题一并消除）。页脚/首页指向站长箱的**功能性链接保留**（用户仍可点击），只是不再提交给搜索引擎 |
+
+> ✅ **批 1（本地代码改动）已于 2026-09-06 完成**，详见 §12。
+
+---
+
+## 1. 现状与硬约束（侦查取证结果）
+
+### 1.1 资产地图
+- `tama.guru` 根域 = 「狼的导航页」（Hugo 0.121.2 / CF Pages）——用户声明不保
+- `box.tama.guru` = **本次迁移对象**（提问箱，生产，DNSPod 三线路 DNS：境内→EdgeOne 新加坡、境外/默认→Cloudflare SaaS+tunnel）
+- `mami.tama.guru` = umami 统计（Vercel）——随迁
+- `blog/status/share/chat.tama.guru` = 站群其余子域——用户未声明保，列入开放项（§11）
+- `r2.337845818.best`、`337845818.best` zone = 独立域，**不受影响**（仅需在 R2 CORS 白名单追加新域）
+- 注册信息：tama.guru 注册商 **DNSPod, Inc.**，**expiration 2026-12-24**，当前 active
+
+### 1.2 box.tama.guru 的 SEO 现状（好消息）
+- Bing 收录管道 = `static/sitemap.xml` 仅 **8 条 URL**：
+  `/`、`/explore`、`/register`、`/login`、`/_/tamakyi`、`/change-logs`、`/explore`(重复)、裸域
+- `/explore` 是唯一「内容页」，排名大概率集中于此 → **索引面小、301 映射表短、信号集中，迁移成本极低**
+- ⚠️ robots.txt `Disallow: /_/` 与 sitemap 提交 `/_/tamakyi` **自相矛盾**——搜索引擎以 robots 为准，该条实为无效提交；若 `/_/tamakyi` 有真实流量价值需决策（§11 开放项）
+- ⚠️ 页面**无 `<link rel="canonical">`**（仅 og:url）——迁移是新站补 canonical 的好时机，对 Bing 有实际帮助
+
+### 1.3 关键机制（Bing/Google 官方语义）
+1. **301 全量逐 URL 一一对应**是唯一可靠路径：不 302、不跳首页、无链式跳转
+2. Bing Site Move / GSC Change of Address 只是「加速器」；工具不可用时 301+sitemap 兜底
+3. 提交 Site Move 后 **新域 6 个月内不得再次迁移**
+4. 通行要求：301 保持 6–12 个月；权重转移 60–90 天；迁移期掉 10–30% 属正常
+5. **约束风险**：本方案窗口 ~3.5 个月 < 6 个月通行线。缓解：① 索引面仅 3–5 个有效 URL，Bing 对小型站处理快；② 尽早切换拉满窗口；③ IndexNow 秒级通知加速新站收录
+
+---
+
+## 2. 目标架构
+
+```
+                          ┌─ 境内线路 ──> EdgeOne(box.shiroko.one 加速域) ─┐
+用户 → DNSPod(shiroko.one) ┤                                              ├→ 源站 TamaBox
+   (分线路)                └─ 境外/默认 ─> Cloudflare SaaS + tunnel ──────┘
+                                                │
+旧域 box.tama.guru（DNS 在切换日改指静态 301 载体，见 §6）
+   任意线路 ─> CF Pages 跳转项目 ─ 301 ─> https://box.shiroko.one/<同路径><同query>
+```
+
+- 新域 **双 CDN 架构完全照搬** box.tama.guru 现状（境内 EO / 境外 CF）
+- 旧域在 12-24 前**只做 301**，不再回源 → 源站与旧域解耦，安全退役
+- umami：Vercel 加 `mami.shiroko.one`，同一实例，数据不丢
+
+---
+
+## 3. 时间线（倒排，越早切换 301 窗口越长）
+
+| 阶段 | 窗口 | 内容 | 责任 |
+|---|---|---|---|
+| **P0 准备** | 现在 – 9/20 | 代码/配置改动（§5）、域名/控制台准备（§7）、Bing/GSC 双属性验证（§8.1） | 我 + 你 |
+| **P1 新站上线** | 9/20 – 9/27 | box.shiroko.one 双线打通、全功能验收、旧站并行不动 | 我 + 你 |
+| **P2 切换** | 9 月底某低峰日凌晨 | 改 external_url → 源站重启 → 旧域 DNS 切 301 载体 → Site Move/CoA/IndexNow（§8） | 我 + 你 |
+| **P3 过渡监控** | 10 月 – 12/24 | 每周看两站索引与流量；反链外联更新；旧域保持 301 | 我 |
+| **P4 到期善后** | 12/24 后 | 旧域自然失效属计划内；确认新站独立站稳、无旧缓存依赖 | 我 |
+
+**切换建议 ≤ 2026-10-01**，301 窗口 ≈ 85–90 天，覆盖 Bing 权重转移期（60–90 天）。
+
+---
+
+## 4. 保排名逻辑（为什么这样做能最小化损失）
+
+```
+旧 URL(Bing 索引中) ──301──> 新 URL ──sitemap/IndexNow──> Bing 立即重爬新址
+      │                                                       │
+  排名信号(点击/外链/信任) 由 301 传递 ≈90%          权重 60–90 天内转移
+      │                                                       │
+  旧域 12/24 消亡时：Bing 已把信号合并到新域 ← 目标状态
+```
+
+不这样做的代价：旧 URL 到期后全部变死链 → Bing 逐个降权删除 → 新域从零积累，等于「重新开始」。
+
+---
+
+## 5. 代码与配置文件改动清单（本地副本，批准后分批实施）
+
+### P0 必改（切域前）
+
+| # | 文件 | 改动 | 说明 |
+|---|---|---|---|
+| C1 | 部署侧 `conf/app.ini` | `external_url = https://box.shiroko.one` | **必填配置**；og:url 与全部邮件链接（找回密码/私信通知）一次修复。app.ini 在部署环境持有，本地副本无此文件 |
+| C2 | `static/robots.txt` | `Sitemap:` 行改 `https://box.shiroko.one/sitemap.xml` | go:embed 静态文件，当前硬编码旧域 |
+| C3 | `static/sitemap.xml` | 8 条 URL 域替换为 box.shiroko.one | 同上；建议顺手去掉与 robots 冲突的 `/_/tamakyi`（§11 决策） |
+| C4 | `route/auth/register.go:64` | `Bloglink: "box.shiroko.one"` | 注册引导链接硬编码 |
+| C5 | `internal/security/censor/text.go` | TrustedHosts：`tama.guru` → 增加/替换为 `shiroko.one` | 否则用户在新站发 shiroko.one 链接被当广告拦。实施时确认 RemoveTrustedURL 对子域是否覆盖（needle=裸域 + 边界判断） |
+| C6 | `templates/base/header.html` | og:url 保留（自动跟随 ExternalURL）；**新增** `<link rel="canonical" href="{{.ExternalURL}}{{.CurrentURI}}">` | 新站补 canonical，防重复收录，Bing 友好 |
+| C7 | `templates/base/header.html` | umami 注入块：`s.src = "https://mami.shiroko.one/tamami.js"` | 与 umami 迁移同批（§5 D 组） |
+| C8 | `templates/base/footer.html` | 链接群（blog/chat/share/status/tama.guru）按 §11 决策处理 | 到期后这些全是死链，必须在切换前定 |
+| C9 | `templates/home.html` | 正文内链 `box.tama.guru` → `box.shiroko.one`；指向 blog 的文章链接按 §11 决策 | 首页是 Bing 重点页面，内链必须指向新站而非继续依赖 301 |
+
+### 伴随迁移（D 组，与 box 同批）
+
+| # | 位置 | 改动 |
+|---|---|---|
+| D1 | Vercel 控制台 | umami 项目添加自定义域 `mami.shiroko.one`（CNAME → cname.vercel-dns.com） |
+| D2 | DNS（新 zone） | `mami` 记录 CNAME → Vercel 目标 |
+| D3 | C7 的 header 埋点 | 指向 mami.shiroko.one（同一 data-website-id，数据连续） |
+
+> mami.tama.guru 在 12-24 前保持在线，与新域并行无冲突（浏览器缓存自然淘汰）。
+
+---
+
+## 6. 301 实现方案（旧域唯一使命）
+
+**推荐：CF Pages 静态跳转项目**（免费、一行配置、境内境外通吃）
+
+1. Cloudflare 新建一个 Pages 项目（如 `tama-redirect`），根目录放一个 `_redirects`：
+   ```
+   /*  https://box.shiroko.one/:splat  301!
+   ```
+2. 把 `box.tama.guru` 添加为该 Pages 项目的自定义域（Pages 面板 → Custom domains → 按提示在 DNSPod 加 CNAME）
+3. **切换日**：DNSPod 上 box.tama.guru 的三条线路（境内 EO CNAME / 境外 CF / 默认 CF）统一改 CNAME → 该 Pages 域名（或直接 CNAME 到 pages.dev 域名）
+4. 原 EO 加速站点 / CF SaaS 主机名（box.tama.guru）**可停可留**——DNS 切走后自然不再产生流量，12/24 随旧域注销即可
+
+- ✅ 保留完整路径与 query（`:splat`），无链式跳转，天然 301
+- ✅ 与源站/旧 CDN 完全解耦，源站只需服务新域
+- ✅ 301 响应体积极小，境内经 CF Pages 慢 ~1s 无感
+- 备选 A：EO 重定向规则（境内）+ CF Worker route（境外）——需在两边控制台分别配，操作更碎
+- 备选 B：源站 nginx 按 Host 301——**不推荐**：CDN 回源 Host=box.tama.guru 时会产生回源环，需同时改回源配置，风险高
+
+---
+
+## 7. 控制台操作清单（需你在各平台操作，我提供每一步的精确值）
+
+### 7.1 DNS 托管决策（先行）
+**推荐**：`shiroko.one` 的 NS 从 Spaceship 改到 **DNSPod**（你已在 DNSPod 管理 tama.guru，分线路 DNS 是现有双 CDN 架构的前提；Spaceship DNS 无境内/境外分线路）。
+步骤：DNSPod 添加 `shiroko.one` → 获得 DNSPod 分配的 NS → Spaceship 域名面板改 NS → 等待生效（1–24h，可用 `nslookup -type=NS shiroko.one 8.8.8.8` 验证）。
+
+### 7.2 DNSPod（shiroko.one zone）
+| 主机 | 类型 | 值 | 线路 |
+|---|---|---|---|
+| box | CNAME | EO 分配的 CNAME 目标（控制台给，形如 `xxx.eo.dnse4.com`） | 中国境内 |
+| box | CNAME | CF SaaS CNAME 目标（337845818.best zone → Custom hostnames → 形如 `<hash>.cdn.cloudflare.net`）或既有优选 CNAME | 境外 / 默认 |
+| mami | CNAME | `cname.vercel-dns.com` | 默认 |
+
+> 以上记录结构完全照搬 box.tama.guru / mami.tama.guru 现有三条线；切换日另加 box.tama.guru 的 301 线路（§6）。
+
+### 7.3 EdgeOne（腾讯）
+- 新增加速域名 **box.shiroko.one**：归属验证（TXT/CNAME，验证记录保留勿删）→ HTTPS 证书 → 回源=源站 IP:高位端口、回源 HOST=box.shiroko.one
+- 规则/缓存配置照抄 box.tama.guru 现有站点
+
+### 7.4 Cloudflare
+- `337845818.best` zone → SSL/TLS → Custom hostnames（for SaaS）：添加 **box.shiroko.one**（回源走既有 tunnel；cloudflared ingress 增加 box.shiroko.one 路由）
+- R2 bucket CORS 白名单：追加 `https://box.shiroko.one`（**必须在 301 前完成**，否则新站图片/二维码导出被 CORS 拦）
+
+### 7.5 Vercel
+- umami 项目添加 `mami.shiroko.one`（§5 D1）
+
+---
+
+## 8. SEO 迁移执行序列
+
+### 8.1 预备（P0，先于新站上线，可立即做）
+1. **Bing Webmaster Tools**：添加并验证 `box.shiroko.one`（用 DNS TXT 验证，DNSPod 加记录即可，无需等站点上线）；确认旧站 `box.tama.guru` 属性已存在并验证
+2. **Google Search Console**：同上双属性（URL-prefix：`https://box.tama.guru/`、`https://box.shiroko.one/`）
+
+### 8.2 切换日顺序（P2，低峰凌晨，301 是前提）
+1. 确认 box.shiroko.one 在 EO（境内视角）与 CF（境外视角）全功能验收通过（§9）
+2. 改 `external_url` + 重启 → 新站所有 og/canonical/sitemap/邮件全指新域
+3. 旧域 DNS 切 301 载体（§6）→ `curl -I` 验证 301 与 Location 正确
+4. **Bing Site Move**（旧属性 → Diagnostics & Tools → Site Move → 目标 box.shiroko.one，Scope=Domain）——若工具不可用，301+sitemap 兜底
+5. **GSC Change of Address**（旧属性 → 设置 → Change of Address → 新属性）
+6. 双引擎分别提交**新站 sitemap**；旧站 sitemap 保留 60–90 天（引导爬虫吃 301）
+7. **IndexNow**：用 API key 提交新站全部 URL（Bing 收录最快路径）
+8. 逐条验证 §9.2 的 301 映射
+
+---
+
+## 9. 验证与验收
+
+### 9.1 切换前（新站验收，全部通过才允许 301）
+- [ ] `https://box.shiroko.one/` 境内 EO / 境外 CF 均 200（用不同线路 DNS 查询验证）
+- [ ] 登录 / 提问 / 私信 / 上传 / 投票 / 二维码导出 主链路通过（R2 CORS 已含新域）
+- [ ] `curl -s https://box.shiroko.one/robots.txt` → Sitemap 行 = 新域
+- [ ] `curl -s https://box.shiroko.one/sitemap.xml` → 全部 URL = 新域
+- [ ] 页面含 canonical 指向自身、og:url = 新域
+- [ ] 邮件模板链接 = 新域（发一封找回密码实测）
+
+### 9.2 切换后（301 映射抽查）
+```
+curl -sI https://box.tama.guru/explore          → 301 Location: https://box.shiroko.one/explore
+curl -sI https://box.tama.guru/_/tamakyi        → 301 → https://box.shiroko.one/_/tamakyi
+curl -sI "https://box.tama.guru/vote/xxx?lang=en" → 301 且保留 query
+curl -sI https://box.tama.guru/no-such-page      → 301（不允许 404/302）
+```
+- [ ] 抽样 20+ URL，确认无 302、无 404、无链式跳转（一条 301 直达）
+
+### 9.3 过渡期每周监控（P3）
+- Bing/GSC：旧域 indexed 数量应**逐周下降**；新域**逐周上升**，60–90 天追平旧域基线
+- 综合 Search Performance：前 2–4 周掉 10–30% 属正常；**持续 >30% 且无回升 = 异常**，立即排查
+- 新域 site:box.shiroko.one 查询确认收录增长
+
+---
+
+## 10. 风险清单
+
+| # | 风险 | 等级 | 缓解 |
+|---|---|---|---|
+| R1 | 301 窗口 3.5 个月 < 6 个月通行线，权重转移可能不完整 | 🟠 中 | 9 月底前切换拉满窗口；索引面小 + IndexNow 加速；Bing 对小型站处理快 |
+| R2 | 切换瞬间旧书签/API 用户 301 到新域 → cookie 一次性失效、跨域 | 🟡 低 | 一次性，切换公告；API 调用方（若有）需跟随新域 |
+| R3 | umami 迁移延误 → 12/24 后统计断 | 🟡 低 | D 组随 P1 完成，两域并行过渡 |
+| R4 | DNSPod 到期政策未知：到期日是否即停解析 | 🟡 低 | 按 12-24 停摆做计划；若到期后保留解析则 301 窗口自动延长，纯赚 |
+| R5 | `/_/tamakyi` robots/sitemap 矛盾未决 → 若该页真有 Bing 流量，迁移映射需特殊处理 | 🟡 低 | §11 决策后补映射 |
+| R6 | footer/home 指向 blog 等将死子域 → 新站页面出现死链 | 🟡 低 | §11 决策 |
+
+---
+
+## 11. 开放项（2026-09-06 更新：1/2 已由用户答复）
+
+1. ~~站群其余子域（blog/status/share/chat）是否迁~~ → **已答：一并迁**。已按 `*.shiroko.one` 同名映射改完（footer 6 条链接 + home 文案内链 + llms 三处博客链）。
+   ⚠️ 仍需你操作：这些子域的**实际服务**也要搬（blog 的 Hugo/CF Pages、chat/share/status 各自托管），否则新域链接会是死链。若某个子域打算放弃（如 share/status），告诉我，我把 footer 对应条目删掉。
+2. ~~`/_/tamakyi` 是否保~~ → **已答：不保**。已从 sitemap 移除，robots 维持 Disallow。
+3. **源站回源端口/隧道细节**：EO 与 CF tunnel 的 ingress 路由是否按 hostname 区分——决定 cloudflared 配置加一条路由即可（实施时我出精确 diff）
+4. 迁移公告是否要做（首页横幅提示用户更新收藏/提问链接）
+5. **搜索引擎验证 token 需替换**（本次代码审查新发现）：`templates/base/header.html` 的 `google-site-verification`（636 行）与 `msvalidate.01`（7 行 + 637 行重复）是**绑定域名**的，新域验证后必须替换 content 值，否则 GSC/Bing 无法验证新站 → Site Move / Change of Address 无法提交。已加注释标记。
+
+---
+
+## 12. 批 1 实施记录（本地改动，2026-09-06 已完成）
+
+**备份**：`.workbuddy/backup/domain-shiroko-20260906/`（9 个文件原样）
+**替换规则**：`*.tama.guru` → `*.shiroko.one`；apex `tama.guru` → `shiroko.one`
+
+| 文件 | 改动 |
+|---|---|
+| `static/robots.txt` | `Sitemap:` 行 → `box.shiroko.one` |
+| `static/sitemap.xml` | 5 条 URL 全部换域；**移除 `/_/tamakyi` 条目**；**去重**（原 `https://box.tama.guru` 与 `.../` 重复）；`lastmod` 全量刷新为 2026-09-06 以触发重抓 |
+| `static/llms.txt` | 4 条站点链接 + 2 条资源链接换域 |
+| `static/llms-full.txt` | 7 处换域（主域推荐、FAQ、站点地图、blog 更新日志链） |
+| `templates/base/footer.html` | 6 条链接全换域（admin/notice/chat/drive/status/nav） |
+| `templates/base/header.html` | umami 注释同步为 `mami.shiroko.one`（脚本 src 已先行改为新域）；验证 token 处加迁移提醒注释 |
+| `templates/home.html` | 3 处换域：站长箱链接、投票/Markdown 示例链、4 条 blog 文章链、探索页链 |
+| `route/auth/register.go:64` | `Bloglink` 默认值 → `box.shiroko.one` |
+| `internal/security/censor/text.go` | `TrustedHosts` **新增** `"shiroko.one"`；旧域 `tama.guru` **保留**（过渡期用户分享旧链接仍需判为可信，待旧域到期后再删） |
+| `conf/app.sample.ini` | 补齐**缺失的必填项** `external_url`（conf.go:36 强制校验，原模板缺失会导致照抄即启动失败），示例指向新域 |
+| `dev/eo-probe-ips.py`、`eo-probe-v2.py`、`eo-scan-all.py` | EO 回源探测脚本 `--host` 默认值 → `box.shiroko.one` |
+| `internal/route/route.go` | **新增 `/index-now/{key}` 路由**（IndexNow 密钥文件，见 §12.1）。文件名用 `^[0-9a-f]{32}\.txt$` 白名单校验防路径穿越；配套回归测试 `internal/route/indexnow_route_test.go` |
+
+**验证**：sitemap XML 解析通过（5 条、无重复）；`go test ./templates/`、`./internal/security/censor/`、`./internal/route/` 通过；`route/auth`、`static`、`internal/conf` 带 overlay 编译通过。
+
+### 12.1 IndexNow 密钥文件（迁移后加速新站收录，已实现）
+
+用户在 `static/index-now/66e5e0911b0941f2ba7dbfbbd961e9be.txt` 放了 IndexNow key，但访问被 302 到首页。
+
+**根因（重要，以后加任何根目录静态文件都会踩）**：`internal/route/route.go:138` 的 `flamego.Static` 中间件配置了 `Prefix: "/static"`，**只接管 `/static/...`**；而 `robots.txt`、`sitemap.xml`、`llms.txt`、`llms-full.txt`、`favicon.ico` 这些根目录文件**每一个都是单独注册的 `f.Get` handler**。新加的文件没有对应路由 → 落到 `f.NotFound` → `ctx.Redirect("/")` 返回 302。embed 本身没问题。
+
+**修复**：新增 `f.Get("/index-now/{key}")`，文件名经 `^[0-9a-f]{32}\.txt$` 白名单校验（防路径穿越）后从 embed FS 读取，返回 `text/plain` + `max-age=86400`；校验失败或文件不存在返回 404（不再是 302）。
+
+**提交 IndexNow 时的 keyLocation 填**：
+```
+https://box.shiroko.one/index-now/66e5e0911b0941f2ba7dbfbbd961e9be.txt
+```
+⚠️ 旧域 301 上线后，旧域的该路径会被 301 重定向，而搜索引擎校验密钥文件要求 **200 直出**，因此切换后请用新域的 keyLocation 重新提交。
+
+---
+
+## 附：本地代码改动的执行批次建议（批准后按批落地）
+- ~~**批 1（P0 代码）**：C2/C3/C4/C5/C6/C8/C9 —— 纯本地仓库改动，可先行~~ → ✅ **已完成 2026-09-06**（见 §12）
+- **批 2（配置）**：C1 + D 组 —— 需部署环境 app.ini + Vercel 控制台配合
+- **批 3（切换）**：§6 301 载体 + §7 DNS/CDN 控制台操作 + §8 SEO 提交
diff --git a/outputs/edgeone-cloudflare-dual-cdn-guide.md b/outputs/edgeone-cloudflare-dual-cdn-guide.md
new file mode 100644
index 0000000..8f19470
--- /dev/null
+++ b/outputs/edgeone-cloudflare-dual-cdn-guide.md
@@ -0,0 +1,155 @@
+# TamaBox 双 CDN 接入指南：境内腾讯 EdgeOne + 境外 Cloudflare
+
+> 目标：中国大陆访客走腾讯 EdgeOne 节点加速，境外访客走 Cloudflare 边缘网络加速，共用同一域名与源站。
+> 代码前置：`internal/shared/ip.go` 自 **2026-09-03** 起在 `trust_proxy = true` 时信任 EdgeOne 权威客户端头 `EO-Client-IP`（等效 `CF-Connecting-IP`）。单 EdgeOne 或双 CDN 部署均可直接用本文件配套。
+
+---
+
+## 0. 总体架构
+
+```
+                 ┌──────────────── DNS（DNSPod 智能解析）─────────────────┐
+                 │   线路「境内」 → CNAME → EdgeOne 分配的 CNAME          │
+                 │   线路「境外」 → CNAME → Cloudflare for SaaS CNAME     │
+                 │   线路「默认」 → CNAME → Cloudflare（未匹配线路兜底）    │
+                 └───────────────┬───────────────────┬────────────────────┘
+                                 ▼                   ▼
+                      EdgeOne（腾讯，大陆节点）   Cloudflare（全球边缘）
+                                 │                   │
+                                 └─────► 源站（仅放行两家回源网段）◄──────┘
+                                        TamaBox (Flamego) + PG + Redis
+```
+
+核心思路：**CDN 各自接入，DNS 按线路分发**。两家 CDN 都不需要托管你的主域名 NS，主域名 NS 全程留在 DNSPod（腾讯云解析），靠「境内 / 境外 / 默认」三条线路把用户分给不同的 CNAME 目标。
+
+## 1. 前置条件（逐项确认）
+
+| # | 条件 | 说明 |
+|---|------|------|
+| 1 | 域名已 **ICP 备案** | EdgeOne 加速区域含「中国大陆 / 全球可用区」时的硬性要求，不可绕开 |
+| 2 | 腾讯云账号已实名 | 开通 EdgeOne 需要 |
+| 3 | Cloudflare 账号 | Free 套餐即可（见步骤 3 的 SaaS 说明） |
+| 4 | **一个闲置域名（或其子域）用于 Cloudflare 承载 zone** | Cloudflare for SaaS 需要一个已托管在 CF（NS 迁过去）的域名作为“承载 zone”，主域名不需要迁 NS。没有就考虑末尾的备选方案 C |
+| 5 | 源站公网可达 | 回源协议 / 端口按你的部署调整 |
+
+## 2. 步骤 1：DNS 迁到 DNSPod 并建立分线路骨架
+
+1. 在 DNSPod（腾讯云解析）添加你的域名，按提示把注册商处的 NS 改成 DNSPod 提供的 `xxx.dnspod.net` 两条。
+2. 等解析生效后，先**建立保底记录**，避免切换期中断：
+   - 线路「默认」：`www` → CNAME → EdgeOne（或先保持源站 A 记录，逐步切）；
+   - 建议把各记录 **TTL 临时调小（如 60 秒）**，切换完成后再调回。
+3. ⚠️ 若根域（`@`）承载邮箱（存在 MX 记录），**不能**给 `@` 配 CNAME（与 MX 冲突）。此时只对 `www` / 业务子域做 CDN 加速，`@` 保持 A 记录直连或做 301 跳转。
+
+## 3. 步骤 2：EdgeOne 接入（CNAME 模式）
+
+1. 控制台 → 添加站点 → 输入主域名 → 选购套餐 → **加速区域：中国大陆可用区**（境外交给 Cloudflare）。
+2. **接入模式选 CNAME 接入**（主域名 NS 在 DNSPod，不能用 NS 接入）。
+3. 归属权验证：按控制台提示在 DNSPod 添加 TXT 或做文件验证。
+4. 添加加速域名：在「域名服务 → 域名管理 → 添加域名」里填业务主机名（`www` 或 `@`）+ 源站 IP/域名。
+5. 平台分配一个 CNAME 地址（形如 `xxx.edgeone.net`），**先记下来**，步骤 5 统一填到 DNSPod。
+6. 证书：开启「站点加速 → HTTPS」自动证书（免费）。
+
+## 4. 步骤 3：Cloudflare for SaaS（主域名不迁 NS 的关键）
+
+Cloudflare Free/Pro/Business 套餐的普通接入要求把整个 zone 迁到 CF 的 NS，与分线路解析冲突。**Cloudflare for SaaS**（Free 套餐含 100 个自定义主机名免费）允许主域名不迁 NS、仅用 CNAME 挂到 CF：
+
+1. 用闲置域名（如 `cf-host.example`）在 Cloudflare 添加 zone，并把该域名的 NS 迁到 Cloudflare（承载 zone，仅此域名迁）。
+2. 承载 zone 内：`SSL/TLS → Custom Hostnames（SSL for SaaS）→ Add Custom Hostname`，填入你的**主域名**（如 `www.example.com`）。
+3. 按提示完成归属验证：CF 会给出一条验证 TXT（加到 DNSPod）+ 一个 **CNAME 目标值**（形如 `xxx.1234.cdn.cloudflare.net`），记下来用于步骤 5 的境外线路。
+4. 等待证书签发至状态 `Active`（通常数分钟到数小时）。之后 CF 自动管理该域名的证书与续期。
+
+> 备选：若不想多养一个域名做承载 zone，可退回**方案 C**——EdgeOne 加速区域直接选「全球可用区」，一家覆盖全球，不做 Cloudflare（代价：境外节点质量与覆盖面不如 CF）。或评估 Cloudflare Business（约 $200/月）的官方 CNAME 接入。
+
+## 5. 步骤 4：DNSPod 分线路记录（最终形态）
+
+同一主机名、不同线路分别建行（全部 CNAME，避免 A/CNAME 冲突提示）：
+
+| 主机记录 | 线路 | 类型 | 记录值 | 说明 |
+|---|---|---|---|---|
+| `www` | 境内 | CNAME | `xxx.edgeone.net`（EO 分配） | 大陆走 EdgeOne |
+| `www` | 境外 | CNAME | `xxx.…cdn.cloudflare.net`（SaaS 分配） | 境外走 Cloudflare |
+| `www` | 默认 | CNAME | `xxx.…cdn.cloudflare.net` | 未匹配线路（如部分境外 DNS）兜底 |
+
+> 验证：境内 `dig www.example.com`（或 `nslookup`）应解析出 EdgeOne CNAME；用境外 DNS（如 `dig @8.8.8.8`）应解析出 Cloudflare CNAME。不同递归节点可能有缓存，等待 TTL 过期后复测。
+
+## 6. 步骤 5：源站锁定（安全前提，不可跳过）
+
+`trust_proxy = true` 意味着应用信任 CDN 写来的客户端头，**前提是请求只能来自这两家 CDN**：
+
+1. 从官方渠道取回源网段并配置防火墙 / 安全组，仅放行：
+   - Cloudflare 官方 IP 段：https://www.cloudflare.com/ips/ （`cloudflare.com/ips-v4`、`ips-v6`）
+   - EdgeOne 回源 IP 段：腾讯云 EdgeOne 文档「回源 IP 网段」页（会动态更新，建议做成定期同步或至少配置时核对）
+2. 放行你的运维入口（SSH 管理 IP）与回源端口（80/443），其余一律拒绝直连。
+3. 回归验证：跑一次仓库自带的 `dev/security-selfcheck.sh`，确认带伪造 `CF-Connecting-IP` 的直连请求已被防火墙拦下（应无法到达应用）。
+
+## 7. 步骤 6：真实 IP 传递（EdgeOne 侧关键配置！）
+
+EdgeOne **默认不携带** `EO-Client-IP`，必须在控制台开启，否则经 EdgeOne 的请求到源站后拿不到客户端真实 IP（自动封禁会误伤所有大陆访客）：
+
+- 站点级：`站点加速（全局）→ 网络优化 → 客户端 IP 头部配置 → 开启`，**头部名称务必填 `EO-Client-IP`**（代码固定读这个名字，大小写敏感）。
+- 或域名级：`规则引擎 → 创建规则（Host 匹配该域名）→ 操作：客户端 IP 头部 → 开启 → 名称填 `EO-Client-IP``。
+
+Cloudflare 侧无需额外配置：`CF-Connecting-IP` 默认就有且恒被 CF 覆盖为真实客户端 IP。
+
+## 8. 步骤 7：防“借道伪造”剥离规则（双 CDN 特有安全约束）
+
+两家并存时出现新的伪造面：**攻击者借道 CDN-A 时携带 CDN-B 的权威头**。例如客户端经 Cloudflare 访问时自行塞一个 `EO-Client-IP: 任意IP`，若 CF 透传该头到源站，代码会信任它 → 可绕过限流 / 自动封禁 / 单 IP 投票限制，或嫁祸他人。因此必须在两家 CDN 的**回源请求**上剥离对方权威头：
+
+| CDN | 剥离动作 | 位置 |
+|---|---|---|
+| Cloudflare | 回源前删除请求头 `EO-Client-IP` | `Rules → Transform Rules → Modify Request Header`（Free 套餐可用，规则数有限但只建一条即可） |
+| EdgeOne | 回源前删除请求头 `CF-Connecting-IP` | `规则引擎 → 操作：修改回源请求头 → 删除 CF-Connecting-IP`（或站点全局回源请求头设置） |
+
+> `X-Forwarded-For` / `X-Real-IP` 不需要在此剥离：代码只在 TCP 对端落入 `trusted_proxies` 时才解析它们，两家 CDN 边缘 IP 不在清单内，天然不可信。
+>
+> 验证方法：分别经两家 CDN 发起带伪造头的请求（如 `curl -H 'EO-Client-IP: 203.0.113.66' https://www.example.com/`），在源站访问日志里确认最终到达的请求**不包含**伪造的对方头，且应用记录的客户端 IP 为你的真实出口 IP。
+
+## 9. 步骤 8：应用配置（conf/app.ini）
+
+```ini
+[security]
+trust_proxy = true
+; trusted_proxies 仅用于“你自己的”反代/LB（如本机 nginx 127.0.0.1），
+; 双 CDN 场景不需要也不应把两家 CDN 的全量网段填进来（代码直接信任 CF-Connecting-IP / EO-Client-IP）。
+trusted_proxies =
+
+[server]
+; 若用防火墙按网段放行回源，可继续监听 :443；若希望更严，可只监听本机 + 本机回源代理。
+listen =
+```
+
+行为（2026-09-03 起）：`trust_proxy = true` 时 `ResolveClientIP` 依次信任 `CF-Connecting-IP` → `EO-Client-IP` → （仅当 TCP 对端在 `trusted_proxies` 内）解析 XFF/X-Real-IP → 最后回退 RemoteAddr。
+
+## 10. 步骤 9：缓存与动态内容
+
+TamaBox 是动态应用：
+
+- 两侧都**不要缓存 HTML / 页面 / API 响应**；只缓存静态资源。
+  - EdgeOne：缓存规则命中 `/static/*` 与带版本号资源即可；
+  - Cloudflare：`Caching → Cache Rules` 对 `/static/*` 开缓存，其余 `Bypass`。
+- 若将来启用 WebSocket 长连接：Cloudflare Free 支持；EdgeOne 需在站点配置里显式开启 WebSocket。
+- 注意两侧的 TLS 版本 / HTTP/3 行为差异属正常现象，与应用无关。
+
+## 11. 上线切换与回滚
+
+1. 先切「默认」线路 → 观察 15~30 分钟（错误率、日志中的真实 IP 是否正确）。
+2. 再切「境内」线路（EdgeOne CNAME 生效）→ 用大陆网络（或大陆 DNS 递归查询）验证。
+3. 最后切「境外」线路到 Cloudflare SaaS CNAME → 境外访问验证 + 证书状态 `Active`。
+4. 回滚：把对应线路的 CNAME 改回原记录即可，秒级生效（DNS TTL 决定传播速度）。
+
+## 12. 故障排查速查
+
+| 现象 | 检查 |
+|---|---|
+| 大陆访问慢 / 未走 EO | DNSPod「境内」线路是否已配 EO CNAME；`nslookup` 从大陆递归查询结果 |
+| 境外访问失败 / 证书错误 | SaaS Custom Hostname 状态是否 `Active`；境外线路 CNAME 是否拼错 |
+| 自动封禁误封 / 限流全走同一个 IP | EO「客户端 IP 头部」是否开启且名称是否为 `EO-Client-IP`；`trust_proxy` 是否 true |
+| 应用日志里出现伪造 IP | 两家剥离规则是否生效；防火墙是否真的挡住了直连 |
+| 根域无法配 CNAME | 根域有 MX → 只加速 `www`/业务子域，`@` 保持 A 记录 |
+
+## 13. 相关代码与文档
+
+- 代码改动：`internal/shared/ip.go`（`EO-Client-IP` 信任分支）、`internal/shared/ip_test.go`（新增 4 条用例）、`internal/conf/static.go` 与 `conf/app.sample.ini`（注释同步）。
+- 单 CDN Cloudflare 加固参考：`outputs/cloudflare-origin-lockdown-guide.md`。
+- EdgeOne 客户端 IP 头部（腾讯官方文档，会更新）：「携带客户端 IP 头部回源」。
+- Cloudflare for SaaS 官方文档：developers.cloudflare.com → SSL/TLS → SSL for SaaS。
diff --git a/outputs/edgeone-noicp-cf-tunnel-guide.md b/outputs/edgeone-noicp-cf-tunnel-guide.md
new file mode 100644
index 0000000..c460b64
--- /dev/null
+++ b/outputs/edgeone-noicp-cf-tunnel-guide.md
@@ -0,0 +1,252 @@
+# TamaBox 免备案双线接入指南（EdgeOne 国际站 + Cloudflare Tunnel）
+
+> **适用场景（2026-09-03 定稿）**：不备案。国内用户走腾讯 EdgeOne 国际站（免备案加速区域「全球可用区（不含中国大陆）」，大陆用户落到香港等最近海外节点，跨域骨干质量优于 CF）；海外用户继续走现网 Cloudflare（`box.tama.guru` 已是 `337845818.best` zone 的 SaaS 自定义主机名 + Cloudflare Tunnel 回源，已正常生效）。
+>
+> **配套代码**：`internal/shared/ip.go` 已支持 EO-Client-IP（境内分支）与 CF-Connecting-IP（海外分支），`trust_proxy=true` 时双头同权信任，无需维护 CDN 大 CIDR 清单。
+
+> ## 🔴 重要勘误（2026-09-03 三次更正定稿）——权威在 DNSPod；分线路已确认生效
+>
+> ⚠️ **历次结论演进**：
+> 1. 初版「权威在 Cloudflare → 需子域委派」**作废**（用户 CF 没有 tama.guru zone，正常——它本来就不该有）；
+> 2. 二次更正（RDAP 直连 `.guru` 注册局 Identity Digital 铁证）：`tama.guru` 注册局 NS 委托 = **`byron.dnspod.net` + `sunshine.dnspod.net`（DNSPod）**。此前误判因 apex `tama.guru` 自身 CNAME → `navi-ew2.pages.dev`（CF Pages），nslookup 跟随 CNAME 链误读；
+> 3. **三次更正（12:10 最终确认）**：用户 DNSPod 面板已配好三线路（境内→EO / 境外→CF 优选 `cloudflare.182682.xyz` / 默认→CF 优选），NS=byron/sunshine——**分线路确认生效**：
+>    - **境外视角**（两家境外服务器 API 实测：hackertarget / networkcalc）→ `CNAME cloudflare.182682.xyz` → CF IP（104.x）✅
+>    - **境内视角**（223.5.5.5 / 119.29.29.29 / alidns DoH 稳定查询）→ `CNAME eo.dnse4.com` → EO IP（43.174.x）✅
+>    - 此前「全球四视角全部 EO」的实测是**假象**：大陆本机发往境外公共 DNS（8.8.8.8 / 9.9.9.9 / OpenDNS / 1.0.0.1，UDP 与 TCP 均）的查询被网络劫持/污染，应答按境内线路给出 EO。⚠️ **大陆本机 nslookup 境外 DNS 的结果不可信**，验证分线路必须用境外服务器 API 或境外网络（方法见 2.3 第 4 步）。
+> 4. EO 归属验证若依赖 CNAME 自动校验，仍建议改 TXT 验证并把 TXT 放 DNSPod（防止分线路后续期失败）——此条仍适用。
+
+---
+
+## 0. 已核实事实（官方口径）
+
+| 项 | 结论 |
+|---|---|
+| EdgeOne 加速区域与备案 | 「中国大陆可用区」「全球可用区」**必须备案**；「全球可用区（不含中国大陆）」**无需备案**（国际站同规则） |
+| 不备案时大陆用户走哪 | 无大陆节点，就近落香港/日韩/新加坡等海外节点；香港节点走腾讯跨境骨干，大陆延迟通常显著优于 Cloudflare 免费版（仍建议实测） |
+| Cloudflare for SaaS | 免费额度 100 个自定义主机名；`box.tama.guru` 已配置并正常打开，海外分支**零改动** |
+| EdgeOne EO-Client-IP | **默认关闭**，需手动开启；自定义头部名必须填 `EO-Client-IP`（代码固定读此名） |
+| 应用真实 IP 信任 | 已支持：境内→EO-Client-IP；海外→CF-Connecting-IP |
+| **回源 IP 段官方入口** | 控制台「**安全防护 → 源站防护**」启用后展示回源 IP 列表（IPv4/IPv6 段）；段变更前 14/7/3/1 天站内信+短信+邮件通知；可用 `DescribeOriginACL` API 每 3 天轮询自动同步（intl 文档 1145/48535） |
+| **⚠️ 免费套餐限制** | **免费套餐不支持启用「源站防护」**（2026-03 官方答疑）→ 拿不到官方回源段。出路见 2.2「回源网段三选一」 |
+| **🔴 DNS 分线路实测（2026-09-03 三次更正定稿）** | `tama.guru` 权威 NS = **DNSPod**（注册局 RDAP：`byron.dnspod.net` + `sunshine.dnspod.net`）；CF 无此 zone。三线路（境内→EO / 境外→CF / 默认→CF）**已确认生效**：境外服务器 API → CF（104.x），境内通道 → EO（43.174.x）。⚠️ 大陆本机 nslookup 境外 DNS 会被劫持假返回 EO，不可用作境外视角 |
+
+---
+
+## 1. 目标拓扑
+
+```
+                     ┌────────────────────────────────────────────┐
+                     │  DNSPod 托管 tama.guru 整域 zone（权威）      │
+                     │  box 记录按线路分流：                         │
+                     │   中国境内 ──CNAME──▶ EdgeOne CNAME 目标     │
+                     │   默认 / 国外 ──CNAME──▶ CF SaaS CNAME 目标   │
+                     └───────┬─────────────────────────────┬──────┘
+           大陆用户▶▶────────┘                             │ 海外用户▶▶
+        （大陆 ISP 递归命中境内线路）                        │
+                     ▼                                     ▼
+            EdgeOne 国际站                          Cloudflare 边缘
+            区域: 全球(不含中国大陆)                 SaaS 自定义主机名 box.tama.guru
+            HTTPS 免费证书自动签发                  （挂在 337845818.best zone）
+                     │  EO 回源（直连源站公网端口）        │  Tunnel（源站主动出站）
+                     ▼                                     ▼
+        ┌────────────────────────────┐         cloudflared（本机/内网）
+        │ 源站防火墙：仅放行 EO 回源网段│◀──────────────（无入站端口，不受影响）
+        └───────────────┬────────────┘
+                        ▼
+              TamaBox 应用（监听公网回源端口）
+```
+
+**安全前提（缺一不可，否则头信任模型可被绕过）：**
+1. 源站防火墙只对 **EdgeOne 官方回源网段** 开放回源端口（默认拒绝一切）；
+2. EO 侧开启「客户端 IP 头」且名称 = `EO-Client-IP`；
+3. EO 规则引擎**删除**客户端可伪造的 `CF-Connecting-IP` / `X-Real-IP`（否则大陆攻击者经 EO 带假 CF 头会被应用优先信任）；
+4. `conf/app.ini` 的 `[security]` 设 `trust_proxy = true`。
+
+> ⚠️ **前提 1 与套餐强相关**：官方回源段只有启用「源站防护」才能拿到，而**免费套餐不支持该功能**。免费版请先读 2.2 的「回源网段三选一」选定替代路径，再继续配置。
+
+> 海外分支天然安全：攻击者只能经 Cloudflare 边缘进来，CF 会用自己的观测值重写 `CF-Connecting-IP`，客户端伪造无效；Tunnel 到源站为出站连接，源站无对应入站口。
+
+---
+
+## 2. 分步实施
+
+### 2.1 EdgeOne 接入（国际站 edgeone.ai）
+
+1. 登录 EdgeOne 国际站控制台 → **添加站点**：
+   - 站点域名：`box.tama.guru`（直接用子域做站点，避免影响 `tama.guru` 其他记录）；
+   - 加速区域：**「全球可用区（不含中国大陆）」**（勿选含中国大陆的区域——未备案无法添加，选错会要求备案）；
+   - 接入方式：**CNAME 接入**（保留 DNSPod 分线路能力）。
+2. **归属验证选「DNS / TXT 验证」**（不要选要求整体 CNAME 的方式）：按控制台提示在 DNSPod 为 `box.tama.guru` 添加指定 TXT（或指定子域名的 CNAME），验证通过后**该验证记录保留勿删**（续期/校验会用到）。
+3. HTTPS：开启自动免费证书（默认开启）。
+4. 状态变「已生效」后，记下控制台分配的 **CNAME 目标**（形如 `<hash>.<region>.edgeone…`，以控制台显示为准），供 2.3 使用。
+5. **开启客户端 IP 头**：站点 → 网络优化 / 规则引擎（套餐不同路径略有差异）→「增加客户端 IP 请求头」类功能 → 开启，并把头部名**务必填 `EO-Client-IP`**。
+6. **配置回源**：源站地址 = 服务器公网 IP；端口 = 2.2 选择的回源端口（优先高位非标端口，若控制台仅允许 80/443 则用 443 + 源站 TLS，见 2.2）；回源 HOST = `box.tama.guru`；协议建议与现状一致（HTTP，由 EO 边缘终结 TLS）。
+7. **（可选加固）回源鉴权**：若套餐支持「回源鉴权 / 自定义回源头」，加一个仅源站知道的头（如 `X-EO-Auth: <随机串>`），源站入口校验，作为防火墙白名单之外的纵深兜底。
+
+### 2.2 源站监听公网口（不需要 nginx）与回源锁定（关键安全步骤）
+
+**不需要 nginx/Caddy**：TamaBox 自带 HTTP 服务器，直接让应用监听公网端口即可——nginx 在整套方案里只是可选的「TLS/反代」环节，不是安全环节，低配服务器完全不必装。系统防火墙（ufw/iptables/firewalld）是内核 netfilter 规则，无常驻高内存进程，也不占资源。
+
+1. **改监听地址**：`conf/app.ini` 的 `[server]` 段：
+   ```ini
+   [server]
+   port = 18080              ; 换高位非标端口，别用 80/443
+   listen = 0.0.0.0:18080    ; 关键：从「仅本机」改为「全网卡」，EO 才能远程连入
+   ```
+   > 说明：此前 Cloudflare Tunnel 单线部署建议 `listen = 127.0.0.1:port`（只对本机 cloudflared 可见）；接 EO 直连后必须改为 `0.0.0.0:port`（或删掉 `listen` 留空 = 默认 `:port` 全网卡）。**Tunnel 分支不受影响**——cloudflared 连的是 `127.0.0.1:port`，`0.0.0.0` 监听兼容回环连入。改完重启应用。
+   > 端口限制：EO 回源端口是否允许高位非标以控制台为准；若只允许标准端口集合，再考虑在 `443` 前置 TLS（届时才需要 Caddy/nginx 或改用 HTTPS 回源）。
+2. **EO 回源协议选 HTTP**（TLS 由 EO 边缘终结，与现在 Tunnel 到本机 HTTP 的形态一致）。注意 EO 边缘→源站这段是公网明文，可接受则用，介意再改 HTTPS 回源。
+
+#### 回源网段三选一（决定安全模型）
+
+**背景**：官方回源 IP 段只在「源站防护」功能里给，**免费套餐不支持启用**——这正是你在控制台找不到列表的原因。三条出路：
+
+| 方案 | 成本 | 做法 | 风险 / 说明 |
+|---|---|---|---|
+| **A. 官方源站防护（推荐）** | EO 基础版以上（以控制台计费为准） | 控制台 → 站点 → **安全防护 → 源站防护** → 启用 → 复制回源 IP 列表（IPv4/IPv6）配防火墙；变更前 14/7/3/1 天会站内信/短信/邮件通知；也可用 `DescribeOriginACL` API 每 3 天轮询自动同步 | 最标准，段变更有官方通知兜底 |
+| **B. 观察法自建 ACL（免费）** | 免费 | ① 先把回源端口临时放开（或安全组先放行）；② 源站抓 3–7 天回源连接来源：`tcpdump -nn port 18080` 或看应用日志里的对端 IP；③ 把来源聚类成 CIDR；④ 防火墙收紧为只放行这些段；⑤ **每月自查一次**来源是否有新增 | ⚠️ EO 回源段平均 3–6 个月会变，免费档收不到变更通知 → 段变化会导致回源失败；出故障先临时全放再排查。低流量个人站可接受 |
+| **C. 不设白名单（不推荐）** | 免费 | 仅靠随机高位端口 + 应用层 Host 校验 | 🔴 源站 IP 一旦泄露即被绕过 CDN 直连，且可伪造 `EO-Client-IP`/`CF-Connecting-IP` 绕过限流/封禁。若仍要走，需先做代码加固：让 ip.go 只信任来自 `trusted_proxies`/回环对端的 CDN 头（另行评审） |
+
+**防火墙（ufw 示例，云安全组同理；按 A 或 B 得到的段列表执行）：**
+```bash
+ufw default deny incoming
+ufw allow from <EO_CIDR_1> to any port 18080 proto tcp
+ufw allow from <EO_CIDR_2> to any port 18080 proto tcp
+# …全部 EO 段放行完毕后，确认没有 0.0.0.0/0 放行 18080
+# ssh 等管理端口勿对公网裸开（建议仅内网/跳板）
+```
+
+**验证「直连被拒」**：用一台与 EO 无关的外网 VPS 执行 `nc -zv <服务器IP> 18080`，应 `refused / timeout`；随后通过 EO 加速 URL 访问，确认回源返回 200。
+
+**说明**：cloudflared（Tunnel）不受本次开端口影响——它始终是源站**主动出站**连 Cloudflare，不依赖任何入站规则。
+
+### 2.3 DNS 分线路改造（权威在 DNSPod，直接配置；**无需任何委派**）
+
+> **2026-09-03 三次更正后的最终认知（12:10 实测确认）**：注册局 RDAP 铁证 `tama.guru` 权威 NS = `byron.dnspod.net` + `sunshine.dnspod.net`（DNSPod），Cloudflare 从未托管此 zone。DNSPod 面板的**三线路配置（境内→EO / 境外→CF / 默认→CF）已确认生效**（境外服务器 API 实测 → CF；境内通道实测 → EO）。本节仅需**核对面板与下表一致**；不一致时按下表改。
+
+#### 第 1 步：核对 DNSPod 域名列表（关键，避免改错地方）
+
+登录腾讯云解析 DNSPod → 域名列表，确认：
+- ✅ 存在 **`tama.guru`**（整域 zone，权威 NS = byron/sunshine.dnspod.net 所在）；
+- ⚠️ **若还存在一个独立的 `box.tama.guru` 子域 zone**（之前按旧方案误建的）——它不生效且会造成混淆：在 DNSPod 删除它（或忽略它，把配置改到 tama.guru 整域下）；
+- ⚠️ 确认不是登录错账号/域名在另一个 DNSPod 账号下。
+
+> 判别方法：DNSPod 面板上 tama.guru 域名详情页底部会显示「NS 记录：byron.dnspod.net / sunshine.dnspod.net」；若显示的不是这组，说明域名不在当前账号。
+
+#### 第 2 步：在 tama.guru 整域 zone 里配置 box 记录（主机记录填 `box`）
+
+进入 `tama.guru` → 记录管理，找到/新建主机记录 `box`，**分线路三行**：
+
+| 线路 | 类型 | 记录值 |
+|---|---|---|
+| **中国境内** | CNAME | `box.tama.guru.eo.dnse4.com`（EdgeOne CNAME 目标，2.1 控制台核对） |
+| **境外** | CNAME | **CF SaaS CNAME 目标**（见下） |
+| **默认** | CNAME | 同境外（兜底，覆盖未识别线路） |
+
+- ✅ **用户面板实际状态（2026-09-03 12:07 核对）已符合上表，无需改动**：默认 → `cloudflare.182682.xyz`（2025-11-20 建）、境外 → `cloudflare.182682.xyz`（10:54 建）、境内 → `eo.dnse4.com`（11:29 建），NS = byron/sunshine.dnspod.net。若你的面板只有单条「默认 CNAME → EO」，则把它**编辑为线路=中国境内**，再新增境外/默认两条指向 CF。
+- CF SaaS CNAME 目标获取：CF 控制台 → zone `337845818.best` → **SSL/TLS → Custom hostnames**（for SaaS）→ `box.tama.guru` 详情里的 **CNAME target**（形如 `<hash>.cdn.cloudflare.net`）。若用第三方「优选 IP」域名，填你的优选 CNAME 亦可（保证解析到 CF 边缘）。
+- TTL：`120`~`600`（便于回滚）。
+- ⚠️ DNSPod 免费版**支持**境内/境外/默认分线路（基础分线路免费；运营商级细分才收费）。
+
+#### 第 3 步：⚠️ EO 归属验证方式的适配（重要，防止证书续期失败）
+
+- EO 站点若靠「主记录 CNAME → EO 目标」自动验证归属，分线路后**境外/默认线路不再返回该 CNAME**，EO 周期性校验会失败。
+- 对策：EO 控制台把验证方式改为 **TXT 验证**（EO 会给一条形如 `_<xxx>.box.tama.guru → TXT <值>` 的验证记录），把这条 TXT **加到 DNSPod 的 tama.guru zone**（主机记录 `_<xxx>`，线路=默认，全球可见）；box 的境内线路 CNAME 保持指向 EO 不动。
+
+#### 第 4 步：验证分线路（⚠️ 大陆本机 nslookup 境外 DNS 不可信）
+
+大陆本机向境外公共 DNS（8.8.8.8 / 9.9.9.9 / OpenDNS 等）的查询会被网络劫持/污染，**必然假返回境内线路的 EO**——勿用它判断境外线路。正确方法：
+
+```bash
+# 境内视角（本机即可，通道可信）
+nslookup box.tama.guru 223.5.5.5    # 期望 → eo.dnse4.com / 43.174.x（EO）
+curl -s "https://dns.alidns.com/resolve?name=box.tama.guru&type=A"   # 阿里 DoH（HTTPS），同上
+```
+
+```text
+# 境外视角：用境外服务器 API（浏览器打开即可，2026-09-03 已实测）
+#   https://api.hackertarget.com/dnslookup/?q=box.tama.guru
+#   https://networkcalc.com/api/dns/lookup/box.tama.guru
+# 期望：CNAME cloudflare.182682.xyz → 104.x / 172.x（CF 边缘 IP）
+```
+
+境内 EO + 境外 CF = 分线路成功（2026-09-03 12:10 已按此确认）。若在境外 VPS / 境外网络上，直接 `nslookup box.tama.guru 8.8.8.8` 亦可。
+
+#### 回滚
+把 box 的境外/默认线路 CNAME 改回（或删除，只留境内→EO）即回到全量 EO；或把三条都指向 CF 即全量 CF。分钟级生效，见 §5。
+
+### 2.4 Cloudflare 侧（零改动——CF 没有 tama.guru zone，也无需有）
+
+- **无需在 CF 做任何 DNS 操作**：`tama.guru` 的解析权在 DNSPod，CF 控制台不会、也不应出现该 zone。之前「父 zone 委派」方案基于错误前提，**作废**。
+- **保持不动**：`337845818.best` zone 的 SaaS 自定义主机名 `box.tama.guru`（证书 + Tunnel 路由）、Tunnel 本身、承载域记录。它们只依赖「有流量带着 `Host: box.tama.guru` 到 CF 边缘」，与 DNS 记录归属无关——DNSPod 分线路把境外流量指到 CF 边缘 IP/CNAME 后，CF 按 Host 自动匹配到该自定义主机名并走 Tunnel 回源。
+- **可选纵深**：在 `337845818.best` zone 加一条 Transform Rule「删除请求头 `EO-Client-IP`」——防海外用户经 CF 时把伪造 EO 头带入源站。当前代码因「CF-Connecting-IP 优先」已天然免疫，此规则属可选项。
+- **无环路风险**：EO 回源目标是你的源站 IP，不会指回 CF SaaS 域名；CF 分支回源走 Tunnel（出站），互不干扰。
+
+### 2.5 应用配置
+
+`conf/app.ini`：
+```ini
+[server]
+port = 18080
+listen = 0.0.0.0:18080    ; EO 直连需要公网可达（纯 Tunnel 时期是 127.0.0.1:port，接 EO 后必须改）
+
+[security]
+trust_proxy = true        ; 信任 EO-Client-IP / CF-Connecting-IP
+```
+无需维护 CDN 大 CIDR 清单（安全闭环依赖 2.1~2.2 的防火墙锁定 + 头剥离前提；免费版走观察法方案 B 时同理，前提是端口只对观测到的 EO 来源开放）。
+
+---
+
+## 3. 头信任矩阵（安全模型核对）
+
+| 流量路径 | 到达源站的相关头 | 应用采用 | 伪造风险与对策 |
+|---|---|---|---|
+| 大陆：用户 → EO → 源站 | `EO-Client-IP`（EO 开启后写入真实客户端 IP）；客户端自带的假 `CF-Connecting-IP` 被 EO 规则删除 | `EO-Client-IP` | 若 EO 未开启该功能或未删 CF 头 → 应用会拿到空/伪造 IP，**此为前提 2、3，必须配置** |
+| 海外：用户 → CF 边缘 → Tunnel → 源站 | `CF-Connecting-IP`（CF 边缘以观测值重写）；客户端伪造的 `EO-Client-IP` 也被透传但被忽略 | `CF-Connecting-IP` | CF 重写不可伪造；代码 CF 优先故天然免疫 |
+| 攻击者假设绕过防火墙直连 | 可自带任意头 | — | 防火墙拒绝，到不了应用；纵深：回源 HOST 校验 + 可选 Token |
+
+---
+
+## 4. 上线验证清单
+
+| # | 检查项 | 通过标准 |
+|---|---|---|
+| 0 | DNS 分线路 | 境内视角（本机）：`nslookup box.tama.guru 223.5.5.5` → EO（eo.dnse4.com / 43.174.x）；境外视角：境外服务器 API（hackertarget / networkcalc，方法见 2.3 第 4 步）→ CF（104.x）。⚠️ 大陆本机 `nslookup 8.8.8.8` 会被劫持假返回 EO，不可用 |
+| 1 | 境内访问 | 大陆节点访问 `https://box.tama.guru` 正常，浏览器证书为 EO 签发；源站/EO 访问日志中客户端 IP = 你的大陆公网出口 IP（说明 `EO-Client-IP` 生效） |
+| 2 | 海外访问 | 海外访问正常，日志客户端 IP = 海外出口 IP（CF-Connecting-IP 生效） |
+| 3 | 直连封锁 | 外网 VPS `nc -zv <IP> <回源端口>` 拒绝/超时 |
+| 4 | 伪造头 | 境内客户端手动带 `CF-Connecting-IP: 1.2.3.4` 请求，日志仍记录真实 IP（EO 删除规则生效） |
+| 5 | 限流/封禁联动 | 用 EO 路径触发限流，确认按真实 IP 计数而非 EO 节点 IP |
+| 6 | WebSocket/上传 | 若用到 WS：EO 站点需显式开启 WebSocket（CF 侧 Tunnel 原生支持）；大体积上传实测通过 |
+| 7 | 证书 | 大陆/海外浏览器均无证书告警 |
+
+---
+
+## 5. 回滚顺序
+
+1. **快速回滚（恢复访问）**：DNSPod 里把 box 的「境外/默认」线路临时指向 EO 目标（或全线路都指向 EO）→ 全球走 EO，分钟级生效；
+2. **彻底回滚（回到纯 CF 时代）**：DNSPod 里把 box 三条线路统一改为 `CNAME → <原 CF SaaS 目标 / 承载记录>`（全球走 CF）；
+3. 确认 CF 路径正常后，再逐步收尾：关 EO 客户端 IP 头、撤防火墙放行、删除 EO 站点。
+4. ⚠️ 回滚后 EO 归属验证记录（若已按 2.3 第 3 步迁为 TXT）保持在 DNSPod 即可随线路变化继续有效；若 EO 站点还保留，按 EO 控制台提示重新验证。
+
+---
+
+## 6. 合规与风险提示
+
+- 未备案域名面向大陆提供服务：无大陆节点（合规红线决定了这一点），且存在被运营商/监管按未备案域名处置（如阻断）的风险。本方案仅为技术可达路径，业务风险需自行评估。
+- 若日后完成备案：EO 加速区域可改「全球可用区」（含大陆节点），大陆延迟进一步下降，DNSPod 分线路结构无需变动，只改 EO 区域并复验。
+- `.guru` 等新顶级域在大陆解析/合规环境的稳定性低于 `.com`，如遇解析异常优先查 DNS 污染与线路命中。
+
+---
+
+## 7. 常见问题
+
+- **`EO-Client-IP` 一直没出现？** 功能默认关闭且可自定义头名，需在 EO 侧开启并确认名称一字不差；另外只有走 EO 的流量才会带此头。
+- **从大陆本机 `nslookup box.tama.guru 8.8.8.8` 返回 EO，是不是境外线路没生效？** ⚠️ **不是，别被误导**——大陆本机发往境外公共 DNS 的查询会被网络劫持/污染，应答按境内线路给出（EO），UDP 与 TCP 均如此。境外线路是否生效要用**境外服务器视角**验证：浏览器打开 `https://api.hackertarget.com/dnslookup/?q=box.tama.guru` 或 `https://networkcalc.com/api/dns/lookup/box.tama.guru`，返回 `cloudflare.182682.xyz` → 104.x 即境外→CF 生效（2026-09-03 已实测确认）。若境外 API 真返回 EO，才需要回 DNSPod 面板核对 box 记录三行是否齐全、线路字段是否正确（境内→EO / 境外→CF / 默认→CF）、是否误建了未委派的 `box.tama.guru` 子域 zone。
+- **DNSPod 面板该核对哪些字段？** ① `box` 记录应有三行且线路分别是：境内（值 `box.tama.guru.eo.dnse4.com`）、境外（值 CF 优选 `cloudflare.182682.xyz` 或 CF SaaS CNAME target）、默认（同境外）；② 域名列表只有 `tama.guru` 整域 zone（权威 = byron/sunshine.dnspod.net，域名详情页可见 NS），不应有独立的 `box.tama.guru` 子域 zone；③ 权威归属可用注册局 RDAP 自查（`https://rdap.org/domain/tama.guru` 应返回 byron/sunshine.dnspod.net）。
+- **HSTS 报错「无法访问…使用了 HSTS」？** 应用在 ExternalURL 以 https 开头时对响应下发 `Strict-Transport-Security`（1 年，includeSubDomains），浏览器在 HTTPS 时代已记录。切 CDN 后若边缘证书与域名不匹配（如 EO 返回兜底证书 `*.cdn.myqcloud.com`）即触发此页。根因是**新 CDN 证书尚未签发/部署**，等证书正确即自动恢复（域名不在 preload 列表时无需清浏览器）；排查命令：`echo | openssl s_client -connect box.tama.guru:443 -servername box.tama.guru \| openssl x509 -noout -subject`，subject 应含 `box.tama.guru`。
+- **只放行 EO 段后业务断了？** 大概率回源 IP 段列表不全或已更新：先临时放行全段定位，再按最新清单收紧（付费档以官方源站防护通知为准；免费观察法每月自查来源 IP）。
+- **找不到回源 IP 段列表？** 那是「源站防护」功能里的展示项，而**免费套餐不支持启用**——见 2.2「回源网段三选一」。
+- **服务器太差不想跑 nginx，直接让服务监听公网端口行不行？** 行，而且推荐这么做：TamaBox 自带 HTTP 服务器，nginx 本就不是必需。只需把 `[server] listen` 改为 `0.0.0.0:port` 并让 EO 回源直连该端口；安全由防火墙网段白名单承担，与是否装 nginx 无关。
+- **应用出现 http 跳转 / 非 Secure Cookie？** EO 回源为 HTTP 时应用看到的是 http scheme，与 Tunnel 现状一致。若应用按 scheme 生成链接或下发 Secure Cookie 且行为异常，改为 HTTPS 回源或让应用信任 `X-Forwarded-Proto`。
+- **两家 CDN 缓存冲突？** TamaBox 为动态应用，两侧都保持默认不缓存 HTML/API，仅缓存 `static/` 资源。
diff --git a/outputs/edgeone-origin-whitelist-guide.md b/outputs/edgeone-origin-whitelist-guide.md
new file mode 100644
index 0000000..87cb633
--- /dev/null
+++ b/outputs/edgeone-origin-whitelist-guide.md
@@ -0,0 +1,299 @@
+# EdgeOne 回源端口 iptables 白名单自动维护指南
+
+> **交付物**：`scripts/edgeone-origin-whitelist.sh`（Linux / iptables + ipset）
+> **适用**：TamaBox 源站对公网开放了 EO 回源端口（免备案双线架构的 EO 分支），想把「开放 IP + 端口」收敛为「仅 EdgeOne 可访问」。
+> **更新日期**：2026-09-03
+
+---
+
+## 0. 先泼一盆冷水：官方清单是付费功能
+
+你要的「定期获取 EdgeOne IP 列表」——**免费套餐下官方不提供可程序化获取的渠道**：
+
+| 事实 | 说明 |
+|---|---|
+| 官方唯一清单来源 = 「源站防护 / Origin ACL」 | EO 控制台 → 安全防护 → 源站防护，启用后展示回源 IPv4/IPv6 网段，变更前 14/7/3/1 天通知 |
+| **仅付费套餐支持** | 官方文档明确「origin protection 仅支持绑定付费套餐的站点，free edition 不支持」（腾讯文档 1552/76086）——这就是你在控制台找不到入口的原因 |
+| 自动化 API 存在但同样付费 | `DescribeOriginACL`（teo.intl.tencentcloudapi.com，国际站），每 3 天低频轮询，`NextOriginACL` 非空即同步并调确认接口（文档 71118） |
+
+**所以本脚本的现实定位**：不依赖官方 API，以「本地/远程 CIDR 清单」为骨架，免费档立刻可用；日后升级付费套餐，只需把 API 拉取结果落到清单文件，脚本零改动继续工作（见 §7）。
+
+> ### 🔴 0.1 2026-09-03 实测定稿：免费档请直接用「段级放行」，IP 级采种已证明不可行
+>
+> 曾设计 learn/auto 从连接表逐个收集 EO 出口 IP 作白名单，**服务器实测（tcpdump 取证）否决了该路线**：
+>
+> - EO 回源出口是**节点池，规模数百上千**，且**同一时刻在多段轮换**——一次 23 秒采样就看到 13 个不同出口（分布在 `43.146/43.152/43.168/43.174/43.175` 五段），其中 9 个因不在白名单被 REJECT → 表现为境内**间歇性 521**（EO 边缘回源失败）。
+> - 结论：**IP 级清单 = 打地鼠**，永远追不上。免费档唯一现实可行方案是**按腾讯云大段放行**（脚本原生支持 CIDR，无需任何改动）：
+>
+> ```bash
+> # /etc/edgeone-origin/cidr.txt（2026-09-03 实测生效配置，521 消失）
+> 43.146.0.0/16
+> 43.152.0.0/16
+> 43.168.0.0/16
+> 43.174.0.0/16
+> 43.175.0.0/16
+> ```
+>
+> - learn/auto 在段级模式下**降级为「新段预警」辅助**：auto 采到清单外的 IP → `whois` 反查归属 → 若属腾讯云 EO 新段，把整段 `/16` 补进清单。首次采种不再需要 learn（§3.1 的逐 IP 采种流程整体退役）。
+> - 代价说明：`/16` 段内任意腾讯云主机可直连该回源端口（比全开安全、比精确 ACL 松），对 TamaBox 这类自身带鉴权的应用风险中等、可接受（§8）。
+
+---
+
+## 1. 脚本做什么
+
+把回源端口从「全网开放」收敛为白名单：
+
+```
+INPUT 链（默认仅 2 条规则，其余不动）
+ ├─ -p tcp --dport 18080 -i lo   -> ACCEPT     ← cloudflared Tunnel 本机回连（回环放行）
+ └─ -p tcp --dport 18080 -i eth0 -> EO_IN      ← 仅公网网卡 eth0 入站才判定
+       EO_IN 自建链（一次性建立，内容恒定）
+        ├─ EO_ORIGIN 集合命中     -> ACCEPT   ← EdgeOne 回源（白名单）
+        └─ 其余                   -> REJECT tcp-reset  ← 直连者秒断
+（网卡名不是 eth0 请改脚本头 EO_IFACE；留空=不限网卡，回环由 EO_IN 内 127.0.0.0/8 兜底）
+```
+
+**两个关键设计，保证不会把自己锁死、不会误伤 CF 分支：**
+
+1. **更新零窗口**：白名单存于 ipset 集合 `EO_ORIGIN`，更新走「临时集合填充 → `ipset swap` 原子替换 → 销毁临时集」；iptables 规则永远引用同名集合、从不重建。同步过程中不存在「规则被清空」的瞬间。
+2. **cloudflared 不受影响**：Tunnel 是 cloudflared 从本机 `127.0.0.1` 连回源端口，INPUT 里有独立的 `-i lo` ACCEPT 放行回环（与 eth0 网卡限定解耦），所以**即使防火墙收紧，CF 分支依然正常工作**——这正是裸 iptables 白名单最容易踩的坑（有人把 18080 一刀切 REJECT，Tunnel 分支跟着全挂）。
+
+其余保障：清单为空/拉取失败/全非法 → **拒绝更新、保留现网规则**（fail-safe）；支持 `--dry-run` 演练；全程日志 `/var/log/eo-origin-whitelist.log`。
+
+---
+
+## 2. 部署前确认两件事
+
+1. **确认你的实际回源端口**（脚本默认 `18080`，务必改成实际值）：
+   ```bash
+   ss -tlnp | grep -iE 'tamabox|LISTEN'   # 找 TamaBox 监听的端口
+   ```
+   或看 `conf/app.ini` 的 `[server] port`。改脚本文件头 `EO_PORT=18080` 那一行，或运行时 `sudo EO_PORT=xxxx ./edgeone-origin-whitelist.sh sync`。
+
+2. **确认系统有 ipset**（白名单原子替换依赖它）：
+   ```bash
+   command -v ipset || sudo apt-get install -y ipset   # Debian/Ubuntu
+   command -v ipset || sudo dnf install -y ipset       # RHEL/CentOS/Fedora
+   ```
+
+3. **确认公网网卡名**（脚本默认只对 `eth0` 生效）：
+   ```bash
+   ip route get 1.1.1.1 | awk '{print $5; exit}'   # 输出如 eth0 / ens3 / enp1s0
+   ```
+   输出不是 `eth0` 时，改脚本头 `EO_IFACE=` 或运行时覆盖：`sudo EO_IFACE=ens3 ./edgeone-origin-whitelist.sh sync`。⚠️ 网卡名不对 → 跳转规则永不命中 → 端口等于裸奔。
+
+---
+
+## 3. 初始化：生成种子清单（免费档必经步骤）
+
+> 🔴 **先读 §0.1（实测定稿）**：免费档**不要**再做逐 IP 采种（EO 出口是海量轮换节点池，IP 级白名单实测导致间歇 521）。直接按 §0.1 的五个 `/16` 段建清单即可；learn/auto 只留作「新段预警」，见 §3.1 末注。
+
+### 3.1 首选：腾讯云大段放行（实测定稿）
+
+按 §0.1 直接放行 EO 所属的腾讯云大段（免费档没有官方回源段 API，而逐 IP 采种已被实测否决）。清单内容（2026-09-03 服务器实测生效）：
+
+```bash
+sudo mkdir -p /etc/edgeone-origin
+# 每行一个 CIDR，# 开头为注释。以下为实测生效配置：
+sudo tee /etc/edgeone-origin/cidr.txt >/dev/null <<'EOF'
+# EdgeOne 回源段（腾讯云，2026-09-03 实测；境内 EO 分支访问验证正常）
+43.146.0.0/16
+43.152.0.0/16
+43.168.0.0/16
+43.174.0.0/16
+43.175.0.0/16
+EOF
+```
+
+> 段怎么来的：用 `auto`（或 tcpdump 抓 SYN）持续观察回源出口，把出现过的 IP 归并到所属腾讯云段（whois 查 ASN/归属确认），整段放行。上面五个 `/16` 来自多次实测采样（新加坡/腾讯云 EO 出口遍布这些段）。
+>
+> 🔴 段不是永恒不变的：EO 可能启用清单外的新段（罕见、以月计）。每月跑一次 `auto` 看采样里有没有清单外的 IP，`whois <IP>` 确认属腾讯云 EO 后把整段补进 cidr.txt 再 sync（详见 §4.4）。
+
+### 3.2 备选：向 EO 索取回源段
+
+免费档控制台无源站防护页面，但可尝试**提交工单索取当前回源 IP 段**（客服可能以"尽力提供"形式给出）；拿到后把 CIDR 逐行放进清单文件即可，效果等同。日后升级付费套餐启用源站防护，官方段可直接用（§7）。
+
+### 3.3 首次启用（务必先 dry-run）
+
+```bash
+# 1. 建清单文件
+sudo mkdir -p /etc/edgeone-origin
+sudo cp 你整理好的清单 /etc/edgeone-origin/cidr.txt    # 每行一个 IP/CIDR，# 注释
+
+# 2. 演练：只看将要执行的动作，不触碰系统
+sudo ./edgeone-origin-whitelist.sh sync --dry-run
+
+# 3. 正式启用
+sudo ./edgeone-origin-whitelist.sh sync
+```
+
+启用后**立刻验证**（另开一个 SSH 或终端，别把自己关外面）：
+
+```bash
+# 服务器本机验证（必须能通：Tunnel 回环放行）
+curl -sI --max-time 5 http://127.0.0.1:18080/ | head -3
+
+# 从一台"与 EO 无关"的外网机器验证（必须被拒）
+nc -zv <你的服务器IP> 18080        # 期望 refused 或超时
+
+# 经 EO 访问验证（必须能通）
+# ⚠️ 必须用【境内网络】访问——境外访问会被 DNSPod 解析到 CF 分支（走 Tunnel 回环），
+#    验证到的是 CF 而不是 EO！境内手机 4G 访问最方便
+curl -sI --max-time 10 https://box.tama.guru/ | head -3
+```
+
+### 3.4 撤掉原来的全局放行
+
+若你之前是用 ufw 放行的（`ufw allow 18080`），现在它已冗余（脚本的 REJECT 会先于它拦截非白名单），建议删掉避免困惑：
+
+```bash
+sudo ufw delete allow 18080        # 脚本 sync 时也会检测并提示
+```
+
+> ⚠️ 云厂商安全组若也是「全放行 18080」：本机 iptables 白名单已是最终防线，直连者到本机 INPUT 即被拒，**不强制改安全组**；但建议安全组层面至少把 18080 的源收敛为 EO 大段（升级付费拿到官方段后可做），纵深更稳。
+
+---
+
+## 4. 定时维护（核心诉求）
+
+### 4.1 清单会变吗？
+
+EO 官方口径：**回源网段平均 3–6 个月更新一次**，变更前 14/7/3/1 天通知。付费档启用源站防护后段变更有 API 兜底（§7）；免费档请按 §7 的「工单/客服」或定期（建议每月一次）核对。
+
+### 4.2 用 cron（最简单）
+
+段级模式（§0.1）下清单是 5 个 `/16` 段、几乎不变 → 定时只需**周期 sync 兜底 + 月度人工归段核对**，auto 不再作日常主线（改为按需「新段预警」观测，见 4.4）：
+
+```bash
+sudo crontab -e
+# ★ 推荐：每 3 天一次 sync（全量重建：清单里没有的旧条目自动剔除）
+17 4 */3 * * /usr/local/bin/edgeone-origin-whitelist.sh sync >> /var/log/eo-origin-whitelist.log 2>&1
+#   想更保险可改每天：把 */3 改成 *（即 17 4 * * * …）——sync 开销秒级，零负担
+# 新段预警观测（不设定时，需要时手动跑）：
+#   sudo /usr/local/bin/edgeone-origin-whitelist.sh auto
+#   输出「新增」→ whois 确认属腾讯云新段 → 整段写进 cidr.txt → 再 sync
+```
+
+把脚本放到固定路径：`sudo cp scripts/edgeone-origin-whitelist.sh /usr/local/bin/ && sudo chmod +x /usr/local/bin/edgeone-origin-whitelist.sh`
+
+### 4.3 用 systemd timer（更规范，推荐）
+
+`/etc/systemd/system/eo-origin-whitelist.service`：
+
+```ini
+[Unit]
+Description=Sync EdgeOne origin whitelist
+After=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/edgeone-origin-whitelist.sh sync
+```
+
+推荐**每 3 天一次**（段级清单近乎静态，sync 纯兜底）：
+
+```ini
+# A. 日历式（推荐）：每月 1/4/7/10/13/16/19/22/25/28/31 号 04:17
+# /etc/systemd/system/eo-origin-whitelist.timer
+[Unit]
+Description=EdgeOne origin whitelist sync (3-day)
+
+[Timer]
+OnCalendar=*-*-1/3 04:17:00
+Persistent=true
+
+[Install]
+WantedBy=timers.target
+```
+
+> 想每天跑：`OnCalendar=*-*-* 04:17:00`；想严格 72h 间隔：`OnBootSec=5min` + `OnUnitActiveSec=3d`。
+
+### 4.4 失效的条目会自动剔除吗？（段级模式）
+
+**会——且已内建，不需要任何额外参数。** 关键是理解 sync 的语义：
+
+| 你可能以为 | 实际机制 |
+|---|---|
+| sync 是把清单「增量添加」，旧条目越积越多 | ❌ 错。sync 是**全量重建**：每次按当前清单文件从零填充临时集合 → `ipset swap` 原子替换 → 旧的 `EO_ORIGIN` 整个被新集合顶掉 |
+
+所以**只要某段/某 IP 不在「当前清单文件」里，下一次 sync 它就自动消失**——剔除是 sync 的默认行为，零残留。反证见 §5：「临时 `ipset add` 放行的 IP，下次 sync 就没了」正是同一机制。
+
+段级模式下清单近乎静态（5 个 `/16`），日常维护极简，只剩一件事：**防 EO 启用清单外新段**。
+
+```bash
+# ① 月度新段预警：跑一次 auto（或 tcpdump 抓 SYN），看采样里有没有清单外的 IP
+sudo ./edgeone-origin-whitelist.sh auto
+#    auto 会把「清单外的新 IP」增量合并进 cidr.txt（只增不删），并提示新增了哪些
+# ② 归段：whois <新IP>（/ ipinfo.io/<IP>），确认属腾讯云 EO（Tencent/EdgeOne 字样）
+# ③ 把新 IP 归并成所属整段后写入清单（若 auto 已把裸 IP 加进 cidr.txt，可顺手整理成段）：
+sudo nano /etc/edgeone-origin/cidr.txt     # 示例：43.175.x.x → 加一行 43.175.0.0/16
+sudo ./edgeone-origin-whitelist.sh sync    # 立即生效；不手动跑则下次定时 sync 也会生效
+```
+
+三个要点：
+
+1. **别删到清单为空**：fail-safe 会让 sync 拒绝执行（宁可保留旧白名单，不可裸奔）。
+2. **旧段留在清单里没有安全风险**：那些地址属于腾讯云，不会"变成攻击者"，顶多白名单略宽（/16 级本就宽）；真正要紧的只是**新段漏加 → 偶发 521**（见 §8 免费档清单质量）。
+3. **想彻底全自动**（连月度核对都不想做）：升级付费套餐启用「源站防护」，把 `DescribeOriginACL` 输出定时写入 cidr.txt（§7）——清单每次都是官方最新全集，sync 自动带上新段、自动剔除已退出的段，脚本零改动。
+
+---
+
+## 5. 常用操作速查
+
+```bash
+sudo ./edgeone-origin-whitelist.sh sync                 # 周期入口（定时任务用这个，段级清单全量重建）
+sudo ./edgeone-origin-whitelist.sh auto                 # 新段预警：采集当前回源 IP → 合并进清单 → 有新增即 sync
+sudo ./edgeone-origin-whitelist.sh learn                # 看当前谁在回源（即时观测，不必用于日常维护）
+sudo ./edgeone-origin-whitelist.sh show                 # 当前白名单条目 + iptables 规则
+sudo ./edgeone-origin-whitelist.sh sync --dry-run       # 演练
+sudo ./edgeone-origin-whitelist.sh flush                # 回滚：移除本脚本全部规则/集合
+tail -20 /var/log/eo-origin-whitelist.log               # 看更新历史
+```
+
+**临时放行某个 IP**（不用改清单，立即生效；下次 sync 会随清单重建而消失——想持久就写进清单文件）：
+```bash
+sudo ipset add EO_ORIGIN x.x.x.x
+```
+
+**手动移除某个 IP**：
+```bash
+sudo ipset del EO_ORIGIN x.x.x.x
+```
+
+**修改回源端口**（低概率操作）：改 `EO_PORT` 后先 `flush` 再 `sync`（避免 INPUT 残留旧端口跳转）。
+
+**修改生效网卡**：改 `EO_IFACE`（或 `sudo EO_IFACE=ens3 ./edgeone-origin-whitelist.sh sync`）后直接 sync 即可——从「不限网卡」升级为「限定网卡」时会自动删除旧的无限定跳转；改完用 `show` 确认 INPUT 规则带 `-i <网卡>`。
+
+---
+
+## 6. 排错
+
+| 现象 | 原因与处理 |
+|---|---|
+| sync 报「清单为空…保持现网白名单不变（fail-safe）」 | 正常保护：空清单绝不上线。成因=清单文件不存在 / 内容全非法 / 无有效条目。先用 `learn` 采种并人工审阅后写入 `/etc/edgeone-origin/cidr.txt`（裸 IP 每行即可，已支持直接入清单）；脚本报错会自带下一步指引。若真配了 `EO_CIDR_URL` 且拉取失败 + 本地无条目，会单独报「来源全部失败」 |
+| 收紧后 CF 分支（海外）访问挂 | 几乎肯定是 cloudflared 连的不是 `127.0.0.1`。确认 Tunnel 配置里 service 指向 `http://127.0.0.1:PORT`（脚本对 127.0.0.0/8 放行；若 cloudflared 在**另一台机器**则需把那台机器出口 IP 加进白名单——但那属于另一架构，需单独设计） |
+| 经 EO 访问 502/回源失败（境内间歇性 521） | ① 端口填错（脚本拦的不是 EO 回源那个端口）；② 🔴 **清单太细**——EO 回源出口是海量轮换节点池（实测 23 秒 13 个出口、分布多个 /16），逐 IP 白名单必然间歇漏放 → EO 报 521。解法=按 §0.1 放行腾讯云大段（43.146/43.152/43.168/43.174/43.175 的 /16，2026-09-03 实测 521 消失）；③ 服务器重启后 ipset/iptables 规则丢失 → 见下 |
+| sync 报 `Set EO_ORIGIN doesn't exist` | 🔴 iptables-nft 要求「被引用的 ipset 集合必须先于规则存在」。旧版脚本先建链（内含引用集合的规则）后建集合，**首次运行必失败**。已修复（集合创建挪到建链之前）；旧版升级后重跑 `sync` 即可自愈 |
+| sync 报 `RULE_APPEND failed (Invalid argument)` 且 EO_IN 链**缺 REJECT 兜底行**（只剩 127/集合两条 ACCEPT） | 🔴 iptables-nft 下 `--reject-with tcp-reset` **必须带 `-p tcp`**（nft 的 reject 语句需确认匹配 TCP 才能构造 RST，无 -p 直接 EINVAL）。旧版 REJECT 行无 `-p tcp` 必然失败 → 链尾无兜底 → **非白名单直连仍通，白名单形同虚设**（集合/127 两条 ACCEPT 无此限制，能正常加入）。已修复（REJECT 加 `-p tcp`）；部署新版后重跑 `sync`，验证 `iptables -S EO_IN` 三条齐全：`-s 127.0.0.0/8 ACCEPT` / `-m set --match-set EO_ORIGIN src ACCEPT` / `-p tcp ... REJECT --reject-with tcp-reset` |
+| 服务器重启后白名单没了 | ipset 与 iptables 规则是内存态。用 `iptables-persistent` + `ipset-persistent`（Debian/Ubuntu），或把 sync 加进开机自启（systemd timer `Persistent=true` 只补跑错过的任务，不保证开机即跑——建议加一条 `@reboot` cron 或 oneshot service 开机执行一次 sync） |
+| 直连还是能通 | 先 `iptables -S INPUT` 看是否还有更靠前的全局 ACCEPT 匹配 18080；`ufw status` 若显示 allow 18080 先删；云安全组全放行但本机已 REJECT 的情况下直连应被拒——若仍通说明规则没插在 INPUT 最前或被其它链绕过（如 nftables 后端混用，`iptables -S` 与实际生效不一致时改用 `nft list ruleset` 排查） |
+| auto 立即结束、没等 `EO_SAMPLE_SECONDS` 窗口（日志同秒出现「采样到 0 个」） | 🔴 旧版 tcpdump filter 误写为 `"... and 'tcp[tcpflags] & tcp-syn != 0'"`——双引号内的单引号是**字面字符**，会原样传给 tcpdump，pcap 编译器不认识引号 → syntax error **秒退**（手动执行时单引号由 shell 吃掉，脚本里没这一步）；且旧版 `awk '{print $2}'` 取到的是协议名 `IP` 而非源地址（源在 `>` 前一字段）。两个缺陷叠加 = 抓了也白抓、还秒退。已修复（filter 去引号 + 按 `>` 前字段取源 IP，窗口会真实阻塞）。部署新版后：`sudo edgeone-origin-whitelist.sh auto` 应看到「tcpdump 采样 Ns … 请稍候」并等待 N 秒；`EO_SAMPLE_SECONDS` 非数字会打印提示并跳过 |
+| learn 输出为空 | ① **没有活跃回源连接**——EO 回源是短连接、错过即无，且**必须境内网络访问才走 EO 路径**（境外访问走 CF Tunnel，对端 127.0.0.1 会被脚本过滤，永远为空）；② 端口核对：`ss -tlnp \| grep LISTEN` 确认 TamaBox 监听端口 = 脚本 `EO_PORT`；③ 访问后 60 秒内 `ss -Htan \| grep :<端口>` 看 TIME-WAIT 痕迹；④ 最稳：`tcpdump -ni <网卡> tcp port <端口> and 'tcp[tcpflags] & tcp-syn != 0'` 抓 SYN——触发一次境内访问，出现的源 IP 即 EO 回源 IP。新版脚本空结果时会自带以上提示；`auto` 的采样含 conntrack（窗口比 learn 宽），仍采不到时排查思路同上 |
+
+---
+
+## 7. 升级付费套餐后：接官方 API 全自动（零脚本改动）
+
+启用「源站防护」拿到 ZoneId 后，可用腾讯云 Python SDK / tccli 周期调用 `DescribeOriginACL`，把返回的 `CurrentOriginACL.EntireAddresses.IPv4[]` 写入 `/etc/edgeone-origin/cidr.txt`，本脚本照常 sync 即可——**脚本无需任何改动**（它只认"每行一个 CIDR 的文件"）。
+
+> 也可让脚本直接拉取：把 API 结果发布到一个私有 HTTP URL，配置 `EO_CIDR_URL=...`（文件 + URL 会取并集）。注意变更时先核对 `NextOriginACL` 计划生效时间，建议同步时机放在 `PlannedActiveTime` 前完成，避免 EO 强制切换后回源失败。
+
+---
+
+## 8. 边界与已知限制
+
+- **默认仅公网网卡 eth0**：白名单只判定 `EO_IFACE` 指定网卡的入站流量（默认 `eth0`）；回环由独立的 `-i lo` ACCEPT 放行（供 Tunnel 本机回连），与网卡限定解耦。网卡名不是 eth0 时务必配置，否则跳转永不命中、端口裸奔。
+- **IPv6 天然无风险、无需任何 ip6tables 规则**：脚本只管理 IPv4；TamaBox 监听 `0.0.0.0`（仅 IPv4、无 AAAA），IPv6 上不存在该回源端口，v6 用户访问由 CDN 边缘走 IPv4 回源，一切正常。只有日后改为监听 `[::]:PORT` 并向 EO 开放 v6 回源，才需扩展 inet6 集合 + ip6tables 镜像（脚本头注释 5 有说明）。
+- **免费档清单质量（段级视角）**：清单是 5 个腾讯云 `/16` 段（§0.1），EO 出口怎么轮换都在段内 → 正常无感。唯一风险是 EO 启用清单外的**新段**（罕见、以月计）→ 表现为个别请求偶发 521；对策=月度跑一次 `auto` 看有无清单外新 IP，`whois` 确认归段后补段（§4.4）。这是免费档没有官方清单的固有代价，可接受则用，不可接受就升级付费档走 §7。
+- **脚本不触碰 ufw/云安全组**，只管理自己创建的链与集合；`flush` 也只删自己的东西，可放心回滚。
+- 本机为 1C1G 低配：脚本每次运行仅秒级、无常驻进程，ipset 查表为 O(1) 哈希，不影响转发性能。
diff --git a/outputs/eo-free-probe-2026-09-05.md b/outputs/eo-free-probe-2026-09-05.md
new file mode 100644
index 0000000..1057b02
--- /dev/null
+++ b/outputs/eo-free-probe-2026-09-05.md
@@ -0,0 +1,114 @@
+# EO 优选方案 B 实测报告（免费替代 wetest.vip）
+
+日期：2026-09-05 | 结论状态：**候选已找到，待大陆多节点 itdog 验证后决定是否落地 DNS**
+前提：方案 A（wetest.vip 会员活 IP，付费）用户已排除 → 本次全程免费实测
+
+---
+
+## 一、背景与目标
+
+- 现状：box.tama.guru 国内走 EdgeOne（CNAME 恒定解析新加坡 43.174.246.43/247.43），大陆 itdog 3-11s
+- 方案 B：不付费，自扫/公开 CNAME 找 **EO 网络内能服务 box.tama.guru 的亚洲近大陆边缘 IP**，改 dnspod 境内 A 记录直连
+- 区域不限香港，周边（日/韩/东南亚）比新加坡好即可
+
+## 二、免费公开数据源现状（全部实测，均死）
+
+| 数据源 | 类型 | 实测结果 |
+|---|---|---|
+| wetest.vip/page/edgeone/address_v4 | 会员活 IP | 🔴 需登录/付费，公开页 0 IP（页面仅"登录可购买"） |
+| *.v1/v4.eo.fastlydns.cn（小周优选） | 免费 CNAME | 🔴 全 NXD（域名 NS 在但子域已删） |
+| eo.072103.xyz | 免费 CNAME | 🔴 NXD |
+| eo.088086.xyz | 免费 CNAME | 🔴 NXD |
+| 蓝点网 43.174.150.199 等单 IP | 免费 IP | 🔴 证书已退回 CDN 通用池（*.cdn.myqcloud.com） |
+| 雾创岛 43.174.150.150 等香港 IP | 免费 IP | 🔴 同上，全部失效 |
+
+> 印证：EO 优选 IP 时效性极强（月度级），2025 年社区免费源到 2026-09 已全部死亡。
+> 博客佐证（2026-02）："EdgeOne 现在不能使用优选节点，对套餐不适用的节点直接返回 418"。
+
+## 三、自扫实测方法与结果
+
+### 3.1 判定标准（关键）
+
+社区 2025 教程用"TLS 握手成功"判优选是**错误判据**（腾讯 CDN 泛播池也握手成功但证书是 *.cdn.myqcloud.com）。
+正确判据 = schannel 证书链校验通过（浏览器视角可访问）+ HTTP 200 + 响应头 Server: TencentEdgeOne。
+
+### 3.2 扫描执行
+
+- 段级抽样：43.174.0.0/16 + 43.175.0.0/16 全部 512 个 /24 × 6 IP = 3072 抽样
+- 全段细扫：官方段 + 社区段 21 个 /24 ≈ 5300 IP
+- HK/JP 段细扫：56 个 /24 ≈ 14000 IP
+- 工具：dev/eo-probe-v2.py（schannel 判定）、dev/eo-probe-ips.py、dev/eo-scan-all.py
+
+### 3.3 关键发现
+
+**能服务 box.tama.guru 的 EO 边缘池（证书 CN=box.tama.guru）集中在 9 个 /24，全部新加坡：**
+43.174.192-195、43.174.218、43.174.240-241、43.174.246-247（AS139341 ACE）
+
+**但 EO 泛播确实同步到全球**——非官方分配段也有零星节点可服务：
+- 香港：43.175.115.x / 119.x / 43.174.126.x（8 个 IP）
+- 东京：43.175.16/17/18/113.x（6 个 IP）
+- 大阪：43.175.107.217
+- 阿姆斯特丹 43.175.185.x（5 个）、迪拜 43.174.152.63（远，无意义）
+
+> 说明：域名配置经 EO 泛播池同步到亚洲边缘，只是官方 CNAME 只调度到新加坡。
+> 这些 IP 均可作为境内 A 记录候选（证书/SNI/回源已验证 OK）。
+
+## 四、大陆视角实测对比（南宁电信，真实大陆出口）
+
+### 4.1 动态页 /_/tamakyi TTFB（用户核心痛点指标）
+
+| 节点 | TCP connect | TTFB (3 次) | 评价 |
+|---|---|---|---|
+| **官方新加坡 43.174.247.43** | 180-186ms | 0.81 / 0.91 / 1.03s | 当前最优 |
+| 香港 43.174.126.220 | 354-371ms | 1.29 / 1.47 / 1.80s | 更慢 |
+| 东京 43.175.18.50 | 287-304ms | 1.07 / 1.19 / **4.02s** | 更慢+不稳 |
+| 东京 43.175.113.139 | 292-294ms | 1.08 / 1.50 / 2.10s | 更慢 |
+| 正常 DNS（现状） | 208-1060ms | 0.92 / 0.97 / 1.70s | 与官方一致 |
+
+### 4.2 TCP RTT 排名（南宁电信 443 端口 3-5 次中位）
+
+```
+180ms   43.174.247.43 官方新加坡   ← 最优
+276-299ms 东京 43.175.17/18/113/16.x
+351-377ms 香港 43.175.115/119/43.174.126.x
+```
+
+### 4.3 结论：单点（南宁电信）实测官方新加坡反而最优
+
+- ipinfo 标"香港/东京"的 EO 边缘，大陆电信实际路由质量**不如官方新加坡**
+- 原因：官方 CNAME 的 43.174.246.43/247.43 是 EO 对大陆的优化调度；自扫边缘的跨境路由绕行
+- ⚠️ 注意：南宁电信 ≠ 全国。itdog 曾显示多地区 3-11s 慢，说明不同地区/运营商差异大。
+  香港候选在广州/深圳/福建等华南地区可能优于新加坡，需 itdog 多节点验证才能定论。
+
+## 五、候选 IP 清单（供 itdog 大陆多节点验证）
+
+```bash
+# 官方对照（当前 DNS）
+43.174.246.43 43.174.247.43
+# 香港候选（8）
+43.174.126.152 43.174.126.220 43.175.115.41 43.175.115.123
+43.175.115.149 43.175.115.202 43.175.119.174 43.175.119.214
+# 东京候选（6）
+43.175.16.233 43.175.17.109 43.175.17.185 43.175.18.50 43.175.113.139
+# 大阪
+43.175.107.217（返回 400，慎用）
+```
+
+itdog 建议：URL 填 `https://box.tama.guru/robots.txt`（静态，可缓存对比），
+对上述每个 IP 用"自定义 IP"模式分别测；若某香港/东京 IP 全国均值明显 < 新加坡，再改 DNS。
+
+## 六、结论与建议
+
+1. **免费公开源已全部死亡**（wetest 会员除外）——免费优选的时代窗口（2025 年中-2026 初）已关闭
+2. **自扫能力已具备**（脚本在 dev/），能稳定找出"当前仍服务 box.tama.guru 的 EO 边缘"
+3. **南宁电信单点**：官方新加坡最优，候选不占优 → 但需 itdog 全国多点验证（华南可能反转）
+4. 若 itdog 确认无候选优于新加坡 → 方案 B 免费路线到此为止，剩：
+   - 备案 + 大陆 CDN（治本，免费套餐获取难度降低但需实名+银行卡）
+   - 维持现状（静态已迁 snrat，动态页 ~1s TTFB 已是免备案架构上限附近）
+5. 日常维护建议：若坚持 EO 优选，成本最低的是**订阅一个 ITDOG 会员自己做月度优选**（比 wetest 便宜且通用），而非固定买活 IP 列表
+
+## 七、遗留
+
+- dev/ 下新增 3 个扫描脚本可复用（改 --host 即可用于其他 EO 域名）
+- 43.175.115.x 等香港候选在 check-host HK 节点延迟 2-60ms（真香港），仅大陆跨境路由绕
+- 建议优先 itdog 验证 43.175.115.202 / 43.174.126.220（check-host 证实真香港 PoP）
diff --git a/outputs/feature-mode-2026-09-01.md b/outputs/feature-mode-2026-09-01.md
new file mode 100644
index 0000000..4178144
--- /dev/null
+++ b/outputs/feature-mode-2026-09-01.md
@@ -0,0 +1,47 @@
+# 功能管理面板改进：长期开放模式 + 私聊上限下线 + 按钮同行（2026-09-01）
+
+## 需求与方案
+
+| # | 需求 | 方案 |
+|---|------|------|
+| 1 | 缺少「长期开放」开关：设了时间/数量后服务到期即关，想要一直开放的服务没有直接入口 | 每个功能面板新增「收集模式」三选一（radio）：**长期开放 / 定时收集 / 循环定时**；选「长期开放」保存后即不限时间，保持开放直到手动关闭（仍可叠加收集上限） |
+| 2 | 私聊设置收集上限没有意义 | 私聊面板隐藏「收集上限」与「重置计数」；后端保存私聊时强制 `quota_limit=0`；启动期幂等清零历史残留的私聊上限/计数（`normalizeChatQuota`） |
+| 3 | 「保存该功能设置」应与「重置计数」同一行 | 两按钮合并到同一 flex 行；重置按钮通过 HTML5 `form` 属性指向独立的 reset 表单（HTML 不允许表单嵌套），CSRF 各自保留 |
+
+## 改动明细
+
+### 1. 收集模式三选一（`templates/user/feature-control-form.html` + `route/user/features.go`）
+
+- 模式取值：`always`（长期开放）/ `window`（定时收集，一次性开放/关闭窗口）/ `recurring`（循环定时，每周循环）。
+- 渲染时从已保存配置推断模式（`inferFeatureMode`）：有循环定时 → recurring；有一性次时间 → window；否则 → always。
+- **模式互斥**：保存时只保留所选模式的字段，其余清空。这顺带修掉一个旧语义坑——
+  此前「一次性窗口 AND 循环定时」叠加，一次性关闭时间过后功能**永久结束**（硬边界），
+  用户想恢复一直开放必须手动清空时间字段；现在切换到「长期开放」保存一次即可。
+- JS 按所选模式显隐「定时收集」/「循环定时」字段区（未选模式的字段仍提交，由后端按模式清理）。
+- 未携带 `mode` 的旧表单提交按字段推断兜底，保持兼容；`Evaluate` 判定逻辑零改动。
+
+### 2. 私聊收集上限下线
+
+- UI：`{{ if ne .Key "chat" }}` 条件隐藏配额输入、已收集行、重置按钮。
+- 后端：`FeaturesUpdate` 对 `feature=chat` 强制 `quota = 0`（防历史残留上限导致私聊"莫名关闭"）。
+- 数据：新增 `internal/db/feature_control.go::normalizeChatQuota`，启动时把
+  `feature='chat'` 且 `quota_limit>0 或 quota_count>0` 的行幂等清零（`db.go` 调用，失败仅告警）。
+- 文案：四语言字典更新 `admin.featureHint.chat`（去掉"达到上限后停止新建会话"）。
+
+### 3. 按钮同行
+
+- `.feat-actions` 行内先「重置计数」（default 样式，仅非私聊面板）后「保存」（primary）。
+- 重置按钮 `form="feat-reset-{key}"` 指向表单外的独立 reset 表单，功能与原来完全一致。
+
+## 其他改动
+
+- i18n 四语言（zh-CN/zh-TW/en/ja）新增 `admin.featureMode`、`admin.featureModeAlways/Window/Recurring`、`admin.featureModeHint`。
+- `templates/render_test.go`：mock 结构体补 `Mode` 字段（question=always、chat=always、vote=recurring）。
+- `templates/user/profile.html`：新增 `.feat-modes` / `.feat-field-label` / `.is-hidden` 样式。
+
+## 验证
+
+- `gofmt -l -e` 全部改动文件 ✅
+- 全模块 overlay `go build` / `go vet` ✅（webp 屏蔽包用 `dev/webpstub` 桩 + `-overlay` 类型检查）
+- 全部可运行测试通过（含 `templates` 面板渲染回归、`internal/i18n`）✅
+- 待办：Linux 环境最终 `go build ./...`（webp CGO 真实编译）
diff --git a/outputs/llm-moderation-feasibility-2026-09-10.md b/outputs/llm-moderation-feasibility-2026-09-10.md
new file mode 100644
index 0000000..327dc05
--- /dev/null
+++ b/outputs/llm-moderation-feasibility-2026-09-10.md
@@ -0,0 +1,310 @@
+# 提问箱 LLM 内容审核方案 · 可行性评审
+
+- 日期：2026-09-10
+- 范围：可行性评审，**未改动任何代码**
+- 背景更正：项目文本/图片审核服务为**七牛云**（阿里云通道虽仍在代码中，但 `conf/app.sample.ini` 的 `aliyun_access_key` 为空，实际不生效）
+
+---
+
+## 0. 七牛云能力核对（评审基准）
+
+已验证（官方文档 [文本审核 API](https://developer.qiniu.com/censor/api/7260/api-text-censor)）：
+
+| 项 | 事实 |
+|---|---|
+| 端点 | `POST https://ai.qiniuapi.com/v3/text/censor`（代码 `qiniu.go:85` 一致） |
+| 审核场景 | 仅 `antispam` 一种 |
+| 返回 label | `normal` / `spam` / `ad` / `politics` / `terrorism` / **`abuse`（辱骂）** / `porn` / `flood` / `contraband` / `meaningless` |
+| 管控建议 | `result.suggestion`：`block` / `review` / `pass`，并带 `score` |
+| 限制 | 文本长度 ≤ 2000 字；**不支持白名单**，自定义拉黑词库需提交工单 |
+
+已验证（[七牛 AI 大模型推理](https://developer.qiniu.com/aitokenapi/13379/real-time-ai-interface-api)）：
+
+- 提供 MaaS 推理端点 `https://api.qiniuapi.com/v1` → 实为 **`https://api.qnaigc.com/v1`**
+- 兼容 OpenAI `/v1/chat/completions`、Anthropic `/v1/messages`、支持流式
+- 50+ 模型（DeepSeek / Qwen / Kimi / GLM 等）
+- 使用**独立的 API Key**，与七牛对象存储 AK/SK 不是同一套凭证
+
+代码内已验证的现状（`/internal/security/censor/qiniu.go`）：
+
+```go
+func (r *QiniuTextCensorResponse) IsPass() bool {
+    for _, detail := range r.Result.Scenes.Antispam.Details {
+        blockedLabels := []string{"politics", "terrorism", "porn"}   // ← 只有 3 类
+        if lo.Contains(blockedLabels, detail.Label) { return false }
+    }
+    return r.Result.Scenes.Antispam.Suggestion != "block" // ← review 放行
+}
+```
+
+**关键发现：`abuse`（辱骂）不在硬拦名单内，且 `review` 一律放行** —— 辱骂类内容现在基本是放行的。
+
+> ⚠️ 推测待实测：`abuse` 在七牛返回的是 `review` 而非 `block`。建议直接抽样 `censor_logs.raw_response` 里 `label=abuse` 的记录验证（零成本，不需要额外调接口）。
+
+**另一条已验证的好消息**：`censor.go:50-53` 命中缓存后会用 `QiniuTextCensorParser(raw)` **重新计算** `Pass`（缓存只省 API 调用费，不锁死判定结果）。所以后续若收紧 `IsPass()` 逻辑，**不需要清理 31 天缓存**。
+
+---
+
+## 1. 总体结论
+
+**方案可行，但按现在的描述直接落地会有 4 个 P0 问题（SSRF、Key 明文、成本被刷、邮件轰炸）。**
+
+更重要的一点判断：**方案里"系统内置的若干种屏蔽判定类型"，大部分根本不需要 LLM。**
+
+七牛已经按 `antispam` 场景返回 9 类 label + score，且代码里已经拿到这些数据只是没用上。合理分层是：
+
+| 层级 | 手段 | 成本 | 覆盖 |
+|---|---|---|---|
+| L1（应先做） | 收紧七牛 `IsPass()`：`abuse` + score 阈值 | **0 元，0 延迟** | 辱骂、垃圾、广告、灌水、违禁 |
+| L2（补充） | 本地负面情绪词库打分 | 0 元 | 七牛不覆盖的语气/情绪词 |
+| L3（本方案） | LLM 语义判定 | 钱 + 延迟 | 阴阳怪气、暗示、语境依赖的恶意 |
+
+**建议：L3 只承担 L1/L2 覆盖不到的部分**，否则你在用最贵、最慢、最不确定的手段去解决已经有确定性解的问题。
+
+---
+
+## 2. 数据流与调用时序
+
+### 2.1 现状（已验证）
+
+`route/question/page.go` 的 `New()` 是**全同步**链路，任一环节返回即终止：
+
+```
+长度校验 → 验证码 → 同IP重复拦截 → 屏蔽词 → 七牛审核(10s超时) → 入库 → 邮件通知(goroutine)
+                                                    ↓ 失败
+                                            fail-closed 拒绝发布
+```
+
+现状里唯一的异步是 `shared.SafeGo`（`internal/shared/goutil.go`）——**裸 goroutine，无重试、无持久化、进程重启即丢失**，项目里没有队列/Worker，Redis 只用于 session 与 cache。
+
+### 2.2 拟议方案插在哪里
+
+按方案 3「命中时在前端提示提问者」，LLM 判定**必须同步阻塞**在入库之前：
+
+```
+... → 屏蔽词 → 七牛审核 → 【LLM 审核】→ 入库
+                              ├─ 命中   → 前端提示 / 拦截
+                              ├─ 未命中 → 正常入库
+                              └─ 超限/连不上 → 跳过 + 前端异常提示 + 邮件告警 + 正常入库
+```
+
+### 2.3 时序上的问题
+
+| # | 问题 | 级别 | 说明 |
+|---|---|---|---|
+| T1 | **同步阻塞被放大** | 🟠 P1 | 七牛审核约 100–500ms；LLM 判定通常 1–10s（推理模型可达 30s+）。提问提交从"几乎无感"变成明显卡顿 |
+| T2 | **超时预算未定义** | 🟠 P1 | 方案未给超时值。必须独立设 deadline（建议 3–5s），且不能复用请求 ctx（客户端断连会误判为调用失败 → 触发邮件告警） |
+| T3 | **429 与连接失败未区分** | 🟠 P1 | 429（配额耗尽）应当立即熔断，不要再每次都等满超时；连接失败才走告警路径 |
+| T4 | **无结果缓存** | 🟡 P2 | 相同内容重复提交会重复计费。可直接复用 `censor_logs` 已有的 31 天缓存范式 |
+| T5 | **临时性错误无重试** | 🟡 P2 | 一次网络抖动就降级放行，命中率会明显低于预期 |
+
+**改进建议（时序）**
+
+1. 硬超时 3–5s，用独立 `context.WithTimeout`，**不复用请求 ctx**；
+2. 内置熔断器：连续 N 次失败或收到 429 → 熔断 5–10 分钟，期间直接 fail-open 且**不发邮件**；
+3. 结果按 `hash(userID + 内容)` 缓存，复用 `censor_logs` 的写法；
+4. 若坚持不阻塞体验，可改为**先入库 → 异步判定 → 命中则转"待审/折叠"**，但这就不是方案 3 描述的"前端提示"了，需要你二选一（见 §7）。
+
+---
+
+## 3. 逐条评审
+
+### 3.1 用户自填 API 地址与 Key
+
+**可行，但这是整个方案风险最集中的一条。**
+
+🔴 **P0-1 · SSRF（服务端请求伪造）**
+用户填的地址由**你的服务器**发起请求。攻击者注册账号后填入 `http://127.0.0.1:6379`、`http://169.254.169.254/latest/meta-data/`、内网段地址，即可：
+- 探测内网拓扑与端口存活
+- 打云厂商 metadata 拿临时凭证
+- 1C1G 机器上 Redis(6379) / Postgres(5432) 通常与 Web 同机
+
+而且**方案 4 的"保存前连通性测试"本身就是一个开箱即用的内网探测入口**——不需要任何绕过技巧，填个地址点保存就能看到响应差异。
+
+必须的防护（缺一不可）：
+- 仅允许 `https`（例外：显式允许 `http://localhost` 供自建模型调试，且需独立开关）
+- 解析 DNS 后**逐个 IP 校验**，拒绝 loopback / link-local(169.254/16) / private(10/8, 172.16/12, 192.168/16) / IPv6 ULA
+- **禁用 HTTP 重定向跟随**（否则 302 到内网即可绕过上面的校验）
+- 建议在 `internal/shared/multidial.go` 已有自定义 Dialer 的基础上实现，统一在 dial 层拦截
+
+🔴 **P0-2 · Key 存储安全**
+- 已验证：全项目**没有任何 at-rest 加密**（grep `aes` / `Encrypt(` / `secretbox` 无结果）
+- `users` 表单表存储，新增列即明文落库；DB/备份/导出 CSV 泄露 = Key 全泄露
+- 建议：派生密钥加密存储（不要直接用 `conf.Server.Salt`，用 HKDF 派生独立子密钥）；后台**只回显掩码**（`sk-...abcd`）；**永不写日志**（现有代码有把完整响应写日志的习惯，需确认 LLM 请求体不会被 logrus 打出来）
+
+🟠 **P1 · 协议兼容性未定义**
+"API 地址"是任意 OpenAI 兼容地址，还是固定七牛 `https://api.qnaigc.com/v1`？若允许任意地址，则：
+- 需约定必须 OpenAI 兼容（否则无法解析）
+- 模型名由用户填还是系统固定？不同模型对 JSON 输出的遵循度差异极大
+- 建议：**内置预设 + 允许自定义**，预设直接给七牛官方端点，用户只填 Key 和选模型（顺带消掉 SSRF 面）
+
+### 3.2 内置判定类型，用户只能勾选
+
+**方向正确。** 但强烈建议：
+
+- **类型优先映射到七牛 label**（`abuse` / `spam` / `ad` / `flood` / `contraband` …），这部分走 L1，零成本、确定性、无延迟
+- LLM 类型只保留七牛覆盖不到的少数几种（如「阴阳怪气 / 恶意暗示」「情绪宣泄 / 人身攻击」）
+- 类型定义要写死在 Go 常量 + i18n key 里，与现有 `ForbiddenType`（`internal/security/censor/text.go:16`）保持同一种风格
+
+🟡 注意：判定类型与界面语言是 4 种（zh-CN / zh-TW / en / ja），提示词里的类型描述要用提问箱主人设置的语言，但**被审核的提问文本可能是任意语言**，prompt 需显式要求"按原文语言判断"。
+
+### 3.3 命中时在前端提示提问者
+
+🟠 **P1 · 提示会泄露规则，可被枚举探测**
+若提示写成"你的提问包含辱骂内容"，攻击者就能用二分法逐词试探出完整判定规则，进而绕过。
+现有屏蔽词的提示（`question.errBlockWords`）只说"包含屏蔽词"、不说是哪个 —— **LLM 提示应对齐这个粒度**，不暴露具体类型。
+
+🟠 **P1 · 误判兜底（最重要的一条）**
+LLM 判定是非确定性的：同一段文本两次调用可能给出不同结果。如果"命中 = 拒绝提交"，那么**误判导致的提问丢失是不可逆的**——提问者写了一大段，被吞了，且不知道为什么。
+
+建议三选一（按推荐度排序）：
+1. **命中 → 提示 + 仍允许提交**，但给箱主打 ⚠️ 标记并默认折叠（推荐：零丢失，箱主有最终处置权）
+2. 命中 → 提示 + 要求二次确认后提交（保留"冷静期"效果，又不丢内容）
+3. 命中 → 硬拦（不推荐，除非你接受误判成本）
+
+另需注意：**提示文案走 i18n**，4 种语言各一份（现有 `admin.*` / `question.*` key 的写法）。
+
+### 3.4 保存前连通性与鉴权测试
+
+**可行，但是 SSRF 的头号入口（见 P0-1）。** 补充：
+
+- 测试请求本身也要有超时（≤5s）与 SSRF 校验
+- 建议用**最小 chat 请求**（`max_tokens=1`）而不是 `/v1/models`：部分 Key 只有推理权限没有列举模型权限，用 `/v1/models` 会误判为鉴权失败
+- 测试通过 ≠ 长期可用：Key 可能随时被吊销/欠费。**保存时通过只是准入条件，运行期的熔断与告警才是主力**
+- 保存动作必须防重放：测试是服务端发起的外网请求，需加频率限制（否则可被用来打第三方 / 放大攻击）
+
+### 3.5 失败降级：前端提示 + 邮件告警 + 跳过审核正常提交
+
+🟠 **P1 · fail-open 之后没有补审**
+"跳过 LLM 审核并正常提交"意味着降级窗口内恶意内容**照常入库且无人复查**。而攻击者完全可以**主动制造失败**（刷到 Key 超限 / 打满你的连接），把系统稳定地压在降级态。
+
+建议：降级期间入库的提问标记为 `llm_review = 'skipped'`，后台提供"补审"入口（复用 `cmd/censor.go` 已有的批量补审范式），否则降级态就是永久免审。
+
+🔴 **P0-3 · 成本被刷（用户 Key 直接经济损失）**
+Key 是**用户自己的钱**。提问入口匿名开放，攻击者可对某个启用了 LLM 的箱主持续提问，一夜烧光配额：
+- 必须有**每箱主每日调用上限**（超上限即 fail-open，不再调用）
+- 复用 `internal/route/ratelimit.go` 已有的内存滑动窗口限流器做**单 IP 限流**
+- 超限后应**自动停用**该箱主的 LLM 审核并通知箱主，而不是静默继续烧钱
+
+🔴 **P0-4 · 邮件轰炸 → SMTP 账号被封**
+"调用失败就发邮件"在攻击场景下 = **每条提问一封邮件**。攻击者刷 1000 条提问，你的发信账号会被标记为垃圾邮件发送者甚至直接封号，**影响的是全站所有邮件（含找回密码）**。
+
+必须的节流：
+- 按 **箱主 + 时间窗聚合**（建议 10 分钟最多 1 封），窗口内汇总次数
+- 收敛粒度建议按**错误类别**（连接失败 / 超时 / 429 / 鉴权失败）分别计数，而不是每次都发
+- 触发熔断后**停止发信**，只在恢复时发一封汇总
+- 告警收件人建议复用 `conf.Security.SecurityAlertEmail` 的模式，并允许箱主选择关闭告警
+
+---
+
+## 4. 失败降级策略 · 建议矩阵
+
+| 失败类型 | 是否跳过审核 | 是否提示提问者 | 是否发邮件 | 是否熔断 |
+|---|---|---|---|---|
+| 超时 | 跳过 | 否（静默） | 窗口内聚合 | 连续 N 次 → 熔断 |
+| 连接失败 | 跳过 | 否（静默） | 窗口内聚合 | 是 |
+| 429 / 配额耗尽 | 跳过 | 否 | 是（1 次） | 是（较长） |
+| 401 / 403 鉴权失败 | 跳过 | 否 | 是（1 次） | **自动停用该功能** |
+| 响应解析失败 | 跳过（视为未命中） | 否 | 窗口内聚合 | 连续 N 次 → 熔断 |
+| 达到日调用上限 | 跳过 | 否 | 是（1 次） | 是（到次日） |
+
+> 原则：**提问者侧永远不要暴露"审核系统坏了"**——否则等于告诉对方"现在可以随便发"。
+
+---
+
+## 5. 风险清单
+
+| ID | 级别 | 问题 | 处置 |
+|---|---|---|---|
+| P0-1 | 🔴 | 用户自填 API 地址导致 SSRF，连通性测试即探测入口 | 协议白名单 + DNS 解析后逐 IP 校验 + 禁用重定向 |
+| P0-2 | 🔴 | Key 明文落库、无 at-rest 加密、可能回显/入日志 | 派生密钥加密 + 后台掩码 + 禁用请求体日志 |
+| P0-3 | 🔴 | 用户 Key 被刷造成直接经济损失 | 每日调用上限 + 单 IP 限流 + 超限自动停用 |
+| P0-4 | 🔴 | 失败即发信 → 邮件轰炸 → SMTP 封号 | 箱主+时间窗聚合 + 熔断后停发 + 允许关闭告警 |
+| P1-1 | 🟠 | 同步阻塞放大（1–10s+），超时预算未定义 | 独立 3–5s deadline，不复用请求 ctx |
+| P1-2 | 🟠 | 误判导致提问不可逆丢失 | 改"提示 + 标记折叠"或"二次确认"，不要硬拦 |
+| P1-3 | 🟠 | 提示文案泄露判定规则，可被枚举绕过 | 提示不暴露具体类型，对齐现有屏蔽词语气 |
+| P1-4 | 🟠 | fail-open 后无补审，攻击者可主动维持降级态 | 标记 `skipped` + 后台补审入口 |
+| P1-5 | 🟠 | LLM 输出解析不可靠（中文自由文本） | 强制 JSON 输出（`response_format`），严格 schema 校验，解析失败视为未命中 |
+| P2-1 | 🟡 | 无结果缓存，重复内容重复计费 | 复用 `censor_logs` 31 天缓存范式 |
+| P2-2 | 🟡 | 临时错误无重试 | 1 次快速重试（仅对连接类错误） |
+| P2-3 | 🟡 | 提问内容出网给第三方 LLM（匿名提问的隐私） | 设置页明确告知 + 默认关闭 |
+| P2-4 | 🟡 | 七牛文本上限 2000 字；`AnswerContentLen` 默认即 2000（边界） | 站长若调高超 2000，七牛会拒 → fail-closed 拒绝发布。需加前置截断或上限校验 |
+| P2-5 | 🟡 | 无调用审计（谁、何时、花多少） | 建议记录调用量/耗时/结果，供箱主自查 |
+
+---
+
+## 6. 成本与限额
+
+| 维度 | 建议 |
+|---|---|
+| 调用时机 | 只对**提问**调用，不要覆盖回答 / 追问 / 私聊（成本与延迟都会失控） |
+| 单箱主日上限 | 建议默认 100–300 次/天，可在 `[limits]` 配置，超限 fail-open + 通知箱主 |
+| 单 IP 限流 | 复用 `internal/route/ratelimit.go`，建议 5–10 次/分钟 |
+| 输入长度 | 截断到提问上限（`QuestionContentLen`，默认 1000 字符），避免超长文本爆 token |
+| 模型 | 审核是分类任务，用小模型即可（成本差一个数量级）；不要上推理模型 |
+| 输出 | `max_tokens` 压到最小（如 64），只回 JSON |
+| 缓存 | 相同内容 31 天内不重复调用 |
+| 免费额度 | 七牛 AI 推理对新用户有免费 token，可作为内置预设的冷启动优势 |
+
+---
+
+## 6.5 修订：撤回 L1 建议（用户实测反馈后追加）
+
+> 2026-09-10 追加。用户反馈：**七牛对「辱骂」的判定过于严格，正常对话经常被误伤。**
+
+这条反馈直接推翻了本文档 §1 的 L1 建议（"收紧 `IsPass()`，把 `abuse` 纳入硬拦"）——**该建议予以撤回**，照做只会放大误伤。
+
+配合代码复核，误伤的真实成因有两个，且都是**硬拦语义**造成的：
+
+| 成因 | 代码位置 | 现状 |
+|---|---|---|
+| 七牛把正常内容判为 `abuse` 且 `suggestion=block` | `qiniu.go:55-68` → `!Pass` → 拒绝 | 提问/私聊**直接发不出去**，用户只看到"内容安全检查不通过 [辱骂]" |
+| 审核服务不可用/超时 | `page.go:574`、`chat_handler.go:258` → `err != nil` → **fail-closed 拒绝** | 七牛抖动期间所有提问与私聊一律失败 |
+
+第二个成因尤其容易被忽略：**这不是"判得准不准"的问题，是审核服务一抖全站就发不出内容。**
+
+### 关键约束（七牛官方已确认）
+
+文本审核**不支持白名单**，自定义拉黑词库需**提交工单**处理 —— 也就是说：
+
+**我们既不能让七牛判得更准，也不能让它判得更松，唯一能控制的是"命中之后怎么办"。**
+
+### 修订后的设计原则
+
+**显式规则硬拦，算法推断只标记。**
+
+| 判定来源 | 处置 | 理由 |
+|---|---|---|
+| 箱主自定义屏蔽词 | **硬拦** | 用户显式指定，知道自己拦的是什么，误伤自负 |
+| 算法判定 `politics` / `terrorism` / `porn` | **硬拦** | 合规底线，不能软 |
+| 算法判定 `abuse` / `spam` / `ad` / `flood` / `contraband` / `meaningless` | **只打 ⚠️ 标记，照常送达** | 误报率高，误伤不可逆，把决定权交回箱主 |
+| 审核服务不可用 | **fail-open + 标记待审** | 避免服务抖动导致全站发不出内容 |
+
+### 落地形态
+
+- `questions` / `messages` 各加一个标记列（GORM `AutoMigrate` 自动加列，无需手写迁移）
+- 箱主后台：⚠️ 角标 + 默认折叠 + 可筛选 + 一键"忽略/删除"
+- 设置页新增「审核严格度」三档，把权衡交还给用户：
+  - **严格**：维持现状（不过即拒）
+  - **宽松（建议默认）**：仅高危三类硬拦，其余标记
+  - **仅标记**：全部不拒，只标记
+- 阈值自建：不采信七牛 `suggestion`，改用已有的 `detail.Score` + 可配阈值（默认偏高，如 0.9）
+- 容错：短文本可跳过判定；箱主"这不是辱骂"反馈计数，用于后续调阈值
+
+### 这条路线顺带消掉的风险
+
+零延迟、零外部依赖 → **SSRF、Key 明文、Key 被刷、邮件轰炸四个 P0 全部不再存在**，也无需引入队列或加密主密钥。
+
+---
+
+## 7. 需要你确认的点
+
+1. **命中后的语义**：是「①仅提示 + 仍提交（打标记折叠）」/「②提示 + 二次确认后提交」/「③硬拦拒绝」？
+   —— 我的建议是 ①，理由见 §3.3。
+2. **是否接受同步阻塞**？若不接受，方案 3「前端提示提问者」就要改成异步 + 待审队列（需要新增队列能力，项目现在没有）。
+3. **API 地址范围**：固定七牛 `https://api.qnaigc.com/v1`（消灭 SSRF 面）/ 还是允许任意 OpenAI 兼容地址？
+4. **模型名**：系统固定一个小模型，还是用户自填？
+5. **Key 加密**：是否接受引入 at-rest 加密（需要一个主密钥，放 `[server]` 段）？还是先明文 + `json:"-"` + 掩码回显，后续再补？
+6. **告警收件人**：复用 `conf.Security.SecurityAlertEmail`，还是发给箱主本人（`users.email`），还是两者都发？
+7. **调用范围**：只审提问，还是也要审回答 / 追问 / 私聊？
+8. **是否先做 L1/L2**：我建议先收紧七牛 `IsPass()`（把 `abuse` 纳入 + score 阈值），这条零成本、零延迟，可能就解决了你 80% 的诉求，之后再决定 LLM 要不要上。要不要我先出这部分的变更清单？
diff --git a/outputs/p0-p1-fixes-2026-09-01.md b/outputs/p0-p1-fixes-2026-09-01.md
new file mode 100644
index 0000000..094b933
--- /dev/null
+++ b/outputs/p0-p1-fixes-2026-09-01.md
@@ -0,0 +1,77 @@
+# TamaBox-v4 P0/P1 修复报告（2026-09-01）
+
+第三轮审计的全部 P0×2 + P1×6 已修复，并在验证过程中额外发现并修复了一处
+被 webp 屏障遮蔽的**隐藏编译回归**（见「额外发现」）。全模块构建/vet/测试全绿。
+
+## 🔴 P0 修复
+
+### P0-1 profile.go 导出函数编译错误
+- `route/user/profile.go`：`personalData` 是 `[][]interface{}`，原代码把 `interface{}` 直接传给
+  `sanitizeCell(string)` 导致编译失败。
+- 改为逐单元格类型断言：字符串净化防公式注入，非字符串（`time.Time` 等）原样写入。
+
+### P0-2 history-template 复合游标未同步（翻页损坏）
+- 采用更彻底的方案：`route/question/page.go` 的 `ListAPI` 响应改为
+  `{data: [...], next_cursor: "..."}`，由**服务端直接下发** `EncodePinCursor` 编码的复合游标。
+- 前端 JS 不再用 `new Date().getTime()*1e6` 自行拼游标——JS 双精度浮点无法精确表示纳秒级
+  UnixNano（毫秒以下精度丢失），时间戳相同的提问会在翻页边界被跳过。
+- JS 层已适配 `ctx.JSON` 的统一包装 `{code, data, message}`（内层才是分页负载）。
+
+## 🟠 P1 修复
+
+### P1-1 upload_images.go 级联删除查询不存在的列
+- `DeleteByQuestionID` 重写：先查 `upload_image_questions` 关联行拿 imageID，
+  再事务内软删 `UploadImage` 主体并删除关联行（原代码直接在错误表上 `WHERE question_id`）。
+
+### P1-2 conversation.go 重复删除二次回退配额
+- `MarkDeletedByOwner` 增加幂等守卫：`conv.IsDeletedByOwner == true` 直接返回，
+  不再重复 `IncrementQuota(-1)`。
+
+### P1-3 questions.go 非 PinFirst 游标 PG 报错 + ASC 方向反
+- 游标改用 `strconv.ParseUint` 校验（原 `id < ?` 传 string，PG 下 `integer < text` 无操作符）。
+- 排序方向规范化提前，ASC 用 `id > ?`、DESC 用 `id < ?`；解析失败忽略游标（与 PinFirst 一致）。
+
+### P1-4 home.html 供应链 XSS
+- 远程公告改 `x-text` 纯文本渲染，移除 `x-html`；meta 行与正文拆成两个元素分别渲染。
+
+### P1-5 tracing span 泄露 query string
+- span 名从 `RequestURI` 改为 `URL.Path`，`?t=<token>`、`?code=` 等不再落入 trace。
+
+### P1-6 password.go（第一轮遗留项）
+- legacy HMAC-SHA1 比较改用 `crypto/subtle.ConstantTimeCompare`（常量时间，防时序侧信道）。
+- `encodePasswordBcrypt` 失败不再静默降级为 HMAC-SHA1 弱哈希：密码超 72 字节按 bcrypt
+  原生语义截断；bcrypt 生成失败记日志并返回空串（账号校验失败比弱哈希安全，且
+  `users.go:390` 的 `newHash != ""` 守卫保证空串不会被写库）。
+
+## ⚠️ 额外发现：internal/route 隐藏编译回归（P0 级）
+
+P1-8 批次（autoban 重构）引入、一直被 webp 屏障遮蔽的编译错误，本次通过
+`go build -overlay` 全模块类型检查暴露：
+
+- `internal/route/route.go`：使用 `autoban` / `mail` / `shared` 三个标识符但缺少 import；
+- `internal/route/autoban.go`：`autoban.Autoban` 类型不存在，应为 `autoban.Banner`。
+
+**若不修复，Linux 上的完整构建同样会失败。** 两处已修复。
+
+## 验证方式（重要）
+
+Windows 沙箱缺 libwebp，`internal/storage` 及其依赖包无法正常编译，导致其中的类型错误
+（P0-1、internal/route 回归）在常规 `go build` 下被遮蔽。本次引入 **overlay 桩验证法**：
+
+- `dev/webpstub/`：chai2010/webp 的签名兼容桩（仅 `Encode`/`Options`），保留在仓库供复用；
+- `go build -overlay=<临时 overlay.json> ./route/... ./internal/... .` 将
+  `internal/storage/s3.go` 的 import 临时替换为桩包，实现全模块完整类型检查。
+
+验证结果：
+- 全模块 `go build`（overlay）✅
+- 全模块 `go vet`（overlay）✅
+- 全部可运行测试通过（templates/form/i18n/cache/autoban/censor 等，`go test` sweep）✅
+  - 含 `TestTemplatesParse` / `TestRenderPublicQuestionList` / `TestRenderPublicQuestionItem` /
+    `TestRenderUserQuestionList` / `TestTemplateCrossReferences`
+- `internal/db` 测试需 `DB_TYPE` 环境变量 + 真实数据库，属既有环境限制，非回归。
+
+## 待办提醒
+
+1. **Linux/CI 环境跑一次 `go build ./...` + `go test ./...` 最终确认**（overlay 桩只覆盖类型检查，
+   webp CGO 真实编译仍需 libwebp 环境）。
+2. P2 9 项（mail header、上传后缀白名单、孤儿文件、dbutil pageSize 上限等）尚未处理。
diff --git a/outputs/p1-fixes-2026-08-31.md b/outputs/p1-fixes-2026-08-31.md
new file mode 100644
index 0000000..61160a3
--- /dev/null
+++ b/outputs/p1-fixes-2026-08-31.md
@@ -0,0 +1,51 @@
+# P1 修复落地记录（P1-3 / 4 / 5 / 7 / 8 / 9 / 10）
+
+- **日期**：2026-08-31
+- **范围**：按用户要求顺序实施 7 个 P1 项（P1-6 密码比较不在本次范围；P1-3 按要求**不使用 Turnstile/recaptcha**）。
+- **P0-1（IP 伪造）暂缓**，按用户指示留待后续。
+
+## 1. P1-3 验证码限流 + 常量时间比较
+**文件**：`internal/captcha/math.go`、`internal/route/route.go`
+- 答案比对改为 `crypto/subtle.ConstantTimeCompare`，消除时序侧信道。
+- `VerifyOnly`（模态框预校验）累加尝试次数，达到 `maxCaptchaAttempts=5` 即销毁该验证码，防止无限轮询爆破。
+- `GenerateMath` 处理 `rand.Int` 错误（不再忽略）。
+- `/api/captcha/generate`、`/api/captcha/verify` 加上 `rateLimitMiddleware(20, 1m)`。
+- ⚠️ 这是**缓解**而非根治：数学答案仍返回给客户端，脚本理论上可读题。根治依赖 P0-1（IP 信任校验）落地后整体提权。
+
+## 2. P1-4 追问"等主人回复"服务端校验
+**文件**：`internal/db/follow_ups.go`、`route/question/follow_up.go`
+- 新增 `FollowUps.GetLatestByQuestionID`（`Order(created_at DESC) Limit 1`）。
+- `PublishFollowUp` 在计数校验后，取该问题最新一条追问；若其 `Answer == ""` 直接拒绝（不再仅依赖前端 `waitingFollowUpReply` 隐藏表单）。
+
+## 3. P1-5 审核可信域名精确匹配
+**文件**：`internal/security/censor/text.go`
+- `RemoveTrustedURL` 改为边界感知：仅当可信域名后紧跟 `/`、`?`、`#` 或位于字符串结尾时才剥离，避免 `https://github.com.evil.tld` 被误判为 `github.com` 子域而漏审。
+
+## 4. P1-7 删除回退功能配额计数
+**文件**：`internal/db/feature_control.go`、`internal/db/questions.go`、`internal/db/conversation.go`
+- `IncrementQuota` 负 delta 增加 `WHERE quota_count > 0` 守卫，防止计数减到负数。
+- `questions.DeleteByID` 删除提问后回退 `FeatureQuestion` 配额 -1。
+- `conversations.MarkDeletedByOwner` 删除私聊会话后回退 `FeatureChat` 配额 -1（并先取 OwnerID，已删除/不存在时幂等返回）。
+
+## 5. P1-8 自动封禁仅计真正 404
+**文件**：`internal/route/autoban.go`、`internal/route/route.go`
+- `autobanMiddleware` 改为接收共享 `*autoban.Autoban` 实例（由 `New()` 创建一次）。
+- 真正的 404 探测计数移入 `f.NotFound` 处理器单独记录；不再把业务性 `302 → /`（语言切换 / 登出 / 投票不存在 / 黑名单跳转）误判为路径扫描导致误封。
+
+## 6. P1-9 服务反代路径穿越 / query / 超时
+**文件**：`route/service/proxy.go`
+- `forwardPath` 经 `path.Clean` 归一化，`singleJoiningSlash` 安全拼接，杜绝 `../` 越出白名单前缀。
+- 透传原始 `RawQuery`（此前静默丢弃）。
+- 复用带超时的共享 `Transport`（`ResponseHeaderTimeout=15s`、`IdleConnTimeout=30s`），不再每请求新建。
+
+## 7. P1-10 像素追踪路由收紧
+**文件**：`internal/route/route.go`、`internal/context/context.go`、`route/pixel/pixel.go`
+- `/api/v1/pixel/{**}` 由 `f.Any` 改为 `f.Get` + `rateLimitMiddleware(30, 1m)`，仅放行只读 GET，并补限流。
+- `context.go` 去掉对 `/api/v1/pixel/` 的 CSRF 豁免（GET 本不需 CSRF，写方法已被路由层禁止）。
+- `pixel.go`：路径 `path.Clean` 后必须仍在 `/api/` 之下，否则拒绝；响应头仅透传白名单（Content-Type/Length/Encoding/Disposition/Cache-Control/ETag/Expires/Last-Modified/Pragma/Vary），**不透传 Set-Cookie 等**。
+
+## 验证状态
+- ✅ `go build` / `go vet` 全绿（不依赖 storage 的 5 个包）：`internal/captcha`、`internal/security/censor`、`internal/db`、`route/pixel`、`route/service`。
+- ✅ 单元测试通过：`internal/security/censor`、`internal/security/autoban`。
+- ✅ 12 个改动文件 `gofmt -w` 已格式化。
+- ⚠️ `internal/route/route.go`、`internal/route/autoban.go`、`internal/context/context.go`、`route/question/follow_up.go` 因传递依赖 `internal/storage`（`github.com/chai2010/webp` 缺 libwebp，Windows 沙箱 CGO 限制）**无法在此环境完整编译**；已用 `gofmt -e` 确认无语法错误，请在 Linux / 带 libwebp 环境做完整 `go build ./...` 验证。
diff --git a/outputs/p2-fixes-and-p0-alt-2026-09-01.md b/outputs/p2-fixes-and-p0-alt-2026-09-01.md
new file mode 100644
index 0000000..4abc82b
--- /dev/null
+++ b/outputs/p2-fixes-and-p0-alt-2026-09-01.md
@@ -0,0 +1,76 @@
+# TamaBox-v4 — P0 替代方案 + P2 整改（除 P2-4）与复审
+
+- **日期**：2026-09-01
+- **范围**：P0 IP 伪造的「免 CIDR」替代方案落地；P2-1~P2-3、P2-5~P2-14（除 P2-4）全部改进；改动后复审。
+- **方法**：静态走查 + `go build` / `go vet` / `go test`（受 webp CGO 沙箱限制，含 `internal/storage` 的包仅做 `gofmt -e` 语法校验）。
+
+---
+
+## 一、P0 的「免 CIDR」替代方案（你最关心的点）
+
+原报告建议「维护 Cloudflare 全量 CIDR 白名单 + 自右向左剥离跳数」。但正如你指出的：CIDR 列表太大、且 Cloudflare 边缘节点会变动，维护成本高且易遗漏。本次采用 **不依赖任何 CDN CIDR 清单** 的方案：
+
+### 设计核心（`internal/shared/ip.go`）
+1. **优先采用 `CF-Connecting-IP`**（Cloudflare 权威头）。只要源站被 **锁定只接受 Cloudflare 连接**，该头即等于真实客户端 IP，无需任何 IP 白名单。
+2. **`trusted_proxies` 仅用于你自己的基础设施**（如本机 nginx `127.0.0.1`、私有 `10.0.0.0/8` LB），默认空。仅当 TCP 对端命中该小清单时才解析 `X-Forwarded-For` / `X-Real-IP`，且从右向左剥离已知可信跳数后取原始客户端。
+3. **其余情况一律回退到 `RemoteAddr`**，绝不信任客户端自行提供的头。
+
+### 为什么这能根治，且不用 CIDR
+- **关键在部署侧锁定源站**，推荐二选一（都**不需要** CIDR 清单）：
+  - **Cloudflare Tunnel（`cloudflared`）**：源站无任何公网 IP，只与 Cloudflare 建隧道 → 攻击者无法直连源站伪造 `CF-Connecting-IP`。
+  - **Cloudflare Authenticated Origin Pull（mTLS）**：源站 TLS 要求 Cloudflare 客户端证书 → 非 Cloudflare 连接被拒。
+- 二者都让「伪造 `CF-Connecting-IP`」在物理/密码学层面不可行，从而免去了维护庞大 CIDR 的负担。
+
+### 配置变更
+- `conf/static.go`：`Security` 新增 `TrustedProxies string \`ini:"trusted_proxies"\``。
+- `conf/app.sample.ini`：`[security]` 下新增 `trusted_proxies =`（默认空），并改写 `trust_proxy` 注释，明确「开启 trust_proxy 必须配合 Tunnel/mTLS 锁定源站」。
+- `internal/cmd/web.go`：`conf.Init()` 后调用 `shared.InitTrustedProxies()` 解析清单（解析失败则启动报错）。
+
+> 残留风险（已文档化）：若 `trust_proxy=true` 但**源站仍可被直连**（未锁源站），攻击者可自行发 `CF-Connecting-IP` 被信任。生产必须配合上述锁定手段。这是「免 CIDR」方案的必要前提。
+
+---
+
+## 二、P2 整改清单（除 P2-4 外全部完成）
+
+| # | 位置 | 改动 |
+|---|---|---|
+| P2-1 | `route/vote/vote.go:310` | 排序题统计 `json.Unmarshal(s.FormData, &data.Ranking)` → `&data`，修复解析必失败、排名恒为 0 的 bug |
+| P2-2 | `route/vote/vote.go` + `route/user/vote.go` | 抽离 `InvalidateResultsCache(voteID)`；除新提交外，草稿「选项/字段重建」「投票删除」也主动失效结果缓存 |
+| P2-3 | `internal/db/vote_submissions.go` | `DeleteByVoteID` 改为 `Unscoped()` 物理删除；避免软删行残留占据唯一索引导致「统计归零却无法重投」 |
+| P2-5 | `internal/db/questions.go` + `follow_ups.go` + `upload_images.go` | 删除提问时级联软删其 `follow_ups` 与 `upload_images`，消除孤儿记录 |
+| P2-6 | `internal/db/users.go:814` | `CountTodayMessagesFromUser` 改用应用本地时区当日 00:00 边界，替代 DB 的 `CURRENT_DATE`，修正每日私信上限窗口偏移 |
+| P2-7 | `route/user/profile.go` | 导出 XLSX 单元格前置单引号防御公式注入（以 `= + - @ \t \r \n` 开头的内容按纯文本处理） |
+| P2-8 | `internal/db/users.go:244` | 注册 `Create` 遇重复键错误时重新执行 `validate` 返回友好错误（`ErrDuplicateEmail`/`ErrDuplicateDomain`），消除 TOCTOU 暴露底层 DB 错误 |
+| P2-9 | `internal/route/gzip.go` | `Write` 将嗅探到的 `Content-Type` 写回响应头使压缩判定生效；`204/304` 不再附加 `Content-Encoding` |
+| P2-10 | `internal/route/route.go:244` | `/i18n/{lang}` 重定向拦截反斜杠 `\\` 与控制字符，防开放重定向变体 |
+| P2-11 | `internal/route/route.go` | 加 `Strict-Transport-Security`（仅 https 时下发）；`lang` cookie 在 https 下设 `Secure` |
+| P2-12 | `internal/route/chat/chat_handler.go` | `SendMessage` 发送前重新校验 `FeatureStateOf(FeatureChat).Open`，箱主中途关闭私聊即阻止继续发消息 |
+| P2-13 | `internal/db/questions.go` + `route/question/page.go` | 置顶优先分页改用复合键集游标 `(is_pinned, created_at, id)`，消除置顶项与非置顶项 id 交错导致的「加载更多」漏项 |
+| P2-14 | `internal/captcha/math.go` | 已由前次 P1-3 覆盖：`rand.Int` 错误已校验（无新增改动） |
+
+> P2-4（Question.Token 仅 6 位/唯一索引）按你要求**跳过**。
+
+---
+
+## 三、复审验证结果
+
+| 项目 | 结果 |
+|---|---|
+| `go build` 不依赖 storage 的包（`shared/db/captcha/security/censor`） | ✅ 全绿 |
+| `go vet` 同上包 | ✅ 无告警 |
+| `go test ./route/vote/...` | ✅ 通过（覆盖 P2-1 排名聚合、缓存接口一致） |
+| `gofmt -e` 受 webp 影响的编辑文件（`route/user/*`、`route/question/page.go`、`internal/route/*`、`chat_handler.go`） | ✅ 均无语法错误 |
+| `route/vote` 整包 `go build` | ✅ 通过（P2-1/P2-2 改动类型校验通过） |
+
+⚠️ 含 `internal/storage`（webp CGO）的包（`internal/route`、`route/user`、`route/question`、`internal/route/chat`、`cmd/web`）**本沙箱无法完整编译**（既定限制，与改动无关）。这些文件已用 `gofmt -e` 确认无语法错误，需在 **Linux / 带 libwebp** 环境跑一次 `go build ./...` 做最终确认。
+
+### 复审新发现 / 残留项
+- **P2-2 多实例一致性**：本方案让各实例在「新提交 / 改选项 / 删投票」时各自失效自身进程内缓存，但**跨实例**仍依赖 30s TTL 自然过期（进程内 TTL 缓存的固有限制）。若未来做多实例横向扩容，建议将 `resultsCache` 迁到 Redis 共享缓存，方能做到即时全局一致。当前单实例/低并发场景已足够。
+- **P2-5 级联为软删除**：与提问本身的软删除保持一致；对象存储中的实际图片文件未删除（避免误删复用资源），仅清 DB 记录。若需彻底清理文件，应另起异步任务。
+- 其余改动逻辑自洽，未发现引入新的越权 / 竞态 / 注入点。
+
+---
+
+## 四、待你确认/执行的部署动作
+1. **P0 生效前提**：生产环境用 **Cloudflare Tunnel 或 Authenticated Origin Pull** 锁定源站；并在 `app.ini` 设 `trust_proxy = true`、`trusted_proxies` 填入你自己的反代 IP（如 `127.0.0.1`）。
+2. **最终构建**：在带 libwebp 的环境 `go build ./...` 验证全部包。
diff --git a/outputs/pg-cursor-diagnose-v2-nekobox.sql b/outputs/pg-cursor-diagnose-v2-nekobox.sql
new file mode 100644
index 0000000..afdff1e
--- /dev/null
+++ b/outputs/pg-cursor-diagnose-v2-nekobox.sql
@@ -0,0 +1,234 @@
+-- ============================================================================
+-- TamaBox「加载更多重复加载」根因诊断 v2（按生产真实结构定制）
+-- 适用库: schema = nekobox，表 = nekobox.questions / nekobox.users
+--    questions: id numeric, created_at/updated_at/deleted_at timestamp(6) WITHOUT time zone,
+--               user_id bigint, answer text, is_private/is_pinned/is_read boolean NOT NULL
+--    users:     id numeric, domain text, ...
+-- 脚本用途: 用纯 SQL 复刻 ListAPI(FilterAnswered+PrivateStatus=1+PinFirst, 每页20)的
+--           复合键集翻页，判定「DB 层数据自洽性」+「时区解释是否与线上游标一致」。
+-- 覆盖范围: 只读查询 + 会话级临时表，无任何持久写。可放心在生产执行。
+-- 使用: psql/pgAdmin/DBeaver 整段执行；若当前库 schema 不是 nekobox，改开头 SET 一行。
+-- 判读: 见文件末尾说明；跑完把「查询结果 + NOTICE」整体贴回。
+-- ============================================================================
+
+-- ============ 0) 切换 schema（关键：默认 search_path 只有 public，所以之前找不到表） ============
+SET search_path TO nekobox, public;
+SELECT '连接确认' AS step,
+       current_database() AS db,
+       current_schema()    AS effective_schema,   -- 应显示 nekobox
+       current_setting('TimeZone') AS session_tz;
+
+-- ============================================================================
+-- PART A  环境 / 结构 / 目标集合核对
+-- ============================================================================
+SELECT 'PART A: 环境与结构核对' AS step;
+
+-- 1) questions 关键列定义（确认 id 为 numeric、created_at 无时区精度6）
+SELECT column_name, data_type, datetime_precision, is_nullable, column_default
+FROM information_schema.columns
+WHERE table_schema = 'nekobox' AND table_name = 'questions'
+  AND column_name IN ('id','created_at','updated_at','deleted_at','user_id',
+                      'answer','is_private','is_pinned','is_read')
+ORDER BY ordinal_position;
+
+-- 2) user_id 相关索引（确认是否命中 idx_questions_user_private_created 复合索引）
+SELECT indexname, indexdef
+FROM pg_indexes
+WHERE schemaname = 'nekobox' AND tablename = 'questions'
+  AND indexdef ILIKE '%user_id%';
+
+-- 3) aoi 箱主定位 + 集合核对（answered_public_all 应=线上 API 总数，曾为 38）
+SELECT u.id  AS aoi_user_id,
+       u.domain,
+       count(*) FILTER (WHERE q.answer IS NOT NULL AND q.answer <> '' AND q.is_private = false)
+              AS answered_public_all,
+       count(*) FILTER (WHERE q.answer IS NOT NULL AND q.answer <> '' AND q.is_private = false AND q.is_pinned)
+              AS answered_public_pinned,
+       count(*) AS all_questions_rows
+FROM users u
+LEFT JOIN questions q ON q.user_id = u.id AND q.deleted_at IS NULL
+WHERE u.domain = 'aoi'
+GROUP BY u.id, u.domain;
+
+-- 4) 该集合最新 6 条（含被删/私密剔除样本），关键看 created_at 的「墙钟」写法
+--    -> 与线上 API JSON 的 created_at(如 2026-09-05T00:49:38.648502Z) 逐位比对:
+--       若 DB 墙钟==线上 Z 时间文本 => 读写按 UTC 对称(无时区偏移)
+--       若 DB 墙钟比线上 Z 大 8 小时 => 时区偏移实锤(上海墙钟被当 UTC / 反之)
+SELECT q.id,
+       q.is_pinned,
+       q.created_at AS db_wall_clock,   -- 无时区列原值
+       to_char(q.created_at, 'YYYY-MM-DD"T"HH24:MI:SS.US') AS db_wall_text,
+       (extract(epoch FROM q.created_at) * 1000000000)::numeric(30,0) AS nano_if_wall_is_utc,
+       q.answer <> '' AS has_answer,
+       q.is_private   AS is_private,
+       q.deleted_at IS NOT NULL AS is_deleted
+FROM questions q
+WHERE q.user_id = (SELECT id FROM users WHERE domain = 'aoi')
+ORDER BY q.is_pinned DESC, q.created_at DESC, q.id DESC
+LIMIT 6;
+
+-- 5) 是否存在 created_at 完全相同的行（同刻多行若缺 id tiebreaker 会导致翻页跳行/重复）
+SELECT q.created_at, count(*) AS n
+FROM questions q
+WHERE q.user_id = (SELECT id FROM users WHERE domain = 'aoi')
+  AND q.deleted_at IS NULL AND q.answer <> '' AND q.is_private = false
+GROUP BY q.created_at
+HAVING count(*) > 1
+ORDER BY n DESC
+LIMIT 10;
+
+
+-- ============================================================================
+-- PART B  纯 SQL 复刻 ListAPI 复合键集翻页（核心复现，DB 层数据自洽性判定）
+-- 游标锚点直接用 DB 行自身的 created_at(墙钟) 值推进——不经过任何 Go/时区转换，
+-- 专门回答: 「库里的数据 + 墙钟 keyset 排序」本身能否正确翻页、不重不漏。
+-- ============================================================================
+SELECT 'PART B: keyset 翻页复现' AS step;
+
+DROP TABLE IF EXISTS pg_temp.diag_pages;
+
+DO $$
+DECLARE
+    v_uid      numeric;          -- users.id 也是 numeric
+    v_page     int := 0;
+    v_rows     int;
+    v_ids      text;
+    v_prev_ids text := '';
+    v_pin      boolean;          -- 上一页末条锚点
+    v_ts       timestamp;        -- 上一页末条锚点（用 timestamp 变量，避免任何时区换算）
+    v_id       numeric;
+    v_last_pin boolean;
+    v_last_ts  timestamp;
+    v_last_id  numeric;
+    r          record;
+BEGIN
+    SELECT id INTO v_uid FROM users WHERE domain = 'aoi' LIMIT 1;
+    IF v_uid IS NULL THEN
+        RAISE EXCEPTION 'users 中不存在 domain=aoi，请把脚本中的 aoi 换成你的箱 domain';
+    END IF;
+
+    CREATE TEMP TABLE IF NOT EXISTS diag_pages (page_no int, n_rows int, ids text);
+    DELETE FROM diag_pages;
+
+    LOOP
+        v_page := v_page + 1;
+        v_ids  := '';
+        v_rows := 0;
+        v_last_pin := NULL; v_last_ts := NULL; v_last_id := NULL;
+
+        FOR r IN
+            SELECT q.id, q.is_pinned, q.created_at
+            FROM questions q
+            WHERE q.user_id = v_uid
+              AND q.deleted_at IS NULL
+              AND q.answer IS NOT NULL AND q.answer <> ''
+              AND q.is_private = false
+              AND (
+                  CASE
+                      WHEN v_page = 1 THEN TRUE   -- 首页无游标
+                      WHEN v_pin  THEN            -- 锚点在置顶段: 置顶段内更小 + 全部非置顶
+                          (q.is_pinned = true  AND (q.created_at < v_ts OR (q.created_at = v_ts AND q.id < v_id)))
+                          OR q.is_pinned = false
+                      ELSE                        -- 锚点在非置顶段: 非置顶段内更小
+                          q.is_pinned = false AND (q.created_at < v_ts OR (q.created_at = v_ts AND q.id < v_id))
+                  END
+              )
+            ORDER BY q.is_pinned DESC, q.created_at DESC, q.id DESC
+            LIMIT 20
+        LOOP
+            v_rows := v_rows + 1;
+            v_ids  := v_ids || r.id::text || ',';
+            v_last_pin := r.is_pinned;
+            v_last_ts  := r.created_at;
+            v_last_id  := r.id;
+        END LOOP;
+
+        IF v_rows = 0 THEN
+            RAISE NOTICE '第 % 页: 0 行 -> 翻页正常结束（空页，等价 has_more=false）', v_page;
+            EXIT;
+        END IF;
+
+        v_ids := left(v_ids, -1);
+        INSERT INTO diag_pages VALUES (v_page, v_rows, v_ids);
+        RAISE NOTICE '第 % 页: % 行  ids=[%]', v_page, v_rows, v_ids;
+
+        IF v_ids = v_prev_ids THEN
+            RAISE NOTICE '!!! 异常: 第 % 页与第 % 页完全重复，游标未前进（正是线上 bug 症状）', v_page, v_page - 1;
+            EXIT;
+        END IF;
+        v_prev_ids := v_ids;
+
+        IF v_rows < 20 THEN
+            RAISE NOTICE '本页不足 20 行 -> 已到末页（等价 has_more=false），翻页完成';
+            EXIT;
+        END IF;
+        IF v_page >= 30 THEN
+            RAISE NOTICE '!!! 异常: 已达 30 页上限仍未收敛，疑似死循环';
+            EXIT;
+        END IF;
+
+        v_pin := v_last_pin;
+        v_ts  := v_last_ts;
+        v_id  := v_last_id;
+    END LOOP;
+
+    RAISE NOTICE '--- 汇总: 共 % 页 ---', (SELECT count(*) FROM diag_pages);
+END $$;
+
+-- 表格形式再输出一次（NOTICE 显示不全时看这里）
+SELECT page_no, n_rows, ids FROM diag_pages ORDER BY page_no;
+
+-- 跨页重复检测: 无重复时只返回上面提示
+SELECT '跨页重复检测: 若下方无第二张表结果则无重复' AS check_msg;
+SELECT unnest(string_to_array(ids, ','))::numeric AS duplicated_question_id
+FROM diag_pages
+GROUP BY 1
+HAVING count(*) > 1;
+
+
+-- ============================================================================
+-- PART C  时区/游标指纹核对 —— 区分「部署版本旧」vs「无时区列+时区解释错位」
+-- 线上游标形如 0.1788566476678885000.3089（= pin=0, nano=1788566476678885000, id=3089）
+-- 判读: 下面第 1 条若能精确命中 DB 行(3089) => 服务端按「DB墙钟==UTC」生成游标，
+--       与库值一致 => 无时区错位，问题指向部署版本/API 层；
+--       若命中不了 => nano 与实际库值对不上，时区解释有偏差。
+-- 用法: 把 nano 数字换成你线上抓到的 next_cursor 中间段；id 换成对应行。
+-- ============================================================================
+SELECT 'PART C: 时区/游标指纹核对' AS step;
+
+-- 1) nano 反向推导: 假定「墙钟==UTC」得到的 timestamp，是否正好等于 DB 中 3089 行的 created_at？
+WITH c(nano) AS (VALUES (1788566476678885000::numeric))  -- <-- 替换为线上 next_cursor 中间段
+SELECT c.nano,
+       (to_timestamp(c.nano / 1000000000.0) AT TIME ZONE 'UTC')::timestamp(6) AS derived_ts_if_wall_is_utc,
+       (SELECT q.created_at FROM questions q WHERE q.id = 3089)                AS actual_db_ts_of_id_3089,
+       ((to_timestamp(c.nano / 1000000000.0) AT TIME ZONE 'UTC')::timestamp(6)
+          = (SELECT q.created_at FROM questions q WHERE q.id = 3089))          AS match_3089
+FROM c;
+
+-- 2) 命中检测（通用版）: nano 推导出的墙钟时刻在库中对应哪些行（正常应含线上游标那行）
+WITH c(nano) AS (VALUES (1788566476678885000::numeric))  -- <-- 同上
+SELECT q.id, q.created_at
+FROM questions q, c
+WHERE q.user_id = (SELECT id FROM users WHERE domain = 'aoi')
+  AND q.deleted_at IS NULL AND q.answer <> '' AND q.is_private = false
+  AND q.created_at = (to_timestamp(c.nano / 1000000000.0) AT TIME ZONE 'UTC')::timestamp(6)
+ORDER BY q.id;
+
+-- 3) 对照: 库中是否存在「把线上 JSON 的 Z 时刻原样解释为墙钟」对应的行
+--    即验证: 应用写库时是否把 UTC 时刻的墙钟数字直接存入无时区列（读写对称、无偏移）
+SELECT q.id, q.created_at
+FROM questions q
+WHERE q.user_id = (SELECT id FROM users WHERE domain = 'aoi')
+  AND q.deleted_at IS NULL AND q.answer <> '' AND q.is_private = false
+  AND q.created_at IN ('2026-09-05 00:49:38.648502', '2026-09-05 00:01:16.678885')  -- <-- 替换为线上首页首尾条的 created_at 文本
+ORDER BY q.created_at DESC, q.id DESC;
+
+
+-- ============================================================================
+-- 判读指引
+-- 1) PART B 第1页 id 应=线上首页20条；第2页应翻出剩余且无重复（DB 层自洽）
+-- 2) PART B 若出现「第N页与第N-1页完全重复」=> 直接用 SQL 在 DB 层复现了 bug -> 数据/排序问题
+-- 3) PART C.1 match_3089=true 且 C.3 能命中 => 读写按 UTC 对称，无时区错位，
+--    DB keyset 正常时问题锁定在【部署版本/API层】；反之 => 无时区列+时区解释错位
+-- 4) PART A.4 直接目视: DB 墙钟 vs 线上 JSON 的 Z 文本，差 8 小时即时区偏移实锤
+-- ============================================================================
diff --git a/outputs/pg-cursor-pagination-diagnose.sql b/outputs/pg-cursor-pagination-diagnose.sql
new file mode 100644
index 0000000..47812ea
--- /dev/null
+++ b/outputs/pg-cursor-pagination-diagnose.sql
@@ -0,0 +1,224 @@
+-- ============================================================================
+-- TamaBox「加载更多重复加载」根因排查 SQL（PostgreSQL）
+-- 目标箱: aoi（/api/v1/user/aoi/questions，/_/aoi/3105 底部历史列表同款数据）
+-- 依据: internal/db/questions.go GetByUserID (PinFirst) + route/question/page.go ListAPI
+--       ListAPI 等价条件: user_id=aoi箱 AND answer<>'' AND is_private=false AND deleted_at IS NULL
+--       排序: is_pinned DESC, created_at DESC, id DESC；每页 20 条
+--       游标: "<isPinned>.<createdAtUnixNano>.<id>"（末条编码，下一页取严格更小的行）
+-- 兼容: psql / pgAdmin / DBeaver（避免 psql 专属元命令；NOTICE 各客户端均可看到）
+-- 若提示语法错误 -> 说明当前连接不是 PostgreSQL，请改连 PG 实例
+-- 使用: 按 PART 顺序整段复制执行，把「结果 + NOTICE 消息」原样粘贴回来
+-- ============================================================================
+
+-- ============================================================================
+-- PART A  环境 / 表结构 / 集合核对
+-- 目的: 核对列类型与精度、索引，确认下方 SQL 筛选后条数与线上 API 总数一致
+--       （线上 page_size=99 曾返回 38 条 -> 这里 answered_public_all 应=38，
+--        若不一致说明还有隐藏过滤或连接的不是同一库）
+-- ============================================================================
+
+SELECT 'PART A: 环境与结构核对' AS step;
+
+SELECT current_setting('server_version')          AS server_version,
+       current_setting('TimeZone')                AS session_tz,
+       version()                                  AS full_version;
+
+-- 1) questions 关键列定义（看 created_at 是 timestamptz 还是 timestamp、精度几位）
+SELECT column_name, data_type, datetime_precision, is_nullable, column_default
+FROM information_schema.columns
+WHERE table_name = 'questions'
+  AND column_name IN ('id','created_at','updated_at','deleted_at',
+                      'user_id','answer','is_private','is_pinned','is_read')
+ORDER BY ordinal_position;
+
+-- 2) user_id 相关索引（若只有单列 user_id 索引即可；看是否缺复合索引影响性能，不影响正确性）
+SELECT indexname, indexdef
+FROM pg_indexes
+WHERE tablename = 'questions' AND indexdef ILIKE '%user_id%';
+
+-- 3) 目标集合核对：应=线上 API 总数（曾为 38）
+SELECT u.id                                        AS aoi_user_id,
+       u.domain                                    AS domain,
+       count(*) FILTER (WHERE q.answer <> '' AND q.is_private = false)
+                                                   AS answered_public_all,
+       count(*) FILTER (WHERE q.answer <> '' AND q.is_private = false AND q.is_pinned)
+                                                   AS answered_public_pinned,
+       count(*)                                   AS all_rows_for_user
+FROM users u
+LEFT JOIN questions q ON q.user_id = u.id AND q.deleted_at IS NULL
+WHERE u.domain = 'aoi'
+GROUP BY u.id, u.domain;
+
+-- 4) 该集合最新 5 条：把 created_at 按 UTC 与 UnixNano 打出来，
+--    便于和线上 API JSON / next_cursor（形如 0.1788566476678885000.3089）逐位目视比对
+SELECT q.id,
+       q.is_pinned,
+       q.created_at,
+       to_char(q.created_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US') AS created_at_utc_text,
+       (extract(epoch FROM q.created_at) * 1000000000)::numeric(30,0)        AS created_at_unix_nano
+FROM questions q
+JOIN users u ON u.id = q.user_id AND u.domain = 'aoi'
+WHERE q.answer <> '' AND q.is_private = false AND q.deleted_at IS NULL
+ORDER BY q.is_pinned DESC, q.created_at DESC, q.id DESC
+LIMIT 5;
+
+-- 5) 是否存在 created_at 完全相同的行（同一时间多行时若旧版漏 id tiebreaker 会翻页跳行/重复）
+SELECT q.created_at, count(*) AS n
+FROM questions q
+JOIN users u ON u.id = q.user_id AND u.domain = 'aoi'
+WHERE q.answer <> '' AND q.is_private = false AND q.deleted_at IS NULL
+GROUP BY q.created_at
+HAVING count(*) > 1
+ORDER BY n DESC
+LIMIT 10;
+
+
+-- ============================================================================
+-- PART B  用纯 SQL 完整复刻 ListAPI 的复合键集翻页（核心复现）
+-- 目的: 逐页打印每页的 id 序列。若 DB 层正常: 第1页 20 条、第2页 18 条后结束，
+--       且无任何一行与上一页重复（总 38 条不重不漏）。
+--       若 DB 层有 bug: 会出现重复页 / 跳页 / 死循环（脚本会检测并提前退出）。
+-- 判读:
+--   [DB 层正常]   第1页id集合与线上首页一致，第2页正常翻出剩余 -> 问题在应用层
+--                 （部署版本旧 / GORM 参数转换），与 DB 无关，见 PART C 指纹进一步定位。
+--   [DB 层异常]   某页与上一页完全重复 / 提前空页 / 顺序错乱 -> 问题在数据或库配置，
+--                 把输出贴回即可看到错在哪一页。
+-- ============================================================================
+
+SELECT 'PART B: keyset 翻页复现' AS step;
+
+DROP TABLE IF EXISTS pg_temp.diag_pages;
+
+DO $$
+DECLARE
+    v_uid          bigint;
+    v_page         int := 0;
+    v_rows         int;
+    v_ids          text;
+    v_prev_ids     text := '';
+    v_pin          boolean;          -- 上一页末条 is_pinned（游标锚点）
+    v_ts           timestamptz;      -- 上一页末条 created_at（游标锚点）
+    v_id           bigint;           -- 上一页末条 id（游标锚点）
+    v_last_pin     boolean;
+    v_last_ts      timestamptz;
+    v_last_id      bigint;
+    v_note         text;
+    r              record;
+BEGIN
+    SELECT id INTO v_uid FROM users WHERE domain = 'aoi' LIMIT 1;
+    IF v_uid IS NULL THEN
+        RAISE EXCEPTION 'users 表中不存在 domain=aoi 的用户，请把脚本里的 aoi 换成你的箱 domain';
+    END IF;
+
+    CREATE TEMP TABLE diag_pages (page_no int, n_rows int, ids text);
+
+    LOOP
+        v_page := v_page + 1;
+        v_ids  := '';
+        v_rows := 0;
+        v_last_pin := NULL; v_last_ts := NULL; v_last_id := NULL;
+
+        FOR r IN
+            SELECT q.id, q.is_pinned, q.created_at
+            FROM questions q
+            WHERE q.user_id = v_uid
+              AND q.answer <> ''
+              AND q.is_private = false
+              AND q.deleted_at IS NULL
+              AND (
+                  CASE
+                      WHEN v_page = 1 THEN TRUE   -- 首页无游标
+                      WHEN v_pin  THEN            -- 游标位于置顶段: 置顶段更小 + 全部非置顶
+                          (q.is_pinned = true  AND (q.created_at < v_ts OR (q.created_at = v_ts AND q.id < v_id)))
+                          OR q.is_pinned = false
+                      ELSE                        -- 游标位于非置顶段: 非置顶段内更小
+                          q.is_pinned = false AND (q.created_at < v_ts OR (q.created_at = v_ts AND q.id < v_id))
+                  END
+              )
+            ORDER BY q.is_pinned DESC, q.created_at DESC, q.id DESC
+            LIMIT 20
+        LOOP
+            v_rows := v_rows + 1;
+            v_ids  := v_ids || r.id::text || ',';
+            v_last_pin := r.is_pinned;
+            v_last_ts  := r.created_at;
+            v_last_id  := r.id;
+        END LOOP;
+
+        IF v_rows = 0 THEN
+            RAISE NOTICE '第 % 页: 0 行 -> 翻页正常结束（空页，等价 has_more=false）', v_page;
+            EXIT;
+        END IF;
+
+        v_ids := left(v_ids, -1);
+        INSERT INTO diag_pages VALUES (v_page, v_rows, v_ids);
+        RAISE NOTICE '第 % 页: % 行  ids=[%]', v_page, v_rows, v_ids;
+
+        -- 死循环防护: 本页与上一页逐字相同（key set 未前进）则提前退出并标记异常
+        IF v_ids = v_prev_ids THEN
+            RAISE NOTICE '!!! 异常: 第 % 页与第 % 页内容完全重复，游标未前进（复现线上 bug 的症状）', v_page, v_page - 1;
+            EXIT;
+        END IF;
+        v_prev_ids := v_ids;
+
+        -- 末页判定: 本页不足 20 行 -> 已无下一页（等价 ListAPI 的 has_more=false）
+        IF v_rows < 20 THEN
+            RAISE NOTICE '本页不足 20 行 -> 已到末页（等价 has_more=false），翻页完成';
+            EXIT;
+        END IF;
+
+        IF v_page >= 30 THEN
+            RAISE NOTICE '!!! 异常: 已达 30 页上限仍未收敛，疑似死循环';
+            EXIT;
+        END IF;
+
+        -- 前进游标锚点 = 本页末条
+        v_pin := v_last_pin;
+        v_ts  := v_last_ts;
+        v_id  := v_last_id;
+    END LOOP;
+
+    RAISE NOTICE '--- 汇总: 共 % 页 ---', (SELECT count(*) FROM diag_pages);
+END $$;
+
+-- 同一会话内再以表格形式输出一次（若客户端 NOTICE 显示不全，看这个即可）
+SELECT page_no, n_rows, ids
+FROM pg_temp.diag_pages
+ORDER BY page_no;
+
+-- 重复检测: 跨页是否存在重复 id（正常应为 0 行，无重复时只显示上一条提示）
+SELECT '跨页重复检测: 若下方无第二张表结果则无重复' AS check_msg;
+SELECT unnest(string_to_array(ids, ','))::bigint AS duplicated_question_id
+FROM pg_temp.diag_pages
+GROUP BY 1
+HAVING count(*) > 1;
+
+
+-- ============================================================================
+-- PART C  created_at 精度指纹核对（可选，用于区分「部署版本旧」vs「DB 环境问题」）
+-- 目的: 若线上 next_cursor 里的 UnixNano（如 0.1788566476678885000.3089 中的
+--       1788566476678885000）能在下方查询里精确命中对应 id 的 created_at_unix_nano，
+--       说明 API 下发的游标与 DB 行完全对应 -> 问题几乎锁定在部署版本/API 层。
+--       若命中不了 / 差着末几位 -> 说明 DB 存值与线上 JSON 时间对不上，是库环境问题。
+-- 用法: 把下方 id 列表替换成你想核对的线上行（默认最新几条 + 3089/3105）。
+-- ============================================================================
+
+SELECT 'PART C: created_at 精度指纹' AS step;
+
+SELECT q.id,
+       q.is_pinned,
+       to_char(q.created_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US') AS created_at_utc_text,
+       (extract(epoch FROM q.created_at) * 1000000000)::numeric(30,0)        AS created_at_unix_nano,
+       (extract(epoch FROM q.created_at) * 1000000000)::numeric(30,0) % 1000 AS nano_tail3 -- 应为0: 微秒精度*1000
+FROM questions q
+WHERE q.id IN (3109, 3105, 3089, 3088)   -- 替换成线上首页前几条 id
+ORDER BY q.id DESC;
+
+-- ============================================================================
+-- 判读指引（复制上面的 PART A/B 即可，C 按需）:
+--   1) PART A.3 的 answered_public_all 应与线上 API 总数一致（曾为 38）
+--   2) PART B 第1页应=线上首页20条；第2页应翻出剩余且与第1页无重复 ->
+--      DB 层 keyset 自洽 = 问题在应用层（部署版本/参数转换）
+--   3) 若 PART B 出现「某页与上一页完全相同」= 直接在 DB 层复现了 bug
+--   4) PART C 的 unix_nano 与线上 next_cursor 中间段逐位一致 = 版本/API 层问题
+-- ============================================================================
diff --git a/outputs/prod-tamakyi-snrat-check.png b/outputs/prod-tamakyi-snrat-check.png
new file mode 100644
index 0000000..aa2c759
Binary files /dev/null and b/outputs/prod-tamakyi-snrat-check.png differ
diff --git a/outputs/proxy-image-timeout-2026-09-02.md b/outputs/proxy-image-timeout-2026-09-02.md
new file mode 100644
index 0000000..4dfe488
--- /dev/null
+++ b/outputs/proxy-image-timeout-2026-09-02.md
@@ -0,0 +1,90 @@
+# proxy-image 回源超时事故处置报告
+
+- **日期**：2026-09-02
+- **影响**：`/proxy-image` 拉取 R2 图片稳定超时 502（后台 `ProxyImage fetch failed`）；分享卡生成存在同根因隐患
+- **状态**：代码侧已修复并全量验证；待服务器部署验证
+
+---
+
+## 一、症状
+
+```
+ERRO[0013] ProxyImage fetch failed  error="Get \"https://r2.337845818.best/tamabox/picture/...\": context deadline exceeded (Client.Timeout exceeded while awaiting headers)"
+2026-09-02 23:51:00 Logger: Completed method=GET path="/proxy-image?url=..." status=502 duration=10.57s
+```
+
+- 同一 URL 每次请求稳定 10.5s 超时（旧 client `Timeout: 10s` + 开销）
+- 用户在浏览器直接访问该 R2 链接正常
+
+## 二、证据链（根因判定过程）
+
+| 证据 | 结论 |
+|---|---|
+| 报错文本 "awaiting headers" | TCP+TLS 已完成、HTTP 已发出，**等不到响应头**（非 DNS/dial/TLS 失败） |
+| `r2.337845818.best` 解析结果 | Cloudflare anycast：104.21.47.52 / 172.67.144.141 + 2 IPv6 → **多边缘 IP** |
+| 本地对照：走 https_proxy 代理 | ✅ 正常响应 |
+| 本地对照：强制直连两个 CF IPv4 | ❌ code=000，TLS 未建立即断 → 裸连 CF 存在劣化边缘 |
+| 服务器 curl 裸连 | ✅ **200 但耗时 6.46s** → 链路"慢而通"，非完全不通 |
+| 服务器 `env \| grep -i proxy` | 无代理 → 排除"程序绕过代理"假设 |
+
+**代码侧根因**（与 curl 的行为差异）：
+1. `route/proxy.go` 旧 `proxyImageDialContext` 解析后**固定拨第一个 IP**——覆盖了标准库的多 IP 容错。anycast 恰好抽中被劣化的边缘 → 稳定等满超时；curl 默认多 IP 尝试所以能成功。
+2. 超时预算过紧：`Timeout: 10s`（curl 成功都要 6.46s）、TLS 5s、读头阶段无独立兜底。
+
+## 三、修复内容
+
+### 1. 共享多 IP 并发拨号（新增）
+`internal/shared/multidial.go` → `DialFirstReachable(ctx, dialer, network, ips, port, maxCandidates)`
+- 对候选 IP **并发拨号取最先成功**（happy-eyeballs 风格）
+- IP 字面量直连、无二次解析 → **DNS rebinding 免疫**（SSRF 防护不降级）
+- 成功路径取消其余拨号、关闭落选连接（防泄漏）；空候选/ctx 取消/截断均有防御
+
+### 2. `/proxy-image`（route/proxy.go）
+| 项 | 旧 | 新 |
+|---|---|---|
+| DialContext | 固定单 IP | `shared.DialFirstReachable`（上限 6 并发） |
+| `Client.Timeout` | 10s | 25s |
+| `TLSHandshakeTimeout` | 5s | 8s |
+| `ResponseHeaderTimeout` | 无 | 8s（兜底"响应头迟到"黑洞） |
+| 超时类错误 | 不重试 | 自动重试一次（`fetchProxyImageWithRetry`） |
+
+### 3. 分享卡生成（route/question/share.go）——排查发现的同根因复发点
+- `shareDialContext` 同款固定单 IP → 改调共享 helper
+- 超时放宽：`Timeout` 10→20s、TLS 5→8s、读头 10→8s（图源同为 R2，宁等勿缺）
+- 全仓 `DialContext` 扫查：**仅上述两处，无第三处同类**
+
+### 4. 测试
+- 新增 `internal/shared/multidial_test.go`（5 项）：坏 IP 在前仍选通 / 全败报错 / ctx 取消即返回 / 空候选 / maxCandidates 截断
+- 原 `route/proxy_test.go` 随实现迁移删除
+
+## 四、验证矩阵
+
+| 项 | 结果 |
+|---|---|
+| gofmt | 无差异 |
+| overlay `go build ./...`（全模块） | exit 0 |
+| `go vet`（route + internal/shared） | 干净 |
+| 全量安全相关测试（12 包：templates/cache/conf/form/i18n/imagecheck/internal-route/autoban/censor/shared/internal-template/route-vote） | 全 PASS |
+| 新增回归测试 | 5/5 PASS |
+
+## 五、部署验证清单（服务器侧）
+
+1. 重新编译部署（Linux 补跑 `go build ./...`，webp/CGO 惯例确认）
+2. 观察日志：`ProxyImage fetch failed` 应消失
+3. 刷新提问箱页：头像/背景图正常出图
+4. 触发一次分享卡生成（任意提问箱分享链接），确认头像/背景/社交图标完整
+5. **判断标准**：链路本身 ~6s 属正常（curl 实测），重点是**不再 10s 稳定超时**
+
+## 六、补充诊断（可选）
+
+服务器 curl 成功也要 6.46s，建议部署后定位慢在哪个阶段：
+
+```bash
+curl -sI --max-time 15 -o /dev/null -w \
+"dns=%{time_namelookup} connect=%{time_connect} tls=%{time_appconnect} total=%{time_total}\n" \
+"https://r2.337845818.best/tamabox/picture/2026/05/13/f95ba0476f90331e190baa65052a03"
+```
+
+- 若 `dns` 占大头 → 服务器 DNS 解析慢（可换公共 DNS / 加 hosts）
+- 若 `tls` 占大头 → Cloudflare 边缘 TLS 劣化（多 IP 并发已缓解，可考虑图源域名走非代理直连评估）
+- 若 `connect` 占大头 → 链路 TCP 劣化
diff --git a/outputs/r2-assets-cdn-audit-2026-09-05.md b/outputs/r2-assets-cdn-audit-2026-09-05.md
new file mode 100644
index 0000000..772bb68
--- /dev/null
+++ b/outputs/r2-assets-cdn-audit-2026-09-05.md
@@ -0,0 +1,115 @@
+# R2 静态资源盘点与国内加速建议（2026-09-05）
+
+> 背景：uikit 已迁移 cdnjs.snrat.com（国内 4-5× 提速）。本次全量盘点仍挂在
+> `r2.337845818.best`（Cloudflare 链路、未接 EdgeOne）的静态资源，逐文件做
+> **官方源 hash 校验 + 国内实测**，给出分类迁移建议。
+
+## 0. 关键结论速览
+
+| # | 结论 | 级别 |
+|---|---|---|
+| 1 | 截图 1100ms 来自 **PageSpeed（海外探测）**，是 CF 链路 + Rocket Loader 的组合；**国内 EdgeOne 路径干净无 rocket-loader**，国内体验不受其影响 | 🔴 认知修正 |
+| 2 | 国内真实瓶颈 = `r2.337845818.best` 本身（CF 国际链路），实测**每个资源 0.72–1.10s**，与"哪个库"无关，是源的问题 | 🔴 |
+| 3 | **公共 CDN ≠ 快**：cdnjs.cloudflare/jsdelivr 国内实测 0.6–1.8s，与 R2 同级；真正快的是 **snrat（cdnjs 国内镜像）0.15–0.42s** | 🟠 关键认知 |
+| 4 | 6 个 JS 库经 sha256 校验 = **纯官方原版**，可安全迁 snrat（2–7.4× 提速） | 🟢 |
+| 5 | waline-no-commits.css / easy.qrcode(remake) / time.box.js / neko-pixel / 图片图标 = **定制或专属文件，无公共源**，只能自托 | 🟡 |
+| 6 | 根治定制文件的唯一途径：**把 R2 静态域名接入 EdgeOne 国内加速**（方案 A），与库迁移可叠加 | 🟡 推荐 |
+
+---
+
+## 1. 全量清单（去重后 17 项，含已注释项）
+
+### A 组：官方库，sha256 与官方完全一致 → 可迁 cdnjs.snrat.com ✅
+
+| 文件 | 大小 | 加载位置 | 加载方式 | 国内实测 R2→snrat | 提速 |
+|---|---|---|---|---|---|
+| `cdn/lib/alpinejs/3.9.0/cdn.min.js` | 38KB | header 全站 | defer | 1.10s → 0.15s | **7.4×** |
+| `cdn/lib/jquery/3.7.1/jquery.min.js` | 88KB | 二维码页（list/not-found） | 按需 | 0.83s → 0.17s | **4.9×** |
+| `cdn/lib/vconsole/3.12.1/vconsole.min.js` | 214KB | header（VConsole 条件） | 同步 | 0.72s → 0.20s | **3.5×** |
+| `cdn/lib/cropperjs/1.6.2/cropper.min.js` | 37KB | 头像裁剪页 | 按需 | 0.81s → 0.22s | **3.6×** |
+| `cdn/lib/dayjs/1.10.8/dayjs.min.js` | 6.5KB | header 全站 | defer | 0.85s → 0.42s | **2.0×** |
+| uikit css/js/icons | — | header 全站 | 已迁 ✅ | — | 4.3–4.9× |
+
+> 校验方式：R2 文件与 snrat/cdnjs/jsdelivr 官方逐一 sha256 比对，全部一致
+> （jquery/dayjs/alpine/cropperjs/vConsole 同 cdnjs 官方发行版；waline.js 同
+> `@waline/client@2.15.8` 官方发行版）。
+
+### B 组：官方原版但公共源国内不优 → 暂留 R2 / 随方案 A
+
+| 文件 | 大小 | 说明 | 判断 |
+|---|---|---|---|
+| `cdn/lib/waline/2.15.8/waline.js` | 164KB | sha256 = 官方原版，但 @waline/client 只发 jsdelivr/unpkg（**无 cdnjs 收录**），jsdelivr 国内实测 ~0.99s > R2 0.79s | 🟡 迁移无收益，暂留 |
+| `cdn/waline/.../waline-no-commits.css` | 19KB | **定制**：193 规则与官方一致，39 条差异全部是把 `.wl-card*`（评论卡片/管理操作/徽章/状态/内容）设 `display:none` —— 即"只留评论区容器、不显示评论列表"的刻意定制，**不可换官方 css** | 🟡 media=print 非阻塞，暂留 |
+
+### C 组：专属/定制文件，无公共源 → 留 R2，等方案 A 🔴
+
+| 文件 | 用途 | 说明 |
+|---|---|---|
+| `cdn/time.box.js` | 全站 defer | 站点专属脚本 |
+| `cdn/js/remake/easy.qrcode.min.js` | 二维码页 | **remake 改造版**，公共 qrcodejs 功能不等价 |
+| `cdn/lib/neko-pixel/0.0.21/{style.css, neko-pixel-app.umd.js}` | IsPixel 页 | npm registry **查无此包**，无公共源 |
+| `tamabox/tamabox_low.png` | logo/favicon/og | 站点资源 |
+| `tamabox/icon/social/*.png` ×5 | 社交图标 | 站点资源 |
+
+### D 组：已注释、未启用（清理候选）
+
+- `cdn/busuanzi.pure.mini.js`（header 注释）— UV/PV 已由 vercount 承担
+- `oss-to-r2/nekobox/.../waline.js` + `waline-no-commits.css`（home.html 注释）
+
+---
+
+## 2. 实测数据
+
+### 国内本机（2026-09-05，3 次全量下载取中位）
+
+| 资源 | R2（CF 链路） | snrat（国内节点） |
+|---|---|---|
+| jquery | 0.83s | **0.17s** |
+| dayjs | 0.85s | **0.42s** |
+| alpinejs | 1.10s | **0.15s** |
+| cropperjs | 0.81s | **0.22s** |
+| vconsole | 0.72s | **0.20s** |
+| waline.js（仅 jsdelivr 可比） | 0.79s | jsdelivr 0.99s ❌ |
+| 专属文件（png/time.box.js） | 0.72–1.10s | 无公共对应 |
+
+> R2 所有资源稳定落在 0.72–1.10s（连接的是 Cloudflare AMS 国际链路）。
+> 对照参考：snrat 上 uikit 全量 263KB 约 0.25s —— 差的不是文件，是源。
+
+### 修正认知
+
+- **Rocket Loader 只影响走 CF 的海外路径**（PageSpeed/GTmetrix/测试域名），
+  国内 EdgeOne 路径的 HTML 实测无 rocket-loader。**国内用户感受到的"慢"
+  主要是 R2 的 CF 国际链路，不是 Rocket Loader。**
+- PageSpeed 分数低的部分原因（海外 1100ms 资源）仍可靠关 Rocket Loader
+  改善海外体验，但对国内数字无影响。
+
+---
+
+## 3. 迁移方案对比
+
+| 方案 | 做法 | 覆盖范围 | 工作量 | 模板改动 | 风险 |
+|---|---|---|---|---|---|
+| **A. R2 接入 EdgeOne**（根治） | r2.337845818.best 走 EdgeOne 国内加速（源站=CF R2 公共端点），沿用 dnspod 境内/境外分流经验 | **全部文件**：A+B+C 组一次解决 | EdgeOne 控制台 + DNS 记录 | 无（域名不变） | 🟢 低，但涉及账号/计费与回源配置 |
+| **B. 库迁 snrat**（对症） | A 组 5 个库 URL 换 cdnjs.snrat.com | 仅官方库 | 每库改 1 处模板 URL | 5 处 | 🟢 极低（sha256 已验证） |
+| A+B 组合（推荐） | 先 B 快速见效，再 A 收尾定制文件 | 全部 | — | 5 处 + 控制台 | 🟢 |
+
+> 方案 A 的核心价值：B/C 组那些"无公共源"的定制文件（no-commits.css、
+> easy.qrcode remake、time.box.js、neko-pixel、图片）在 R2 上每请求 ~0.8s，
+> 只有接国内加速才能根治；逐个找公共源既找不到也不值得。
+> 注：EdgeOne 加速的对象是**静态资源分发**，R2 仍保留在 Cloudflare 作为
+> 源站与海外出口，国内节点回源缓存后 CDN 分发。
+
+---
+
+## 4. 建议落地批次（待批准）
+
+- 🟢 **P1（已做）**：uikit 三件套 → snrat ✅ 已上线测试环境
+- 🟢 **P1-批量 B**：alpine/dayjs（header 全站）→ snrat；jquery/cropperjs/vconsole（按需页）→ snrat，共 5 处 URL
+- 🟠 **P2-方案 A**：r2.337845818.best 接入 EdgeOne 国内加速（需你在 EdgeOne 控制台操作/确认计费；我可以先帮你查 EdgeOne 对 R2 自定义域作源站的官方支持方式）
+- 🟡 **P3**：waline.js/no-commits.css 随方案 A 覆盖；清理 D 组注释残留；PageSpeed 若仍需优化海外分可关 CF Rocket Loader（per-zone）
+
+## 5. 风险与回滚
+
+- 全部 A 组迁移经 sha256 验证 = 官方原版，无内容差异风险；回滚=改回 R2 URL
+- waline-no-commits.css **不可**替换为官方 waline.css（会显示被隐藏的评论区）；若误换，回滚即可
+- 方案 A 若回源/计费踩坑，DNS 一条记录切回原解析即完全回滚
diff --git a/outputs/re-audit-2026-09-01.md b/outputs/re-audit-2026-09-01.md
new file mode 100644
index 0000000..8a3f024
--- /dev/null
+++ b/outputs/re-audit-2026-09-01.md
@@ -0,0 +1,73 @@
+# TamaBox-v4 第三轮审计报告（2026-09-01）
+
+本轮聚焦前两轮未覆盖的区域（上传/存储/邮件/基础设施、模板层）+ 对 8/31~9/1 修复批次做回归复审。
+所有 P0/P1 结论均已逐一核对源码确认，并纠正了子代理的一处误报（见 P1-3 说明）。
+
+## 验证基线
+- `go build`：不依赖 storage 的 14 个包全部通过；`go test`（form/i18n/cache/autoban/censor）全绿。
+- ⚠️ 注意：本轮两个 P0 都藏在 webp 屏障遮住的包里（route/user、route/db），Windows 下编译不到——**务必在 Linux/带 libwebp 环境跑一次 `go build ./...`**，否则下面 P0-1 会直接让部署失败。
+
+---
+
+## 🔴 P0（2 项，均为上一批修复引入的回归）
+
+### P0-1 profile.go:335 — 导出函数无法编译（构建失败）
+`personalData` 是 `[][]interface{}`，`sanitizeCell(row[0])` 把 `interface{}` 传给 `string` 参数 → **编译错误**。webp CGO 屏蔽了本机报错，Linux/Docker 构建同样会失败。
+**修复**：遍历单元格时先做 `s, ok := v.(string)` 类型断言，非字符串（如 `user.CreatedAt` 的 time.Time）跳过净化原样写入。
+
+### P0-2 history-template.html:29 — 复合游标未同步，「加载更多」翻页损坏
+P2-13 把游标改成 `<isPinned>.<createdAtNano>.<id>` 复合格式，但前端 JS 仍回传纯 `data[data.length-1].id` → 服务端 `parsePinCursor` 解析失败 → 游标被忽略 → 每次都返回第一页（内容重复、无法翻页）。
+**修复**：JS 按 `${q.is_pinned?1:0}.${new Date(q.created_at).getTime()*1e6}.${q.id}` 组装游标；或服务端兼容裸 id 格式（解析失败时回退为 id 游标）。
+
+---
+
+## 🟠 P1（6 项）
+
+### P1-1 upload_images.go:167 — 级联删除查询了不存在的列
+`DeleteByQuestionID` 在 `upload_images` 表上执行 `WHERE question_id=?`，但该列实际在关联表 `upload_image_questions`（:54）。PG 报列不存在 → 级联失败（目前仅记日志不阻断删除），**关联记录永久残留**。
+**修复**：改为先 `UploadImageQuestion` 按 question_id 查出 imageID 列表，再软删对应 `UploadImage`（并顺带删 link 行）。
+（纠正误报：子代理称"提问无法删除"，实际 `questions.DeleteByID` 只记日志不返回错误，删除本身仍成功。）
+
+### P1-2 conversation.go:205 — 重复删除导致配额二次回退
+会话删除是标志位软删（`is_deleted_by_owner`），重复 POST 同一删除请求，`First()` 仍命中 → 每次都 `IncrementQuota(-1)`。守卫保证了不为负，但多条会话反复删可把计数错误清零。
+**修复**：`First()` 后若 `conv.IsDeletedByOwner == true` 直接幂等返回。
+
+### P1-3 questions.go:222 — 非 PinFirst 游标路径在 PG 下报错 + ASC 方向错误
+`q.Where("id < ?", cursorStr)` 传 string，PG 中 `integer < text` 无操作符 → 管理后台 `/api/.../questions` 带游标请求 500。且 ASC（sort=oldest）时仍用 `id < ?`，方向相反 → 翻页停在第一页。
+**修复**：`strconv.ParseUint` 校验游标；按 `opts.SortOrder` 选择 `id < ?`（DESC）或 `id > ?`（ASC）。
+
+### P1-4 home.html:8-12 — 远程内容经 `x-html` 无消毒渲染（供应链 XSS）
+首页从外部 API（`api-direct.337845818.best/...importantinfomation.json`）取 `log.content` 后 `x-html` 直出。该域被劫持或 JSON 中混入用户上报内容时，首页即任意 JS 执行。
+**修复**：改 `x-text`（内容纯文本时），或引入 DOMPurify 白名单过滤后再 `x-html`；顺带补上 `class=uk-article-meta` 缺失的引号。
+
+### P1-5 tracing/flamego.go:42 — span 名含 query string，私密 token 落日志
+span 取 `RequestURI`，`?t=<问题token>`、找回密码 `?code=` 等会原样写入 trace；配合 `AlwaysSample` + stdout 全量输出，1C1G 上还是 IO 负担。
+**修复**：span 名只用 `URL.Path`；生产关闭 stdout exporter 或降采样。
+
+### P1-6（遗留提醒）password.go — legacy 密码 `==` 非常量时间比较
+第一轮报告的 P1-6 至今未修（你当时未勾选）。bcrypt 失败静默降级 HMAC 路径同样在。建议尽快处理。
+
+---
+
+## 🟡 P2（择要 9 项）
+
+1. **mail.go:123**：`SetHeader("To", to)` 建议 `SetAddressHeader`（防 header 注入的纵深防御）。
+2. **page.go:664/673**：上传 key 保留用户可控后缀（可为 .svg/.html），建议后缀白名单。
+3. **孤儿文件**：图片上传 S3 成功但 DB 失败仅记日志；删除从不清理 S3 对象 → 存储只增不减。
+4. **conf/db.go:16**：PostgresDsn 密码未转义 + `sslmode=disable` 写死。
+5. **dbutil/pagination.go:19**：`LimitOffset` 无 pageSize 上限，可被超大值打 DB。
+6. **storage/oss.go**：全项目已无调用方（遗留代码），建议删除。
+7. **autoban 双计数**：敏感路径未命中路由时被中间件和 f.NotFound 各计一次 → 封禁提前触发；NotFound 应跳过 IsSensitivePath 命中的路径。
+8. **captcha VerifyOnly**：Attempts 读改写非原子，并发可绕 5 次上限（单会话低风险）。
+9. **questions 删除链路非事务**：级联失败仅记日志可留孤儿，建议包 `Transaction`；另 `sanitizeCSVCell`（vote.go:1194）缺 `\t\r\n` 分支，与 profile.go 净化规则不一致。
+
+---
+
+## ✅ 本轮确认无问题的部分
+- 模板层：41 处 POST 表单 CSRF token 全覆盖；`toJSON`/内联 JS 均经 html/template script-context 转义，无逃逸；Markdown 白名单消毒；探索页 AJAX 分支 escapeHTML 正确。
+- storage/s3.go：LimitReader 8MB + 魔数 + 像素上限 + 随机 key + 重试，凭证不入日志。
+- cache：RWMutex + maxItems + TTL，无泄漏。
+- 回归确认正确：XFF 从右向左剥离、autoban 单实例单次 Next、配额归属（提问→箱主、私聊→OwnerID 一致）、追问服务端校验、proxy 编码绕过防护、pixel GET-only、chat 重校验覆盖全部写路径。
+
+## 建议修复顺序
+P0-1/P0-2（我引入的回归，必修）→ P1-1/P1-2/P1-3（数据一致性）→ P1-4/P1-5 → P1-6 遗留项 → P2 择要。
diff --git a/outputs/security-review-2026-09-02.md b/outputs/security-review-2026-09-02.md
new file mode 100644
index 0000000..89308c2
--- /dev/null
+++ b/outputs/security-review-2026-09-02.md
@@ -0,0 +1,253 @@
+# TamaBox v4 全量代码安全审阅报告
+
+- **审阅日期**：2026-09-02
+- **代码规模**：123 个 Go 文件 / 约 40 个 HTML 模板
+- **技术栈**：Flamego + GORM + PostgreSQL/MySQL + Redis
+- **审阅方式**：静态代码审计（6 个领域并行）+ `go build` / `go vet` / `go test -race` + **真实启动服务做动态渗透验证**
+- **凭据处理**：全程未读取 `conf/app.ini`；服务日志经正则脱敏后才进入分析，配置内容未外传
+
+---
+
+## 一、总体结论
+
+| 项目 | 结果 |
+|---|---|
+| `go build ./...` | ✅ 通过，无错误 |
+| `go vet ./...` | ✅ 完全干净，零告警 |
+| `go test -race ./...` | ✅ **无任何 DATA RACE**（`internal/db` 因缺数据库环境变量失败，非代码缺陷） |
+| 实际运行 | ✅ 成功启动并连接数据库，监听 5877 端口，功能正常 |
+| SQL 注入 | ✅ 未发现 |
+| IDOR / 越权 | ✅ 未发现，归属校验完备 |
+| SSRF | ✅ 防护完备（已实测拦截） |
+| XSS | ✅ 主链路 sanitize 扎实 |
+
+**这是一个安全基线明显高于同类项目的代码库**：bcrypt 密码哈希、登录后重建 session ID、CSRF 全局校验、SSRF fail-closed 白名单 + DNS rebinding 防护、开放重定向多变体防护、限流 + 自动封禁、CSV 公式注入转义、敏感字段 `json:"-"`，这些都做对了。
+
+**未发现可被匿名攻击者直接利用的 P0 漏洞。** 以下为 5 个 P1 与 12 个 P2 项。
+
+---
+
+## 二、P1 问题（重要，建议优先修复）
+
+### 🔴 P1-1　CSRF token 未与用户会话绑定（已动态验证可跨会话复用）
+
+**位置**：`internal/route/route.go:349` 与 `route/auth/login.go:74`
+
+```go
+// route.go:349 —— 未指定 SessionKey
+csrf.Csrfer(csrf.Options{
+    Secret: conf.Server.XSRFKey,
+    Header: "X-CSRF-Token",
+})
+
+// login.go:74 —— 实际写入的 key 是 "uid"
+ctx.Session.Set("uid", user.ID)
+```
+
+**根因**：`flamego/csrf@v1.3.0` 的 `defaultSessionKey = "userID"`（`csrf.go:150`）。应用写入的却是 `"uid"`，导致 `s.Get("userID")` 恒为 `nil`，进而 `x.id` 恒为字符串 `"0"`（`csrf.go:198-202`）。而 token 校验是**无状态 HMAC 重算**，并不与 session 中存储的 token 比对：
+
+```go
+// csrf.go:62 —— 校验只依赖 secret + c.id("0") + "POST" + 时间戳
+func (c *csrf) ValidToken(t string) bool {
+    return ValidToken(t, c.secret, c.id, http.MethodPost)
+}
+```
+
+**动态验证结果**（本地实测，非推测）：
+
+| 测试用例 | 结果 |
+|---|---|
+| 会话 B 的 cookie + **会话 A 的 token** | `HTTP 200` — **通过校验**，进入业务逻辑 |
+| 会话 B 的 cookie + 伪造 token | `HTTP 400 Bad Request: invalid CSRF token` |
+| 同一个 token 连续复用 26 次 | 全部通过（token 有效期 24 小时） |
+
+即：**任意匿名访客从公开的 `/login` 页面拿到的 token，对任何已登录用户都有效**，CSRF 从「每会话密钥」退化为「全站公开常量」。
+
+**缓解因素**：session cookie 实测带 `SameSite=Lax`，可阻断经典跨站表单 POST。因此未定为 P0。但一旦出现子域接管、站内 HTML 注入，或将来因兼容性调整为 `SameSite=None`，防线即完全失效。
+
+**修复**（一行）：
+```go
+csrf.Csrfer(csrf.Options{
+    Secret:     conf.Server.XSRFKey,
+    Header:     "X-CSRF-Token",
+    SessionKey: "uid",   // 与 login.go 写入的 key 对齐
+})
+```
+修复后匿名 token（id=`"0"`）将无法通过登录用户（id=`uid`）的校验。**建议同时增加一条回归测试**锁定该行为，避免日后 key 改名再次错配。
+
+---
+
+### 🔴 P1-2　Session cookie 缺少 `Secure` 标志
+
+**位置**：`internal/route/route.go:111-114`
+
+```go
+sessioner := session.Sessioner(session.Options{
+    Initer: initer,
+    Config: sessionStorage,
+    // 缺少 Cookie 配置，Secure 默认为 false
+})
+```
+
+**实测响应头**：
+```
+Set-Cookie: flamego_session=pqc9w5j3kq9thjxu; Path=/; HttpOnly; SameSite=Lax
+```
+`HttpOnly` 与 `SameSite=Lax` 有（库默认），**但 `Secure` 缺失**。虽然站点已下发 HSTS，但用户首次访问（HSTS 尚未落地、且未加入 preload 名单）时，主动 MITM 可诱导明文 HTTP 请求窃取会话 cookie。
+
+**修复**：
+```go
+sessioner := session.Sessioner(session.Options{
+    Initer: initer,
+    Config: sessionStorage,
+    Cookie: session.CookieOptions{
+        HTTPOnly: true,
+        SameSite: http.SameSiteLaxMode,
+        Secure:   strings.HasPrefix(conf.App.ExternalURL, "https"),
+    },
+})
+```
+建议与 `securityHeaders()` 中已有的 HSTS 判断复用同一条件，保持 http 本地开发可用。
+
+---
+
+### 🟠 P1-3　无请求体总大小上限，可磁盘耗尽 DoS
+
+**位置**：`internal/form/form.go:52`
+
+```go
+if err := r.ParseMultipartForm(10 * 1 << 20); err != nil { // 10 MiB
+```
+
+**关键误区澄清**：`10 MiB` 参数**只限制内存缓冲**，超出部分由 `mime/multipart` 自动落盘到临时文件，**总量无任何上限**；且全项目未使用 `http.MaxBytesReader`（已全局搜索确认）。
+
+匿名可达的提问接口即接受 multipart，攻击者可持续 POST 超大 body 撑满磁盘。`ReadTimeout: 30s` 仅提供有限约束，高带宽下 30 秒足以写入数 GB。
+
+> **附带澄清一个误报**：初步审计曾怀疑 `imgFile.Size`（`route/question/page.go:632`）取自客户端声明的 `Content-Length` 因而可伪造绕过 5MB 校验。**我编写测试实测否定了这一点** —— 构造声明 `Content-Length: 10` 而实际写入 100000 字节的 multipart part，`FileHeader.Size` 如实返回 `100000`。Go 的该字段反映真实字节数，**5MB 校验有效，此处无漏洞**。
+
+**修复**（在 `form.Bind` 或最外层中间件统一加固）：
+```go
+const maxBody = 12 << 20 // 略高于业务上限 10MiB，留 multipart 边界开销
+r.Body = http.MaxBytesReader(w, r.Body, maxBody)
+if err := r.ParseMultipartForm(10 << 20); err != nil {
+    // 超限时返回 413 Request Entity Too Large
+}
+```
+
+---
+
+### 🟠 P1-4　IPv6 未按 `/64` 聚合，限流与自动封禁可被绕过
+
+**位置**：`internal/shared/ip.go:105`、`internal/route/ratelimit.go:140`、`internal/security/autoban/autoban.go`
+
+`ResolveClientIP` 返回完整 IPv6 地址，限流与 autoban 直接以其作 map key。单个住宅 IPv6 `/64` 前缀通常可用 2^64 个地址，攻击者每请求换一个源地址，则每个 key 仅命中 1 次，**阈值永远无法触发**；同时海量 key 会持续膨胀内存。
+
+**实测补充**：IPv4 场景下限流工作正常 —— 连续 26 次请求精确地在第 21 次开始返回 `429`；伪造 `X-Forwarded-For` / `CF-Connecting-IP` / `X-Real-IP` **均未能绕过**（`trust_proxy` 关闭时确实忽略这些头，实现正确）。本条仅针对 IPv6 键粒度。
+
+**修复**：
+```go
+// internal/shared/ip.go
+func LimitKey(ip string) string {
+    p := net.ParseIP(ip)
+    if p == nil { return ip }
+    if v4 := p.To4(); v4 != nil { return v4.String() }
+    return p.Mask(net.CIDRMask(64, 128)).String() + "/64"
+}
+```
+在限流与 autoban 取 key 处改用 `shared.LimitKey(ip)`；**IP 黑名单仍保持精确匹配**，不要套用聚合。
+
+---
+
+### 🟠 P1-5　限流 / 封禁状态仅存进程内存，多实例部署失效
+
+**位置**：`internal/route/ratelimit.go:17`（`visitors` 为进程内 map）
+
+限流与 autoban 状态均在单进程内存中，未落 Redis（尽管 Redis 已作为 session/cache 后端接入）。横向扩容到 N 个副本后，攻击者轮询各副本即可获得 **N 倍配额**；某副本封禁的 IP 打到其他副本仍被放行。
+
+**修复**：迁移到 Redis 滑动窗口（`INCR` + `EXPIRE`，或 `SET NX EX`）；若坚持单副本部署，请在 README 与部署文档中明确标注「本服务不支持多副本水平扩展」，并配合宿主机 fail2ban 兜底。
+
+---
+
+## 三、P2 问题（改进建议）
+
+| # | 问题 | 位置 | 说明与修复 |
+|---|---|---|---|
+| P2-1 | `safeURL` 允许协议相对 URL | `internal/template/markdown.go:246-255` | `strings.HasPrefix(lower, "/")` 会让 `//evil.com` 通过。**已写测试实测确认 `safeURL("//evil.com") == true`**。markdown 中 `[x](//evil.com)` 渲染为外链，可用于钓鱼。注意 `javascript:` 变体仍被正确拦截。修复：在白名单判断前先 `if strings.HasPrefix(lower, "//") { return false }` |
+| P2-2 | 缺少 Content-Security-Policy | `internal/route/route.go:47-59` | 实测响应头确认无 CSP。其余安全头（X-Frame-Options / nosniff / Referrer-Policy / HSTS）齐备。因站内大量内联脚本，短期需保留 `'unsafe-inline'`，但限定 `script-src` 域名仍能显著收窄面 |
+| P2-3 | `ProfileAPI` 返回完整 User 含 email | `route/user/profile.go:39-41` | `return ctx.JSON(ctx.User)`，而 `Email` 标签为 `json:"email"`（`users.go:82`）。虽为本人数据，仍违反最小暴露原则。建议返回裁剪后的 DTO |
+| P2-4 | 提问删除级联未包事务 | `internal/db/questions.go:354-383` | 软删提问 → 删追问 → 删图片 → 回退配额，四步非原子，中途失败会留下孤儿记录与计数漂移。建议包入 `Transaction` |
+| P2-5 | autoban 告警 goroutine 无 recover | `internal/security/autoban/autoban.go:172` | `go func(){ _ = b.sendAlert(...) }()` 一旦 panic 将终止整个进程。改用带 `recover` 的 `shared.SafeGo` |
+| P2-6 | 登出未销毁会话 | `route/auth/logout.go:12` | 仅 `Session.Flush()` 清空数据，会话 ID 与 cookie 仍有效。建议改用 `Destroy()` 或登出后 `RegenerateID()` |
+| P2-7 | 登录时序差异可枚举邮箱 | `internal/db/users.go:378` | 邮箱不存在时立即返回；存在但密码错时执行 bcrypt（约 50–100ms）。建议不存在时也比对一个固定 dummy hash 以对齐耗时（错误文案已正确统一） |
+| P2-8 | 颜色字段仅校验长度未校验格式 | `internal/form/user.go:12-13` | `Usernamecolor` / `Introcolor` 仅 `minlen:7;maxlen:7`，可提交任意 7 字符。建议加 `Match(^#[0-9a-fA-F]{6}$)`。**注意：这不构成 XSS**，见第四节 |
+| P2-9 | 会话有效期偏长 | `internal/route/route.go:97,108` | `Lifetime: 7 * 24h` 且无空闲超时，建议缩短并引入 idle timeout |
+| P2-10 | `.bak` 文件被打包进二进制 | `templates/question/new-question-template.html.bak` | `//go:embed ... question ...` 会包含该文件（虽因 `.html` 后缀过滤不会被注册为模板）。建议删除或移出 embed 目录 |
+| P2-11 | `app.sample.ini` 存在重复配置块 | `conf/app.sample.ini:82-86` 与 `89-93` | `image_endpoint` / `image_access_id` / `image_bucket` 等整组重复定义，会被静默覆盖为后者，易误导部署者。注释虽区分了「头像/背景」与「用户上传图片」，但键名完全相同 |
+| P2-12 | `production` 默认 `false` | `internal/conf/static.go` + `route.go:63` | 缺省运行于 dev 模式可能暴露错误栈。建议默认按生产处理，或启动时强制校验该项 |
+
+**附加工程建议**：`internal/db` 的 8 个测试因需要 `DB_TYPE`/`DB_USER` 等环境变量而全部失败（`internal/dbutil/testing.go:40`）。建议提供 `docker-compose.test.yml` 或 `Makefile` 目标一键拉起测试库，否则这部分测试在 CI 外基本不会被执行。
+
+---
+
+## 四、经验证排除的「疑似问题」（误报澄清）
+
+审阅过程中有 3 项初步怀疑，我通过编写测试或实际请求**逐一验证后排除**，特此说明以免造成不必要的返工：
+
+1. **模板 JS 上下文缺引号 ≠ 注入**
+   `templates/question/question-not-found.html:46-47` 写作 `style.color = {{.PageUser.Introcolor}};`（无引号），与 `list.html:132` 的 `"{{...}}"` 不一致，初判为 JS 表达式上下文注入。
+   **实测结论：安全。** Go `html/template` 在 JS 表达式上下文会自动 JSON 编码并补引号：输入 `0;alert(1` 输出 `"0;alert(1"`，输入 `</script>` 输出 `"\u003c/script\u003e"`。两种写法均安全，无需修改（仅风格不统一）。
+
+2. **`multipart.FileHeader.Size` 不可伪造** —— 详见 P1-3 中的澄清说明。
+
+3. **`service.Proxy` / `pixel.Proxy` 无 SSRF** —— 目标 Host 取自配置，用户仅控制路径且经 `path.Clean` 归一化，非用户可控目标。
+
+---
+
+## 五、经确认实现正确的部分
+
+- **密码安全**：bcrypt(cost=10) + 每用户 salt，超 72 字节截断；旧 HMAC-SHA1 仅作兼容且登录时自动升级，旧路径用 `subtle.ConstantTimeCompare`
+- **会话固定防护**：`login.go:67` 认证成功后先 `RegenerateID()` 再写入身份
+- **密码重置**：`randstr.String(64)` 加密级随机，24h 过期，一次性消费，按 code 直查无枚举面
+- **页面密码 / 提问密码**：均 bcrypt 存储与比较
+- **验证码**：`crypto/rand` 生成，答案仅存服务端 session，5 分钟 TTL，一次性，尝试上限 5 次，`ConstantTimeCompare` 比对
+- **SQL 注入**：`Raw`/`Exec` 仅用于固定 DDL；排序字段已归一化为 `ASC`/`DESC` 白名单；`LIKE` 有 `escapeLike` 转义 `% _ \`；`db.go` 的 `fmt.Sprintf` 仅拼接配置 schema 与硬编码表名
+- **越权防护**：`getOwnedVote` 校验 `vote.UserID`；`Questioner` 中间件校验归属并注入 `canDelete`；chat 处理器校验 `OwnerID`/`AskerID`
+- **SSRF**：**实测全部拦截** —— `127.0.0.1:6379`、`169.254.169.254`（云元数据）、`localhost`、`10.0.0.1`、`[::1]`、`example.com` 均返回 `403 domain not allowed`，`file://` 返回 `400 invalid url`。白名单默认为空即 fail-closed；`proxyImageDialContext` 在拨号时重新解析并固定公网 IP，彻底防 DNS rebinding；`CheckRedirect` 对每跳重复校验
+- **开放重定向**：**实测全部拦截** —— `//evil.com`、`https://evil.com`、`\\evil.com`、`/\evil.com`、`////evil.com`、`/%09/evil.com`、`%2F%2Fevil.com` 一律回落到 `/`
+- **XSS 主链路**：blackfriday 未开启 `HTML` 扩展（原始标签被转义），渲染后经白名单 sanitize + `on*` 属性剥离 + `safeURL`/`safeColorValue` 校验 + 文本节点二次转义；`toJSON` 依赖 `json.Marshal` 默认 HTML 转义
+- **HTTP 方法约束**：`site-stats` 等只读端点对 `POST`/`PUT`/`DELETE` 均不执行；登出已正确改为 POST
+- **中间件顺序**：CSRF 校验先于限流，无效 token 不消耗限流配额
+- **并发安全**：`go test -race` 零 race；`rateLimiter.visitors`、`autoban.probes/banned`、`TTLCache.items`、`stats.cached`、`shared.App` 全部有锁保护；`captcha` 类型断言使用双返回值
+- **数据一致性**：追问创建用 `clause.Locking` 行锁；会话消息计数为原子 `UPDATE ... WHERE count < ?` 且失败回滚；投票提交有复合唯一索引兜底；配额用 `gorm.Expr` 并防负数
+- **敏感字段**：`Password`/`PagePassword`/`AskPassword`/`UID`/`BlockWords`/`FromIP`/`VoterIP` 均标 `json:"-"`；CSV/XLSX 导出有公式注入转义
+- **超时配置**：`http.Server` 四类超时齐备；所有外部 HTTP 调用均设 `Timeout`
+
+---
+
+## 六、建议修复顺序
+
+1. **P1-1 CSRF `SessionKey: "uid"`** —— 一行改动，收益最高，**建议补回归测试**
+2. **P1-2 session cookie `Secure`** —— 一行改动
+3. **P1-3 `http.MaxBytesReader`** —— 防匿名磁盘耗尽
+4. **P1-4 IPv6 `/64` 聚合** —— 同时缓解内存膨胀
+5. **P2-1 `safeURL` 拒绝 `//`** —— 一行改动
+6. P1-5 与其余 P2 项按迭代节奏推进
+
+---
+
+## 七、修复状态（批次 A+B 已落地）
+
+| 项 | 修复 | 回归测试 |
+|----|------|----------|
+| P1-1 CSRF `SessionKey: "uid"` | `route.go` 改为包级常量 `CSRFUserSessionKey = "uid"` | `internal/route/csrf_binding_test.go`：`TestCSRFTokenBoundToUserSession`（内存会话重放跨会话 token 复用 → 期望 400；SessionKey 误改回 `"userID"` 即失败） |
+| P1-2 session cookie `Secure` | `route.go`：`Secure = strings.HasPrefix(ExternalURL,"https")` | （一行常量改动，行为随部署 `ExternalURL` 而定；HTTPS 部署下自动 `Secure`） |
+| P1-3 请求体上限 | `form/form.go`：`http.MaxBytesReader` 封顶 12 MiB | （`internal/form` 既有测试保持通过） |
+| P1-4 IPv6 `/64` 聚合 | `shared/ip.go` 新增 `LimitKey`；`ratelimit.go`/`autoban.go`/NotFound 统一套用 | `internal/shared/ip_test.go`：`TestLimitKey` + `TestLimitKeyIPv6SamePrefixCollapses` |
+| P2-1 `safeURL` 拒绝 `//` | `markdown.go`：先拒协议相对 URL（`//`、`\\`、`/\`） | `internal/template/markdown_test.go`：`TestSafeURL` |
+
+**验证**：`go build ./...` 与 `go vet ./...` 均干净；`internal/route`、`internal/shared`、`internal/template`、`internal/form` 测试全过（含上述 3 个新测试）。
+**说明**：CSRF 跨会话拒绝（最关键动态发现）已由 DB 无关集成测试覆盖；本沙箱无 SQL DB（`db.Init` 启动连库），故未在此重启动服务做完整动态复验，需在用户可达 SQL DB 的测试环境下复跑 SSRF / 开放重定向 / 限流等探针。
+
+---
+
+*报告完毕。全程未读取 `conf/app.ini`；测试服务已停止，临时文件已清理；审阅期间在 `internal/template/` 临时创建的验证测试文件已删除，工作区无残留改动。*
diff --git a/outputs/shared-egress-vote-antispam-review-2026-08-26.md b/outputs/shared-egress-vote-antispam-review-2026-08-26.md
new file mode 100644
index 0000000..678ef33
--- /dev/null
+++ b/outputs/shared-egress-vote-antispam-review-2026-08-26.md
@@ -0,0 +1,76 @@
+# 共享出口匿名投票防刷修改与测试报告
+
+- **时间**：2026-08-26
+- **目标**：解决 Cloudflare + `trust_proxy=true` 场景下，局域网用户共享公网 IP 导致同一投票只能一人提交的问题。
+- **策略**：签名 `vote_fp` 负责设备级一人一票；IP 仅用于高阈值突发风控，不再承担同一投票的一票封顶。
+
+## 修改内容
+
+### 1. 删除匿名投票的 IP 一票封顶
+
+`route/vote/vote.go`：
+
+- 移除提交处理器内 `CountByIP(... 24h)` 且 `count >= 1` 即拒绝的逻辑。
+- 匿名用户继续通过有效 HMAC `vote_fp` 与数据库唯一索引防止同一浏览器/设备重复投票。
+- 无效或缺失 Cookie 仍会被重新签发，不会成为可信身份。
+
+### 2. 新增投票提交专用的身份优先限流
+
+`internal/route/ratelimit.go`：
+
+新增 `voteSubmitRateLimitMiddleware`，投票提交同时经过两层限制：
+
+- 登录用户：按 `user:<uid>` 独立限流，额度为常规参数的 3 倍。
+- 匿名用户：按有效 `token:<vote_fp>` 独立限流。
+- 所有匿名请求：同时经过 `ip:<client-ip>` 高阈值兜底限流，默认是传入基础额度的 10 倍。
+- 无效/缺失 Cookie 不会获得独立 token 限流身份，只能使用 IP 兜底。
+- 触发限制时返回 HTTP 429，不进入实际投票提交处理器。
+
+`internal/route/route.go` 已将 `/vote/{token}/submit` 从普通 IP 限流切换到该专用中间件。
+
+### 3. 校准 Cloudflare 客户端 IP 解析
+
+`internal/shared/ip.go`：
+
+- `TrustProxy=true` 时优先读取 Cloudflare 官方 `CF-Connecting-IP`。
+- 若该头不存在或非法，再回退到 `X-Real-IP`、`X-Forwarded-For`，最后使用 `RemoteAddr`。
+- `TrustProxy=false` 时仍完全忽略这些请求头，只使用 `RemoteAddr`。
+- 新增 Cloudflare 头优先级和不信任代理时忽略头部的测试。
+
+### 4. 更新设计文档
+
+`anonymous-vote-design.md` 已同步新的防刷矩阵、token 流程和共享出口说明。
+
+## 验证结果
+
+通过：
+
+```text
+gofmt -d internal/route/ratelimit.go internal/route/route.go \
+  internal/shared/ip.go route/vote/vote.go
+# 无输出
+
+go test -count=1 ./internal/shared ./route/vote ./internal/template \
+  ./templates ./internal/i18n ./internal/cache ./internal/security/autoban
+# 全部 PASS
+
+go vet ./route/vote ./internal/shared ./internal/template ./templates ./internal/i18n
+# 无输出
+```
+
+补充测试覆盖：
+
+- 同一共享 IP 下多个不同 token 彼此独立；
+- 同一 token 仍受独立限流；
+- IP 兜底允许多次正常请求，但能阻断异常突发；
+- Cloudflare `CF-Connecting-IP` 优先于其他代理头；
+- 未启用可信代理时伪造的代理头不会生效。
+
+`go test ./internal/route` 当前仍无法编译完成，原因是项目既有的 `github.com/chai2010/webp@v1.4.0` 在本机缺少 CGO/WebP 编译符号，并非本次限流逻辑测试失败。
+
+## Cloudflare 部署注意事项
+
+1. 源站防火墙应只允许 Cloudflare 官方 IP 段访问源站端口，否则攻击者可能直接访问源站并伪造 `CF-Connecting-IP`。
+2. 保持 `trust_proxy=true` 的前提是源站确实位于可信反向代理之后。
+3. 重要投票建议开启 Turnstile 或要求登录；匿名签名 Cookie 只能保证设备级防重，无法阻止清 Cookie、换浏览器或自动化客户端。
+4. 当前共享 IP 兜底阈值为 200 次/分钟（投票路由传入基础值 20），可根据真实并发量调整。
diff --git a/outputs/tb-dev-test-qr-crop.png b/outputs/tb-dev-test-qr-crop.png
new file mode 100644
index 0000000..67e48eb
Binary files /dev/null and b/outputs/tb-dev-test-qr-crop.png differ
diff --git a/outputs/tb-dev-test-qr.png b/outputs/tb-dev-test-qr.png
new file mode 100644
index 0000000..3b7484f
Binary files /dev/null and b/outputs/tb-dev-test-qr.png differ
diff --git a/outputs/tb-page-snapshot.html b/outputs/tb-page-snapshot.html
new file mode 100644
index 0000000..e87f7ed
--- /dev/null
+++ b/outputs/tb-page-snapshot.html
@@ -0,0 +1,1712 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width">
+  <title>小狼 - 狼的提问箱 | 匿名提问箱</title>
+  <meta name="description" content="狼的提问箱——一个无需注册、可匿名提问的匿名提问箱，安全地倾诉与回应。">
+  <meta name="keywords" content="匿名提问箱,提问箱,匿名提问,狼的提问箱,匿名问答,匿名提问网站">
+  
+  <link rel="preconnect" href="https://r2.337845818.best" crossorigin>
+  <link rel="preconnect" href="https://cdnjs.snrat.com" crossorigin>
+  <link rel="dns-prefetch" href="https://cn.vercount.one">
+  
+  <link rel="stylesheet" href="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/css/uikit.min.css"/>
+  
+  <link rel="stylesheet" href="https://r2.337845818.best/tamabox/cdn/waline/client/v2/waline-no-commits.css" media="print" onload="this.media='all'"/>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/js/uikit.min.js"></script>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/js/uikit-icons.min.js"></script>
+  
+  <style>
+      .uk-light { color: rgba(0,0,0,.7); }
+      .uk-light .uk-h1, .uk-light .uk-h2, .uk-light .uk-h3, .uk-light .uk-h4, .uk-light .uk-h5, .uk-light .uk-h6,
+      .uk-light .uk-heading-2xlarge, .uk-light .uk-heading-large, .uk-light .uk-heading-medium, .uk-light .uk-heading-small, .uk-light .uk-heading-xlarge,
+      .uk-light h1, .uk-light h2, .uk-light h3, .uk-light h4, .uk-light h5, .uk-light h6 { color: #000; }
+      .uk-light .uk-table th { color: rgba(0,0,0,.7); }
+  </style>
+  
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/dayjs/1.10.8/dayjs.min.js"></script>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/alpinejs/3.9.0/cdn.min.js"></script>
+  
+  
+  <script defer src="https://r2.337845818.best/tamabox/cdn/time.box.js"></script>
+  
+  <script defer src="https://cn.vercount.one/js"></script>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/waline/2.15.8/waline.js"></script>
+  
+  
+  <style>
+      .captcha-equation-box {
+          display: inline-flex;
+          align-items: center;
+          background: #f0f2f5;
+          border: 1px solid #dcdcdc;
+          border-radius: 8px;
+          padding: 8px 8px 8px 16px;
+          gap: 6px;
+          transition: border-color 0.2s;
+      }
+      .captcha-equation-box:focus-within {
+          border-color: #1e87f0;
+          box-shadow: 0 0 0 3px rgba(30,135,240,0.12);
+      }
+      .math-captcha-modal-question {
+          font-size: 1.4rem;
+          font-family: "Courier New", monospace;
+          font-weight: 700;
+          color: #333;
+          letter-spacing: 1px;
+          white-space: nowrap;
+      }
+      #captcha-modal-answer {
+          width: 80px;
+          padding: 6px 10px;
+          text-align: center;
+          font-size: 1.2rem;
+          font-family: "Courier New", monospace;
+          font-weight: 600;
+          border: 1px solid #ccc;
+          border-radius: 5px;
+          outline: none;
+          transition: border-color 0.15s, box-shadow 0.15s;
+          background: #fff;
+      }
+      #captcha-modal-answer:focus {
+          border-color: #1e87f0;
+          box-shadow: 0 0 0 2px rgba(30,135,240,0.2);
+      }
+       
+      #captcha-modal-answer::-webkit-inner-spin-button,
+      #captcha-modal-answer::-webkit-outer-spin-button {
+          -webkit-appearance: none;
+          margin: 0;
+      }
+      #captcha-modal-answer {
+          -moz-appearance: textfield;
+      }
+  </style>
+  
+  
+  <style>
+      .grecaptcha-badge {visibility: hidden;}
+      .icon-container {
+         display: flex;
+         justify-content: center;
+         width: 100%;
+  }
+      .icon {
+         margin-left: 10px;
+         width: 20px;  
+         height: auto;  
+      }
+      .emoji-placeholder {
+         display: inline-block;
+         animation: jump 0.5s ease-in-out;
+      }
+
+      @keyframes jump {
+         0%, 100% { transform: translateY(0); }
+         50% { transform: translateY(-5px); }
+      }
+      
+     .uk-dropbar {
+       opacity: 0;
+       visibility: hidden;
+       transition: opacity 0.2s ease, visibility 0.2s ease;
+     }
+     
+     .uk-dropbar.uk-open {
+       opacity: 1;
+       visibility: visible;
+     }
+     
+     a.uk-button.uk-button-link {
+       text-transform: none;
+     }
+
+      
+     @media (max-width: 640px) {
+         .uk-logo {
+             font-size: 1rem;
+         }
+         .uk-navbar-nav a {
+             font-size: 0.78rem;
+             padding: 0 4px;
+         }
+         .emoji-placeholder {
+             font-size: 1rem;
+         }
+          
+         .tb-nav-username {
+             max-width: 64px;
+             overflow: hidden;
+             text-overflow: ellipsis;
+             white-space: nowrap;
+             display: inline-block;
+             vertical-align: middle;
+         }
+     }
+  </style>
+
+  
+  <style>
+      html[data-theme="dark"] {
+          --tb-bg: #1a1d23;
+          --tb-surface: #242830;
+          --tb-surface-2: #2d323c;
+          --tb-border: #3a404c;
+          --tb-text: #d8dce4;
+          --tb-text-muted: #8b93a1;
+          --tb-primary: #5c8dff;
+      }
+       
+      html[data-theme="dark"],
+      html[data-theme="dark"] body {
+          background-color: var(--tb-bg) !important;
+          color: var(--tb-text) !important;
+      }
+       
+      html[data-theme="dark"] .uk-card,
+      html[data-theme="dark"] .uk-card-default,
+      html[data-theme="dark"] .uk-card-secondary,
+      html[data-theme="dark"] .uk-dropbar,
+      html[data-theme="dark"] .uk-navbar-dropdown,
+      html[data-theme="dark"] .uk-modal-dialog,
+      html[data-theme="dark"] .uk-dropdown,
+      html[data-theme="dark"] .uk-offcanvas-bar,
+      html[data-theme="dark"] .uk-section,
+      html[data-theme="dark"] .uk-tile,
+      html[data-theme="dark"] .uk-panel,
+      html[data-theme="dark"] .uk-background-default,
+      html[data-theme="dark"] .uk-search-default .uk-search-input {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-navbar-container {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-navbar-nav > li > a,
+      html[data-theme="dark"] .uk-card a,
+      html[data-theme="dark"] .uk-link,
+      html[data-theme="dark"] a.uk-button-link,
+      html[data-theme="dark"] .uk-navbar-dropdown-nav > li > a,
+      html[data-theme="dark"] .uk-dropdown-nav > li > a,
+      html[data-theme="dark"] .uk-list a {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-navbar-nav > li > a:hover,
+      html[data-theme="dark"] .uk-card a:hover,
+      html[data-theme="dark"] .uk-navbar-dropdown-nav > li > a:hover,
+      html[data-theme="dark"] .uk-dropdown-nav > li > a:hover {
+          color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .uk-input,
+      html[data-theme="dark"] .uk-textarea,
+      html[data-theme="dark"] .uk-select {
+          background-color: var(--tb-surface-2) !important;
+          color: var(--tb-text) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] .uk-input:focus,
+      html[data-theme="dark"] .uk-textarea:focus,
+      html[data-theme="dark"] .uk-select:focus {
+          border-color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .uk-text-muted,
+      html[data-theme="dark"] .uk-text-meta,
+      html[data-theme="dark"] .uk-text-secondary,
+      html[data-theme="dark"] .uk-text-muted a,
+      html[data-theme="dark"] .uk-text-small.uk-text-muted {
+          color: var(--tb-text-muted) !important;
+      }
+      html[data-theme="dark"] .uk-divider-icon::after,
+      html[data-theme="dark"] hr,
+      html[data-theme="dark"] .uk-table th,
+      html[data-theme="dark"] .uk-table td,
+      html[data-theme="dark"] .uk-list-divider > li:nth-child(n+2) {
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] .uk-button-default {
+          background-color: var(--tb-surface-2) !important;
+          color: var(--tb-text) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] .uk-modal-title,
+      html[data-theme="dark"] h1, html[data-theme="dark"] h2, html[data-theme="dark"] h3,
+      html[data-theme="dark"] h4, html[data-theme="dark"] h5, html[data-theme="dark"] h6,
+      html[data-theme="dark"] .uk-card-title {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-alert-warning,
+      html[data-theme="dark"] .uk-alert-danger,
+      html[data-theme="dark"] .uk-alert-success,
+      html[data-theme="dark"] .uk-alert-primary {
+          background-color: var(--tb-surface-2) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .uk-modal-dialog {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .captcha-equation-box {
+          background-color: var(--tb-surface-2) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .math-captcha-modal-question {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-answer {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-answer::placeholder {
+          color: var(--tb-text-muted) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .uk-text-meta,
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-refresh {
+          color: var(--tb-text-muted) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-refresh:hover {
+          color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .uk-label {
+          color: #fff !important;
+      }
+       
+      html[data-theme="dark"] .recommend-card,
+      html[data-theme="dark"] .recommend-card:hover {
+          background-color: var(--tb-surface-2) !important;
+      }
+      html[data-theme="dark"] .explore-name a {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .explore-name a:hover {
+          color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .explore-intro {
+          color: var(--tb-text-muted) !important;
+      }
+       
+      #theme-toggle .tb-icon-dark, #theme-toggle-mobile .tb-icon-dark { display: none; }
+      html[data-theme="dark"] #theme-toggle .tb-icon-light,
+      html[data-theme="dark"] #theme-toggle-mobile .tb-icon-light { display: none; }
+      html[data-theme="dark"] #theme-toggle .tb-icon-dark,
+      html[data-theme="dark"] #theme-toggle-mobile .tb-icon-dark { display: inline; }
+  </style>
+
+  
+  <style>
+      .uk-navbar-nav a {
+          font-size: 0.95rem;
+          padding: 0 10px;
+      }
+       
+      .tb-mobile-balancer { display: none; }
+       
+      .tb-navbar .uk-logo {
+          white-space: nowrap;
+      }
+      @media (max-width: 1200px) {
+          .uk-navbar-nav a {
+              font-size: 0.88rem;
+              padding: 0 8px;
+          }
+      }
+      @media (max-width: 1000px) {
+          .uk-navbar-nav a {
+              font-size: 0.82rem;
+              padding: 0 6px;
+          }
+          .uk-logo {
+              font-size: 1.1rem;
+          }
+           
+          .tb-nav-username {
+              max-width: 110px;
+              overflow: hidden;
+              text-overflow: ellipsis;
+              white-space: nowrap;
+              display: inline-block;
+              vertical-align: middle;
+          }
+      }
+      @media (max-width: 800px) {
+          .uk-navbar-nav a {
+              font-size: 0.78rem;
+              padding: 0 4px;
+          }
+          .uk-logo {
+              font-size: 1rem;
+          }
+          .tb-nav-username {
+              max-width: 80px;
+          }
+      }
+       
+      @media (max-width: 640px) {
+          .tb-navbar {
+              position: relative;
+              min-height: 56px;
+              overflow: visible;
+          }
+          .tb-navbar > .uk-navbar-center {
+              position: relative !important;
+              top: auto !important;
+              left: auto !important;
+              right: auto !important;
+              bottom: auto !important;
+              transform: none !important;
+              display: flex !important;
+              align-items: center;
+              justify-content: center;
+              width: 100%;
+              min-height: 56px;
+              white-space: nowrap;
+              flex-wrap: nowrap;
+          }
+          .tb-navbar .uk-navbar-center-left,
+          .tb-navbar .uk-navbar-center-right {
+              position: static !important;
+              top: auto !important;
+              left: auto !important;
+              right: auto !important;
+              bottom: auto !important;
+              transform: none !important;
+              display: flex !important;
+              align-items: center;
+              flex: 0 0 auto;
+              white-space: nowrap;
+          }
+          .tb-navbar .uk-navbar-center-left > div,
+          .tb-navbar .uk-navbar-center-right > div {
+              display: flex;
+              align-items: center;
+              white-space: nowrap;
+          }
+          .tb-navbar .uk-navbar-nav {
+              display: flex;
+              flex-wrap: nowrap;
+              flex: 0 0 auto;
+          }
+          .tb-navbar .uk-navbar-nav > li > a,
+          .tb-navbar .uk-logo {
+              white-space: nowrap;
+          }
+           
+          .tb-mobile-balancer { display: block; }
+      }
+  </style>
+
+  
+  <style>
+      .tb-label-btn {
+          border: none !important;
+          cursor: pointer;
+          font-family: inherit;
+          margin: 0;
+          vertical-align: middle;
+          outline: none;
+          background-image: none;
+          box-sizing: border-box;
+          -webkit-appearance: none;
+          appearance: none;
+      }
+      .tb-label-btn:hover {
+          opacity: 0.85;
+      }
+       
+      .tb-pin-flag {
+          font-size: 0.9em;
+          margin-right: 4px;
+          vertical-align: -1px;
+          cursor: default;
+      }
+  </style>
+
+  
+  <style>
+      .tb-spinner {
+          display: inline-block;
+          width: 0.9em;
+          height: 0.9em;
+          border: 2px solid rgba(128, 128, 128, 0.25);
+          border-top-color: #666;
+          border-radius: 50%;
+          vertical-align: -2px;
+          animation: tb-spin 0.8s linear infinite;
+      }
+      html[data-theme="dark"] .tb-spinner {
+          border-color: rgba(255, 255, 255, 0.2);
+          border-top-color: #bbb;
+      }
+      @keyframes tb-spin {
+          to { transform: rotate(360deg); }
+      }
+  </style>
+
+  
+  <style>
+       
+      .tb-preline {
+          white-space: pre-wrap;
+      }
+       
+      .tb-clamp-5 {
+          display: -webkit-box;
+          -webkit-box-orient: vertical;
+          -webkit-line-clamp: 5;
+          overflow: hidden;
+      }
+      .md-body {
+          line-height: 1.7;
+          text-align: left;
+          word-break: break-word;
+      }
+      .md-body p { margin: 0.5em 0; }
+      .md-body h1, .md-body h2, .md-body h3,
+      .md-body h4, .md-body h5, .md-body h6 {
+          margin: 0.8em 0 0.4em;
+          font-weight: 600;
+          line-height: 1.4;
+      }
+      .md-body ul, .md-body ol { padding-left: 1.6em; margin: 0.5em 0; }
+      .md-body li { margin: 0.2em 0; }
+      .md-body blockquote {
+          border-left: 3px solid #d3d1c7;
+          margin: 0.6em 0;
+          padding: 0.2em 1em;
+          color: #5f5e5a;
+      }
+      .md-body pre {
+          background: #f5f5f5;
+          padding: 0.8em 1em;
+          border-radius: 6px;
+          overflow-x: auto;
+          margin: 0.6em 0;
+      }
+      .md-body code {
+          background: #f0f0f0;
+          padding: 0.1em 0.35em;
+          border-radius: 4px;
+          font-size: 0.9em;
+      }
+      .md-body pre code { background: none; padding: 0; }
+      .md-body img { max-width: 100%; height: auto; }
+      .md-body table { border-collapse: collapse; margin: 0.6em 0; }
+      .md-body th, .md-body td {
+          border: 1px solid #ddd;
+          padding: 0.4em 0.8em;
+      }
+      .md-body hr { margin: 1em 0; }
+      html[data-theme="dark"] .md-body blockquote {
+          border-color: #3a404c;
+          color: #8b93a1;
+      }
+      html[data-theme="dark"] .md-body pre,
+      html[data-theme="dark"] .md-body code { background: #2d323c; }
+      html[data-theme="dark"] .md-body th,
+      html[data-theme="dark"] .md-body td { border-color: #3a404c; }
+  </style>
+
+  
+  <style>
+      .uk-progress {
+          -webkit-appearance: none;
+          -moz-appearance: none;
+          appearance: none;
+          height: 10px;
+          margin: 0;
+          border: none;
+          border-radius: 6px;
+          background-color: #e5e5e5;
+          overflow: hidden;
+          box-shadow: none;
+      }
+      .uk-progressbar {
+          display: block;
+          height: 100%;
+          background-color: #1e87f0;
+          border-radius: 6px 0 0 6px;
+          transition: width 0.3s ease;
+      }
+      html[data-theme="dark"] .uk-progress {
+          background-color: var(--tb-border);
+      }
+      html[data-theme="dark"] .uk-progressbar {
+          background-color: var(--tb-primary);
+      }
+  </style>
+
+  
+  <style>
+      #tb-mobile-utils {
+          display: none;
+      }
+      @media (max-width: 640px) {
+           
+          .tb-nav-utils {
+              display: none !important;
+          }
+           
+          .tb-nav-username {
+              display: none !important;
+          }
+           
+          #tb-mobile-utils {
+              display: flex;
+              position: fixed;
+              left: 0;
+              right: 0;
+              bottom: 0;
+              z-index: 1000;
+              justify-content: center;
+              align-items: center;
+              gap: 10px;
+              padding: 8px 12px calc(8px + env(safe-area-inset-bottom));
+              background: rgba(255, 255, 255, 0.92);
+              -webkit-backdrop-filter: blur(8px);
+              backdrop-filter: blur(8px);
+              box-shadow: 0 -2px 12px rgba(0, 0, 0, 0.08);
+          }
+          #tb-mobile-utils .uk-select {
+              width: 110px;
+          }
+          html[data-theme="dark"] #tb-mobile-utils {
+              background: rgba(36, 40, 48, 0.92);
+              box-shadow: 0 -2px 12px rgba(0, 0, 0, 0.4);
+          }
+           
+          body {
+              padding-bottom: 56px;
+          }
+      }
+  </style>
+
+
+  <meta property="og:site_name" content="狼的提问箱 | 匿名提问箱" />
+  <meta property="og:type" content="website" />
+  <meta property="og:title" content="小狼 - 狼的提问箱 | 匿名提问箱" />
+  <meta property="og:url" content="https://box.tama.guru/_/tamakyi" />
+  <meta property="og:description" content="小狼 - 狼的提问箱——一个无需注册、可匿名提问的匿名提问箱，安全地倾诉与回应。" />
+  <meta name="robots" content="noindex">
+  
+   <meta property="og:image" content="https://r2.337845818.best/tamabox/picture/2026/09/05/2e571390c431d19d75e51971a15bd6?og-image=1" />
+   <meta property="og:image:alt" content="小狼" />
+   <meta itemprop="image" content="https://r2.337845818.best/tamabox/picture/2026/09/05/2e571390c431d19d75e51971a15bd6?og-image=1"/>
+   <meta name="msapplication-TileImage" content="https://r2.337845818.best/tamabox/picture/2026/09/05/2e571390c431d19d75e51971a15bd6"/>
+   <link rel="shortcut icon" href="https://r2.337845818.best/tamabox/picture/2026/09/05/2e571390c431d19d75e51971a15bd6?og-image=1"/>
+   <link rel="apple-touch-icon" href="https://r2.337845818.best/tamabox/picture/2026/09/05/2e571390c431d19d75e51971a15bd6?og-image=1"/>
+   <link rel="icon" sizes="192x192" href="https://r2.337845818.best/tamabox/picture/2026/09/05/2e571390c431d19d75e51971a15bd6?og-image=1">
+   <meta name="twitter:image:src" content="https://r2.337845818.best/tamabox/picture/2026/09/05/2e571390c431d19d75e51971a15bd6?og-image=1" />
+   
+
+
+  <meta name="google-site-verification" content="fEPwRRJfiGsgwc5SINBQwZhPK8F0cwRaOvRx0YRurI4" />
+  <meta name="msvalidate.01" content="2F185E8E63C93635F50B3574F3B31E42" />
+  <script defer src="https://mami.tama.guru/tamami.js" data-website-id="c42ebe8b-9281-4da0-83a4-8f18b3e710fe"></script>
+</head>
+<body>
+<nav class="uk-navbar-container uk-margin tb-navbar" uk-navbar>
+  <div class="uk-navbar-center">
+    <div class="uk-navbar-center-left">
+      <div>
+        <ul class="uk-navbar-nav">
+          
+          <li><a href="/explore">探索</a></li>
+          
+          
+          <li class="tb-mobile-balancer" aria-hidden="true"><a tabindex="-1" style="visibility:hidden">我的</a></li>
+          
+        </ul>
+      </div>
+    </div>
+
+    <a class="uk-navbar-item uk-logo" href="/"><span class="emoji-placeholder" aria-label="random animal">🐺</span>的提问箱</a>
+
+    <div class="uk-navbar-center-right">
+      <div>
+        
+        <ul class="uk-navbar-nav">
+          <li><a href="/register">注册</a></li>
+        </ul>
+        <ul class="uk-navbar-nav">
+          <li><a href="/login">登录</a></li>
+        </ul>
+        
+        
+        
+        <ul class="uk-navbar-nav tb-nav-utils">
+          <li>
+            <a href="#" id="theme-toggle" title="切换深色/浅色模式" aria-label="切换深色/浅色模式">
+              <span class="tb-icon-light">🌙</span><span class="tb-icon-dark">☀️</span>
+            </a>
+          </li>
+        </ul>
+      </div>
+    </div>
+  </div>
+</nav>
+
+<script>
+document.addEventListener("DOMContentLoaded", function() {
+    const emojis = ["🐺","🐗","🐻","🐨","🐼","🐹","🐭","🐰","🦊","🐮","🐷","🐽","🐸","🐒","🦍","🐔","🐧","🐦","🐤","🐦‍⬛","🦅","🦉","🦇","🐴","🦄","🐝","🦎","🦖","🦕","🐙","🦑","🦐","🦞","🦀","🐡","🐠","🐟","🐬","🐳","🐋","🦈","🐊","🐅","🐆","🦓","🦍","🦧","🐘","🦛","🦏","🐪","🐫","🦒","🦘","🐃","🐂","🐄","🐎","🐖","🐏","🐑","🦙","🐐","🦌","🐕","🐩","🦮","🐕‍🦺","🐈","🐋","🐳","🐬","🐉","🐲"];
+    const placeholder = document.querySelector('.emoji-placeholder');
+    if (placeholder) {
+        placeholder.textContent = emojis[Math.floor(Math.random() * emojis.length)];
+    }
+});
+</script>
+
+
+<div id="tb-mobile-utils">
+  
+  <button type="button" id="theme-toggle-mobile" class="uk-button uk-button-default uk-button-small"
+          title="切换深色/浅色模式" aria-label="切换深色/浅色模式">
+    <span class="tb-icon-light">🌙</span><span class="tb-icon-dark">☀️</span>
+  </button>
+</div>
+
+<script>
+(function() {
+    
+    var THEME_COOKIE = 'theme';
+    function getTheme() {
+        var m = document.cookie.match(/(?:^|;\s*)theme=([^;]*)/);
+        return m ? m[1] : '';
+    }
+    function applyTheme(theme) {
+        if (theme === 'dark') {
+            document.documentElement.setAttribute('data-theme', 'dark');
+        } else {
+            document.documentElement.removeAttribute('data-theme');
+        }
+    }
+    function toggleTheme() {
+        var next = getTheme() === 'dark' ? 'light' : 'dark';
+        applyTheme(next);
+        var expires = new Date(Date.now() + 365 * 24 * 3600 * 1000).toUTCString();
+        document.cookie = THEME_COOKIE + '=' + next + '; path=/; max-age=' + (365 * 24 * 3600) + '; SameSite=Lax';
+    }
+    
+    applyTheme(getTheme());
+    document.addEventListener('DOMContentLoaded', function() {
+        
+        var buttons = document.querySelectorAll('#theme-toggle, #theme-toggle-mobile');
+        buttons.forEach(function(btn) {
+            btn.addEventListener('click', function(e) {
+                e.preventDefault();
+                toggleTheme();
+            });
+        });
+
+        
+        var langSel = document.getElementById('mobile-lang-select');
+        if (langSel) {
+            langSel.addEventListener('change', function() {
+                if (!this.value) return;
+                var to = window.location.pathname + window.location.search;
+                window.location.href = '/i18n/' + encodeURIComponent(this.value) + '?to=' + encodeURIComponent(to);
+            });
+        }
+    });
+})();
+</script>
+
+
+<div class="uk-container uk-container-xsmall">
+
+
+
+<div id="math-captcha-modal" uk-modal>
+  <div class="uk-modal-dialog uk-modal-body uk-text-center">
+    <h3 class="uk-modal-title">人机验证</h3>
+    <p class="uk-text-meta">请计算下方的算术题以验证你不是机器人</p>
+    <div class="captcha-equation-box">
+      <span id="captcha-modal-question" class="math-captcha-modal-question">加载中...</span>
+      <input type="number" id="captcha-modal-answer" placeholder="?" autocomplete="off" inputmode="numeric">
+    </div>
+    <div style="margin-top:6px;">
+      <button type="button" class="uk-button uk-button-text uk-text-small" id="captcha-modal-refresh">换一题</button>
+    </div>
+    <div id="captcha-modal-error" class="uk-text-danger uk-text-small" style="display:none;min-height:20px;"></div>
+    <div class="uk-margin-small-top">
+      <button type="button" class="uk-button uk-button-primary" id="captcha-modal-submit">验证并提交</button>
+      <button type="button" class="uk-button uk-button-default uk-modal-close">取消</button>
+    </div>
+  </div>
+</div>
+
+<script>
+var CAPTCHA_I18N = {
+  loading: "加载中...",
+  loadFailed: "加载失败",
+  loadRetry: "加载失败，请重试",
+  inputAnswer: "请输入答案",
+  wrongAnswer: "答案错误，请重新计算",
+  verifyFailed: "验证失败，请重试",
+  needPassword: "此提问箱需要密码",
+  needEmail: "请填写接收通知的邮箱地址"
+};
+</script>
+
+<script>
+(function() {
+  var captchaId = '';
+  var pendingForm = null;
+  var pendingNeedPassword = false;
+  var verifying = false;
+
+  function fetchCaptcha() {
+    var qEl = document.getElementById('captcha-modal-question');
+    var errEl = document.getElementById('captcha-modal-error');
+    var ansEl = document.getElementById('captcha-modal-answer');
+    qEl.textContent = CAPTCHA_I18N.loading;
+    fetch('/api/captcha/generate')
+      .then(function(r) { return r.json(); })
+      .then(function(data) {
+        if (data.code === 0 && data.data) {
+          captchaId = data.data.id;
+          qEl.textContent = data.data.question;
+          if (errEl) errEl.style.display = 'none';
+          if (ansEl) { ansEl.value = ''; ansEl.focus(); }
+        } else {
+          qEl.textContent = CAPTCHA_I18N.loadFailed;
+        }
+      })
+      .catch(function() {
+        qEl.textContent = CAPTCHA_I18N.loadRetry;
+      });
+  }
+
+  function getCSRFToken() {
+    var input = document.querySelector('input[name="_csrf"]');
+    return input ? input.value : '';
+  }
+
+  function doSubmit(form) {
+    
+    var ans = document.getElementById('captcha-modal-answer').value.trim();
+    var hidden = form.querySelector('[name="g-recaptcha-response"]');
+    if (hidden) hidden.value = captchaId + ':' + (ans || '0');
+
+    UIkit.modal('#math-captcha-modal').hide();
+
+    
+    if (pendingNeedPassword) {
+      UIkit.modal.prompt(CAPTCHA_I18N.needPassword, '', 'password')
+        .then(function(password) {
+          if (password) {
+            var pwInput = document.getElementById('ask_password_input');
+            if (pwInput) pwInput.value = password;
+            form.submit();
+          }
+        });
+    } else {
+      form.submit();
+    }
+  }
+
+  
+  document.getElementById('captcha-modal-submit').addEventListener('click', function() {
+    if (verifying) return;
+    var ans = document.getElementById('captcha-modal-answer').value.trim();
+    if (!ans) {
+      var errEl = document.getElementById('captcha-modal-error');
+      errEl.textContent = CAPTCHA_I18N.inputAnswer;
+      errEl.style.display = 'block';
+      return;
+    }
+    verifying = true;
+    fetch('/api/captcha/verify', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'X-CSRF-Token': getCSRFToken()
+      },
+      body: JSON.stringify({ id: captchaId, answer: parseInt(ans, 10) })
+    })
+    .then(function(r) { return r.json(); })
+    .then(function(data) {
+      verifying = false;
+      if (data.correct) {
+        if (pendingForm) doSubmit(pendingForm);
+      } else {
+        var errEl = document.getElementById('captcha-modal-error');
+        errEl.textContent = CAPTCHA_I18N.wrongAnswer;
+        errEl.style.display = 'block';
+        fetchCaptcha(); 
+      }
+    })
+    .catch(function() {
+      verifying = false;
+      var errEl = document.getElementById('captcha-modal-error');
+      errEl.textContent = CAPTCHA_I18N.verifyFailed;
+      errEl.style.display = 'block';
+      fetchCaptcha();
+    });
+  });
+
+  
+  document.getElementById('captcha-modal-answer').addEventListener('keydown', function(e) {
+    if (e.key === 'Enter') {
+      e.preventDefault();
+      document.getElementById('captcha-modal-submit').click();
+    }
+  });
+
+  
+  document.getElementById('captcha-modal-refresh').addEventListener('click', fetchCaptcha);
+
+  
+  document.addEventListener('click', function(e) {
+    var btn = e.target.closest('.math-captcha-trigger');
+    if (!btn) return;
+    e.preventDefault();
+
+    var form = btn.closest('form');
+    if (!form) return;
+    pendingForm = form;
+
+    
+    pendingNeedPassword = !!(form.querySelector('#ask_password_input'));
+
+    
+    var notifyCb = document.getElementById('notify-checkbox');
+    var emailInput = document.getElementById('email-input');
+    if (notifyCb && notifyCb.checked && emailInput && emailInput.value.trim() === '') {
+      UIkit.modal.alert(CAPTCHA_I18N.needEmail);
+      return;
+    }
+
+    fetchCaptcha();
+    UIkit.modal('#math-captcha-modal').show();
+  });
+})();
+</script>
+
+
+<link rel="shortcut icon" href="https://r2.337845818.best/tamabox/picture/2026/09/05/2e571390c431d19d75e51971a15bd6?v=2" crossorigin="anonymous"/>
+<link rel="apple-touch-icon" href="https://r2.337845818.best/tamabox/picture/2026/09/05/2e571390c431d19d75e51971a15bd6?v=2" crossorigin="anonymous"/>
+<link rel="icon" sizes="192x192" href="https://r2.337845818.best/tamabox/picture/2026/09/05/2e571390c431d19d75e51971a15bd6?v=2" crossorigin="anonymous">
+<style>
+   
+  .profile-votes-list { display: grid; gap: 0; }
+  .profile-vote-item {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 16px;
+    min-width: 0;
+    padding: 14px 16px;
+    border-bottom: 1px solid var(--tb-border, #e9e9e9);
+    text-decoration: none;
+  }
+  .profile-vote-item:first-child { border-top: 1px solid var(--tb-border, #e9e9e9); }
+  .profile-vote-item:hover { background: var(--tb-surface-hover, #f8fbff); text-decoration: none; }
+  .profile-vote-content { min-width: 0; }
+  .profile-vote-title {
+    display: block;
+    overflow: hidden;
+    color: var(--tb-text, #333);
+    font-size: 0.98rem;
+    font-weight: 600;
+    line-height: 1.45;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+  }
+  .profile-vote-meta {
+    display: flex;
+    flex-wrap: wrap;
+    align-items: center;
+    gap: 7px;
+    margin-top: 8px;
+  }
+  .profile-vote-meta .uk-label { font-size: 0.72rem; line-height: 1.6; }
+  .profile-vote-action {
+    flex: 0 0 auto;
+    color: var(--tb-primary, #1e87f0);
+    font-size: 0.82rem;
+    white-space: nowrap;
+  }
+  html[data-theme="dark"] .profile-vote-item { border-color: var(--tb-border); }
+  html[data-theme="dark"] .profile-vote-title { color: var(--tb-text); }
+  html[data-theme="dark"] .profile-vote-item:hover { background: rgba(78, 168, 245, 0.10); }
+   
+   
+  .profile-tabs {
+    display: flex;
+    gap: 4px;
+    padding: 4px;
+    margin-top: 20px;
+    margin-bottom: 18px;
+    border: 1px solid var(--tb-border, #e5e5e5);
+    border-radius: 9px;
+    background: var(--tb-surface-2, #fafafa);
+  }
+  .profile-tab {
+    flex: 1;
+    border: 0;
+    border-radius: 6px;
+    padding: 9px 15px;
+    background: transparent;
+    color: var(--tb-text-muted, #666);
+    cursor: pointer;
+    font-size: 0.9rem;
+    transition: background 0.2s ease, color 0.2s ease;
+  }
+  .profile-tab:hover { color: var(--tb-primary, #1e87f0); }
+  .profile-tab.is-active {
+    background: var(--tb-surface, #fff);
+    box-shadow: 0 1px 3px rgba(0, 0, 0, 0.10);
+    color: var(--tb-primary, #1e87f0);
+    font-weight: 600;
+  }
+   
+  .profile-tab.is-disabled,
+  .profile-tab:disabled {
+    cursor: not-allowed;
+    color: var(--tb-text-muted, #999);
+    opacity: 0.7;
+  }
+  .profile-tab.is-disabled:hover { color: var(--tb-text-muted, #999); }
+  .profile-panel[hidden] { display: none !important; }
+  html[data-theme="dark"] .profile-tabs {
+    border-color: var(--tb-border);
+    background: var(--tb-surface-2);
+  }
+  html[data-theme="dark"] .profile-tab { color: var(--tb-text-muted); }
+  html[data-theme="dark"] .profile-tab.is-active { background: var(--tb-surface); color: var(--tb-primary); }
+  html[data-theme="dark"] .profile-tab.is-disabled { color: var(--tb-text-muted); opacity: 0.55; }
+</style>
+<div class="uk-card uk-card-default uk-text-center">
+  <div class="uk-flex uk-flex-center uk-flex-middle uk-background-cover uk-light" style="min-height: 260px;" data-src="https://r2.337845818.best/tamabox/box_background.png" uk-img>
+    <div class="uk-card-body">
+      <img class="uk-border-circle uk-box-shadow-large" src="https://r2.337845818.best/tamabox/picture/2026/09/05/2e571390c431d19d75e51971a15bd6?v=2" crossorigin="anonymous" style="width: 100px; height: 100px; max-width: 100%; max-height: 100%;">
+      <h3 id="usernamecolor">小狼</h3>
+      <p id="introcolor">提问密码是12123。欢迎你，我的朋友，不管你是因为什么原因发现这个网站，都希望它能帮助到你。有疑问和建议可以在下方提交问题，或者加群聊聊。</p>
+        <div class="icon-container">
+        
+         <a href="https://www.acfun.cn/u/852888" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/ailicili.png" alt="acfunlink" class="icon">
+         </a>
+        
+        
+        
+         <a href="https://blog.tama.guru" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/weibo.png" alt="weibolink" class="icon">
+         </a>
+        
+        
+         <a href="https://blog.tama.guru" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/xiaohongshu.png" alt="xiaohongshulink" class="icon">
+         </a>
+        
+        
+          <a href="https://blog.tama.guru" target="_blank">
+           <img src="https://r2.337845818.best/tamabox/icon/social/blog.png" alt="bloglink" class="icon">
+         </a>
+        
+        </div>
+    </div>
+  </div>
+</div>
+<script>
+document.getElementById("usernamecolor").style.color = "#007bff";
+document.getElementById("introcolor").style.color = "#cd4c6c";
+</script>
+<div>
+  <div class="uk-card uk-card-default uk-card-small uk-card-body">
+    
+    
+    <script defer src="https://cdnjs.snrat.com/ajax/libs/jquery/3.7.1/jquery.min.js"></script>
+    <script defer src='https://r2.337845818.best/tamabox/cdn/js/remake/easy.qrcode.min.js' type="text/javascript"  charset="utf-8"></script>
+    <center><div id="boxqrimg"></div></center>
+    <script type="text/javascript">
+    document.addEventListener('DOMContentLoaded', function () {
+        var options = {
+            text: window.location.href,
+            width: 200,
+            height: 200,
+            
+            
+            colorDark: ( true  ? "#1C1918" : "#000000") || "#000000",
+            colorLight: "#6e6e6e" || "#FFFFFF",
+            dotScale: parseFloat("0.4") || 0.4,
+            dotScaleTiming: parseFloat("0.4") || 0.4,
+            dotScaleA: parseFloat("0.4") || 0.4,
+            correctLevel: QRCode.CorrectLevel.H,
+            logo: (function () {
+                
+                var a = "https:\/\/r2.337845818.best\/tamabox\/picture\/2026\/09\/05\/2e571390c431d19d75e51971a15bd6" || "https:\/\/r2.337845818.best\/tamabox\/tamabox_low.png";
+                return a ? (a.indexOf("http") === 0 ? a + "?v=2" : a) : undefined;
+            })(),
+            logoWidth: 60,
+            logoHeight: 60,
+            logoBackgroundTransparent: true,
+            
+            crossOrigin: 'anonymous',
+            backgroundImage: ("https:\/\/r2.337845818.best\/tamabox\/picture\/2024\/09\/22\/486a690e6f40a6e3939b474c9cb754" ? "https:\/\/r2.337845818.best\/tamabox\/picture\/2024\/09\/22\/486a690e6f40a6e3939b474c9cb754" : undefined),
+            backgroundImageAlpha: parseFloat("0.7") || 0.8,
+            autoColor: false,
+            PO: "#606175" || "#000000",
+            PI: "#606175" || "#000000",
+            AO: '',
+            AI: '',
+            timing: "#606175" || "#000000"
+        };
+        new QRCode(document.getElementById("boxqrimg"), options);
+    });
+    </script>
+ 
+    <p class="uk-text-center uk-text-small">扫码向@小狼提问<br>谁都可以以匿名的形式提问</p>
+
+    <div class="uk-text-center uk-margin-small-top">
+        <a id="share-btn" href="/_/tamakyi/share-card" download class="uk-button uk-button-default uk-button-small">
+            📤 分享提问箱
+        </a>
+    </div>
+
+    <div id="share-loading-overlay" style="display:none; position: fixed; top:0; left:0; width:100%; height:100%; background: rgba(255,255,255,0.85); z-index:9999;">
+        <div style="display:flex; flex-direction:column; align-items:center; justify-content:center; height:100%;">
+            <div uk-spinner="ratio: 2" class="uk-margin-bottom"></div>
+            <p class="uk-text-large uk-text-muted">正在生成分享图…</p>
+        </div>
+    </div>
+
+    <script>
+    (function() {
+        var btn = document.getElementById('share-btn');
+        var overlay = document.getElementById('share-loading-overlay');
+        if (!btn || !overlay) return;
+        btn.addEventListener('click', function(e) {
+            e.preventDefault();
+            overlay.style.display = 'block';
+            btn.style.pointerEvents = 'none';
+            fetch(btn.href)
+                .then(function(response) {
+                    if (!response.ok) throw new Error('网络错误');
+                    return response.blob();
+                })
+                .then(function(blob) {
+                    var url = URL.createObjectURL(blob);
+                    var a = document.createElement('a');
+                    a.href = url;
+                    a.download = 'share.png';
+                    document.body.appendChild(a);
+                    a.click();
+                    setTimeout(function() {
+                        document.body.removeChild(a);
+                        URL.revokeObjectURL(url);
+                    }, 100);
+                })
+                .catch(function(err) {
+                    alert('生成分享图失败，请稍后重试');
+                    console.error(err);
+                })
+                .finally(function() {
+                    overlay.style.display = 'none';
+                    btn.style.pointerEvents = 'auto';
+                });
+        });
+    })();
+    </script>
+    
+    
+
+
+
+
+
+
+
+
+
+    
+    <div class="profile-tabs" role="tablist">
+      <button type="button" class="profile-tab is-active" data-profile-tab="questions" role="tab" aria-selected="true">提问</button>
+      
+      <button type="button" class="profile-tab" data-profile-tab="votes" role="tab" aria-selected="false">投票</button>
+      
+    </div>
+
+    <div class="profile-panel" data-profile-panel="questions">
+    
+<form method="post" action="/_/tamakyi" enctype="multipart/form-data" id="form">
+  <input type="hidden" name="_csrf" value="PFoaNHKUbYlKfz8eh4St43Ipt7o6MTc4ODYwMDk4Nzc0MDc3ODMwNA">
+
+  
+  <input type="hidden" name="ask_password" id="ask_password_input" value="">
+  
+
+  <input type="hidden" name="start_chat_val" id="start_chat_val" value="false">
+  <input type="hidden" name="g-recaptcha-response" id="g-recaptcha-response" value="">
+
+  <div class="uk-margin uk-text-center">
+    <textarea name="content" class="uk-textarea" rows="5" placeholder="在此处撰写你的问题..."
+              maxlength="1000"></textarea>
+    <div x-data="{ files: null }" style="width: 100%; background-color: #f8f8f8; display: flex; padding-top: 5px; padding-bottom: 5px; align-items: center; justify-content: start;gap: 5px">
+      <div uk-form-custom>
+        <a href="#" class="uk-icon-link" uk-icon="image" style="margin-left: 10px"></a>
+        <span style="font-size: 12px" x-text="files ? files[0].name : '添加图片'"></span>
+        <input id="uploader" name="images" type="file" accept="image/*" x-on:change="files = Object.values($event.target.files)">
+      </div>
+      <button x-show="files" type="button" class="uk-icon-link" uk-icon="close" style="margin-left: 10px;"
+              @click="files = null"></button>
+    </div>
+  </div>
+
+  <div class="uk-margin uk-grid-small">
+    <label class="uk-text-small">
+      <input name="private" class="uk-checkbox" type="checkbox"> 回复后不公开
+    </label>
+    <label class="uk-text-small">
+      <input name="receive_reply_via_email" id="notify-checkbox" class="uk-checkbox" type="checkbox"> 接收通知
+    </label>
+    <div id="email-container" style="width: 100%; display: none;" class="uk-margin-small-top">
+      <input class="uk-input uk-form-small" type="email" name="receive_reply_email" id="email-input" placeholder="请输入你的邮箱地址">
+    </div>
+  </div>
+
+  <div class="uk-margin uk-text-center">
+    <div class="uk-grid-small uk-flex-center" uk-grid>
+      <div>
+        
+        <button type="button" class="uk-button uk-button-primary math-captcha-trigger" id="normal-submit-btn">发送提问</button>
+        
+      </div>
+      
+      <div>
+          <button type="button" class="uk-button uk-button-secondary" id="chat-submit-btn">发起私聊</button>
+      </div>
+      
+    </div>
+  </div>
+</form>
+
+<script>
+  
+  var notifyCheckbox = document.getElementById('notify-checkbox');
+  var emailContainer = document.getElementById('email-container');
+  var emailInput = document.getElementById('email-input');
+
+  if (notifyCheckbox && emailContainer && emailInput) {
+    notifyCheckbox.addEventListener('change', function() {
+      if (this.checked) {
+        emailContainer.style.display = 'block';
+        emailInput.setAttribute('required', 'required');
+      } else {
+        emailContainer.style.display = 'none';
+        emailInput.removeAttribute('required');
+        emailInput.value = '';
+      }
+    });
+  }
+
+  
+  var chatBtn = document.getElementById('chat-submit-btn');
+  if (chatBtn) {
+    chatBtn.addEventListener('click', function() {
+      var isLogged = false;
+      if (!isLogged) {
+        var currentURI = '\/_\/tamakyi';
+        UIkit.modal.dialog(
+            '<div class="uk-text-center uk-padding" style="min-height: 150px; display: flex; flex-direction: column; justify-content: center;">' +
+            '<h3 class="uk-modal-title uk-margin-small-bottom">需要登录</h3>' +
+            '<p class="uk-text-muted uk-margin-small-bottom">发起私聊需要登录账号</p>' +
+            '<a href="/login?to=' + encodeURIComponent(currentURI) + '" class="uk-button uk-button-primary">去登录</a>' +
+            '</div>',
+            {width: '400px'}
+        );
+        return;
+      }
+      document.getElementById('start_chat_val').value = 'true';
+      
+      var submitBtn = document.getElementById('normal-submit-btn');
+      if (submitBtn) submitBtn.click();
+      
+    });
+  }
+
+  
+</script>
+
+
+
+    
+    <p class="uk-text-left uk-text-muted uk-text-small">@小狼 以前回答过的问题 (32)</p>
+    
+<div id="question-list">
+  
+  <div data-qid="3029">
+    <hr>
+    <a class="uk-button uk-button-default uk-button-small uk-float-right"
+       href="/_/tamakyi/3029">查看回答</a>
+    <div class="uk-text-left uk-text-small uk-text-muted">
+      <span class="tb-pin-flag" title="已置顶">⭐</span>
+      2026-08-27 13:42:36
+    </div>
+    <p class="uk-text-small uk-text-break tb-preline tb-clamp-5">礼貌请教小狼提问箱如何避免被恶意利用
+</p>
+  </div>
+  
+  <div data-qid="2234">
+    <hr>
+    <a class="uk-button uk-button-default uk-button-small uk-float-right"
+       href="/_/tamakyi/2234">查看回答</a>
+    <div class="uk-text-left uk-text-small uk-text-muted">
+      <span class="tb-pin-flag" title="已置顶">⭐</span>
+      2026-05-12 21:22:46
+    </div>
+    <p class="uk-text-small uk-text-break tb-preline tb-clamp-5">小狼小狼，想问问可不可以实现提问后继续回复被提问者的功能，就像在同一层聊天一样；还有就是好像我发出提问之后，在提问者回答之前我好像都看不到自己发出的提问，这样的话感觉有点不好找（？）
+</p>
+  </div>
+  
+  <div data-qid="2894">
+    <hr>
+    <a class="uk-button uk-button-default uk-button-small uk-float-right"
+       href="/_/tamakyi/2894">查看回答</a>
+    <div class="uk-text-left uk-text-small uk-text-muted">
+      
+      2026-08-18 14:59:06
+    </div>
+    <p class="uk-text-small uk-text-break tb-preline tb-clamp-5">以下是markdown语法展示，大部分功能基本正常实现，空格和换行调整为一般语法，html代码暂不开放。
+标题展示：
+Heading level 1
+Heading level 2
+Heading level 3
+Heading level 4
+Heading level 5
+Heading level 6
+粗体：
+I just love bold text.
+斜体：
+Italicized text is the cat’s meow.
+又粗又斜：
+This text is really important.
+引用：
+&gt; Dorothy followed her through many of the beautiful rooms in her castle.
+列表：
+- First item
+- Second item
+- Third item
+    - Indented item
+    - Indented item
+- Fourth item
+代码块：
+At the command prompt, type nano.
+链接：
+这是一个链接 提问箱。
+</p>
+  </div>
+  
+  <div data-qid="2861">
+    <hr>
+    <a class="uk-button uk-button-default uk-button-small uk-float-right"
+       href="/_/tamakyi/2861">查看回答</a>
+    <div class="uk-text-left uk-text-small uk-text-muted">
+      
+      2026-08-13 02:04:36
+    </div>
+    <p class="uk-text-small uk-text-break tb-preline tb-clamp-5">这是个md测试:
+粗体
+斜体
+ 代码
+链接
+</p>
+  </div>
+  
+  <div data-qid="2463">
+    <hr>
+    <a class="uk-button uk-button-default uk-button-small uk-float-right"
+       href="/_/tamakyi/2463">查看回答</a>
+    <div class="uk-text-left uk-text-small uk-text-muted">
+      
+      2026-07-15 15:36:26
+    </div>
+    <p class="uk-text-small uk-text-break tb-preline tb-clamp-5">小狼有没有想过为什么人总是先学会告别再学会爱吗
+</p>
+  </div>
+  
+  <div data-qid="2405">
+    <hr>
+    <a class="uk-button uk-button-default uk-button-small uk-float-right"
+       href="/_/tamakyi/2405">查看回答</a>
+    <div class="uk-text-left uk-text-small uk-text-muted">
+      
+      2026-06-15 13:39:45
+    </div>
+    <p class="uk-text-small uk-text-break tb-preline tb-clamp-5">啊不是 是聊天室总是显示 应用程序错误：发生了客户端异常（更多信息请参见浏览器控制台）。（上一条打错字了orz
+</p>
+  </div>
+  
+  <div data-qid="2403">
+    <hr>
+    <a class="uk-button uk-button-default uk-button-small uk-float-right"
+       href="/_/tamakyi/2403">查看回答</a>
+    <div class="uk-text-left uk-text-small uk-text-muted">
+      
+      2026-06-15 13:28:43
+    </div>
+    <p class="uk-text-small uk-text-break tb-preline tb-clamp-5">小狼是什么mbti（
+</p>
+  </div>
+  
+  <div data-qid="2402">
+    <hr>
+    <a class="uk-button uk-button-default uk-button-small uk-float-right"
+       href="/_/tamakyi/2402">查看回答</a>
+    <div class="uk-text-left uk-text-small uk-text-muted">
+      
+      2026-06-15 13:27:29
+    </div>
+    <p class="uk-text-small uk-text-break tb-preline tb-clamp-5">页面底部的 聊天室 如何创建房间哇
+</p>
+  </div>
+  
+  <div data-qid="2399">
+    <hr>
+    <a class="uk-button uk-button-default uk-button-small uk-float-right"
+       href="/_/tamakyi/2399">查看回答</a>
+    <div class="uk-text-left uk-text-small uk-text-muted">
+      
+      2026-06-15 05:24:30
+    </div>
+    <p class="uk-text-small uk-text-break tb-preline tb-clamp-5">这个网站的页面和box.n3ko.cc这个好像（是同一个开发者嘛
+</p>
+  </div>
+  
+  <div data-qid="2215">
+    <hr>
+    <a class="uk-button uk-button-default uk-button-small uk-float-right"
+       href="/_/tamakyi/2215">查看回答</a>
+    <div class="uk-text-left uk-text-small uk-text-muted">
+      
+      2026-05-06 11:23:26
+    </div>
+    <p class="uk-text-small uk-text-break tb-preline tb-clamp-5">好厉害啊，自己做一个网站也太棒了吧👍🏻老师回复的好及时，感觉好温暖啊。原来这个提问箱背后是这样的初心，希望它能一直被好好运营下去，也谢谢你愿意分享这些想法✨
+</p>
+  </div>
+  
+  <div data-qid="2214">
+    <hr>
+    <a class="uk-button uk-button-default uk-button-small uk-float-right"
+       href="/_/tamakyi/2214">查看回答</a>
+    <div class="uk-text-left uk-text-small uk-text-muted">
+      
+      2026-05-06 10:46:32
+    </div>
+    <p class="uk-text-small uk-text-break tb-preline tb-clamp-5">小狼，你做这个网站是为了什么呀
+</p>
+  </div>
+  
+  <div data-qid="2172">
+    <hr>
+    <a class="uk-button uk-button-default uk-button-small uk-float-right"
+       href="/_/tamakyi/2172">查看回答</a>
+    <div class="uk-text-left uk-text-small uk-text-muted">
+      
+      2026-04-23 01:07:41
+    </div>
+    <p class="uk-text-small uk-text-break tb-preline tb-clamp-5">小狼小狼，请问可以有拉黑功能吗？
+</p>
+  </div>
+  
+  <div data-qid="2124">
+    <hr>
+    <a class="uk-button uk-button-default uk-button-small uk-float-right"
+       href="/_/tamakyi/2124">查看回答</a>
+    <div class="uk-text-left uk-text-small uk-text-muted">
+      
+      2026-03-20 18:26:42
+    </div>
+    <p class="uk-text-small uk-text-break tb-preline tb-clamp-5">谢谢小狼ruarua小狼（鞠躬
+</p>
+  </div>
+  
+  <div data-qid="2120">
+    <hr>
+    <a class="uk-button uk-button-default uk-button-small uk-float-right"
+       href="/_/tamakyi/2120">查看回答</a>
+    <div class="uk-text-left uk-text-small uk-text-muted">
+      
+      2026-03-16 23:02:34
+    </div>
+    <p class="uk-text-small uk-text-break tb-preline tb-clamp-5">小狼，你有哪个瞬间感觉到“界限”消失，又或者猛然意识到命运这回事吗🤔
+</p>
+  </div>
+  
+  <div data-qid="1978">
+    <hr>
+    <a class="uk-button uk-button-default uk-button-small uk-float-right"
+       href="/_/tamakyi/1978">查看回答</a>
+    <div class="uk-text-left uk-text-small uk-text-muted">
+      
+      2025-12-30 16:15:04
+    </div>
+    <p class="uk-text-small uk-text-break tb-preline tb-clamp-5">测试图片上传机能
+</p>
+  </div>
+  
+  <div data-qid="1906">
+    <hr>
+    <a class="uk-button uk-button-default uk-button-small uk-float-right"
+       href="/_/tamakyi/1906">查看回答</a>
+    <div class="uk-text-left uk-text-small uk-text-muted">
+      
+      2025-11-16 23:03:26
+    </div>
+    <p class="uk-text-small uk-text-break tb-preline tb-clamp-5">找了几个例子，这些”?“的位置以前都是emoji，看起来好像确实是比较新的emoji会显示成符号，老版常规的像❤️这样的就可以显示出来。回答页面也是类似的情况
+</p>
+  </div>
+  
+  <div data-qid="1905">
+    <hr>
+    <a class="uk-button uk-button-default uk-button-small uk-float-right"
+       href="/_/tamakyi/1905">查看回答</a>
+    <div class="uk-text-left uk-text-small uk-text-muted">
+      
+      2025-11-15 13:58:28
+    </div>
+    <p class="uk-text-small uk-text-break tb-preline tb-clamp-5">小狼，之前提问里的emoji是可以正常显示的，但是从昨天开始变成了”?“符号🤔不过也有个别emoji现在还能显示
+</p>
+  </div>
+  
+  <div data-qid="1706">
+    <hr>
+    <a class="uk-button uk-button-default uk-button-small uk-float-right"
+       href="/_/tamakyi/1706">查看回答</a>
+    <div class="uk-text-left uk-text-small uk-text-muted">
+      
+      2025-08-31 14:02:26
+    </div>
+    <p class="uk-text-small uk-text-break tb-preline tb-clamp-5">小狼小狼今天吃了什么！
+</p>
+  </div>
+  
+  <div data-qid="1573">
+    <hr>
+    <a class="uk-button uk-button-default uk-button-small uk-float-right"
+       href="/_/tamakyi/1573">查看回答</a>
+    <div class="uk-text-left uk-text-small uk-text-muted">
+      
+      2025-07-25 12:28:46
+    </div>
+    <p class="uk-text-small uk-text-break tb-preline tb-clamp-5">awa
+</p>
+  </div>
+  
+  <div data-qid="840">
+    <hr>
+    <a class="uk-button uk-button-default uk-button-small uk-float-right"
+       href="/_/tamakyi/840">查看回答</a>
+    <div class="uk-text-left uk-text-small uk-text-muted">
+      
+      2024-12-31 15:04:20
+    </div>
+    <p class="uk-text-small uk-text-break tb-preline tb-clamp-5">小狼小狼，如果提问者勾选了私密不公开提问，但又没有勾选接收通知，就算被提问者回答了，提问者是不是也没有办法看到回复呀？
+</p>
+  </div>
+  
+</div>
+
+
+<div x-data="{ more: true, loading: false, cursor: '0.1735628660879000000.840' }">
+  <button x-show="more" x-bind:disabled="loading" x-on:click.debounce="() => {
+          if (loading) return
+          loading = true
+          fetch(`/api/v1/user/tamakyi/questions?cursor=${cursor}`)
+            .then(response => response.json())
+            .then(resp => {
+              loading = false
+              // 外层为 ctx.JSON 的统一包装 {code, data, message}，内层才是分页负载；
+              // code !== 0（接口报错）时保持 more 不变，仅复位 loading，下次可重试。
+              if (!resp || resp.code !== 0) return
+              const payload = resp.data || {}
+              let items = Array.isArray(payload.data) ? payload.data : []
+              if (items.length === 0) {
+                more = false
+                return
+              }
+
+              // 防重兜底：先扫描 #question-list 下全部已渲染条目（含服务端首屏与既往
+              // 追加）的 data-qid 构造“已见”集合，仅追加未出现过的提问。若服务端因游标
+              // 未前进等原因返回了与已见内容相同的批次（重复加载历史 bug 的表现形态），
+              // 直接按“到底”处理并隐藏按钮，杜绝无限重复追加。
+              const seenQIDs = new Set()
+              document.querySelectorAll('#question-list [data-qid]').forEach(el => seenQIDs.add(Number(el.dataset.qid)))
+              items = items.filter(q => !seenQIDs.has(q.id))
+              if (items.length === 0) {
+                more = false
+                return
+              }
+
+              // 服务端下发复合键集游标（见上方注释），前端不自行拼接；
+              // has_more 由服务端多取一条探测得出，最后一页加载完立即隐藏按钮。
+              more = payload.has_more !== false
+              cursor = payload.next_cursor || cursor
+              items.forEach(question => {
+                const div = document.createElement('div')
+                div.dataset.qid = question.id
+                div.innerHTML = `
+                  <div>
+                    <hr>
+                    <a class='uk-button uk-button-default uk-button-small uk-float-right'
+                       href='/_/tamakyi/${question.id}'>查看回答</a>
+                    <div class='uk-text-left uk-text-small uk-text-muted'>
+                      ${question.is_pinned ? '<span class=\'tb-pin-flag\' title=\'已置顶\'>⭐</span>' : ''}
+                      ${dayjs(question.created_at).format('YYYY-MM-DD HH:mm:ss')}
+                    </div>
+                    <p class='uk-text-small uk-text-break tb-preline tb-clamp-5'></p>
+                  </div>`
+                div.getElementsByTagName('p')[0].innerText = question.content
+                document.getElementById('question-list').appendChild(div)
+              })
+            })
+            // 网络失败/响应非法 JSON 时复位 loading，避免按钮永远停留在加载中状态
+            .catch(() => { loading = false })
+        }" class="uk-button uk-button-default uk-width-1-1 uk-margin-small-bottom">
+    <span x-show="!loading">加载更多</span>
+    <span x-show="loading"><div uk-spinner="ratio: 0.8"></div> 加载中...</span>
+  </button>
+  <div x-show="!more" class="uk-text-meta uk-text-center">
+    <hr>
+    无更多留言
+    <br><br>
+  </div>
+</div>
+
+    
+    </div>
+
+    <div class="profile-panel" data-profile-panel="votes" hidden>
+    
+    
+    <div class="profile-votes-list">
+      
+      <a href="/vote/sANyLkiBNUGN" class="profile-vote-item">
+        <div class="profile-vote-content">
+          <span class="profile-vote-title" title="投票功能测试和建议反馈">投票功能测试和建议反馈</span>
+          <span class="profile-vote-meta">
+            
+            
+            
+            
+            <span class="uk-label uk-label-primary">表单收集</span>
+            <span class="uk-text-meta">2026-08-25</span>
+          </span>
+        </div>
+        <span class="profile-vote-action">去投票 <span uk-icon="icon: arrow-right; ratio: .8"></span></span>
+      </a>
+      
+    </div>
+    
+    </div>
+  </div>
+</div>
+<script>
+document.addEventListener('DOMContentLoaded', function() {
+  var tabs = document.querySelectorAll('[data-profile-tab]');
+  var panels = document.querySelectorAll('[data-profile-panel]');
+  function showPanel(name) {
+    tabs.forEach(function(tab) {
+      var active = tab.dataset.profileTab === name;
+      tab.classList.toggle('is-active', active);
+      tab.setAttribute('aria-selected', active ? 'true' : 'false');
+    });
+    panels.forEach(function(panel) {
+      panel.hidden = panel.dataset.profilePanel !== name;
+    });
+    if (window.history && window.history.replaceState) {
+      window.history.replaceState({}, document.title, window.location.pathname + window.location.search + (name === 'votes' ? '#votes' : ''));
+    }
+  }
+  tabs.forEach(function(tab) {
+    tab.addEventListener('click', function() { showPanel(tab.dataset.profileTab); });
+  });
+  
+  if (window.location.hash === '#votes' && document.querySelector('[data-profile-tab="votes"]')) {
+    showPanel('votes');
+  }
+});
+</script>
+<p class=" uk-text-right uk-text-muted uk-text-small">
+    您是本站第 <span id="busuanzi_value_site_uv"><span class="tb-spinner"></span></span> 位访客 | 本页面已被访问 <span id="busuanzi_value_page_pv"><span class="tb-spinner"></span></span> 次
+  <br>Powered by NekoBox | 狼ICP备 20230101<br>提问箱已成功存活：<span id="box_runtime"></span>
+  <br>
+  
+  <a href="https://box.tama.guru/_/tamakyi" target="_blank">找站长</a>
+  | <a href="https://blog.tama.guru" target="_blank">公告板</a>
+  | <a href="https://chat.tama.guru" target="_blank">聊天室</a>
+  | <a href="https://share.tama.guru" target="_blank">盘</a>
+  | <a href="https://status.tama.guru" target="_blank">监控板</a>
+  | <a href="https://tama.guru" target="_blank">导航页</a>
+</p>
+<br>
+</div>
+
+<script>
+  
+  
+  
+  
+  var SUBMIT_I18N = {
+    submitting: '提交中...',
+    uploading:  '上传中...'
+  };
+
+  function tbResetSubmitButtons() {
+    document.querySelectorAll('button[data-tb-submitting]').forEach(function(b) {
+      b.disabled = false;
+      b.removeAttribute('data-tb-submitting');
+      var orig = b.getAttribute('data-tb-restore');
+      if (orig !== null) {
+        b.innerHTML = orig;
+        b.removeAttribute('data-tb-restore');
+      }
+    });
+  }
+
+  document.addEventListener('submit', function(e) {
+    var form = e.target;
+    if (!form || form.tagName !== 'FORM') return;
+
+    
+    
+    if (e.defaultPrevented || form.getAttribute('data-tb-skip-submit-feedback') === '1') {
+      form.removeAttribute('data-tb-skip-submit-feedback');
+      return;
+    }
+
+    
+    
+    if (form.getAttribute('target') === '_blank') return;
+
+    
+    var trigger = e.submitter || form.querySelector('button[type="submit"]');
+
+    
+    var hasFile = false;
+    form.querySelectorAll('input[type="file"]').forEach(function(f) {
+      if (f.files && f.files.length > 0) hasFile = true;
+    });
+    var label = hasFile ? SUBMIT_I18N.uploading : SUBMIT_I18N.submitting;
+
+    if (trigger && trigger.tagName === 'BUTTON') {
+      trigger.setAttribute('data-tb-restore', trigger.innerHTML);
+      trigger.innerHTML = '<span uk-spinner="ratio: 0.6"></span> ' + label;
+    }
+
+    
+    form.querySelectorAll('button').forEach(function(b) {
+      b.disabled = true;
+      b.setAttribute('data-tb-submitting', '1');
+    });
+  });
+
+  
+  window.addEventListener('pageshow', tbResetSubmitButtons);
+</script>
+</body>
+</html>
diff --git a/outputs/tb-prod-test-qr-crop.png b/outputs/tb-prod-test-qr-crop.png
new file mode 100644
index 0000000..5c68d2e
Binary files /dev/null and b/outputs/tb-prod-test-qr-crop.png differ
diff --git a/outputs/tb-prod-test-qr.png b/outputs/tb-prod-test-qr.png
new file mode 100644
index 0000000..510f972
Binary files /dev/null and b/outputs/tb-prod-test-qr.png differ
diff --git a/outputs/timestamptz-migration-fix-8h.sql b/outputs/timestamptz-migration-fix-8h.sql
new file mode 100644
index 0000000..54550e3
--- /dev/null
+++ b/outputs/timestamptz-migration-fix-8h.sql
@@ -0,0 +1,124 @@
+-- ============================================================================
+-- TamaBox 存量时间 +8h 漂移反向修正脚本（线上执行版）
+-- 背景: 先前 timestamptz 迁移用 `AT TIME ZONE 'UTC'` 把存量"上海墙钟"误标为
+--       UTC，导致全部存量时间绝对时刻 +8h（页面显示比真实本地时间晚 8 小时）。
+-- 本脚本: 把当前值按 UTC 还原出原墙钟，再按 Asia/Shanghai 重新解释（净效果
+--       -8h 绝对时刻，会话显示回到真实本地墙钟）。与会话时区无关。
+-- 影响范围: nekobox.questions / users / censor_logs / upload_images 的
+--       created_at / updated_at / deleted_at（12 列，全为 timestamptz）。
+-- 安全: 全程无 DROP 业务对象；仅 CREATE SCHEMA/临时快照表 + ALTER TYPE。
+--       回滚方式见 PART 4（注释）。
+-- 预期: PART 3 各项判读通过即成功；异常则执行 PART 4 回滚后贴回输出。
+-- ============================================================================
+
+-- PART 0: 核对当前状态 -------------------------------------------------------
+-- 确认处于"错误状态"(时间列全为 timestamptz 且显示比真实晚 8h)。
+-- 应输出 12 列 timestamptz; 3089 应显示 08:01:16(错误态) 而非 00:01:16。
+SET TIME ZONE 'Asia/Shanghai';
+SELECT 'PART 0: 当前状态核对(仅本次修正涉及的4表12列)' AS step;
+SELECT table_name, column_name, data_type
+FROM information_schema.columns
+WHERE table_schema = 'nekobox'
+  AND table_name IN ('questions','users','censor_logs','upload_images')
+  AND column_name IN ('created_at','updated_at','deleted_at')
+ORDER BY table_name, column_name;
+SELECT id, created_at AS now_display, (extract(epoch FROM created_at)*1000000000)::numeric(30,0) AS epoch_ns
+FROM nekobox.questions WHERE id = 3089;
+
+-- PART 1: 迁移前快照 ----------------------------------------------------------
+CREATE SCHEMA IF NOT EXISTS diag_test;
+DROP TABLE IF EXISTS diag_test.fix_before;
+CREATE TABLE diag_test.fix_before(tbl text, col text, n bigint, s numeric);
+DO $$
+DECLARE r record;
+BEGIN
+  FOR r IN
+    SELECT table_name tbl, column_name col
+    FROM information_schema.columns
+    WHERE table_schema='nekobox' AND data_type='timestamp with time zone'
+      AND column_name IN ('created_at','updated_at','deleted_at')
+      AND table_name IN ('questions','users','censor_logs','upload_images')
+    ORDER BY table_name, column_name
+  LOOP
+    EXECUTE format(
+      'INSERT INTO diag_test.fix_before SELECT %L, %L, count(%I), sum(extract(epoch FROM %I)*1000000000) FROM nekobox.%I',
+      r.tbl, r.col, r.col, r.col, r.tbl);
+  END LOOP;
+END $$;
+SELECT 'PART 1: 快照完成' AS step, count(*) AS cols FROM diag_test.fix_before;
+
+-- PART 2: 反向修正 ------------------------------------------------------------
+-- 核心: 原墙钟按 Asia/Shanghai 解释。净效果 = 绝对时刻 -8h, 会话显示回本地墙钟。
+SELECT 'PART 2: 反向修正执行' AS step;
+DO $$
+DECLARE r record;
+BEGIN
+  FOR r IN
+    SELECT table_name tbl, column_name col
+    FROM information_schema.columns
+    WHERE table_schema='nekobox' AND data_type='timestamp with time zone'
+      AND column_name IN ('created_at','updated_at','deleted_at')
+      AND table_name IN ('questions','users','censor_logs','upload_images')
+    ORDER BY table_name, column_name
+  LOOP
+    EXECUTE format(
+      'ALTER TABLE nekobox.%I ALTER COLUMN %I TYPE timestamptz USING (%I AT TIME ZONE ''UTC'' AT TIME ZONE ''Asia/Shanghai'')',
+      r.tbl, r.col, r.col);
+  END LOOP;
+END $$;
+SELECT '修正完成' AS step;
+
+-- PART 3: 验收 -----------------------------------------------------------------
+-- 3.1 关键行: 会话上海显示应回到真实本地墙钟(3089=00:01:16.678885+08, epoch 1788537676678885000)
+DROP TABLE IF EXISTS diag_test.fix_after;
+CREATE TABLE diag_test.fix_after(tbl text, col text, n bigint, s numeric);
+DO $$
+DECLARE r record;
+BEGIN
+  FOR r IN
+    SELECT table_name tbl, column_name col
+    FROM information_schema.columns
+    WHERE table_schema='nekobox' AND data_type='timestamp with time zone'
+      AND column_name IN ('created_at','updated_at','deleted_at')
+      AND table_name IN ('questions','users','censor_logs','upload_images')
+    ORDER BY table_name, column_name
+  LOOP
+    EXECUTE format(
+      'INSERT INTO diag_test.fix_after SELECT %L, %L, count(%I), sum(extract(epoch FROM %I)*1000000000) FROM nekobox.%I',
+      r.tbl, r.col, r.col, r.col, r.tbl);
+  END LOOP;
+END $$;
+SELECT '3.1 修正后关键行(期望 3089=2026-09-05 00:01:16.678885+08 / epoch 1788537676678885000)' AS check_name;
+SELECT id, created_at AS val_after, (extract(epoch FROM created_at)*1000000000)::numeric(30,0) AS epoch_ns
+FROM nekobox.questions WHERE id IN (3089,3109,2411) ORDER BY id;
+
+-- 3.2 keyset 翻页抽查(期望第2页 3088,2883..2411 共18条)
+SELECT '3.2 keyset 第2页抽查' AS check_name;
+SELECT q.id
+FROM nekobox.questions q
+WHERE q.user_id = 329 AND q.deleted_at IS NULL AND q.answer <> '' AND q.is_private = false
+  AND q.is_pinned = false
+  AND (q.created_at < TIMESTAMPTZ '2026-09-05 00:01:16.678885+08'
+       OR (q.created_at = TIMESTAMPTZ '2026-09-05 00:01:16.678885+08' AND q.id < 3089))
+ORDER BY q.is_pinned DESC, q.created_at DESC, q.id DESC
+LIMIT 20;
+
+-- 3.3 全表差异留档(修正前后仅整体偏移, n 与结构不变; 供留档)
+SELECT '3.3 修正前后列计数(应逐列一致)' AS check_name;
+SELECT b.tbl, b.col, b.n AS n_before, a.n AS n_after
+FROM diag_test.fix_before b JOIN diag_test.fix_after a USING (tbl,col)
+WHERE b.n IS DISTINCT FROM a.n;
+
+-- 3.4 列类型(仍应为 timestamptz, 残余 without=0)
+SELECT '3.4 残余 timestamp without time zone(应0)' AS check_name;
+SELECT count(*) AS remain_without
+FROM information_schema.columns
+WHERE table_schema='nekobox' AND data_type='timestamp without time zone'
+  AND column_name IN ('created_at','updated_at','deleted_at');
+
+-- PART 4: 回滚(需要时才执行; 当前被注释) ---------------------------------------
+-- 若修正后发现问题需回到"错误态"(UTC 基准):
+--   把 PART 2 的 USING 子句换成  (%I AT TIME ZONE 'Asia/Shanghai' AT TIME ZONE 'UTC')
+--   即: ALTER TABLE nekobox.xxx ALTER COLUMN c TYPE timestamptz
+--        USING (c AT TIME ZONE 'Asia/Shanghai' AT TIME ZONE 'UTC');
+--   可先对比 diag_test.fix_before 快照确认还原。
diff --git a/outputs/timestamptz-migration-online.sql b/outputs/timestamptz-migration-online.sql
new file mode 100644
index 0000000..85a17a9
--- /dev/null
+++ b/outputs/timestamptz-migration-online.sql
@@ -0,0 +1,158 @@
+-- ============================================================================
+-- TamaBox 时间列 timestamptz 迁移脚本（线上执行版）
+-- 前置: 本脚本已在你提供的生产克隆库(nekobox_clone)完整验证通过:
+--   * 迁移后 epoch 与迁移前逐项一致(差异 0)
+--   * 回滚路径同样验证无损(可安全回退)
+--   * 会话时区无关(验证时使用 Asia/Shanghai 会话)
+-- 实际受影响表(含数据): questions / users / censor_logs / upload_images
+-- 其余表(conversations/messages/votes/...)时间列本来就是 timestamptz, 脚本会自动跳过
+-- 覆盖: 只读 + ALTER(DDL), 建议低峰窗口执行; 克隆实测全库 1.7s 完成
+-- 使用: psql/pgAdmin 整段按 PART 顺序执行, 把输出贴回核对
+-- 注意: 迁移期间避免应用滚动发布; 执行前确认无长时间运行事务持锁
+-- ============================================================================
+
+-- ============================================================================
+-- PART 0  前置核对: 列出将被迁移的列(线上应为 4 表 x 3 列 = 12 列)
+-- ============================================================================
+SELECT 'PART 0: 将被迁移的无时区时间列' AS step;
+SELECT table_name, column_name
+FROM information_schema.columns
+WHERE table_schema = 'nekobox'
+  AND data_type = 'timestamp without time zone'
+  AND column_name IN ('created_at','updated_at','deleted_at')
+ORDER BY table_name, column_name;
+
+-- ============================================================================
+-- PART 1  迁移前 epoch 快照(存入 diag_test schema, 供 PART 3 自动比对)
+-- ============================================================================
+SELECT 'PART 1: 迁移前快照' AS step;
+CREATE SCHEMA IF NOT EXISTS diag_test;
+DROP TABLE IF EXISTS diag_test.snap_before;
+CREATE TABLE diag_test.snap_before(tbl text, col text, n bigint, minv numeric, maxv numeric, s numeric);
+DO $$
+DECLARE r record;
+BEGIN
+  FOR r IN
+    SELECT table_name tbl, column_name col
+    FROM information_schema.columns
+    WHERE table_schema='nekobox' AND data_type='timestamp without time zone'
+      AND column_name IN ('created_at','updated_at','deleted_at')
+    ORDER BY table_name, column_name
+  LOOP
+    EXECUTE format(
+      'INSERT INTO diag_test.snap_before SELECT %L, %L, count(%I), min(extract(epoch FROM %I)*1000000000), max(extract(epoch FROM %I)*1000000000), sum(extract(epoch FROM %I)*1000000000) FROM nekobox.%I',
+      r.tbl, r.col, r.col, r.col, r.col, r.col, r.tbl);
+  END LOOP;
+END $$;
+SELECT '快照完成, 共 ' || count(*) || ' 列' AS info FROM diag_test.snap_before;
+
+-- ============================================================================
+-- PART 2  执行迁移
+-- 核心语义: 库存值是 UTC 墙钟, 用 AT TIME ZONE 'UTC' 显式解释为 timestamptz,
+--           与会话时区无关。绝不可用裸 ALTER(会按会话时区解释 -> 全部 -8h 偏移)。
+-- ============================================================================
+SELECT 'PART 2: 执行迁移' AS step;
+DO $$
+DECLARE r record;
+BEGIN
+  FOR r IN
+    SELECT table_name tbl, column_name col
+    FROM information_schema.columns
+    WHERE table_schema='nekobox' AND data_type='timestamp without time zone'
+      AND column_name IN ('created_at','updated_at','deleted_at')
+    ORDER BY table_name, column_name
+  LOOP
+    EXECUTE format(
+      'ALTER TABLE nekobox.%I ALTER COLUMN %I TYPE timestamptz USING %I AT TIME ZONE ''UTC''',
+      r.tbl, r.col, r.col);
+  END LOOP;
+END $$;
+SELECT '迁移完成' AS step;
+
+-- ============================================================================
+-- PART 3  验收(4 项全绿 = 迁移成功; 任一项不满足立即执行 PART 4 回滚)
+-- ============================================================================
+SELECT 'PART 3: 验收' AS step;
+
+-- 3.1 迁移后快照并自动比对: 差异应为 0 行
+DROP TABLE IF EXISTS diag_test.snap_after;
+CREATE TABLE diag_test.snap_after(tbl text, col text, n bigint, minv numeric, maxv numeric, s numeric);
+DO $$
+DECLARE r record;
+BEGIN
+  FOR r IN
+    SELECT table_name tbl, column_name col
+    FROM information_schema.columns
+    WHERE table_schema='nekobox' AND data_type='timestamp with time zone'
+      AND column_name IN ('created_at','updated_at','deleted_at')
+    ORDER BY table_name, column_name
+  LOOP
+    EXECUTE format(
+      'INSERT INTO diag_test.snap_after SELECT %L, %L, count(%I), min(extract(epoch FROM %I)*1000000000), max(extract(epoch FROM %I)*1000000000), sum(extract(epoch FROM %I)*1000000000) FROM nekobox.%I',
+      r.tbl, r.col, r.col, r.col, r.col, r.col, r.tbl);
+  END LOOP;
+END $$;
+SELECT '3.1 迁移前后 epoch 差异(应为 0 行)' AS check_name;
+SELECT b.tbl, b.col, b.n AS n_before, a.n AS n_after,
+       b.minv AS min_before, a.minv AS min_after,
+       b.maxv AS max_before, a.maxv AS max_after,
+       b.s AS sum_before, a.s AS sum_after
+FROM diag_test.snap_before b
+JOIN diag_test.snap_after a USING (tbl, col)
+WHERE b.n IS DISTINCT FROM a.n OR b.minv IS DISTINCT FROM a.minv
+   OR b.maxv IS DISTINCT FROM a.maxv OR b.s IS DISTINCT FROM a.s;
+
+-- 3.2 残余无时区时间列(应为 0)
+SELECT '3.2 残余 timestamp without time zone(应 0)' AS check_name;
+SELECT count(*) AS remain_without
+FROM information_schema.columns
+WHERE table_schema='nekobox' AND data_type='timestamp without time zone'
+  AND column_name IN ('created_at','updated_at','deleted_at');
+
+-- 3.3 关键行 epoch 指纹(应与迁移前/线上游标一致)
+SELECT '3.3 关键行 epoch 指纹' AS check_name;
+SELECT id, (extract(epoch FROM created_at)*1000000000)::numeric(30,0) AS epoch_ns
+FROM nekobox.questions WHERE id IN (3109, 3089, 2411) ORDER BY id;
+
+-- 3.4 keyset 翻页抽查: 应精确返回 3088,2883,...,2411 共 18 条(与修复后线上第2页一致)
+SELECT '3.4 keyset 翻页抽查(第2页)' AS check_name;
+SELECT q.id
+FROM nekobox.questions q
+WHERE q.user_id = (SELECT id FROM nekobox.users WHERE domain='aoi')
+  AND q.deleted_at IS NULL AND q.answer <> '' AND q.is_private = false
+  AND q.is_pinned = false
+  AND (q.created_at < TIMESTAMPTZ '2026-09-05 00:01:16.678885+00'
+       OR (q.created_at = TIMESTAMPTZ '2026-09-05 00:01:16.678885+00' AND q.id < 3089))
+ORDER BY q.is_pinned DESC, q.created_at DESC, q.id DESC;
+
+-- ============================================================================
+-- PART 4  回滚(仅在 PART 3 验收不通过或线上出现异常时执行)
+-- 还原为 timestamp, 与迁移前快照一致(已在克隆库验证无损)
+-- ============================================================================
+-- SELECT 'PART 4: 回滚(按需执行)' AS step;
+-- DO $$
+-- DECLARE r record;
+-- BEGIN
+--   FOR r IN
+--     SELECT table_name tbl, column_name col
+--     FROM information_schema.columns
+--     WHERE table_schema='nekobox' AND data_type='timestamp with time zone'
+--       AND column_name IN ('created_at','updated_at','deleted_at')
+--       AND table_name IN ('questions','users','censor_logs','upload_images')
+--     ORDER BY table_name, column_name
+--   LOOP
+--     EXECUTE format(
+--       'ALTER TABLE nekobox.%I ALTER COLUMN %I TYPE timestamp USING %I AT TIME ZONE ''UTC''',
+--       r.tbl, r.col, r.col);
+--   END LOOP;
+-- END $$;
+-- SELECT '回滚完成(可再次跑 PART 3 核验)' AS step;
+-- ============================================================================
+-- 验收说明:
+--   3.1 = 0 行且 3.2 = 0、3.3 指纹与迁移前一致、3.4 翻出 18 条 -> 迁移成功
+--   任何一项不符 -> 执行 PART 4 回滚后停止排查, 联系开发
+-- 迁移后建议:
+--   1) 重新部署应用(含 parsePinCursor 的 .UTC() 修复版本)
+--   2) 复跑今日翻页验收脚本, 预期 38 条唯一收敛
+--   3) 确认无误后可清理 diag_test schema: DROP SCHEMA diag_test;
+-- ============================================================================
diff --git a/outputs/tutorial-dual-cdn-split-routing.md b/outputs/tutorial-dual-cdn-split-routing.md
new file mode 100644
index 0000000..87d9a57
--- /dev/null
+++ b/outputs/tutorial-dual-cdn-split-routing.md
@@ -0,0 +1,314 @@
+# 以狼的提问箱为例-免备案双 CDN 分流实战教程：境内走 EdgeOne、境外走 Cloudflare
+
+> **教程性质**：
+> 本文以 狼的提问箱 项目为例，但所有原理与步骤对任何「不备案、有海外用户、想让境内/境外各走最优线路」的站点通用。
+>
+> 场景速览：域名权威 DNS 托管在 **DNSPod**（免费版支持按「境内 / 境外 / 默认」线路返回不同解析结果）；境内线路 CNAME 到**腾讯 EdgeOne 国际站**（免备案区域，大陆用户落到香港等最近节点，走腾讯跨境骨干，比 Cloudflare 免费版大陆绕行明显更快）；境外/默认线路 CNAME 到 **Cloudflare 优选 IP**（经 Cloudflare for SaaS 自定义主机名识别流量，由既有 Cloudflare Tunnel 回源）。
+
+
+---
+
+## 1. 为什么能这么搭 —— 三个关键认知
+
+整套方案成立的前提，是先把三个「概念解耦」想清楚：
+
+### 1.1 Cloudflare for SaaS：让「流量识别」与「DNS 解析权」解耦
+
+Cloudflare 普通接入（Free 套餐）要求把整域 NS 迁到 Cloudflare，这与「DNS 要放在 DNSPod 做分线路」**天然冲突**——NS 在谁手里，谁才说了算。
+
+Cloudflare for SaaS（免费额度 100 个自定义主机名）绕开这个限制：
+
+- 你有一个**承载 zone**（例如 `cf-zone.example.net`，托管在 Cloudflare）；
+- 在承载 zone 里把目标域名（`box.example.com`）加为 **Custom Hostname**，并验证归属；
+- Cloudflare 边缘从此「认识」这个域名：**任何带着 `Host: box.example.com` 到达 CF 边缘的请求**，都会被匹配证书、按配置路由（本项目为 Tunnel 回源）。
+
+关键结论：**CF 侧只负责"来了流量怎么认、怎么转"，不负责"流量怎么来"**。流量能不能到 CF 边缘，取决于你自己的 DNS（DNSPod）把境外用户解析到哪。所以「境外走 CF」必须在 DNSPod 配一条境外线路指向 CF 的 IP/CNAME——CF 自己不会拉客。
+
+### 1.2 DNSPod 分线路：免费就能「同一域名，不同答案」
+
+腾讯云解析（DNSPod）免费版就支持按查询来源返回不同记录：线路可选「中国境内 / 境外 / 默认」，境内细分到省、运营商。**默认线路是兜底**，任何未命中的查询都走它。
+
+要理解一个易错点：**分线路的判定发生在 DNSPod 的权威服务器上**，依据是「递归 DNS 服务器的出口 IP 归属地」——所以「境外用户走境外线路」成立的前提是境外用户的递归 DNS（8.8.8.8 等）能真的问到 DNSPod 权威，且没被中间网络劫持/污染（第 6 节有实战案例）。
+
+### 1.3 EdgeOne 国际站：选对「加速区域」就不用备案
+
+EdgeOne 分「中国大陆可用区 / 全球可用区（不含中国大陆）/ 海外可用区」等区域配置。官方口径：
+
+- 选 **全球可用区（不含中国大陆）** 或海外区域 → **不要求 ICP 备案**；
+- 选中国大陆区域 → 必须备案。
+
+不备案的代价：大陆用户**没有本地节点**，请求落到最近的海外节点（大陆一般落香港，也有日韩/新加坡等），由腾讯跨境骨干回源。实测体验通常仍明显优于 Cloudflare 免费版大陆线路（后者常绕美/日且抖动大）——所以「不备案也选 EO 当境内线路」是有实测前提的，切换前建议先测速对比。
+
+> 补充：Cloudflare for SaaS 启用通常需要账户先绑定支付方式，额度内不扣费。
+
+---
+
+## 2. 目标架构
+
+```
+        DNS 层   DNSPod（example.com 整域权威，免费版支持按线路返回）
+                NS = byron.dnspod.net / sunshine.dnspod.net（官方 NS）
+                box CNAME 记录
+                   ├─ 境内  ──▶ box.example.com.edgeone.example   （EdgeOne 接入目标）
+                   ├─ 境外  ──▶ cf-pref.example.net               （CF 优选 IP 域名）
+                   └─ 默认  ──▶ cf-pref.example.net               （兜底，语义同境外）
+   ┌──────────────┴──────────────────────────────┐
+大陆用户 ▶▶（命中境内线路）        ◀◀ 海外用户（命中境外/默认线路）
+   ▼                                             ▼
+EdgeOne 国际站                            Cloudflare 边缘
+区域: 全球(不含中国大陆)                  优选 IP: 198.51.100.x（示例段）
+证书: TrustAsia, CN=box.example.com      识别: for SaaS 自定义主机名
+回源: EO 直连源站公网端口                 回源: Cloudflare Tunnel（纯出站）
+   │                                             │
+   └──────────────────┬──────────────────────────┘
+                      ▼
+  源站防火墙 iptables+ipset（仅放行 EO 回源网段；cloudflared 走 127.0.0.1 不受影响）
+                      ▼
+  HTTP 应用直接监听公网高位端口（本项目 TamaBox，无 nginx）
+```
+
+两条回源路径互不干扰：EO 是 **入站直连**（需开放端口 + 白名单锁定），CF 是 **Tunnel 出站**（无需任何入站规则）。
+
+---
+
+## 3. 前置条件清单
+
+| # | 条件 | 说明 |
+|---|---|---|
+| 1 | 一个域名（`example.com`），权威 DNS 托管在 DNSPod | 免费版即可；注册局委派的 NS = byron/sunshine.dnspod.net |
+| 2 | 一个 Cloudflare 账户 + 承载 zone（`cf-zone.example.net`） | 用于 for SaaS 与 Tunnel；**域名本身的 DNS 不用迁给 CF** |
+| 3 | cloudflared Tunnel 已在跑 | 服务器 → CF 纯出站连接，绑定承载域 `box.cf-zone.example.net` |
+| 4 | 服务器有公网 IP，且能开一个高位入站端口 | 给 EO 回源用；**不需要 nginx**，应用直接监听即可 |
+| 5 | EdgeOne 账户（本例国际站 edgeone.ai） | 选免备案区域 |
+| 6 | CF 账户已绑支付方式 | 启用 for SaaS 的前提（额度内不扣费） |
+| 7 | 服务器 1C1G 级别即可 | iptables/ipset 是内核规则，无常驻进程 |
+
+---
+
+## 4. 分步实施
+
+> 建议顺序：**先 CF（步骤 A）→ 再 EO（步骤 B）→ 再 DNS（步骤 C）→ 最后服务器（步骤 D）**。
+> 前两步做完，流量仍在旧路径上，随时可暂停；步骤 C/D 才真正切换与收敛。
+
+### Step A —— Cloudflare 侧：SaaS 自定义主机名 + Tunnel（本次零改动，讲解原理）
+
+本项目 `box.example.com` 的 SaaS 自定义主机名此前已配好（放在承载 zone `cf-zone.example.net` 下），Tunnel 已正常回源。若从零配置，动作是：
+
+1. 承载 zone `cf-zone.example.net` → **SSL/TLS → Custom hostnames** → Add custom hostname，填 `box.example.com`；
+2. 按提示完成归属验证（加一条 TXT 或 CNAME 验证记录）；
+3. 在 Tunnel 的路由里把 `box.example.com` 指到本地 HTTP 服务（`http://127.0.0.1:端口`）；
+4. 记录页里能拿到该主机名的 **CNAME target**（形如 `<hash>.cdn.cloudflare.net`）——它是「把流量引到 CF 边缘」的官方入口。
+
+> ⚠️ 本项目实际没用 SaaS CNAME target，而是用**优选 IP CNAME（`cf-pref.example.net`）**：一个第三方维护的、解析到 CF 低延迟边缘 IP 的域名。原理相同——解析结果落在 CF 边缘，CF 靠 `Host: box.example.com` 识别出这是 SaaS 自定义主机名流量再按 Tunnel 路由。**优选域名的可用性依赖第三方维护，失效时换回官方 CNAME target 即可**（第 7 节维护清单）。
+>
+> 本项目 DNSPod 上境外/默认线路指向的是 `cf-pref.example.net`。
+
+### Step B —— EdgeOne 侧：添加站点（CNAME 接入，免备案区域）
+
+1. EO 控制台 → 添加站点 → 填 `box.example.com`；
+2. **接入方式选 CNAME 接入**（⚠️ 不要选 NS 接入——NS 接入会要求把域名托管给 EO，与 DNSPod 分线路冲突，和「DNS 在 CF 手里没法分线路」是同一个问题）；
+3. **加速区域选「全球可用区（不含中国大陆）」**（免备案的关键选择）；
+4. 归属验证：按 EO 提示添加验证记录（本项目用 TXT：`edgeonereclaim.example.com TXT ...`），**记录加在 DNSPod 的默认线路**（CA/验证服务器多在境外，放默认线路全球可见最稳）；
+5. 配置回源：源站地址 = 你的公网 IP + 高位端口，Host 头 = `box.example.com`；回源协议按你的源站监听协议选（应用直监听 HTTP 就选 HTTP，TLS 由 EO 边缘终结）；
+6. 免费证书：CNAME 验证通过 + 回源配置就绪后，EO 自动签发（本项目 TrustAsia，`CN=box.example.com`）。签发需要几分钟到几小时——**在证书签发完成前，443 会拿 `*.cdn.myqcloud.com` 兜底证书应答**，浏览器会出现证书/HSTS 报错（第 6 节排障 6.1），属正常过程，等签发即可；
+7. **开启「客户端 IP 头」**（关键，默认关闭！）：站点 → 网络优化 / 规则引擎 → 客户端 IP 头部 → 开启，**自定义头部名必须填 `EO-Client-IP`**——应用侧固定读取这个名字；
+8. **删除/改写伪造的 CF 头**：在 EO 加一条规则引擎规则，把客户端可能携带的 `CF-Connecting-IP` / `X-Real-IP` 等头删掉——否则大陆攻击者经 EO 带假 CF 头，会被应用当成 CF 流量优先信任（头信任模型见 Step D）。
+
+### Step C —— DNSPod 分线路：三条记录
+
+权威 DNS 在 DNSPod（整域 zone `example.com`），所以**直接在整域 zone 里配，不需要任何子域委派**。
+
+| 主机记录 | 类型 | 线路 | 记录值 | TTL |
+|---|---|---|---|---|
+| `box` | CNAME | **中国境内** | `box.example.com.edgeone.example`（EO 分配的目标） | 120~600 |
+| `box` | CNAME | **境外** | `cf-pref.example.net`（CF 优选 / 或 SaaS CNAME target） | 600 |
+| `box` | CNAME | **默认** | `cf-pref.example.net`（兜底，语义同境外） | 600 |
+
+要点：
+
+- **EO 归属验证 TXT 保持「默认」线路**（全球可见），别只放境内；
+- 若之前误把 EO 的 CNAME 建在「默认」线路，会导致全球都走 EO——把它改成「中国境内」，境外/默认补 CF 两条；
+- TTL 别太大，方便回滚与换优选域时快速生效。
+
+### Step D —— 服务器侧：应用监听 + 信任头 + 端口锁定
+
+#### D1 应用直接监听公网端口（免 nginx）
+
+本项目 TamaBox 自带 HTTP 服务器，改配置即可：
+
+```ini
+[server]
+listen = 0.0.0.0:18080   ; 从仅本机 127.0.0.1 改为全网卡，EO 才能远程连入（18080 仅为示例端口）
+```
+
+- cloudflared 连的是 `127.0.0.1:端口`，`0.0.0.0` 监听兼容回环连入，**Tunnel 分支不受影响**；
+- nginx 在本方案中从头到尾不是必需——防火墙（iptables/ufw）是内核规则，零常驻进程，比 nginx 轻得多，适合 1C1G 小机器。
+
+#### D2 应用信任两家 CDN 的权威头
+
+`conf/app.ini`：
+
+```ini
+[security]
+trust_proxy = true
+```
+
+配合代码层支持（本项目 `internal/shared/ip.go` 的 `ResolveClientIP`），信任顺序：
+
+1. `CF-Connecting-IP`（Cloudflare 权威头，海外分支）；
+2. `EO-Client-IP`（EdgeOne 权威头，境内分支）；
+3. 兜底：TCP 对端 RemoteAddr。
+
+> ⚠️ **头信任的安全前提（缺一不可）**：
+> 1. 源站防火墙**只放行两家 CDN 的回源来源**（EO 直连需要；CF 分支天然安全——Tunnel 是出站，外人到不了源站）；
+> 2. EO 侧已删除伪造的 CF 头（Step B-8）；
+> 3. 若还有 CF 侧直连，同样在 CF 规则里删除伪造的 EO 头。
+>
+> 任一缺失，「信任头」就会被攻击者直连源站 + 自带假头绕过——限流/封禁会拿到伪造 IP。
+
+#### D3 端口白名单：iptables + ipset 自动维护（EO 免费档没有官方回源段）
+
+EO 官方回源清单由「源站防护 / Origin ACL」提供（配套 `DescribeOriginACL` API），**但该功能只支持付费套餐**——免费档在控制台找不到入口，也没有可拉取的清单 URL。
+
+> 🔴 **免费档方案定稿（2026-09-03 实测）**：**不要**逐个收集 EO 出口 IP 做白名单——实测发现 EO 回源出口是**海量轮换节点池**（一次 23 秒抓包就出现 13 个不同出口、散布多个腾讯云 /16 段），逐 IP 白名单必然间歇漏放 → 境内访问偶发 **521**（EO 边缘回源失败）。正解 = 直接放行 EO 所属的**腾讯云大段**（CIDR 整段入清单，脚本原生支持）。实测生效清单见下。
+
+交付脚本 `scripts/edgeone-origin-whitelist.sh`（bash，需 root，架构要点）：
+
+- 白名单放 **ipset 集合** `EO_ORIGIN`，iptables 一条规则引用它：`自建链 EO_IN` 内「命中集合放行 → 其余 REJECT tcp-reset」。INPUT 层规则默认**只对公网网卡 eth0 生效**（`EO_IFACE` 可配，网卡名不同必改否则端口裸奔）；cloudflared 本机回连走独立的 `-i lo` ACCEPT 放行，与网卡限定解耦；
+- 更新走「临时集填充 → `ipset swap` 原子替换」：**同步全程无规则清空窗口**；
+- **fail-safe**：拉取失败 / 清单为空 / 全非法 → 拒绝更新、保留现网，绝不误删导致端口裸奔；
+- 命令：`sync`（周期入口）/ `auto`（采集当前回源 IP → 新段预警）/ `learn`（即时观测）/ `show` / `flush`（回滚）/ `--dry-run`；
+- 清单来源：本地文件（`/etc/edgeone-origin/cidr.txt`）+ 可选 URL，取并集。脚本支持每行一个 IP 或 CIDR。
+
+落地四步：
+
+```bash
+# 1. 改端口（默认 18080 → 你的实际端口）
+# 2. 安装 ipset
+apt-get install -y ipset
+# 3. 建清单：放行腾讯云 EO 大段（每行一个 CIDR，# 注释；以下为实测生效配置）
+mkdir -p /etc/edgeone-origin
+cat > /etc/edgeone-origin/cidr.txt <<'EOF'
+43.146.0.0/16
+43.152.0.0/16
+43.168.0.0/16
+43.174.0.0/16
+43.175.0.0/16
+EOF
+#    段哪来的？用脚本 auto / tcpdump 持续观察回源出口，把出现的 IP whois 归并到所属腾讯云段
+#    注意：种子/采样是 EO 的"出口 IP"，不是应用日志里的客户端 IP（日志里是 EO-Client-IP，
+#    客户端真实 IP，不能当白名单）！段级方案下无需逐个采种，新段靠 auto 月度预警
+bash edgeone-origin-whitelist.sh sync --dry-run
+bash edgeone-origin-whitelist.sh sync
+# 4. 验证：外网机器 nc -zv <IP> 18080 应 refused；境内访问 https://box.example.com 应正常（无 521）
+# 5. 挂定时：cron「17 4 */3 * *」或 systemd timer 每 3 天一次 sync（EO 段以月计才变）
+```
+
+> 日后升级付费套餐：把 `DescribeOriginACL` API 的输出写入 `cidr.txt` 即可，脚本零改动。
+
+---
+
+## 5. 验证方法（含大陆 DNS 劫持陷阱）
+
+### 5.1 分线路是否生效（🔴 重点：别在大陆本机 nslookup 境外 DNS）
+
+大陆网络对发往境外公共 DNS（8.8.8.8 / 1.1.1.1 / 9.9.9.9 / OpenDNS，**UDP 53 和 TCP 53 都会被劫持**）的查询会返回**按境内线路伪造的答案**——在本机 `nslookup box.example.com 8.8.8.8` 永远显示 EO，即使境外线路早已配好。正确验证通道：
+
+```bash
+# 境内视角（本机直接查即可，通道可信）
+nslookup box.example.com 223.5.5.5      # 期望 → CNAME edgeone.example → 203.0.113.x（EO 示例段）
+nslookup box.example.com 119.29.29.29   # 同上（DNSPod 自家 DNS）
+
+# 境外视角：用「境外服务器代为查询」，浏览器直接打开下面两个 API 之一
+# https://api.hackertarget.com/dnslookup/?q=box.example.com
+# https://networkcalc.com/api/dns/lookup/box.example.com
+# 期望 → CNAME cf-pref.example.net → 198.51.100.x（CF 边缘 IP 示例段）
+```
+
+两条结果**不一样 = 分线路生效**。
+
+### 5.2 HTTPS 证书是否就绪
+
+```bash
+echo | openssl s_client -connect box.example.com:443 -servername box.example.com \
+  | openssl x509 -noout -subject -issuer -dates
+# 期望 subject = CN=box.example.com（而不是 *.cdn.myqcloud.com 兜底证书）
+```
+
+### 5.3 真实 IP 是否被正确识别
+
+境内访问后看源站/EO 访问日志中的客户端 IP = 你的大陆公网出口 IP（说明 `EO-Client-IP` 生效）；海外访问后同理应为你的海外出口 IP（`CF-Connecting-IP`）。
+
+---
+
+## 6. 今日排障实录（每个坑都值得记）
+
+### 6.1 「网站使用 HSTS」报错 = EO 证书还没签发（不是配置错）
+
+现象：DNS 切到 EO 后浏览器报 HSTS 错误页。
+原因链：之前走 CF HTTPS 时应用下发了 `Strict-Transport-Security: max-age=31536000; includeSubDomains`（按 ExternalURL 以 https 开头就对每个响应下发）→ 浏览器记录「一年内必须 HTTPS」→ 切到 EO 后证书尚未签发、443 拿 `*.cdn.myqcloud.com` 兜底证书 → 证书与域名不匹配 → HSTS 错误页。
+处理：等 EO 证书签发（几分钟~几小时）即可，**域名不在 HSTS preload 列表，浏览器自动恢复，无需清缓存**。紧急回滚 = DNS 改回 CF。
+（若在 preload 列表里才是真麻烦——需先修好证书再等 preload 移除，故平时别主动提交 preload。）
+
+### 6.2 误判「权威 DNS 在 Cloudflare」（方向性错误）
+
+现象：一度以为 `example.com` 权威在 Cloudflare，推导出「需要子域 NS 委派」的复杂方案，差点让用户在 CF 做一堆不存在 zone 的操作。
+根因：apex `example.com` 本身是一条 CNAME → `your-project.pages.dev`（Cloudflare Pages 项目）——nslookup 查 NS 时**一路跟随 CNAME 链**走到 pages.dev 的 NS（CF），被误读为「example.com zone 在 CF」。
+正确做法：**查域名权威必须问注册局（RDAP）或直查 SOA**，不能信递归 CNAME 链：
+
+```bash
+# RDAP（注册局铁证）：https://rdap.org/domain/example.com → 应返回 byron/sunshine.dnspod.net
+# 或直查 SOA：nslookup -type=SOA example.com byron.dnspod.net
+```
+
+用户一句「我的 Cloudflare 根本没有 example.com zone」就是最有效的纠偏信号——**控制台里没有的 zone，DNS 上不可能归它管**。
+
+### 6.3 「境外也返回 EO」的假象 = 大陆 DNS 劫持（连 TCP 53 都劫）
+
+现象：从大陆本机用 nslookup 测 8.8.8.8 / 9.9.9.9 / OpenDNS（UDP 和 TCP 都试），境外视角全部返回 EO，一度以为分线路没生效、甚至怀疑 DNSPod 配置错了。
+真相：大陆网络劫持出境 DNS 查询，返回按境内线路伪造的 EO 答案，请求根本没到境外服务器。
+破案手段：用**境外服务器**（hackertarget / networkcalc API）代为查询，立刻看到 CF 答案——DNSPod 三线路配置完全正确，从未出过错。教训见 5.1。
+
+### 6.4 残留的阿里云验证记录
+
+实测发现 DNSPod 上有历史残留 `_dnsauth.box.example.com CNAME → xxxxxxxx...aliyunauth.certificate-validations.com`（以前阿里云申请证书留下的）。`_dnsauth` / `_acme-challenge` 下的旧验证记录会干扰证书自动续期验证——**证书验证记录的坑**，建议确认证书正常后删除。
+
+### 6.5 免费档没有「源站防护」，回源 IP 段拿不到
+
+见 Step D3：免费档无官方清单，用 learn 观察法兜底；付费后切 `DescribeOriginACL`，脚本零改动。
+
+---
+
+## 7. 日常维护清单
+
+| 周期 | 事项 |
+|---|---|
+| 证书到期前 | EO 免费证书自动续期并**重新做域名验证**——⚠️ CA 验证服务器多在境外，**所有验证记录务必放默认线路**；到期前留意 EO 控制台证书状态，失败会提示重新验证 |
+| 每 3 天（定时任务） | 白名单 sync（EO 回源段 3~6 个月才变，每 3 天足够）；sync 是全量重建，清单里删掉的旧 IP 会自动剔除 |
+| 每月 | 抽查清单有无漏网的新回源 IP（auto 已每日自动补种，此处仅兜底核对）；确认优选域名 `cf-pref.example.net` 仍解析到 CF 边缘（失效则换回官方 SaaS CNAME target，只改 DNSPod 一条记录） |
+| EO 回源突然失败 | 先临时放行全段定位，再按 learn 结果收紧——EO 免费档收不到段变更通知，要有这个预案 |
+| 长期 | 若升级 EO 付费套餐：启用源站防护拿官方段 → 接入 DescribeOriginACL 输出到 cidr.txt |
+
+---
+
+## 8. 回滚
+
+1. **快速回滚（境外也要回 CF 之外的兜底）**：DNSPod 把「境内」线路改指向 CF（或删掉境内线路，让默认兜底接管）→ 全球走 CF，分钟级生效；
+2. **彻底回滚（回到纯 CF 时代）**：删除 EO 站点/记录、撤防火墙放行、DNSPod 三线路合并为默认→CF；
+3. EO 证书到期前回滚，记得去 EO 控制台删除站点避免残留验证记录干扰。
+
+---
+
+## 附：配置快照（示例，2026-09-03 实测定稿，域名已脱敏）
+
+```
+域名:        box.example.com（权威 DNS: DNSPod，NS=byron/sunshine.dnspod.net）
+境内:        CNAME box.example.com.edgeone.example → 203.0.113.x   （EdgeOne 国际站，区域不含大陆，示例段）
+境外/默认:   CNAME cf-pref.example.net → 198.51.100.x              （CF 优选 IP，示例段）
+CF 侧:       SaaS 自定义主机名（承载 zone cf-zone.example.net）+ Tunnel 出站回源
+EO 证书:     TrustAsia, CN=box.example.com（签发后约 90 天到期，自动续期）
+EO 归属验证: edgeonereclaim.example.com TXT（DNSPod 默认线路 ✅）
+EO 客户端头: EO-Client-IP（手动开启，头名固定 EO-Client-IP）
+源站:        TamaBox 直监听 0.0.0.0:高位端口（无 nginx）；iptables+ipset 白名单
+应用信任:    trust_proxy=true；ResolveClientIP 信任 CF-Connecting-IP → EO-Client-IP → RemoteAddr
+```
diff --git a/outputs/user-updates-2026-09-01-02.md b/outputs/user-updates-2026-09-01-02.md
new file mode 100644
index 0000000..3f88ab2
--- /dev/null
+++ b/outputs/user-updates-2026-09-01-02.md
@@ -0,0 +1,37 @@
+# 近期更新速览（9 月 1 日 — 9 月 2 日）
+
+> 面向站点使用者的简要更新说明，已省略技术细节。
+> 提示：以下内容在服务端部署最新版本后才会全部生效。
+
+---
+
+## 2026-09-01
+
+### 新增 / 改进
+- 管理后台的「功能设置」为提问、私聊、投票新增三种开放方式：**一直开放**、**指定时间段开放**、**每周固定时段循环开放**。以前定时开放一旦结束，功能就会一直关闭；现在可以设定每周循环时间，到期自动开启与关闭。
+- 未登录访客查看问题详情页时，「分享」按钮自动居中，页面更整齐。
+
+### 修复
+- 修复未登录用户切换界面语言不生效的问题。
+- 全站提示文字（错误提示、操作结果、表单校验等）统一跟随所选界面语言显示，简体中文 / 繁體中文 / English / 日本語 不再混用。
+
+---
+
+## 2026-09-02
+
+### 新增 / 改进
+- 投票的自定义回答框加入**实时字数统计**，超过字数上限会标红并阻止提交，不再被悄悄截断。
+- 站长创建投票时，每个选项文本的长度上限放宽到 300 字。
+- 标签与屏蔽词改为「标签块」式输入：回车或逗号即可生成一个词，点 × 删除，无需手动敲英文逗号分隔，并实时显示数量。
+- 提问、回答、追问、私聊消息的字数上限已统一，超出时会有明确提示。
+- 私聊的会话消息条数上限可在 1～200 之间自行设置（新用户默认 200 条）。
+
+### 修复
+- 修复已发布投票在编辑保存后出现「未知的投票类型」、选项看似丢失的问题，现在保存后投票与选项均正常显示。
+- 修复「加载更多」按钮失效：公开主页与后台投票列表可以正常翻页；列表到底后按钮不再出现，连点也不会重复加载。
+- 修复头像、背景、分享卡片等图片偶尔加载超时失败的问题。
+
+### 调整
+- 屏蔽词现在对提问、私聊（对方发来的消息）与投票的自定义内容**同时生效**；提问 / 私聊 / 投票三个设置面板展示同一份屏蔽词，改一处即全局同步。
+- 精简后台投票设置页，移除重复的「投票内容管理」入口（投票列表仍可从顶栏进入）。
+- 多项安全与稳定性加固（细节略）。
diff --git a/outputs/vote-i18n-audit-2026-09-01.md b/outputs/vote-i18n-audit-2026-09-01.md
new file mode 100644
index 0000000..76c9a4d
--- /dev/null
+++ b/outputs/vote-i18n-audit-2026-09-01.md
@@ -0,0 +1,53 @@
+# 投票页中文提示 Bug 排查 + 同类 i18n 缺口审计（2026-09-01）
+
+## 一、结论先行
+- **你报告的 `投票成功！感谢参与` 确属 Bug**：`route/vote/vote.go` 的 `Submit` 之前把成功提示硬编码成了中文，未走 i18n，所以无论访客界面语言设成什么，弹出的都是中文。
+- **已修复**：投票页全部用户提示 + 验证码包（共享根因，影响 6 个页面）。
+- **还有大量同类问题**：route 层另有 40+ 处硬编码中文 flash（含登录页直接把 db 中文错误弹给用户），以及 db 层的中文错误哨兵，属于系统性 i18n 缺口，建议作为下一批次修复（见第三节）。
+
+## 二、本次已修复（可直接验收）
+### 1. `route/vote/vote.go`（投票参与页，访客可见）
+- `SetSuccessFlash("投票成功！感谢参与")` → `i18n.T(lang, "vote.flash.success")`。
+- `Page` / `Submit` 的全部 `SetErrorFlash("中文")` 改为对应 i18n 键（`vote.flash.notFound/notPublished/archived/ended/notStarted`、`vote.page.loginRequired/alreadyVoted`）。
+- 表单解析 `parseSubmission` 内约 25 条校验错误（单选/多选/评分/排名/表单字段必填、超长、自定义选项、序列化失败等）全部改为 `i18n.T(lang, ...)`，动态字段名以 `%s` 占位注入（标签本身是箱主自定的内容，不翻译）。
+- `censorCheck` 签名改为 `(ctx, lang, text)`，失败文案走 `censor.unavailable` 键。
+- 新增 i18n 键：`vote.err.fieldRequired/fieldCustomRequired/fieldCustomTooLong/fieldInvalidOption/fieldConfigError/fieldRankIncomplete/fieldRankRange/fieldRankDuplicate/fieldTooLong/fieldNotNumber/fieldRating/customTooLong/serialize/unknownType/invalidOption/optionDuplicate`（四语言已补齐）。
+
+### 2. `internal/captcha/math.go`（验证码，共享根因）
+- `Verify` / `VerifyMath` 增加 `lang` 参数，6 处硬编码中文错误（不能为空/格式错误/答案格式/已过期/服务异常/答案错误/验证码错误）改为 i18n 键。
+- 新增 i18n 键：`captcha.errEmpty/errFormat/errAnswerFormat/errExpired/errService/errAnswerWrong`（四语言已补齐）。
+- 副作用：登录、注册、找回密码、提问箱页的验证码错误现在也跟随界面语言（这 6 个调用点已同步传 `ctx.Lang()` 并把 `if !ok` 分支的硬编码 `验证码错误` 改为 `captcha.error` 键）。
+- 配套：`internal/context/context.go` 新增 `(*Context).Lang()` 方法（返回中间件注入的界面语言，未注入回退 `i18n.Default`），供后端 flash/错误本地化复用。
+
+**验证**：gofmt 通过；`go build -overlay`（含 webp 屏障包）全绿；`go vet` 全绿；全量可运行测试（templates / i18n / vote / auth / question 等）通过。
+
+## 三、尚未修复的同类问题（建议下一批次）
+判定标准：用户可见的 flash / 错误信息硬编码中文、不跟随界面语言。按「访客可见 / 箱主后台」分级。
+
+### P0 — 访客/公开页（与投票页同类，匿名用户可见，优先级最高）
+| 文件:行 | 当前硬编码 | 建议键 |
+|---|---|---|
+| route/auth/login.go:49 | `errors.Cause(err).Error()` → `ErrBadCredential` "邮箱或密码错误" | `auth.errBadCredential` |
+| route/auth/recover.go:124 | `用户不存在` | `auth.errUserNotFound` |
+| route/auth/recover.go:70 / 86 / 105 / 169 | 邮件频繁/失败/验证码过期/密码修改成功 | `auth.*` |
+| route/question/page.go:232 | `密码错误` | `question.errWrongPassword` |
+| route/question/page.go:313 | `仅注册用户才能提问…` | `question.errLoginRequired` |
+| route/question/page.go:322 / 345 | `不能给自己发起私聊` / `你已被对方拉黑…` | `question.*` |
+| route/question/page.go:384 | `检测到重复提交，请稍后再试` | `question.errDuplicate` |
+| route/question/follow_up.go:38/45/75/90/149/161/180 | 无权操作/未回答不能追问/等上一条/审核不可用/追问不存在/回答成功 等 | `question.*` |
+| route/question/question.go:215/281/299/313/325 | 回答发布成功/操作成功/已读/未读 等 | `question.*` |
+| internal/db/users.go:206-208 | `ErrBadCredential`/`ErrDuplicateEmail`/`ErrDuplicateDomain` 中文哨兵 | 改为键或 handler 层映射 |
+
+### P1 — 箱主后台（登录态可见，影响较小）
+route/user/vote.go、profile.go、password.go、tags.go、harassment.go 等约 25 处硬编码中文 flash
+（如 `投票已发布！分享链接：…`、`更新标签成功`、`页面访问密码已更新`、`私聊设置更新成功` 等）。
+
+### P2 — 内部 API（JS 消费的 JSON，非 flash）
+internal/captcha/math.go `VerifyHandler` 返回的 `请求格式错误` / `验证码 ID 不能为空`（JSON message，前端弹通用提示，影响低）。
+
+## 四、建议的下一步
+1. **先修 P0（公开页）**：与投票页同类，直接决定匿名访客的语言体验，工作量约 8 个文件 + 约 30 个 i18n 键。
+2. 再修 P1（箱主后台）+ P2（可选）。
+3. db 层中文错误哨兵建议统一改为「哨兵错误 + handler 层按 `errors.Is` 映射 i18n」，避免翻译逻辑下沉到 db 包。
+
+请确认是否按上述批次继续修复（特别是 P0 公开页），我可立即开工。
diff --git a/route/auth/login.go b/route/auth/login.go
new file mode 100644
index 0000000..c47a18b
--- /dev/null
+++ b/route/auth/login.go
@@ -0,0 +1,77 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package auth
+
+import (
+	"path"
+
+	"github.com/flamego/recaptcha"
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+
+	"github.com/tamakyi/TamaBox/internal/captcha"
+	"github.com/tamakyi/TamaBox/internal/context"
+	"github.com/tamakyi/TamaBox/internal/db"
+	"github.com/tamakyi/TamaBox/internal/form"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+	"github.com/tamakyi/TamaBox/internal/shared"
+)
+
+func Login(ctx context.Context) {
+	ctx.Success("auth/login")
+}
+
+func LoginAction(ctx context.Context, f form.Login, recaptcha recaptcha.RecaptchaV3) {
+	if ctx.HasError() {
+		ctx.Success("auth/login")
+		return
+	}
+
+	// Check captcha code (unified: recaptcha, turnstile, or math).
+	uri := ctx.Request().Request.RequestURI // Keep the query when redirecting.
+	ok, err := captcha.Verify(f.Recaptcha, shared.ResolveClientIP(ctx.Request().Request), ctx.Session, recaptcha, ctx.Lang())
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to check captcha")
+		ctx.SetErrorFlash(err.Error())
+		ctx.Redirect(uri)
+		return
+	}
+	if !ok {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "captcha.error"))
+		ctx.Redirect(uri)
+		return
+	}
+
+	user, err := db.Users.Authenticate(ctx.Request().Context(), f.Email, f.Password)
+	if err != nil {
+		if errors.Is(err, db.ErrBadCredential) {
+			ctx.SetErrorFlash(i18n.T(ctx.Lang(), "auth.errBadCredential"))
+		} else {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to authenticate user")
+			ctx.SetInternalErrorFlash()
+		}
+		ctx.Redirect(uri)
+		return
+	}
+
+	to := ctx.Query("to")
+	to = path.Clean("/" + to)
+	if to == "" {
+		to = "/_/" + user.Domain
+	}
+
+	// 会话固定防护：登录认证成功后、写入用户标识之前，重新生成会话 ID，
+	// 使登录前种下的匿名会话失效，防止攻击者借固定会话 ID 劫持已认证会话。
+	if err := ctx.Session.RegenerateID(ctx.ResponseWriter(), ctx.Request().Request); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to regenerate session ID on login")
+		ctx.SetInternalErrorFlash()
+		ctx.Redirect(uri)
+		return
+	}
+
+	ctx.Session.Set("uid", user.ID)
+	ctx.Session.Set("pwd_ver", user.PasswordVersion)
+	ctx.Redirect(to)
+}
diff --git a/route/auth/logout.go b/route/auth/logout.go
new file mode 100644
index 0000000..4f52a18
--- /dev/null
+++ b/route/auth/logout.go
@@ -0,0 +1,14 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package auth
+
+import (
+	"github.com/tamakyi/TamaBox/internal/context"
+)
+
+func Logout(ctx context.Context) {
+	ctx.Session.Flush()
+	ctx.Redirect("/")
+}
diff --git a/route/auth/recover.go b/route/auth/recover.go
new file mode 100644
index 0000000..e33b6c3
--- /dev/null
+++ b/route/auth/recover.go
@@ -0,0 +1,172 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package auth
+
+import (
+	"os"
+	"time"
+
+	"github.com/flamego/cache"
+	"github.com/flamego/recaptcha"
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+	"github.com/thanhpk/randstr"
+
+	"github.com/tamakyi/TamaBox/internal/captcha"
+	"github.com/tamakyi/TamaBox/internal/context"
+	"github.com/tamakyi/TamaBox/internal/db"
+	"github.com/tamakyi/TamaBox/internal/form"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+	"github.com/tamakyi/TamaBox/internal/mail"
+	"github.com/tamakyi/TamaBox/internal/shared"
+)
+
+func ForgotPassword(ctx context.Context) {
+	ctx.Success("auth/forgot-password")
+}
+
+func ForgotPasswordAction(ctx context.Context, f form.ForgotPassword, cache cache.Cache, recaptcha recaptcha.RecaptchaV3) {
+	if ctx.HasError() {
+		ctx.Success("auth/forgot-password")
+		return
+	}
+
+	// Check captcha code (unified: recaptcha, turnstile, or math).
+	ok, err := captcha.Verify(f.Recaptcha, shared.ResolveClientIP(ctx.Request().Request), ctx.Session, recaptcha, ctx.Lang())
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to check captcha")
+		ctx.SetErrorFlash(err.Error())
+		ctx.Redirect("/forgot-password")
+		return
+	}
+	if !ok {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "captcha.error"))
+		ctx.Redirect("/forgot-password")
+		return
+	}
+
+	user, err := db.Users.GetByEmail(ctx.Request().Context(), f.Email)
+	if err != nil {
+		if errors.Is(err, db.ErrUserNotExists) {
+			// 防邮箱枚举：不区分邮箱是否存在，统一渲染"已发送"提示页（不实际发信）。
+			ctx.Data["email"] = f.Email
+			ctx.Success("auth/forgot-password-sent")
+			return
+		}
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to get user by email")
+		ctx.SetInternalErrorFlash()
+		ctx.Redirect("/forgot-password")
+		return
+	}
+
+	emailSentCacheKey := "forgot-password-email-sent:" + user.Email
+	_, err = cache.Get(ctx.Request().Context(), emailSentCacheKey)
+	if err != nil {
+		if !errors.Is(err, os.ErrNotExist) {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to read password recovery email sent cache")
+		}
+	} else {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "auth.errEmailFrequent"))
+		ctx.Redirect("/forgot-password")
+		return
+	}
+
+	code := randstr.String(64)
+	recoveryCodeCacheKey := "forgot-password-recovery-code:" + code
+	if err := cache.Set(ctx.Request().Context(), recoveryCodeCacheKey, user.ID, 24*time.Hour); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to set password recovery code cache")
+		ctx.SetInternalErrorFlash()
+		ctx.Redirect("/forgot-password")
+		return
+	}
+
+	if err := mail.SendPasswordRecoveryMail(user.Email, code); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to send password recovery mail")
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "auth.errEmailFailed"))
+		ctx.Redirect("/forgot-password")
+		return
+	}
+
+	if err := cache.Set(ctx.Request().Context(), emailSentCacheKey, time.Now(), 2*time.Minute); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to set password recovery email cache")
+	}
+
+	ctx.Data["email"] = user.Email
+	ctx.Success("auth/forgot-password-sent")
+}
+
+func checkRecoverPasswordCode(ctx context.Context, cache cache.Cache) (*db.User, bool) {
+	code := ctx.Query("code")
+	recoveryCodeCacheKey := "forgot-password-recovery-code:" + code
+	userIDItf, err := cache.Get(ctx.Request().Context(), recoveryCodeCacheKey)
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			ctx.SetErrorFlash(i18n.T(ctx.Lang(), "auth.errCodeExpired"))
+		} else {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to read password recovery code cache")
+			ctx.SetInternalErrorFlash()
+		}
+		ctx.Redirect("/login")
+		return nil, false
+	}
+
+	userID, ok := userIDItf.(uint)
+	if !ok {
+		logrus.WithContext(ctx.Request().Context()).WithField("user_id_itf", userIDItf).Error("Failed to convert user id interface to uint")
+		ctx.SetInternalErrorFlash()
+		ctx.Redirect("/login")
+		return nil, false
+	}
+
+	user, err := db.Users.GetByID(ctx.Request().Context(), userID)
+	if err != nil {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "auth.errUserNotFound"))
+		ctx.Redirect("/login")
+		return nil, false
+	}
+
+	return user, true
+}
+
+func RecoverPassword(ctx context.Context, cache cache.Cache) {
+	user, ok := checkRecoverPasswordCode(ctx, cache)
+	if !ok {
+		return
+	}
+
+	ctx.Data["User"] = user
+	ctx.Success("auth/password-recovery")
+}
+
+func RecoverPasswordAction(ctx context.Context, cache cache.Cache, f form.RecoverPassword) {
+	user, ok := checkRecoverPasswordCode(ctx, cache)
+	if !ok {
+		return
+	}
+	if ctx.HasError() {
+		ctx.Data["User"] = user
+		ctx.Success("auth/password-recovery")
+		return
+	}
+
+	code := ctx.Query("code")
+	recoveryCodeCacheKey := "forgot-password-recovery-code:" + code
+	if err := cache.Delete(ctx.Request().Context(), recoveryCodeCacheKey); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to delete password recovery code cache")
+		ctx.SetInternalErrorFlash()
+		ctx.Redirect("/login")
+		return
+	}
+
+	if err := db.Users.UpdatePassword(ctx.Request().Context(), user.ID, f.NewPassword); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to update user password")
+		ctx.SetInternalErrorFlash()
+		ctx.Refresh()
+		return
+	}
+
+	ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "auth.errPasswordChanged"))
+	ctx.Redirect("/login")
+}
diff --git a/route/auth/register.go b/route/auth/register.go
new file mode 100644
index 0000000..65d1e44
--- /dev/null
+++ b/route/auth/register.go
@@ -0,0 +1,92 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package auth
+
+import (
+	"github.com/flamego/recaptcha"
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+
+	"github.com/tamakyi/TamaBox/internal/captcha"
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/context"
+	"github.com/tamakyi/TamaBox/internal/db"
+	"github.com/tamakyi/TamaBox/internal/form"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+	"github.com/tamakyi/TamaBox/internal/shared"
+)
+
+func Register(ctx context.Context) {
+	ctx.Success("auth/register")
+}
+
+func RegisterAction(ctx context.Context, f form.Register, recaptcha recaptcha.RecaptchaV3) {
+	if ctx.HasError() {
+		ctx.Success("auth/register")
+		return
+	}
+
+	// Check captcha code (unified: recaptcha, turnstile, or math).
+	ok, err := captcha.Verify(f.Recaptcha, shared.ResolveClientIP(ctx.Request().Request), ctx.Session, recaptcha, ctx.Lang())
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to check captcha")
+		ctx.SetErrorFlash(err.Error())
+		ctx.Redirect("/register")
+		return
+	}
+	if !ok {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "captcha.error"))
+		ctx.Redirect("/register")
+		return
+	}
+
+	if err := db.Users.Create(ctx.Request().Context(), db.CreateUserOptions{
+		Name:                 f.Name,
+		Password:             f.Password,
+		Email:                f.Email,
+		Avatar:               conf.Upload.DefaultAvatarURL,
+		Domain:               f.Domain,
+		Background:           conf.Upload.DefaultBackground,
+		Intro:                "问你想问的",
+		Qrcodebackcolor:      "#FDF8F0",
+		Qrcodecolor:          "#C45500",
+		Usernamecolor:        "#000000",
+		Introcolor:           "#000000",
+		Dotscale:             "0.35",
+		BackgroundImage:      conf.Upload.DefaultBackgroundImageURL,
+		Backgroundimagealpha: "0.8",
+		Qrcodepdpcolor:       "#C45500",
+		Acfunlink:            "none",
+		Bililink:             "none",
+		Weibolink:            "none",
+		Bloglink:             "box.shiroko.one",
+		Xiaohongshulink:      "none",
+		Language:             i18n.Resolve(f.Language), // 注册时选择的界面语言；留空回退站点默认
+	}); err != nil {
+		switch {
+		case errors.Is(err, db.ErrDuplicateEmail):
+			ctx.SetError(errors.New(i18n.T(ctx.Lang(), "auth.errDuplicateEmail")))
+		case errors.Is(err, db.ErrDuplicateDomain):
+			ctx.SetError(errors.New(i18n.T(ctx.Lang(), "auth.errDuplicateDomain")))
+		case errors.Is(err, db.ErrBadCredential):
+			ctx.SetError(errors.New(i18n.T(ctx.Lang(), "auth.errBadCredential")))
+
+		default:
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to create new user")
+			ctx.SetInternalError()
+		}
+
+		ctx.Success("auth/register")
+		return
+	}
+
+	// 成功提示跟随用户注册时选择的语言
+	lang := "zh-CN"
+	if l, ok := ctx.Data["Lang"].(string); ok && l != "" {
+		lang = l
+	}
+	ctx.SetSuccessFlash(i18n.T(lang, "auth.register.success"))
+	ctx.Redirect("/login")
+}
diff --git a/route/home.go b/route/home.go
new file mode 100644
index 0000000..ba2629a
--- /dev/null
+++ b/route/home.go
@@ -0,0 +1,44 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package route
+
+import (
+	"github.com/sirupsen/logrus"
+
+	"github.com/tamakyi/TamaBox/internal/context"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+	"github.com/tamakyi/TamaBox/internal/stats"
+)
+
+func Home(ctx context.Context) {
+	if v, err := stats.Get(ctx.Request().Context()); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Warn("Failed to compute site stats")
+	} else {
+		ctx.Data["SiteStats"] = v
+	}
+	ctx.Success("home")
+}
+
+// SiteStatsAPI 返回首页"提问箱信息统计"的 JSON（服务端 30 分钟缓存），
+// 供前端 setInterval 定时刷新，避免重新加载整页。
+func SiteStatsAPI(ctx context.Context) error {
+	v, err := stats.Get(ctx.Request().Context())
+	if err != nil {
+		return ctx.JSONError(50000, i18n.T(ctx.Lang(), "home.errStats"))
+	}
+	return ctx.JSON(v)
+}
+
+func Sponsor(ctx context.Context) {
+	ctx.Success("sponsor")
+}
+
+func AboutMe(ctx context.Context) {
+	ctx.Success("about-me")
+}
+
+func ChangeLogs(ctx context.Context) {
+	ctx.Success("change-logs")
+}
diff --git a/route/pixel/pixel.go b/route/pixel/pixel.go
new file mode 100644
index 0000000..6764dc0
--- /dev/null
+++ b/route/pixel/pixel.go
@@ -0,0 +1,87 @@
+// Copyright 2024 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package pixel
+
+import (
+	"io"
+	"net/http"
+	"path"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/sirupsen/logrus"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/context"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+)
+
+// pixelSafeResponseHeaders 允许从上游透传到客户端的响应头白名单。
+// 绝不透传 Set-Cookie / Set-Cookie2 等，避免上游借像素代理向客户端注入会话或凭证。
+var pixelSafeResponseHeaders = []string{
+	"Content-Type",
+	"Content-Length",
+	"Content-Encoding",
+	"Content-Disposition",
+	"Cache-Control",
+	"ETag",
+	"Expires",
+	"Last-Modified",
+	"Pragma",
+	"Vary",
+}
+
+func Index(ctx context.Context) {
+	ctx.Success("pixel")
+}
+
+func Proxy(ctx context.Context) error {
+	uri := ctx.Param("**")
+
+	// 路径穿越防护：归一化后必须仍位于 /api/ 之下，
+	// 否则（如含 ../ 跳出 /api）直接拒绝，防止访问到未授权路径。
+	cleaned := path.Clean("/api/" + uri)
+	if !strings.HasPrefix(cleaned, "/api/") {
+		return ctx.JSONError(http.StatusBadRequest, i18n.T(ctx.Lang(), "pixel.errPath"))
+	}
+
+	userID := strconv.Itoa(int(ctx.User.ID))
+
+	// 仅允许只读 GET：写方法（POST/PUT/DELETE）在路由层已被限制为 GET，
+	// 此处不再处理请求体，杜绝被用作对上游的越权写入口。
+	req, err := http.NewRequest(http.MethodGet, "http://pixel/", nil)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to create request")
+		return ctx.ServerError()
+	}
+	req.URL.Host = conf.Pixel.Host
+	req.URL.Path = cleaned
+	req.Header.Set("neko-user-id", userID)
+
+	client := http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to send request")
+		return ctx.ServerError()
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	// 仅透传白名单内的安全响应头。
+	for _, k := range pixelSafeResponseHeaders {
+		if v := resp.Header.Get(k); v != "" {
+			ctx.ResponseWriter().Header().Set(k, v)
+		}
+	}
+	ctx.ResponseWriter().WriteHeader(resp.StatusCode)
+
+	_, err = io.Copy(ctx.ResponseWriter(), resp.Body)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to copy response")
+		return ctx.ServerError()
+	}
+
+	return nil
+}
diff --git a/route/question/follow_up.go b/route/question/follow_up.go
new file mode 100644
index 0000000..1712c57
--- /dev/null
+++ b/route/question/follow_up.go
@@ -0,0 +1,208 @@
+package question
+
+import (
+	stdctx "context"
+	"fmt"
+	"unicode/utf8"
+
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/context"
+	"github.com/tamakyi/TamaBox/internal/db"
+	"github.com/tamakyi/TamaBox/internal/form"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+	"github.com/tamakyi/TamaBox/internal/mail"
+	"github.com/tamakyi/TamaBox/internal/security/censor"
+	"github.com/tamakyi/TamaBox/internal/shared"
+)
+
+// isQuestioner 判断当前请求者是否为该提问的提问者。
+// 匿名提问者通过 token（URL 或表单隐藏域）验证；登录提问者通过账号 ID 验证。
+func isQuestioner(ctx context.Context, question *db.Question, token string) bool {
+	if question.Token != "" && question.Token == token {
+		return true
+	}
+	if ctx.IsLogged && question.AskerUserID != 0 && ctx.User.ID == question.AskerUserID {
+		return true
+	}
+	return false
+}
+
+// PublishFollowUp 提问者在问题被回答后，用 token 继续追问。
+func PublishFollowUp(ctx context.Context, pageUser *db.User, question *db.Question, f form.PublishFollowUpQuestion) {
+	// govalid 校验失败（追问内容为空）时回显表单，与 AnswerFollowUp 同路径。
+	// （旧实现漏掉该早退：required 失败后仍会继续 censor/入库，追问空内容也会被创建。）
+	if ctx.HasError() {
+		ctx.Success("question/item")
+		return
+	}
+
+	// 追问内容长度上限（conf.Limits.FollowUpContentLen，[limits] 配置段），
+	// 与前端追问框 maxlength 同源，rune 计数。
+	if utf8.RuneCountInString(f.Content) > conf.Limits.FollowUpContentLen {
+		ctx.SetError(errors.New(i18n.T(ctx.Lang(), "form.followup.contentTooLong", conf.Limits.FollowUpContentLen)), f)
+		ctx.Success("question/item")
+		return
+	}
+
+	token := ctx.Query("t")
+	if token == "" {
+		token = f.Token
+	}
+
+	if !isQuestioner(ctx, question, token) {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "followup.errNoPermission"))
+		ctx.Redirect("/")
+		return
+	}
+
+	// 只能对已回答的问题追问
+	if question.Answer == "" {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "followup.errNotAnswered"))
+		ctx.Redirect(fmt.Sprintf("/_/%s/%d?t=%s", pageUser.Domain, question.ID, question.Token))
+		return
+	}
+
+	// 追问次数限制：先快速预检查（友好提示），CreateIfBelowLimit 内再原子兜底
+	// （并发场景下 count-then-create 存在竞态，必须以数据库原子检查为准）。
+	count, err := db.FollowUps.CountByQuestionID(ctx.Request().Context(), question.ID)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to count follow ups")
+		ctx.SetInternalErrorFlash()
+		ctx.Redirect(fmt.Sprintf("/_/%s/%d?t=%s", pageUser.Domain, question.ID, question.Token))
+		return
+	}
+	if count >= db.MaxFollowUpCount {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "followup.errLimit", db.MaxFollowUpCount))
+		ctx.Redirect(fmt.Sprintf("/_/%s/%d?t=%s", pageUser.Domain, question.ID, question.Token))
+		return
+	}
+
+	// 服务端校验"等主人回复"：模板仅在前一条被回复后才展示追问表单，
+	// 但 POST 可被直接构造绕过，因此必须检查最新一条追问是否已回复。
+	latest, err := db.FollowUps.GetLatestByQuestionID(ctx.Request().Context(), question.ID)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to get latest follow up")
+		ctx.SetInternalErrorFlash()
+		ctx.Redirect(fmt.Sprintf("/_/%s/%d?t=%s", pageUser.Domain, question.ID, question.Token))
+		return
+	}
+	if latest != nil && latest.Answer == "" {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "followup.errWaitReply"))
+		ctx.Redirect(fmt.Sprintf("/_/%s/%d?t=%s", pageUser.Domain, question.ID, question.Token))
+		return
+	}
+
+	if ctx.HasError() {
+		ctx.Success("question/item")
+		return
+	}
+
+	// 内容安全检测
+	censorResponse, err := censor.Text(ctx.Request().Context(), f.Content)
+	if err != nil {
+		// 审核源全部不可用：fail-closed，拒绝发布而非免审放行。
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to censor follow up text")
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "censor.unavailable"))
+		ctx.Redirect(fmt.Sprintf("/_/%s/%d?t=%s", pageUser.Domain, question.ID, question.Token))
+		return
+	}
+	if !censorResponse.Pass {
+		ctx.SetErrorFlash(censorResponse.ErrorMessage())
+		ctx.Redirect(fmt.Sprintf("/_/%s/%d?t=%s", pageUser.Domain, question.ID, question.Token))
+		return
+	}
+
+	created, err := db.FollowUps.CreateIfBelowLimit(ctx.Request().Context(), db.CreateFollowUpOptions{
+		QuestionID: question.ID,
+		Content:    f.Content,
+	})
+	if err != nil {
+		if errors.Is(err, db.ErrFollowUpLimitReached) {
+			ctx.SetErrorFlash(i18n.T(ctx.Lang(), "followup.errLimit", db.MaxFollowUpCount))
+			ctx.Redirect(fmt.Sprintf("/_/%s/%d?t=%s", pageUser.Domain, question.ID, question.Token))
+			return
+		}
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to create follow up")
+		ctx.SetInternalErrorFlash()
+		ctx.Redirect(fmt.Sprintf("/_/%s/%d?t=%s", pageUser.Domain, question.ID, question.Token))
+		return
+	}
+	_ = created
+
+	// 邮件通知提问箱主人（开启邮件提醒时）
+	shared.SafeGo(func() {
+		if pageUser.Notify == db.NotifyTypeEmail {
+			if err := mail.SendNewFollowUpMail(pageUser.Email, pageUser.Domain, question.ID, question.Content, f.Content); err != nil {
+				logrus.WithContext(stdctx.Background()).WithError(err).Error("Failed to send new follow up mail to user")
+			}
+		}
+	})
+
+	ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "followup.flash.sent"))
+	ctx.Redirect(fmt.Sprintf("/_/%s/%d?t=%s", pageUser.Domain, question.ID, question.Token))
+}
+
+// AnswerFollowUp 提问箱主人回答某条追问。
+func AnswerFollowUp(ctx context.Context, pageUser *db.User, question *db.Question, f form.AnswerFollowUpQuestion) {
+	if ctx.User.ID != pageUser.ID {
+		ctx.Redirect("/")
+		return
+	}
+
+	if ctx.HasError() {
+		ctx.Success("question/item")
+		return
+	}
+
+	// 追问的回答内容长度上限：与主回答共用 conf.Limits.AnswerContentLen
+	// （[limits] 配置段），与前端回复框 maxlength 同源，rune 计数。
+	if utf8.RuneCountInString(f.Answer) > conf.Limits.AnswerContentLen {
+		ctx.SetError(errors.New(i18n.T(ctx.Lang(), "form.followup.answerTooLong", conf.Limits.AnswerContentLen)), f)
+		ctx.Success("question/item")
+		return
+	}
+
+	followUpID := uint(ctx.ParamInt("followUpID"))
+
+	// 内容安全检测
+	censorResponse, err := censor.Text(ctx.Request().Context(), f.Answer)
+	if err != nil {
+		// 审核源全部不可用：fail-closed，拒绝发布而非免审放行。
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to censor follow up answer")
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "censor.unavailable"))
+		ctx.Success("question/item")
+		return
+	}
+	if !censorResponse.Pass {
+		ctx.SetErrorFlash(censorResponse.ErrorMessage())
+		ctx.Success("question/item")
+		return
+	}
+
+	if err := db.FollowUps.UpdateAnswerByID(ctx.Request().Context(), question.ID, followUpID, f.Answer); err != nil {
+		if errors.Is(err, db.ErrFollowUpNotFound) {
+			ctx.SetErrorFlash(i18n.T(ctx.Lang(), "followup.errNotFound"))
+			ctx.Success("question/item")
+			return
+		}
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to answer follow up")
+		ctx.SetInternalErrorFlash()
+		ctx.Success("question/item")
+		return
+	}
+
+	// 邮件通知提问者（留下邮箱时）：复用"您的提问有了回复"模板，带 token 链接
+	shared.SafeGo(func() {
+		if question.ReceiveReplyEmail != "" {
+			if err := mail.SendNewAnswerMail(question.ReceiveReplyEmail, pageUser.Domain, question.ID, question.Content, f.Answer, question.Token); err != nil {
+				logrus.WithContext(stdctx.Background()).WithError(err).Error("Failed to send follow up answer mail to questioner")
+			}
+		}
+	})
+
+	ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "followup.flash.answered"))
+	ctx.Redirect(fmt.Sprintf("/_/%s/%d", pageUser.Domain, question.ID))
+}
diff --git a/route/question/page.go b/route/question/page.go
new file mode 100644
index 0000000..ab802d6
--- /dev/null
+++ b/route/question/page.go
@@ -0,0 +1,787 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package question
+
+import (
+	"bytes"
+	stdctx "context"
+	"crypto/md5"
+	"fmt"
+	"image"
+	_ "image/gif"
+	_ "image/jpeg"
+	_ "image/png"
+	"io"
+	"mime/multipart"
+	"path/filepath"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/flamego/recaptcha"
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+	"github.com/wuhan005/govalid"
+
+	"github.com/tamakyi/TamaBox/internal/captcha"
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/context"
+	"github.com/tamakyi/TamaBox/internal/db"
+	"github.com/tamakyi/TamaBox/internal/dbutil"
+	"github.com/tamakyi/TamaBox/internal/form"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+	"github.com/tamakyi/TamaBox/internal/imagecheck"
+	"github.com/tamakyi/TamaBox/internal/mail"
+	"github.com/tamakyi/TamaBox/internal/security/censor"
+	"github.com/tamakyi/TamaBox/internal/shared"
+	"github.com/tamakyi/TamaBox/internal/storage"
+	templatepkg "github.com/tamakyi/TamaBox/internal/template"
+)
+
+func Pager(ctx context.Context) {
+	domain := ctx.Param("domain")
+
+	pageUser, err := db.Users.GetByDomain(ctx.Request().Context(), domain)
+	if err != nil {
+		if errors.Is(err, db.ErrUserNotExists) {
+			ctx.Redirect("/")
+			return
+		} else {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to get user by domain")
+			ctx.SetInternalError()
+		}
+		ctx.Success("question/page")
+		return
+	}
+	ctx.Map(pageUser)
+
+	// 个人页语言：永远跟随提问箱主人（pageUser）配置的语言，忽略访客 cookie；未配置时回退站点默认语言
+	if pageUser.Language != "" {
+		lang := i18n.Resolve(pageUser.Language)
+		ctx.Data["Lang"] = lang
+		ctx.Data["LangCode"] = lang
+	}
+
+	// 页面密码检查
+	if pageUser.PagePassword != "" && !(ctx.IsLogged && ctx.User.ID == pageUser.ID) {
+		passKey := fmt.Sprintf("page_pass_%d", pageUser.ID)
+		if authorized, _ := ctx.Session.Get(passKey).(bool); !authorized {
+			// 记录原始请求地址（含 query，如带 token 的单题链接），验证通过后跳回此处而非默认首页
+			ctx.Data["Next"] = ctx.Request().URL.RequestURI()
+			ctx.Data["PageUser"] = pageUser
+			ctx.Success("question/password")
+			return
+		}
+	}
+
+	// 分页加载公开已回答的问题（首次加载 20 条，置顶优先）
+	// 多取 1 条探测是否仍有下一页，供模板决定「加载更多」按钮的初始可见状态，
+	// 避免内容不足一页时按钮仍然显示、点击后才消失。
+	const pageQuestionsPageSize = 20
+	pageQuestions, err := db.Questions.GetByUserID(ctx.Request().Context(), pageUser.ID, db.GetQuestionsByUserIDOptions{
+		Cursor: &dbutil.Cursor{
+			PageSize: pageQuestionsPageSize + 1, // 每页数量 + 1 条探测行
+		},
+		FilterAnswered: true, // 只显示已回答的问题
+		PrivateStatus:  1,    // 1 = 仅公开（is_private = false）
+		PinFirst:       true, // 置顶的问题排在最前
+	})
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to get questions by page id")
+		ctx.SetInternalError()
+		ctx.Success("question/page")
+		return
+	}
+	pageQuestionHasMore := false
+	if len(pageQuestions) > pageQuestionsPageSize {
+		pageQuestions = pageQuestions[:pageQuestionsPageSize]
+		pageQuestionHasMore = true
+	}
+
+	answeredCount, err := db.Questions.Count(ctx.Request().Context(), pageUser.ID, db.GetQuestionsCountOptions{
+		FilterAnswered: true,
+	})
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to count questions")
+		ctx.SetInternalError()
+		ctx.Success("question/page")
+		return
+	}
+
+	// 页面标题语言与页面语言保持一致：Data["Lang"] 已由 Pager 上方逻辑或 Contexter 解析好
+	// （提问箱主人语言 > 站点默认语言 shared.App > i18n.Default；个人页忽略访客 cookie）。
+	titleLang := i18n.Default
+	if l, ok := ctx.Data["Lang"].(string); ok && l != "" {
+		titleLang = l
+	}
+	ctx.SetTitle(fmt.Sprintf("%s - %s", pageUser.Name, i18n.T(titleLang, "site.title")))
+
+	ctx.Data["IsUserPage"] = true
+	ctx.Data["IsOwnPage"] = ctx.IsLogged && ctx.User.ID == pageUser.ID
+	ctx.Data["PageUser"] = pageUser
+	ctx.Data["PageQuestions"] = pageQuestions
+	ctx.Data["PageQuestionHasMore"] = pageQuestionHasMore
+	ctx.Data["AnsweredCount"] = answeredCount
+	ctx.Data["ChatMaxMessages"] = pageUser.ChatMaxMessages
+
+	// 功能开关（开关 + 定时 + 定量收集）统一由 feature_controls 驱动：
+	// - 提问：关闭后隐藏提问框并提示原因；
+	// - 私聊：关闭后隐藏/禁用私聊入口；
+	// - 投票：关闭后投票 Tab 保留显示但置灰禁用，hover 提示原因（不再隐藏入口）。
+	askState := db.FeatureStateOf(ctx.Request().Context(), pageUser.ID, db.FeatureQuestion)
+	ctx.Data["CanAsk"] = askState.Open && (ctx.IsLogged || pageUser.HarassmentSetting != db.HarassmentSettingTypeRegisterOnly)
+	ctx.Data["AskState"] = askState
+	// 二维码下的引导文案随「仅允许注册用户提问」设置联动，避免勾选后仍显示"谁都可以匿名提问"。
+	ctx.Data["RegisterOnlyAsk"] = pageUser.HarassmentSetting == db.HarassmentSettingTypeRegisterOnly
+	if !askState.Open {
+		ctx.Data["AskClosedMessage"] = i18n.FeatureClosedMessage(titleLang, db.FeatureQuestion, askState.Reason)
+	}
+	// 关闭状态下展示更多信息：上次关闭时间 / 下次开放时间（含循环定时）。
+	ctx.Data["AskNextOpenAtStr"] = formatFeatureTime(askState.NextOpenAt)
+	ctx.Data["AskLastCloseAtStr"] = formatFeatureTime(askState.LastCloseAt)
+
+	chatState := db.FeatureStateOf(ctx.Request().Context(), pageUser.ID, db.FeatureChat)
+	ctx.Data["AllowChat"] = chatState.Open
+	ctx.Data["ChatState"] = chatState
+
+	voteState := db.FeatureStateOf(ctx.Request().Context(), pageUser.ID, db.FeatureVote)
+	ctx.Data["VoteEnabled"] = voteState.Open
+	ctx.Data["VoteState"] = voteState
+	if !voteState.Open {
+		// 投票 Tab 置灰禁用时的原因提示（手动关闭 / 未到开放时间 / 已结束 / 已达上限）。
+		ctx.Data["VoteClosedMessage"] = i18n.FeatureClosedMessage(titleLang, db.FeatureVote, voteState.Reason)
+	}
+
+	// 个人主页初始 Tab：默认提问；支持 ?tab=votes 直达投票面板（可分享链接）。
+	// hash（#votes）优先级更高，由前端 JS 在渲染后覆盖。
+	// 投票功能关闭时投票 Tab 置灰不可点，直达链接 ?tab=votes 回落到提问 Tab，
+	// 否则会渲染出一个所有面板都隐藏的空页面。
+	activeTab := ctx.Query("tab")
+	if activeTab != "votes" || !voteState.Open {
+		activeTab = "questions"
+	}
+	ctx.Data["ActiveProfileTab"] = activeTab
+
+	// 匿名投票板块：该箱主"进行中"的公开投票（个人主页投票 Tab 展示，最多 20 条）。
+	// 箱主关闭投票功能时不展示任何投票（也不再浪费一次查询）。
+	pageVotes := []*db.Vote{}
+	if voteState.Open {
+		pageVotes, err = db.Votes.ListPublishedPublicByUserID(ctx.Request().Context(), pageUser.ID, 20)
+		if err != nil {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Warn("Failed to list page votes")
+			pageVotes = []*db.Vote{}
+		}
+	}
+	ctx.Data["PageVotes"] = pageVotes
+
+	// 设置下一页游标（如果有数据）。置顶优先场景下必须使用复合键集游标，
+	// 否则置顶项与非置顶项 id 交错会造成"加载更多"漏掉介于其间的非置顶项。
+	if len(pageQuestions) > 0 {
+		last := pageQuestions[len(pageQuestions)-1]
+		ctx.Data["PageQuestionCursor"] = db.EncodePinCursor(last.IsPinned, last.CreatedAt, last.ID)
+	} else {
+		ctx.Data["PageQuestionCursor"] = ""
+	}
+}
+
+// conversationWithFirstMessage 用于在列表展示私聊时附带第一条消息
+type conversationWithFirstMessage struct {
+	Conversation *db.Conversation
+	FirstMessage string
+}
+
+// formatFeatureTime 格式化功能开放/关闭时间供模板展示；nil 返回空串。
+func formatFeatureTime(t *time.Time) string {
+	if t == nil {
+		return ""
+	}
+	return t.Format("2006-01-02 15:04")
+}
+
+func PasswordPage(ctx context.Context) {
+	domain := ctx.Param("domain")
+	pageUser, err := db.Users.GetByDomain(ctx.Request().Context(), domain)
+	if err != nil {
+		ctx.Redirect("/")
+		return
+	}
+	ctx.Data["PageUser"] = pageUser
+	// 直接访问密码页（无"上一页"）时，验证后回首页
+	ctx.Data["Next"] = "/_/" + domain
+	// 密码页同样遵循提问箱主人配置的语言
+	if pageUser.Language != "" {
+		lang := i18n.Resolve(pageUser.Language)
+		ctx.Data["Lang"] = lang
+		ctx.Data["LangCode"] = lang
+	}
+	ctx.Success("question/password")
+}
+
+func VerifyPagePassword(ctx context.Context) {
+	domain := ctx.Param("domain")
+	pageUser, err := db.Users.GetByDomain(ctx.Request().Context(), domain)
+	if err != nil {
+		ctx.Redirect("/")
+		return
+	}
+	password := ctx.Request().FormValue("password")
+	if pageUser.CheckPagePassword(password) {
+		passKey := fmt.Sprintf("page_pass_%d", pageUser.ID)
+		ctx.Session.Set(passKey, true)
+		// 验证成功后跳回原始页面（如带 token 的单题链接），避免一律回到首页
+		next := ctx.Request().FormValue("next")
+		if next == "" || !strings.HasPrefix(next, "/") || strings.HasPrefix(next, "//") || strings.Contains(next, "://") {
+			next = "/_/" + domain
+		}
+		ctx.Redirect(next)
+	} else {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "question.errWrongPassword"))
+		ctx.Redirect("/_/" + domain + "/password")
+	}
+}
+
+func List(ctx context.Context) {
+	ctx.Success("question/list")
+}
+
+func ListAPI(ctx context.Context) error {
+	domain := ctx.Param("domain")
+	pageSize := ctx.QueryInt("page_size")
+	cursorValue := ctx.Query("cursor")
+
+	// 规范化每页大小，并多取 1 条用于探测是否仍有下一页（has_more），
+	// 使前端在加载完最后一页后能立即隐藏「加载更多」按钮，
+	// 而不是依赖下一次点击返回空列表来收尾（避免最后一页重复展示）。
+	if pageSize < 1 {
+		pageSize = dbutil.DefaultPageSize
+	}
+	if pageSize > dbutil.MaxDefaultPageSize-1 {
+		pageSize = dbutil.MaxDefaultPageSize - 1
+	}
+
+	pageUser, err := db.Users.GetByDomain(ctx.Request().Context(), domain)
+	if err != nil {
+		if errors.Is(err, db.ErrUserNotExists) {
+			return ctx.JSONError(40400, i18n.T(ctx.Lang(), "auth.errUserNotFound"))
+		}
+		return ctx.ServerError()
+	}
+
+	pageQuestions, err := db.Questions.GetByUserID(ctx.Request().Context(), pageUser.ID, db.GetQuestionsByUserIDOptions{
+		Cursor: &dbutil.Cursor{
+			Value:    cursorValue,
+			PageSize: pageSize + 1,
+		},
+		FilterAnswered: true,
+		PrivateStatus:  1, // 只返回公开问题
+		PinFirst:       true,
+	})
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to get questions by page id")
+		return ctx.ServerError()
+	}
+
+	// 实际取回条数超过 pageSize 说明还有下一页；裁掉多取的探测行。
+	hasMore := false
+	if len(pageQuestions) > pageSize {
+		pageQuestions = pageQuestions[:pageSize]
+		hasMore = true
+	}
+
+	// 列表 API 返回纯文本内容（剥离 Markdown 符号/排版，与首屏展示一致）
+	for _, q := range pageQuestions {
+		q.Content = templatepkg.PlainText(q.Content)
+	}
+
+	// 响应直接附带服务端编码好的下一页复合键集游标（与 EncodePinCursor 一致）。
+	// 不在前端用 Date.getTime()*1e6 自行拼游标：JS 双精度浮点无法精确表示纳秒
+	// 级 UnixNano（毫秒以下精度丢失），时间戳相同的提问会在翻页边界被跳过。
+	resp := struct {
+		Data       []*db.Question `json:"data"`
+		NextCursor string         `json:"next_cursor"`
+		HasMore    bool           `json:"has_more"`
+	}{Data: pageQuestions, HasMore: hasMore}
+	if len(pageQuestions) > 0 {
+		last := pageQuestions[len(pageQuestions)-1]
+		resp.NextCursor = db.EncodePinCursor(last.IsPinned, last.CreatedAt, last.ID)
+	}
+	return ctx.JSON(resp)
+}
+
+func New(ctx context.Context, f form.NewQuestion, pageUser *db.User, recaptcha recaptcha.RecaptchaV3) {
+
+	// 提问密码检查
+	if pageUser.AskPassword != "" {
+		if !pageUser.CheckAskPassword(f.AskPassword) {
+			ctx.SetError(errors.New(i18n.T(ctx.Lang(), "question.errAskPasswordWrong")), f)
+			ctx.Success("question/list")
+			return
+		}
+	}
+
+	// 提问功能开关 / 定时 / 定量：任一条件不满足即拒绝普通提问（纵深防御，页面入口已隐藏表单）。
+	// 私聊请求不受影响：提问与私聊是相互独立的功能，提问关闭不应阻断已开启的私聊。
+	isChatRequest := f.StartChat == "true" && ctx.IsLogged
+	askState := db.FeatureStateOf(ctx.Request().Context(), pageUser.ID, db.FeatureQuestion)
+	if !askState.Open && !isChatRequest {
+		lang := i18n.Default
+		if l, ok := ctx.Data["Lang"].(string); ok && l != "" {
+			lang = l
+		}
+		ctx.SetErrorFlash(i18n.FeatureClosedMessage(lang, db.FeatureQuestion, askState.Reason))
+		ctx.Redirect("/_/" + pageUser.Domain)
+		return
+	}
+
+	if !ctx.IsLogged && pageUser.HarassmentSetting == db.HarassmentSettingTypeRegisterOnly {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "question.errLoginRequired"))
+		ctx.Redirect(fmt.Sprintf("/login?to=%s", ctx.Request().Request.RequestURI))
+		return
+	}
+
+	// ---------- 私聊处理 ----------
+	if f.StartChat == "true" && ctx.IsLogged {
+
+		if ctx.User.ID == pageUser.ID {
+			ctx.SetErrorFlash(i18n.T(ctx.Lang(), "question.errSelfChat"))
+			ctx.Redirect("/_/" + pageUser.Domain)
+			return
+		}
+
+		// 私聊功能开关 / 定时 / 定量
+		chatState := db.FeatureStateOf(ctx.Request().Context(), pageUser.ID, db.FeatureChat)
+		if !chatState.Open {
+			lang := i18n.Default
+			if l, ok := ctx.Data["Lang"].(string); ok && l != "" {
+				lang = l
+			}
+			ctx.SetErrorFlash(i18n.FeatureClosedMessage(lang, db.FeatureChat, chatState.Reason))
+			ctx.Redirect("/_/" + pageUser.Domain)
+			return
+		}
+
+		// 检查是否被对方拉黑
+		blocked, err := db.Users.IsUserBlocked(ctx.Request().Context(), pageUser.ID, ctx.User.ID)
+		if err != nil {
+			logrus.WithError(err).Error("Failed to check block status")
+		}
+		if blocked {
+			ctx.SetErrorFlash(i18n.T(ctx.Lang(), "question.errBlockedChat"))
+			ctx.Redirect("/_/" + pageUser.Domain)
+			return
+		}
+
+		// 检查每日消息限制
+		if pageUser.DailyMessageLimit > 0 {
+			todayCount, err := db.Users.CountTodayMessagesFromUser(ctx.Request().Context(), pageUser.ID, ctx.User.ID)
+			if err != nil {
+				logrus.WithError(err).Error("Failed to count today messages")
+			}
+			if todayCount >= int64(pageUser.DailyMessageLimit) {
+				ctx.SetErrorFlash(i18n.T(ctx.Lang(), "question.errChatDailyLimit", pageUser.DailyMessageLimit))
+				ctx.Redirect("/_/" + pageUser.Domain)
+				return
+			}
+		}
+
+		if ctx.HasError() {
+			ctx.Success("question/list")
+			return
+		}
+
+		// 私聊首条消息长度上限：与对话内后续消息一致（conf.Limits.ChatMessageLen，
+		// [limits] 配置段）。此分支与提问共用同一 content 字段，长度不能按提问上限约束，
+		// 必须在入口按聊天语义单独校验。
+		if utf8.RuneCountInString(f.Content) > conf.Limits.ChatMessageLen {
+			ctx.SetErrorFlash(i18n.T(ctx.Lang(), "chat.errTooLong", conf.Limits.ChatMessageLen))
+			ctx.Redirect("/_/" + pageUser.Domain)
+			return
+		}
+
+		// 箱主全局屏蔽词（提问/私聊/投票共用一份词表）：首条消息同样拦截，
+		// 防止通过发起私聊绕过提问入口的屏蔽词校验（发送者是对方，非箱主本人）。
+		if _, hit := shared.BlockWordHit(pageUser.BlockWords, f.Content); hit {
+			ctx.SetErrorFlash(i18n.T(ctx.Lang(), "chat.errBlockWords"))
+			ctx.Redirect("/_/" + pageUser.Domain)
+			return
+		}
+
+		// 私聊同样需要验证码校验（防止机器人批量发起私聊刷骚扰信息）
+		ok, err := captcha.Verify(f.Recaptcha, shared.ResolveClientIP(ctx.Request().Request), ctx.Session, recaptcha, ctx.Lang())
+		if err != nil {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to check captcha")
+			ctx.SetErrorFlash(err.Error())
+			ctx.Redirect("/_/" + pageUser.Domain)
+			return
+		}
+		if !ok {
+			ctx.SetErrorFlash(i18n.T(ctx.Lang(), "captcha.error"))
+			ctx.Redirect("/_/" + pageUser.Domain)
+			return
+		}
+
+		// 同 IP + 相同内容重复拦截（防刷屏）
+		if !shared.DuplicateGuard.Allow(shared.DuplicateKey(shared.ResolveClientIP(ctx.Request().Request), f.Content)) {
+			ctx.SetErrorFlash(i18n.T(ctx.Lang(), "question.errDuplicateSubmit"))
+			ctx.Redirect("/_/" + pageUser.Domain)
+			return
+		}
+
+		// 内容安全检测
+		censorResponse, err := censor.Text(ctx.Request().Context(), f.Content)
+		if err != nil {
+			// 审核源全部不可用：fail-closed，拒绝发布而非免审放行。
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to censor text")
+			ctx.SetError(errors.New(i18n.T(ctx.Lang(), "censor.unavailable")), f)
+			ctx.Success("question/list")
+			return
+		}
+		if !censorResponse.Pass {
+			ctx.SetError(errors.New(censorResponse.ErrorMessage()), f)
+			ctx.Success("question/list")
+			return
+		}
+
+		maxMessages := pageUser.ChatMaxMessages
+		if maxMessages <= 0 {
+			// 存量兜底（老数据 / 极端配置）：回落到系统硬顶 conf.Limits.ChatMaxMessages
+			maxMessages = conf.Limits.ChatMaxMessages
+		}
+
+		conv, err := db.Conversations.Create(ctx.Request().Context(), db.CreateConversationOptions{
+			OwnerID:     pageUser.ID,
+			AskerID:     ctx.User.ID,
+			MaxMessages: maxMessages,
+		})
+		if err != nil {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to create conversation")
+			ctx.SetInternalError(f)
+			ctx.Success("question/list")
+			return
+		}
+
+		_, err = db.Messages.Create(ctx.Request().Context(), db.CreateMessageOptions{
+			ConversationID: conv.ID,
+			SenderID:       ctx.User.ID,
+			Content:        f.Content,
+		})
+		if err != nil {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to create first message")
+			ctx.SetInternalError(f)
+			ctx.Success("question/list")
+			return
+		}
+
+		if err := db.Conversations.IncrementMessageCount(ctx.Request().Context(), conv.ID); err != nil {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to increment message count")
+		}
+
+		// 私聊定量收集：新建会话即计一条（后续往来消息不重复计数）
+		if err := db.FeatureControls.IncrementQuota(ctx.Request().Context(), pageUser.ID, db.FeatureChat, 1); err != nil {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Warn("Failed to increment chat quota")
+		}
+
+		// 请求态数据提前提取，避免 goroutine 在请求结束后访问 ctx.User
+		askerName := ctx.User.Name
+		askerEmail := ctx.User.Email
+		shared.SafeGo(func() {
+			if pageUser.Notify == db.NotifyTypeEmail {
+				if err := mail.SendNewConversationMail(pageUser.Email, askerName, pageUser.Domain, conv.Token, f.Content); err != nil {
+					logrus.WithContext(stdctx.Background()).WithError(err).Error("Failed to send new conversation mail to owner")
+				}
+				if err := mail.SendNewConversationMail(askerEmail, askerName, pageUser.Domain, conv.Token, f.Content); err != nil {
+					logrus.WithContext(stdctx.Background()).WithError(err).Error("Failed to send new conversation mail to asker")
+				}
+			}
+		})
+
+		chatURL := fmt.Sprintf("/_/%s/chat/%s", pageUser.Domain, conv.Token)
+		chatAbsURL := fmt.Sprintf("%s%s", strings.TrimRight(conf.App.ExternalURL, "/"), chatURL)
+
+		ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "question.flash.chatSent", chatAbsURL))
+		ctx.Redirect("/_/" + pageUser.Domain)
+		return
+	}
+
+	// ---------- 普通提问 ----------
+
+	// 提问内容长度上限（conf.Limits.QuestionContentLen，[limits] 配置段），
+	// 与前端提问框 maxlength 同源。旧实现依赖 govalid maxlen 标签（写死 2000，
+	// 无法随配置调整），现移到此处以 rune 计数校验。
+	if utf8.RuneCountInString(f.Content) > conf.Limits.QuestionContentLen {
+		ctx.SetError(errors.New(i18n.T(ctx.Lang(), "form.question.contentTooLong", conf.Limits.QuestionContentLen)), f)
+		ctx.Success("question/list")
+		return
+	}
+
+	var receiveReplyEmail string
+	if f.ReceiveReplyViaEmail != "" {
+		if errs, ok := govalid.Check(struct {
+			Email string `valid:"required;email" label:"邮箱地址" msg:"form.email.required"`
+		}{
+			Email: f.ReceiveReplyEmail,
+		}); !ok {
+			ctx.SetError(errs[0], f)
+			ctx.Success("question/list")
+			return
+		}
+		receiveReplyEmail = f.ReceiveReplyEmail
+	}
+
+	if ctx.HasError() {
+		ctx.Success("question/list")
+		return
+	}
+
+	// Check captcha code (unified: recaptcha, turnstile, or math).
+	ok, err := captcha.Verify(f.Recaptcha, shared.ResolveClientIP(ctx.Request().Request), ctx.Session, recaptcha, ctx.Lang())
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to check captcha")
+		ctx.SetErrorFlash(err.Error())
+		ctx.Redirect("/_/" + pageUser.Domain)
+		return
+	}
+	if !ok {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "captcha.error"))
+		ctx.Redirect("/_/" + pageUser.Domain)
+		return
+	}
+
+	content := f.Content
+	isPrivate := f.IsPrivate != ""
+
+	// 统一走 shared.ResolveClientIP：仅 trust_proxy=true 时信任代理头，防止伪造 IP 混入审计记录
+	fromIP := shared.ResolveClientIP(ctx.Request().Request)
+
+	// 同 IP + 相同内容重复拦截（防刷屏）
+	if !shared.DuplicateGuard.Allow(shared.DuplicateKey(fromIP, content)) {
+		ctx.SetError(errors.New(i18n.T(ctx.Lang(), "question.errDuplicateSubmit")), f)
+		ctx.Success("question/list")
+		return
+	}
+
+	// 箱主全局屏蔽词（逗号分隔，提问/私聊/投票共用一份词表）：命中即拒绝。
+	if _, hit := shared.BlockWordHit(pageUser.BlockWords, content); hit {
+		ctx.SetError(errors.New(i18n.T(ctx.Lang(), "question.errBlockWords")), f)
+		ctx.Success("question/list")
+		return
+	}
+
+	censorResponse, err := censor.Text(ctx.Request().Context(), content)
+	if err != nil {
+		// 审核源全部不可用：fail-closed，拒绝发布而非免审放行，
+		// 避免审核服务宕机期间提问内容免审直接公开。
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to censor text")
+		ctx.SetError(errors.New(i18n.T(ctx.Lang(), "censor.unavailable")), f)
+		ctx.Success("question/list")
+		return
+	}
+	if !censorResponse.Pass {
+		errorMessage := censorResponse.ErrorMessage()
+		ctx.SetError(errors.New(errorMessage), f)
+		ctx.Success("question/list")
+		return
+	}
+
+	// 统一走 shared.ResolveClientIP（已在重复拦截处解析，此处复用）
+	var askerUserID uint
+	if ctx.IsLogged {
+		askerUserID = ctx.User.ID
+	}
+
+	question, err := db.Questions.Create(ctx.Request().Context(), db.CreateQuestionOptions{
+		FromIP:            fromIP,
+		UserID:            pageUser.ID,
+		Content:           content,
+		ReceiveReplyEmail: receiveReplyEmail,
+		AskerUserID:       askerUserID,
+		IsPrivate:         isPrivate,
+	})
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to create new question")
+		ctx.SetInternalError(f)
+		ctx.Success("question/list")
+		return
+	}
+
+	// 提问定量收集：一条提问计一次（含私密提问）；追问不重复计数
+	if err := db.FeatureControls.IncrementQuota(ctx.Request().Context(), pageUser.ID, db.FeatureQuestion, 1); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Warn("Failed to increment question quota")
+	}
+
+	if len(f.Images) > 0 {
+		image := f.Images[0]
+		if err := uploadImage(ctx, uploadImageOptions{
+			Type:           db.UploadImageQuestionTypeAsk,
+			Image:          image,
+			QuestionID:     question.ID,
+			UploaderUserID: askerUserID,
+		}); err != nil {
+			if errors.Is(err, ErrUploadImageSizeTooLarge) || errors.Is(err, imagecheck.ErrImageTooLarge) {
+				ctx.SetErrorFlash(i18n.T(ctx.Lang(), "question.errImageTooLarge"))
+				ctx.Success("question/list")
+				return
+			} else {
+				logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to upload image")
+				ctx.SetError(errors.New(i18n.T(ctx.Lang(), "question.errUploadImageFailed")), f)
+				ctx.Success("question/list")
+				return
+			}
+		}
+	}
+
+	if err := db.Questions.UpdateCensor(ctx.Request().Context(), question.ID, db.UpdateQuestionCensorOptions{
+		ContentCensorMetadata: censorResponse.ToJSON(),
+	}); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to update question censor result")
+	}
+
+	shared.SafeGo(func() {
+		if pageUser.Notify == db.NotifyTypeEmail {
+			if err := mail.SendNewQuestionMail(pageUser.Email, pageUser.Domain, question.ID, question.Content, question.Token); err != nil {
+				logrus.WithContext(stdctx.Background()).WithError(err).Error("Failed to send new question mail to user")
+			}
+			if err := mail.SendNewQuestionMailToUser(question.ReceiveReplyEmail, pageUser.Domain, question.ID, question.Content, question.Token); err != nil {
+				logrus.WithContext(stdctx.Background()).WithError(err).Error("Failed to send new question mail to questioner")
+			}
+		}
+	})
+
+	questionPrivateURL := fmt.Sprintf("/_/%s/%d?t=%s", pageUser.Domain, question.ID, question.Token)
+	questionPrivateAbsURL := fmt.Sprintf("%s%s", strings.TrimRight(conf.App.ExternalURL, "/"), questionPrivateURL)
+
+	// 提问成功页：强提醒保存私密链接/token（尤其针对未留邮箱的匿名提问者）
+	ctx.Data["Question"] = question
+	ctx.Data["PrivateURL"] = questionPrivateURL
+	ctx.Data["PrivateAbsURL"] = questionPrivateAbsURL
+	ctx.Data["HasReceiveEmail"] = receiveReplyEmail != ""
+	titleLang := i18n.Default
+	if l, ok := ctx.Data["Lang"].(string); ok && l != "" {
+		titleLang = l
+	}
+	ctx.SetTitle(i18n.T(titleLang, "success.pageTitle", i18n.T(titleLang, "site.title")))
+	ctx.Success("question/success")
+}
+
+type uploadImageOptions struct {
+	Type               db.UploadImageQuestionType
+	Image              *multipart.FileHeader
+	QuestionID         uint
+	UploaderUserID     uint
+	IsDeletingPrevious bool
+}
+
+var ErrUploadImageSizeTooLarge = errors.New("图片文件大小不能大于 5Mb")
+
+func uploadImage(ctx context.Context, opts uploadImageOptions) error {
+	imgFile := opts.Image
+	fileName := imgFile.Filename
+	fileExt := filepath.Ext(fileName)
+	fileSize := imgFile.Size
+	if fileSize > 1024*1024*5 {
+		return ErrUploadImageSizeTooLarge
+	}
+
+	uploadImageFile, err := imgFile.Open()
+	if err != nil {
+		return errors.Wrap(err, "open image")
+	}
+	defer func() { _ = uploadImageFile.Close() }()
+
+	// 读取原始文件数据并计算 MD5
+	hasher := md5.New()
+	originalData, err := io.ReadAll(io.TeeReader(uploadImageFile, hasher))
+	if err != nil {
+		return errors.Wrap(err, "read image data")
+	}
+	fileMd5 := fmt.Sprintf("%x", hasher.Sum(nil))
+
+	// 根据格式决定是否转换为 WebP
+	var uploadData []byte
+	var contentType string
+	var uploadKey string
+
+	// 检测原始格式（解码前先校验像素总量，防止解压炸弹）
+	if err := imagecheck.CheckPixelLimit(bytes.NewReader(originalData)); err != nil {
+		if errors.Is(err, imagecheck.ErrImageTooLarge) {
+			return imagecheck.ErrImageTooLarge
+		}
+		return errors.Wrap(err, "decode image config")
+	}
+
+	_, format, err := image.Decode(bytes.NewReader(originalData))
+	if err != nil {
+		return errors.Wrap(err, "decode image")
+	}
+
+	now := time.Now()
+	switch format {
+	case "gif":
+		// GIF 保持原样上传，不转换（动画 GIF 需要 cwebp 工具支持）
+		uploadData = originalData
+		contentType = "image/gif"
+		uploadKey = fmt.Sprintf("%d/%d/%d%s", now.Year(), now.Month(), now.UnixNano(), fileExt)
+	default:
+		// JPEG / PNG 等静态图片转换为 WebP
+		webpData, err := storage.ConvertStaticImageToWebP(bytes.NewReader(originalData))
+		if err != nil {
+			// 转换失败时回退为原始数据
+			logrus.WithError(err).Warn("WebP conversion failed, falling back to original format")
+			uploadData = originalData
+			contentType = contentTypeFromFormat(format)
+			uploadKey = fmt.Sprintf("%d/%d/%d%s", now.Year(), now.Month(), now.UnixNano(), fileExt)
+		} else {
+			uploadData = webpData
+			contentType = "image/webp"
+			// WebP 无后缀名，与 UploadPictureToS3 风格一致
+			uploadKey = fmt.Sprintf("%d/%d/%d%s", now.Year(), now.Month(), now.UnixNano(), ".webp")
+		}
+	}
+
+	client, err := storage.GetS3Client()
+	if err != nil {
+		return errors.Wrap(err, "get S3 client")
+	}
+	if _, err := client.PutObject(ctx.Request().Context(), &s3.PutObjectInput{
+		Bucket:        aws.String(conf.Upload.ImageBucket),
+		Key:           aws.String(uploadKey),
+		Body:          bytes.NewReader(uploadData),
+		ContentLength: aws.Int64(int64(len(uploadData))),
+		ContentType:   aws.String(contentType),
+	}); err != nil {
+		return errors.Wrap(err, "put object")
+	}
+
+	_, err = db.UploadImages.Create(ctx.Request().Context(), db.CreateUploadImageOptions{
+		Type:               opts.Type,
+		QuestionID:         opts.QuestionID,
+		UploaderUserID:     opts.UploaderUserID,
+		Name:               fileName,
+		FileSize:           int64(len(uploadData)),
+		Md5:                fileMd5,
+		Key:                uploadKey,
+		IsDeletingPrevious: opts.IsDeletingPrevious,
+	})
+	if err != nil {
+		return errors.Wrap(err, "create upload image")
+	}
+	return nil
+}
+
+// contentTypeFromFormat 根据图片格式返回 MIME 类型
+func contentTypeFromFormat(format string) string {
+	switch format {
+	case "jpeg":
+		return "image/jpeg"
+	case "png":
+		return "image/png"
+	case "gif":
+		return "image/gif"
+	default:
+		return "application/octet-stream"
+	}
+}
diff --git a/route/question/question.go b/route/question/question.go
new file mode 100644
index 0000000..a9c0d00
--- /dev/null
+++ b/route/question/question.go
@@ -0,0 +1,338 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package question
+
+import (
+	stdctx "context"
+	"fmt"
+	"net/url"
+	"unicode/utf8"
+
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/context"
+	"github.com/tamakyi/TamaBox/internal/db"
+	"github.com/tamakyi/TamaBox/internal/form"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+	"github.com/tamakyi/TamaBox/internal/imagecheck"
+	"github.com/tamakyi/TamaBox/internal/mail"
+	"github.com/tamakyi/TamaBox/internal/security/censor"
+	"github.com/tamakyi/TamaBox/internal/shared"
+)
+
+func Questioner(ctx context.Context, pageUser *db.User) {
+	// 从 URL query 读取 token；追问等 POST 请求 token 在表单隐藏域中，需回退读取表单字段。
+	// FormValue 同时覆盖 query 与 body（含 multipart），对 GET 请求行为与 Query 一致。
+	token := ctx.Query("t")
+	if token == "" {
+		token = ctx.Request().FormValue("token")
+	}
+	questionID := uint(ctx.ParamInt("questionID"))
+	question, err := db.Questions.GetByID(ctx.Request().Context(), questionID)
+	if err != nil {
+		if !errors.Is(err, db.ErrQuestionNotExist) {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to get question by ID")
+		}
+
+		ctx.Redirect("/")
+		return
+	}
+	ctx.Data["Question"] = question
+
+	askUploadImages, err := db.UploadImages.GetByTypeQuestionID(ctx.Request().Context(), db.UploadImageQuestionTypeAsk, questionID)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to get ask upload images")
+	}
+	ctx.Data["AskUploadImages"] = askUploadImages
+
+	answerUploadImages, err := db.UploadImages.GetByTypeQuestionID(ctx.Request().Context(), db.UploadImageQuestionTypeAnswer, questionID)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to get answer upload images")
+	}
+	ctx.Data["AnswerUploadImages"] = answerUploadImages
+
+	// Check the question is belongs to the correct page user.
+	// If the question has not been answered, we should check the question is belongs to the correct page user.
+	// The questioner can use the token to view the question.
+	// 注意：token 为空的未回答/私密问题同样禁止匿名访问（不能因 token 为空而放行）。
+	if question.UserID != pageUser.ID ||
+		((question.Answer == "" || question.IsPrivate) &&
+			(!ctx.IsLogged || ctx.User.ID != question.UserID) &&
+			!(question.Token != "" && question.Token == token)) {
+		ctx.Redirect("/")
+		return
+	}
+
+	// The page's owner or the question's token can have the permission to delete the question.
+	// Inject the permission into the context.
+	canDelete := ctx.IsLogged && ctx.User.ID == pageUser.ID
+	ctx.Map(canDelete)
+	ctx.Data["CanDelete"] = canDelete
+
+	// ---------- 追问 ----------
+	followUps, err := db.FollowUps.GetByQuestionID(ctx.Request().Context(), questionID)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to get follow ups")
+		followUps = []*db.FollowUp{}
+	}
+	ctx.Data["FollowUps"] = followUps
+
+	// 提问者身份：token 匹配（匿名）或登录账号匹配（登录用户）
+	isQuestioner := isQuestioner(ctx, question, token)
+	ctx.Data["IsQuestioner"] = isQuestioner
+
+	// 是否可追问：已回答 + 提问者 + 追问次数未达上限
+	followUpRemaining := 0
+	if isQuestioner && question.Answer != "" {
+		count, err := db.FollowUps.CountByQuestionID(ctx.Request().Context(), questionID)
+		if err != nil {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to count follow ups")
+		} else {
+			followUpRemaining = db.MaxFollowUpCount - int(count)
+		}
+	}
+	// 是否可追问：已回答 + 提问者 + 追问次数未达上限 + 上一条追问已被主人回复
+	// （主人尚未回复上一条追问时，提问者不应继续发起新的追问）
+	// 等待提示同样仅对提问者展示——主人/旁观者看到的应是回复框或正常内容。
+	waitingFollowUpReply := false
+	if isQuestioner && len(followUps) > 0 && followUps[len(followUps)-1].Answer == "" {
+		waitingFollowUpReply = true
+	}
+	canFollowUp := isQuestioner && question.Answer != "" && followUpRemaining > 0 && !waitingFollowUpReply
+	ctx.Data["CanFollowUp"] = canFollowUp
+	ctx.Data["WaitingFollowUpReply"] = waitingFollowUpReply
+	ctx.Data["FollowUpRemaining"] = followUpRemaining
+	ctx.Data["FollowUpLimit"] = db.MaxFollowUpCount
+	// 供追问表单隐藏域回传（匿名提问者必须携带 token）
+	ctx.Data["QuestionToken"] = token
+
+	// 返回来源：admin=从管理后台(/user/questions)进入；空=从提问箱主页(/_/domain)或直接访问，
+	// 默认返回提问箱主页。详情页底部"返回xxx的提问箱"按钮据此决定跳转目标。
+	backFrom := ctx.Query("from")
+	ctx.Data["BackFrom"] = backFrom
+	// 从后台返回时，把进入时携带的筛选参数(sort/status/type/read/q)原样回传，
+	// 使"返回"跳回带筛选条件的后台列表，避免丢失已选的筛选/搜索条件。
+	if backFrom == "admin" {
+		backQuery := url.Values{}
+		for _, key := range []string{"sort", "status", "type", "read", "q"} {
+			if v := ctx.Query(key); v != "" {
+				backQuery.Set(key, v)
+			}
+		}
+		backTo := "/user/questions"
+		if qs := backQuery.Encode(); qs != "" {
+			backTo += "?" + qs
+		}
+		ctx.Data["BackTo"] = backTo
+	}
+
+	ctx.Map(question)
+}
+
+func Item(ctx context.Context) {
+	ctx.Success("question/item")
+}
+
+func PublishAnswer(ctx context.Context, pageUser *db.User, question *db.Question, f form.PublishAnswerQuestion) {
+	if ctx.HasError() {
+		ctx.Success("question/item")
+		return
+	}
+
+	// 回答内容长度上限（conf.Limits.AnswerContentLen，[limits] 配置段），
+	// 与前端回答框 maxlength 同源（发布与编辑共用，rune 计数）。
+	if utf8.RuneCountInString(f.Answer) > conf.Limits.AnswerContentLen {
+		ctx.SetError(errors.New(i18n.T(ctx.Lang(), "form.answer.contentTooLong", conf.Limits.AnswerContentLen)), f)
+		ctx.Success("question/item")
+		return
+	}
+
+	if ctx.User.ID != pageUser.ID {
+		ctx.Redirect("/")
+		return
+	}
+
+	// 纵深防御：确认该提问归属当前页面箱主（Questioner 中间件已保证，这里二次校验防中间件改动引入越权）。
+	if question.UserID != pageUser.ID {
+		ctx.Redirect("/")
+		return
+	}
+
+	answer := f.Answer
+
+	// 🚨 Content security check.
+	censorResponse, err := censor.Text(ctx.Request().Context(), answer)
+	if err != nil {
+		// 审核源全部不可用：fail-closed，拒绝发布而非免审放行。
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to censor text")
+		ctx.SetError(errors.New(i18n.T(ctx.Lang(), "censor.unavailable")), f)
+		ctx.Success("question/item")
+		return
+	}
+	if !censorResponse.Pass {
+		errorMessage := censorResponse.ErrorMessage()
+		ctx.SetError(errors.New(errorMessage), f)
+		ctx.Success("question/item")
+		return
+	}
+
+	if len(f.Images) > 0 {
+		image := f.Images[0]
+
+		if err := uploadImage(ctx, uploadImageOptions{
+			Type:               db.UploadImageQuestionTypeAnswer,
+			Image:              image,
+			QuestionID:         question.ID,
+			UploaderUserID:     ctx.User.ID,
+			IsDeletingPrevious: true,
+		}); err != nil {
+			if errors.Is(err, ErrUploadImageSizeTooLarge) || errors.Is(err, imagecheck.ErrImageTooLarge) {
+				ctx.SetErrorFlash(err.Error())
+				ctx.Success("question/item")
+				return
+			} else {
+				logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to upload image")
+			}
+		}
+	}
+
+	if err := db.Questions.AnswerByID(ctx.Request().Context(), question.ID, f.Answer); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to answer question")
+		ctx.SetInternalError(f)
+		ctx.Success("question/item")
+		return
+	}
+
+	// Update censor result.
+	if err := db.Questions.UpdateCensor(ctx.Request().Context(), question.ID, db.UpdateQuestionCensorOptions{
+		AnswerCensorMetadata: censorResponse.ToJSON(),
+	}); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to update answer censor result")
+	}
+
+	shared.SafeGo(func() {
+		if question.ReceiveReplyEmail != "" && question.Answer == "" { // We only send the email when the question has not been answered.
+			// Send notification to questioner.
+			if err := mail.SendNewAnswerMail(question.ReceiveReplyEmail, pageUser.Domain, question.ID, question.Content, f.Answer, question.Token); err != nil {
+				logrus.WithContext(stdctx.Background()).WithError(err).Error("Failed to send receive reply mail to questioner")
+			}
+		}
+	})
+
+	ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "question.flash.answered"))
+	ctx.Redirect(fmt.Sprintf("/_/%s/%d", pageUser.Domain, question.ID))
+}
+
+func Delete(ctx context.Context, pageUser *db.User, question *db.Question, canDelete bool) {
+	if !canDelete {
+		ctx.Redirect("/_/" + pageUser.Domain)
+		return
+	}
+
+	if err := db.Questions.DeleteByID(ctx.Request().Context(), question.ID); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to delete question")
+		ctx.SetInternalError()
+		ctx.Success("question/item")
+		return
+	}
+
+	ctx.Redirect("/_/" + pageUser.Domain)
+}
+
+func SetPrivate(ctx context.Context, pageUser *db.User, question *db.Question, canDelete bool) {
+	if !canDelete {
+		ctx.Redirect("/_/" + pageUser.Domain)
+		return
+	}
+
+	if err := db.Questions.SetPrivate(ctx.Request().Context(), question.ID); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to set question private")
+		ctx.SetInternalError()
+		ctx.Success("question/item")
+		return
+	}
+
+	ctx.Redirect(fmt.Sprintf("/_/%s/%d", pageUser.Domain, question.ID))
+}
+
+func SetPublic(ctx context.Context, pageUser *db.User, question *db.Question, canDelete bool) {
+	if !canDelete {
+		ctx.Redirect("/_/" + pageUser.Domain)
+		return
+	}
+
+	if err := db.Questions.SetPublic(ctx.Request().Context(), question.ID); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to set question public")
+		ctx.SetInternalError()
+		ctx.Success("question/item")
+		return
+	}
+
+	ctx.Redirect(fmt.Sprintf("/_/%s/%d", pageUser.Domain, question.ID))
+}
+
+// TogglePin 置顶/取消置顶（仅提问箱主人，操作入口在我的提问管理页）。
+func TogglePin(ctx context.Context, pageUser *db.User, question *db.Question, canDelete bool) {
+	if !canDelete {
+		ctx.Redirect("/_/" + pageUser.Domain)
+		return
+	}
+
+	if err := db.Questions.SetPinned(ctx.Request().Context(), question.ID, !question.IsPinned); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to toggle question pinned")
+		ctx.SetInternalError()
+		ctx.Success("question/item")
+		return
+	}
+
+	ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "question.flash.operated"))
+	ctx.Redirect("/user/questions")
+}
+
+// SetRead 手动标记提问为已读，跳转回管理列表并定位到该条。
+func SetRead(ctx context.Context, pageUser *db.User, question *db.Question, canDelete bool) {
+	if !canDelete {
+		ctx.Redirect("/_/" + pageUser.Domain)
+		return
+	}
+
+	if err := db.Questions.SetRead(ctx.Request().Context(), question.ID); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to set question read")
+		ctx.SetInternalError()
+		ctx.Success("question/item")
+		return
+	}
+
+	ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "question.flash.markedRead"))
+	ctx.Redirect(fmt.Sprintf("/user/questions#question-%d", question.ID))
+}
+
+// SetUnread 手动标记提问为未读。已回答的提问锁定为已读，不可改回未读。
+// 跳转与 SetRead 一致，回到管理列表并定位到该条，保证"已读/未读"操作路径统一。
+func SetUnread(ctx context.Context, pageUser *db.User, question *db.Question, canDelete bool) {
+	if !canDelete {
+		ctx.Redirect("/_/" + pageUser.Domain)
+		return
+	}
+
+	// 已回答的问题锁定为已读：上层直接拦截，避免误导用户。
+	if question.Answer != "" {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "question.errAnsweredLocked"))
+		ctx.Redirect(fmt.Sprintf("/user/questions#question-%d", question.ID))
+		return
+	}
+
+	if err := db.Questions.SetUnread(ctx.Request().Context(), question.ID); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to set question unread")
+		ctx.SetInternalError()
+		ctx.Success("question/item")
+		return
+	}
+
+	ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "question.flash.markedUnread"))
+	ctx.Redirect(fmt.Sprintf("/user/questions#question-%d", question.ID))
+}
diff --git a/route/question/share.go b/route/question/share.go
new file mode 100644
index 0000000..40fcfd0
--- /dev/null
+++ b/route/question/share.go
@@ -0,0 +1,970 @@
+package question
+
+import (
+	"bytes"
+	stdctx "context"
+	"crypto/md5"
+	"fmt"
+	"image"
+	"image/color"
+	"image/draw"
+	"image/jpeg"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+	"unicode"
+
+	"github.com/disintegration/imaging"
+	"github.com/golang/freetype"
+	"github.com/golang/freetype/truetype"
+	"github.com/sirupsen/logrus"
+	qrcode "github.com/skip2/go-qrcode"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/context"
+	"github.com/tamakyi/TamaBox/internal/db"
+	"github.com/tamakyi/TamaBox/internal/shared"
+	"github.com/tamakyi/TamaBox/internal/template"
+)
+
+// 卡片尺寸与留白
+const (
+	CardWidth  = 960
+	CardHeight = 540
+	Margin     = 15
+)
+
+// 内容区域边界
+const (
+	ContentX = Margin
+	ContentY = Margin
+	ContentW = CardWidth - 2*Margin
+	ContentH = CardHeight - 2*Margin
+)
+
+// 头像参数
+const (
+	AvatarSize  = 112
+	AvatarCX    = ContentX + 90
+	AvatarCY    = ContentY + 90
+	AvatarRingW = 6
+	AvatarRingR = AvatarSize/2 + AvatarRingW
+)
+
+// 左侧文字区域
+const (
+	TextStartX = AvatarCX + AvatarRingR + 30
+	TextStartY = ContentY + 75
+)
+
+// 右侧二维码卡片尺寸
+const (
+	QRCardW = 270
+	QRCardH = 315
+	QRCardX = ContentX + ContentW - QRCardW - 15
+	QRCardY = ContentY + (ContentH-QRCardH)/2
+)
+
+// 二维码尺寸
+const (
+	QRCodeSize = 165
+	QRCodeX    = (QRCardW - QRCodeSize) / 2
+)
+
+// 社交信息
+const (
+	SocialIconW = 24
+	SocialIconH = 24
+	SocialTextX = TextStartX + SocialIconW + 8
+	SocialLineH = 32
+)
+
+// 底部水印
+const (
+	FooterY = ContentY + ContentH - 20
+)
+
+// 字体大小
+const (
+	FontSizeName   = 36
+	FontSizeIntro  = 20
+	FontSizeLink   = 15
+	FontSizeSocial = 17
+	FontSizeQRHint = 17
+	FontSizeFooter = 14
+)
+
+// 颜色系统
+var (
+	ColorWhite      = color.RGBA{255, 255, 255, 255}
+	ColorBlack      = color.RGBA{0, 0, 0, 255}
+	ColorDarkText   = color.RGBA{30, 30, 30, 255}
+	ColorGrayText   = color.RGBA{100, 100, 100, 255}
+	ColorSocialGray = color.RGBA{80, 80, 80, 255}
+	ColorHintGray   = color.RGBA{90, 90, 90, 255}
+	ColorFooterGray = color.RGBA{150, 150, 150, 255}
+	OverlayColor    = color.NRGBA{R: 255, G: 255, B: 255, A: 165}
+)
+
+// 全局字体缓存
+var (
+	fontOnce  sync.Once
+	fontCache *truetype.Font
+	fontErr   error
+)
+
+func getFont() (*truetype.Font, error) {
+	fontOnce.Do(func() {
+		fontBytes, err := os.ReadFile(conf.App.FontPath)
+		if err != nil {
+			fontErr = err
+			return
+		}
+		fontCache, fontErr = freetype.ParseFont(fontBytes)
+	})
+	return fontCache, fontErr
+}
+
+// shareDialer 与 shareDialContext：SSRF 防护——解析域名后校验所有解析 IP 均非内网，
+// 再交由 shared.DialFirstReachable 对公网候选 IP 并发拨号取最先成功者（happy-eyeballs 风格）。
+// 防 DNS rebinding（IP 字面量直连、无二次解析）的同时，避免固定拨单一 IP 抽中劣化边缘
+// 导致分享卡缺图（分享图源同样在 Cloudflare/R2，链路质量差时多 IP 容错尤为必要）。
+var shareDialer = &net.Dialer{Timeout: 8 * time.Second, KeepAlive: 30 * time.Second}
+
+// shareDialMaxCandidates 限制并发拨号扇出上限。
+const shareDialMaxCandidates = 6
+
+func shareDialContext(ctx stdctx.Context, network, addr string) (net.Conn, error) {
+	host, port, err := net.SplitHostPort(addr)
+	if err != nil {
+		return nil, err
+	}
+	ips, err := net.LookupIP(host)
+	if err != nil {
+		return nil, err
+	}
+	var candidates []net.IP
+	for _, ip := range ips {
+		if isBlockedIP(ip) {
+			return nil, fmt.Errorf("blocked ip address: %s", ip)
+		}
+		candidates = append(candidates, ip)
+	}
+	if len(candidates) == 0 {
+		return nil, fmt.Errorf("no public ip address resolved for %s", host)
+	}
+	return shared.DialFirstReachable(ctx, shareDialer, network, candidates, port, shareDialMaxCandidates)
+}
+
+// 全局 HTTP 客户端：连接池复用，避免每次请求都重新建立 TCP/TLS 连接。
+// 超时预算说明：分享卡图源（头像/背景/社交图标）同样位于 Cloudflare/R2，服务器到该链路
+// 质量差（实测单次约 6.5s），总预算放宽以容纳多 IP 并发拨号与慢速首字节；R2 图缺失时
+// 分享卡会静默降级（无头像/背景），宁可等待也不轻易放弃。
+var shareHTTPClient = &http.Client{
+	Timeout: 20 * time.Second,
+	Transport: &http.Transport{
+		MaxIdleConns:          100,
+		MaxIdleConnsPerHost:   10,
+		IdleConnTimeout:       90 * time.Second,
+		TLSHandshakeTimeout:   8 * time.Second,
+		ResponseHeaderTimeout: 8 * time.Second,
+		DialContext:           shareDialContext,
+	},
+	// SSRF 防护：重定向逐跳校验，防止 302 跳转到内网地址（如 169.254.169.254 云元数据）绕过初始校验
+	CheckRedirect: func(req *http.Request, via []*http.Request) error {
+		if len(via) >= 5 {
+			return fmt.Errorf("too many redirects")
+		}
+		if isBlockedImageURL(req.URL.String()) {
+			return fmt.Errorf("blocked redirect to %s", req.URL)
+		}
+		return nil
+	},
+}
+
+// ttlCache 是一个简单的并发安全带 TTL 缓存。
+// 带 maxItems 条数上限，超限时先清过期、再淘汰最早过期的一条，
+// 防止低配服务器（1C1G）上缓存无限膨胀。
+type ttlCache struct {
+	mu       sync.Mutex
+	items    map[string]ttlCacheItem
+	maxItems int
+}
+
+type ttlCacheItem struct {
+	value     interface{}
+	expiresAt time.Time
+}
+
+func newTTLCache(maxItems int) *ttlCache {
+	c := &ttlCache{items: make(map[string]ttlCacheItem), maxItems: maxItems}
+	// 常驻清理循环：每轮迭代单独 recover，panic 后循环不中断
+	go func() {
+		for range time.Tick(5 * time.Minute) {
+			func() {
+				defer func() {
+					if r := recover(); r != nil {
+						logrus.WithField("panic", r).Error("ttlCache cleanup panic recovered")
+					}
+				}()
+				c.cleanup()
+			}()
+		}
+	}()
+	return c
+}
+
+func (c *ttlCache) Get(key string) (interface{}, bool) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	item, ok := c.items[key]
+	if !ok {
+		return nil, false
+	}
+	if time.Now().After(item.expiresAt) {
+		delete(c.items, key)
+		return nil, false
+	}
+	return item.value, true
+}
+
+func (c *ttlCache) Set(key string, value interface{}, ttl time.Duration) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	// 超限时先清过期，仍满则淘汰最早过期的一条
+	if len(c.items) >= c.maxItems {
+		now := time.Now()
+		for k, item := range c.items {
+			if now.After(item.expiresAt) {
+				delete(c.items, k)
+			}
+		}
+		if len(c.items) >= c.maxItems {
+			var victim string
+			var earliest time.Time
+			first := true
+			for k, item := range c.items {
+				if first || item.expiresAt.Before(earliest) {
+					earliest = item.expiresAt
+					victim = k
+					first = false
+				}
+			}
+			if victim != "" {
+				delete(c.items, victim)
+			}
+		}
+	}
+
+	c.items[key] = ttlCacheItem{value: value, expiresAt: time.Now().Add(ttl)}
+}
+
+func (c *ttlCache) cleanup() {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	now := time.Now()
+	for k, item := range c.items {
+		if now.After(item.expiresAt) {
+			delete(c.items, k)
+		}
+	}
+}
+
+// 远程图片缓存（背景图、头像、社交图标），TTL 1 小时。
+// 存的是解码后的 image.Image，最吃内存（1280×720 RGBA ≈ 3.7MB/张），
+// 1C1G 环境下限制为 24 条：正常站点同一时刻活跃用户远小于此值。
+// 社交图标 URL 固定不变，基本永远命中；头像/背景变更时最多延迟 1 小时生效。
+var imageCache = newTTLCache(24)
+
+// 分享图结果缓存，TTL 30 分钟。key 含用户资料指纹，资料变更后自动失效。
+// 存的是 PNG 编码字节（约 0.2~1MB/张），限制 32 条，总内存 ≤ 32MB。
+var shareCardCache = newTTLCache(32)
+
+func ShareCard(ctx context.Context) {
+	domain := ctx.Param("domain")
+	user, err := db.Users.GetByDomain(ctx.Request().Context(), domain)
+	if err != nil {
+		ctx.Redirect("/")
+		return
+	}
+
+	// 命中缓存直接返回，避免重复下载图片与重新绘制
+	cacheKey := shareCardCacheKey(user)
+	if cached, ok := shareCardCache.Get(cacheKey); ok {
+		writeShareCardResponse(ctx, cached.([]byte))
+		return
+	}
+
+	canvas := image.NewRGBA(image.Rect(0, 0, CardWidth, CardHeight))
+
+	// 1. 背景
+	draw.Draw(canvas, canvas.Bounds(), &image.Uniform{ColorWhite}, image.Point{}, draw.Src)
+	innerRect := image.Rect(ContentX, ContentY, ContentX+ContentW, ContentY+ContentH)
+
+	// ---- 并发下载所有远程图片 ----
+	var (
+		bgImg image.Image
+		avImg image.Image
+	)
+	icons := []struct {
+		show bool
+		url  string
+		icon string
+	}{
+		{user.Acfunlink != "" && user.Acfunlink != "none", user.Acfunlink, "https://r2.337845818.best/tamabox/icon/social/ailicili.png"},
+		{user.Bililink != "" && user.Bililink != "none", user.Bililink, "https://r2.337845818.best/tamabox/icon/social/bili.png"},
+		{user.Weibolink != "" && user.Weibolink != "none", user.Weibolink, "https://r2.337845818.best/tamabox/icon/social/weibo.png"},
+		{user.Bloglink != "" && user.Bloglink != "none", user.Bloglink, "https://r2.337845818.best/tamabox/icon/social/blog.png"},
+		{user.Xiaohongshulink != "" && user.Xiaohongshulink != "none", user.Xiaohongshulink, "https://r2.337845818.best/tamabox/icon/social/xiaohongshu.png"},
+	}
+	iconImgs := make([]image.Image, len(icons))
+
+	var wg sync.WaitGroup
+
+	// 背景图
+	bgURL := user.Background
+	if bgURL == "" {
+		bgURL = conf.App.ShareBackground
+	}
+	wg.Add(1)
+	shared.SafeGo(func() {
+		defer wg.Done()
+		img, err := loadImage(bgURL, ContentW, ContentH)
+		if err == nil {
+			bgImg = img
+		}
+	})
+
+	// 头像
+	wg.Add(1)
+	shared.SafeGo(func() {
+		defer wg.Done()
+		img, err := loadImage(user.Avatar, AvatarSize, AvatarSize)
+		if err == nil {
+			avImg = img
+		}
+	})
+
+	// 社交图标
+	for i, item := range icons {
+		if !item.show {
+			continue
+		}
+		idx, iconURL := i, item.icon
+		wg.Add(1)
+		shared.SafeGo(func() {
+			defer wg.Done()
+			img, err := loadImage(iconURL, SocialIconW, SocialIconH)
+			if err == nil {
+				iconImgs[idx] = img
+			}
+		})
+	}
+
+	wg.Wait()
+	// ---- 下载结束 ----
+
+	// 绘制背景
+	if bgImg != nil {
+		draw.Draw(canvas, innerRect, bgImg, image.Point{}, draw.Src)
+	}
+	overlay := image.NewUniform(OverlayColor)
+	draw.Draw(canvas, innerRect, overlay, image.Point{}, draw.Over)
+
+	// 2. 加载字体（复用缓存）
+	ft, err := getFont()
+	if err != nil {
+		http.Error(ctx.ResponseWriter(), "分享图生成失败：字体文件未配置或无法加载", http.StatusInternalServerError)
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to load font for share card")
+		return
+	}
+	fontCtx := freetype.NewContext()
+	fontCtx.SetFont(ft)
+	fontCtx.SetFontSize(24)
+	fontCtx.SetDPI(72)
+
+	// 3. 头像
+	drawCircleFilled(canvas, AvatarCX, AvatarCY, AvatarRingR, ColorWhite)
+	if avImg != nil {
+		avImg = imaging.Fill(avImg, AvatarSize, AvatarSize, imaging.Center, imaging.Lanczos)
+		mask := image.NewAlpha(image.Rect(0, 0, AvatarSize, AvatarSize))
+		drawCircle(mask, AvatarSize/2, AvatarSize/2, AvatarSize/2, color.Alpha{255})
+		draw.DrawMask(canvas,
+			image.Rect(AvatarCX-AvatarSize/2, AvatarCY-AvatarSize/2, AvatarCX+AvatarSize/2, AvatarCY+AvatarSize/2),
+			avImg, image.Point{}, mask, image.Point{}, draw.Over)
+	} else {
+		mask := image.NewAlpha(image.Rect(0, 0, AvatarSize, AvatarSize))
+		drawCircle(mask, AvatarSize/2, AvatarSize/2, AvatarSize/2, color.Alpha{255})
+		draw.DrawMask(canvas,
+			image.Rect(AvatarCX-AvatarSize/2, AvatarCY-AvatarSize/2, AvatarCX+AvatarSize/2, AvatarCY+AvatarSize/2),
+			&image.Uniform{color.Gray{180}}, image.Point{}, mask, image.Point{}, draw.Over)
+	}
+
+	// 4. 左侧文字
+	// 文字区裁剪边界：左侧文字不得侵入右侧二维码卡片（QRCardX 左侧留 20px 间距）。
+	leftClip := image.Rect(TextStartX, ContentY, QRCardX-20, ContentY+ContentH)
+	leftMaxW := QRCardX - TextStartX - 60
+	y := TextStartY
+	drawTextWithShadow(canvas, user.Name, TextStartX, y, FontSizeName, ColorDarkText, color.NRGBA{0, 0, 0, 50}, 1, fontCtx)
+	y += int(FontSizeName) + 15
+	// 简介最多 4 行，超出截断加省略号，避免长简介向下覆盖社交区/水印
+	y = drawTextMultilineLimited(canvas, user.Intro, TextStartX, y, leftMaxW, FontSizeIntro, ColorGrayText, fontCtx, 46, 4, leftClip)
+	y += 30
+
+	// 5. 社交信息
+	socialY := y + 22
+	for i, item := range icons {
+		if !item.show || iconImgs[i] == nil {
+			continue
+		}
+		draw.Draw(canvas,
+			image.Rect(TextStartX, socialY, TextStartX+SocialIconW, socialY+SocialIconH),
+			iconImgs[i], image.Point{}, draw.Over)
+		drawTextClipped(canvas, item.url, SocialTextX, socialY+SocialIconH-6, FontSizeSocial, ColorSocialGray, fontCtx, leftClip)
+		socialY += SocialLineH
+	}
+
+	// 6. 右侧二维码卡片
+	cardRect := image.Rect(QRCardX, QRCardY, QRCardX+QRCardW, QRCardY+QRCardH)
+	cardCenterX := QRCardX + QRCardW/2
+
+	drawRoundedRect(canvas, cardRect, color.NRGBA{245, 245, 245, 255}, 18)
+	drawRoundedRect(canvas, cardRect, ColorWhite, 18)
+
+	boxURL := fmt.Sprintf("%s/_/%s", conf.App.ExternalURL, user.Domain)
+	qr, err := generateQR(boxURL, user, avImg)
+	if err != nil {
+		http.Error(ctx.ResponseWriter(), "二维码生成失败", http.StatusInternalServerError)
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to generate QR code")
+		return
+	}
+	qrResized := imaging.Resize(qr, QRCodeSize, QRCodeSize, imaging.NearestNeighbor)
+
+	const (
+		qrToHintGap    = 26
+		hintLineHeight = 17
+		hintToSepGap   = 21
+		sepHeight      = 1
+		sepToLinkGap   = 21
+		linkLineHeight = 15
+	)
+	totalContentH := QRCodeSize + qrToHintGap + hintLineHeight + hintToSepGap + sepHeight + sepToLinkGap + linkLineHeight
+	startY := QRCardY + (QRCardH-totalContentH)/2
+
+	qrDrawX := QRCardX + QRCodeX
+	qrDrawY := startY
+	draw.Draw(canvas, image.Rect(qrDrawX, qrDrawY, qrDrawX+QRCodeSize, qrDrawY+QRCodeSize), qrResized, image.Point{}, draw.Over)
+
+	hintY := qrDrawY + QRCodeSize + qrToHintGap + hintLineHeight
+	drawTextCentered(canvas, "扫码向我匿名提问", cardCenterX, hintY, FontSizeQRHint, ColorHintGray, fontCtx)
+
+	sepY := hintY + hintToSepGap
+	drawLine(canvas, cardCenterX-90, sepY, cardCenterX+90, sepY, color.NRGBA{200, 200, 200, 180})
+
+	linkY := sepY + sepToLinkGap + linkLineHeight
+	linkText := boxURL
+	linkFontSize := float64(FontSizeLink)
+	availableW := QRCardW - 45
+	actualW := measureTextWidth(linkText, linkFontSize)
+	if actualW > float64(availableW) {
+		linkFontSize = linkFontSize * float64(availableW) / actualW
+	}
+	drawTextCentered(canvas, linkText, cardCenterX, linkY, linkFontSize, ColorDarkText, fontCtx)
+
+	// 7. 底部水印
+	drawTextCentered(canvas, "Powered by 狼的提问箱", CardWidth/2, FooterY, FontSizeFooter, ColorFooterGray, fontCtx)
+
+	// 8. 输出（缓存 + 响应）
+	buf := new(bytes.Buffer)
+	if err := jpeg.Encode(buf, canvas, &jpeg.Options{Quality: 88}); err != nil {
+		http.Error(ctx.ResponseWriter(), "图片生成失败", http.StatusInternalServerError)
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to encode share card PNG")
+		return
+	}
+
+	shareCardCache.Set(cacheKey, buf.Bytes(), time.Hour)
+	writeShareCardResponse(ctx, buf.Bytes())
+}
+
+// writeShareCardResponse 统一输出分享图响应。
+// 加 Cache-Control 让浏览器与 CDN（如 Cloudflare）缓存，进一步减轻服务器压力。
+func writeShareCardResponse(ctx context.Context, data []byte) {
+	ctx.ResponseWriter().Header().Set("Content-Type", "image/jpeg")
+	ctx.ResponseWriter().Header().Set("Content-Disposition", "attachment; filename=\"share.jpg\"")
+	ctx.ResponseWriter().Header().Set("Content-Length", strconv.Itoa(len(data)))
+	ctx.ResponseWriter().Header().Set("Cache-Control", "public, max-age=300")
+	ctx.ResponseWriter().WriteHeader(http.StatusOK)
+	_, _ = ctx.ResponseWriter().Write(data)
+}
+
+// shareCardCacheKey 基于用户资料生成缓存指纹。
+// 资料（名称/简介/头像/背景/社交链接）任何一项变更都会导致 key 变化，缓存自动失效。
+func shareCardCacheKey(user *db.User) string {
+	h := md5.New()
+	fmt.Fprintf(h, "%s|%s|%s|%s|%s|%s|%s|%s|%s|%s",
+		user.Domain, user.Name, user.Intro, user.Avatar, user.Background,
+		user.Acfunlink, user.Bililink, user.Weibolink, user.Bloglink, user.Xiaohongshulink)
+	return fmt.Sprintf("sharecard:%x", h.Sum(nil))
+}
+
+// ---------- 工具函数 ----------
+
+// maxImagePixels 限制远程图片解码后的最大像素总量（4096×4096≈67MB RGBA），
+// 防止恶意超大图耗尽服务器内存。
+const maxImagePixels = 4096 * 4096
+
+// isBlockedImageURL SSRF 防护：仅允许 http/https，且主机不能解析到私网/环回等内网地址。
+func isBlockedImageURL(rawURL string) bool {
+	u, err := url.Parse(rawURL)
+	if err != nil {
+		return true
+	}
+	if u.Scheme != "http" && u.Scheme != "https" {
+		return true
+	}
+	host := u.Hostname()
+	if host == "" {
+		return true
+	}
+	// 直接是 IP 字面量：私网/环回/链路本地/未指定/组播一律拒绝
+	if ip := net.ParseIP(host); ip != nil {
+		return isBlockedIP(ip)
+	}
+	// 域名：解析出任一内网 IP 即拒绝
+	ips, err := net.LookupIP(host)
+	if err != nil {
+		// 解析失败交给 HTTP 层报错（不阻断），避免 DNS 临时故障误伤正常图片
+		return false
+	}
+	for _, ip := range ips {
+		if isBlockedIP(ip) {
+			return true
+		}
+	}
+	return false
+}
+
+func isBlockedIP(ip net.IP) bool {
+	return ip.IsLoopback() || ip.IsPrivate() || ip.IsLinkLocalUnicast() ||
+		ip.IsLinkLocalMulticast() || ip.IsUnspecified() || ip.IsMulticast()
+}
+
+func loadImage(url string, w, h int) (image.Image, error) {
+	// SSRF 防护：拒绝非 http/https 与内网地址（127.0.0.1、10.x、192.168.x 等）
+	if isBlockedImageURL(url) {
+		return nil, fmt.Errorf("blocked image url: %s", url)
+	}
+
+	key := fmt.Sprintf("%s|%dx%d", url, w, h)
+	if cached, ok := imageCache.Get(key); ok {
+		return cached.(image.Image), nil
+	}
+
+	resp, err := shareHTTPClient.Get(url)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("bad status: %s", resp.Status)
+	}
+	img, _, err := image.Decode(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+	// 解码后限制像素总量，防止超大图耗尽内存
+	b := img.Bounds()
+	if b.Dx()*b.Dy() > maxImagePixels {
+		return nil, fmt.Errorf("image too large: %dx%d", b.Dx(), b.Dy())
+	}
+	filled := imaging.Fill(img, w, h, imaging.Center, imaging.Lanczos)
+	imageCache.Set(key, filled, time.Hour)
+	return filled, nil
+}
+
+func drawCircle(mask *image.Alpha, cx, cy, r int, c color.Alpha) {
+	for x := -r; x <= r; x++ {
+		for y := -r; y <= r; y++ {
+			if x*x+y*y <= r*r {
+				mask.SetAlpha(cx+x, cy+y, c)
+			}
+		}
+	}
+}
+
+func drawCircleFilled(dst *image.RGBA, cx, cy, r int, clr color.Color) {
+	for x := -r; x <= r; x++ {
+		for y := -r; y <= r; y++ {
+			if x*x+y*y <= r*r {
+				dst.Set(cx+x, cy+y, clr)
+			}
+		}
+	}
+}
+
+func drawRoundedRect(dst *image.RGBA, rect image.Rectangle, clr color.Color, radius int) {
+	draw.Draw(dst, image.Rect(rect.Min.X+radius, rect.Min.Y, rect.Max.X-radius, rect.Max.Y),
+		&image.Uniform{clr}, image.Point{}, draw.Over)
+	draw.Draw(dst, image.Rect(rect.Min.X, rect.Min.Y+radius, rect.Max.X, rect.Max.Y-radius),
+		&image.Uniform{clr}, image.Point{}, draw.Over)
+	drawCircleFilledRGBA(dst, rect.Min.X+radius, rect.Min.Y+radius, radius, clr)
+	drawCircleFilledRGBA(dst, rect.Max.X-radius, rect.Min.Y+radius, radius, clr)
+	drawCircleFilledRGBA(dst, rect.Min.X+radius, rect.Max.Y-radius, radius, clr)
+	drawCircleFilledRGBA(dst, rect.Max.X-radius, rect.Max.Y-radius, radius, clr)
+}
+
+func drawCircleFilledRGBA(dst *image.RGBA, cx, cy, r int, clr color.Color) {
+	for x := -r; x <= r; x++ {
+		for y := -r; y <= r; y++ {
+			if x*x+y*y <= r*r {
+				dst.Set(cx+x, cy+y, clr)
+			}
+		}
+	}
+}
+
+func drawLine(dst *image.RGBA, x1, y1, x2, y2 int, clr color.Color) {
+	if y1 != y2 {
+		return
+	}
+	for x := x1; x <= x2; x++ {
+		dst.Set(x, y1, clr)
+	}
+}
+
+func drawText(dst *image.RGBA, text string, x, y int, fontSize float64, col color.Color, ftCtx *freetype.Context) {
+	ftCtx.SetClip(dst.Bounds())
+	ftCtx.SetSrc(image.NewUniform(col))
+	ftCtx.SetFontSize(fontSize)
+	ftCtx.SetDst(dst)
+	_, _ = ftCtx.DrawString(text, freetype.Pt(x, y))
+}
+
+// drawTextClipped 同 drawText，但将绘制裁剪到 clip 区域。
+// 用于左侧文字区：即使宽度估算偏差导致某行文字偏宽，也只会被裁掉，不会侵入右侧二维码卡片。
+func drawTextClipped(dst *image.RGBA, text string, x, y int, fontSize float64, col color.Color, ftCtx *freetype.Context, clip image.Rectangle) {
+	ftCtx.SetClip(clip)
+	ftCtx.SetSrc(image.NewUniform(col))
+	ftCtx.SetFontSize(fontSize)
+	ftCtx.SetDst(dst)
+	_, _ = ftCtx.DrawString(text, freetype.Pt(x, y))
+}
+
+// drawTextWithShadow 先绘制偏移阴影再绘制原色文字，增强在复杂背景上的可读性。
+func drawTextWithShadow(dst *image.RGBA, text string, x, y int, fontSize float64, col, shadow color.Color, offset int, ftCtx *freetype.Context) {
+	drawText(dst, text, x+offset, y+offset, fontSize, shadow, ftCtx)
+	drawText(dst, text, x, y, fontSize, col, ftCtx)
+}
+
+func splitText(text string, fontSize float64, maxWidth int) []string {
+	var lines []string
+	var currentLine []rune
+	var currentWidth float64
+	for _, r := range text {
+		charW := charPixelWidth(r, fontSize)
+		if currentWidth+charW > float64(maxWidth) && len(currentLine) > 0 {
+			lines = append(lines, string(currentLine))
+			currentLine = []rune{r}
+			currentWidth = charW
+		} else {
+			currentLine = append(currentLine, r)
+			currentWidth += charW
+		}
+	}
+	if len(currentLine) > 0 {
+		lines = append(lines, string(currentLine))
+	}
+	return lines
+}
+
+func charPixelWidth(r rune, fontSize float64) float64 {
+	// 宽度系数取「保守上界」：中文字体是方形，实际渲染宽度≈fontSize；
+	// 若估算偏窄，splitText 换行后的行宽会超出 maxWidth，文字侵入相邻区域。
+	// 这里按实际宽度的上界估算，保证 splitText 的行数是安全的（宁可多换行，配合行数截断）。
+	if unicode.Is(unicode.Han, r) || unicode.Is(unicode.Punct, r) || unicode.Is(unicode.Symbol, r) {
+		return fontSize * 1.0
+	}
+	return fontSize * 0.62
+}
+
+// measureTextWidth 用逐字符宽度估算（与 splitText 的 charPixelWidth 一致），
+// 避免每次测量都创建 freetype.Context 并执行 DrawString（显著降低生成耗时）。
+func measureTextWidth(text string, fontSize float64) float64 {
+	return measureTextEstimate(text, fontSize)
+}
+
+func measureTextEstimate(text string, fontSize float64) float64 {
+	total := 0.0
+	for _, r := range text {
+		total += charPixelWidth(r, fontSize)
+	}
+	return total
+}
+
+func drawTextCentered(dst *image.RGBA, text string, cx, y int, fontSize float64, col color.Color, ftCtx *freetype.Context) {
+	ftCtx.SetClip(dst.Bounds())
+	ftCtx.SetSrc(image.NewUniform(col))
+	ftCtx.SetFontSize(fontSize)
+	actualW := measureTextWidth(text, fontSize)
+	x := cx - int(actualW/2)
+	if x < 0 {
+		x = 0
+	}
+	ftCtx.SetDst(dst)
+	_, _ = ftCtx.DrawString(text, freetype.Pt(x, y))
+}
+
+func generateQR(content string, user *db.User, logoImg image.Image) (image.Image, error) {
+	qr, err := qrcode.New(content, qrcode.High)
+	if err != nil {
+		return nil, err
+	}
+
+	// 强制传统黑白，忽略用户所有颜色设置
+	qr.BackgroundColor = color.RGBA{255, 255, 255, 255}
+	qr.ForegroundColor = color.RGBA{0, 0, 0, 255}
+
+	qrPaletted := qr.Image(256)
+	rgba := image.NewRGBA(qrPaletted.Bounds())
+	draw.Draw(rgba, rgba.Bounds(), qrPaletted, image.Point{}, draw.Src)
+
+	if logoImg != nil {
+		logo := imaging.Fill(logoImg, 48, 48, imaging.Center, imaging.Lanczos)
+		bounds := rgba.Bounds()
+		logoPos := image.Pt(
+			bounds.Min.X+(bounds.Dx()-logo.Bounds().Dx())/2,
+			bounds.Min.Y+(bounds.Dy()-logo.Bounds().Dy())/2,
+		)
+		draw.Draw(rgba, logo.Bounds().Add(logoPos), logo, image.Point{}, draw.Over)
+	}
+	return rgba, nil
+}
+
+// ---------- 单题分享图 ----------
+
+// 单题分享图布局常量（1280x720）
+const (
+	QContentX = 45
+	QContentY = 45
+	QContentW = CardWidth - 2*QContentX
+	QContentH = CardHeight - 2*QContentY
+
+	QAvatarSize = 33
+	QAvatarX    = QContentX + 2
+	QAvatarY    = QContentY + 2
+	QNameX      = QAvatarX + QAvatarSize + 12
+	QNameY      = QContentY + 28
+
+	QSepY = QContentY + 50
+
+	QLabelFont       = 20.0
+	QQuestionFont    = 26.0
+	QQuestionLineH   = 34
+	QQuestionMaxLine = 3
+	QAnswerFont      = 22.0
+	QAnswerLineH     = 30
+	QAnswerMaxLine   = 7
+
+	// 右侧二维码卡片
+	QQRCardW = 210
+	QQRCardH = 255
+	QQRCardX = QContentX + QContentW - QQRCardW
+	QQRCardY = QContentY + (QContentH-QQRCardH)/2
+	QQRSize  = 128
+	QQRCodeX = (QQRCardW - QQRSize) / 2
+
+	// 内容区最大宽度（左侧，避开二维码卡片）
+	QTextMaxW = QQRCardX - QContentX - 30
+
+	QWatermarkY = CardHeight - 30
+)
+
+// 单题分享图结果缓存，TTL 30 分钟，上限 16 条（1C1G 内存友好）。
+var questionShareCache = newTTLCache(16)
+
+// QuestionShareCard 生成单个问题（问题+回答）的分享卡片图。
+func QuestionShareCard(ctx context.Context) {
+	domain := ctx.Param("domain")
+	user, err := db.Users.GetByDomain(ctx.Request().Context(), domain)
+	if err != nil {
+		ctx.Redirect("/")
+		return
+	}
+
+	questionID := uint(ctx.ParamInt("questionID"))
+	question, err := db.Questions.GetByID(ctx.Request().Context(), questionID)
+	if err != nil {
+		ctx.Redirect("/")
+		return
+	}
+
+	// 仅公开且已回答的问题可以生成分享图（Questioner 中间件已挡住私密/未回答，这里再兜底一次）
+	if question.UserID != user.ID || question.Answer == "" || question.IsPrivate {
+		ctx.Redirect("/")
+		return
+	}
+
+	cacheKey := questionShareCardCacheKey(user, question)
+	if cached, ok := questionShareCache.Get(cacheKey); ok {
+		writeShareCardResponse(ctx, cached.([]byte))
+		return
+	}
+
+	canvas := image.NewRGBA(image.Rect(0, 0, CardWidth, CardHeight))
+	innerRect := image.Rect(QContentX, QContentY, QContentX+QContentW, QContentY+QContentH)
+
+	// ---- 并发加载背景与头像 ----
+	var (
+		bgImg image.Image
+		avImg image.Image
+	)
+	var wg sync.WaitGroup
+	bgURL := user.Background
+	if bgURL == "" {
+		bgURL = conf.App.ShareBackground
+	}
+	wg.Add(1)
+	shared.SafeGo(func() {
+		defer wg.Done()
+		img, err := loadImage(bgURL, QContentW, QContentH)
+		if err == nil {
+			bgImg = img
+		}
+	})
+	wg.Add(1)
+	shared.SafeGo(func() {
+		defer wg.Done()
+		img, err := loadImage(user.Avatar, QAvatarSize, QAvatarSize)
+		if err == nil {
+			avImg = img
+		}
+	})
+	wg.Wait()
+
+	// 背景 + 白色遮罩
+	draw.Draw(canvas, canvas.Bounds(), &image.Uniform{ColorWhite}, image.Point{}, draw.Src)
+	if bgImg != nil {
+		draw.Draw(canvas, innerRect, bgImg, image.Point{}, draw.Src)
+	}
+	draw.Draw(canvas, innerRect, image.NewUniform(OverlayColor), image.Point{}, draw.Over)
+
+	// 字体
+	ft, err := getFont()
+	if err != nil {
+		http.Error(ctx.ResponseWriter(), "分享图生成失败：字体文件未配置或无法加载", http.StatusInternalServerError)
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to load font for question share card")
+		return
+	}
+	fontCtx := freetype.NewContext()
+	fontCtx.SetFont(ft)
+	fontCtx.SetFontSize(24)
+	fontCtx.SetDPI(72)
+
+	// 头部：头像 + 名字
+	drawCircleFilled(canvas, QAvatarX+QAvatarSize/2, QAvatarY+QAvatarSize/2, QAvatarSize/2+2, ColorWhite)
+	if avImg != nil {
+		avImg = imaging.Fill(avImg, QAvatarSize, QAvatarSize, imaging.Center, imaging.Lanczos)
+		mask := image.NewAlpha(image.Rect(0, 0, QAvatarSize, QAvatarSize))
+		drawCircle(mask, QAvatarSize/2, QAvatarSize/2, QAvatarSize/2, color.Alpha{255})
+		draw.DrawMask(canvas,
+			image.Rect(QAvatarX, QAvatarY, QAvatarX+QAvatarSize, QAvatarY+QAvatarSize),
+			avImg, image.Point{}, mask, image.Point{}, draw.Over)
+	} else {
+		mask := image.NewAlpha(image.Rect(0, 0, QAvatarSize, QAvatarSize))
+		drawCircle(mask, QAvatarSize/2, QAvatarSize/2, QAvatarSize/2, color.Alpha{255})
+		draw.DrawMask(canvas,
+			image.Rect(QAvatarX, QAvatarY, QAvatarX+QAvatarSize, QAvatarY+QAvatarSize),
+			&image.Uniform{color.Gray{180}}, image.Point{}, mask, image.Point{}, draw.Over)
+	}
+	drawTextWithShadow(canvas, user.Name+" 的提问箱", QNameX, QNameY, 22, ColorDarkText, color.NRGBA{0, 0, 0, 45}, 1, fontCtx)
+
+	// 分隔线
+	drawLine(canvas, QContentX+2, QSepY, QContentX+QContentW-2, QSepY, color.NRGBA{190, 190, 190, 200})
+
+	// 左侧文字区裁剪边界：问题/回答文字不得侵入右侧二维码卡片（QQRCardX 左侧留 10px 间距）。
+	qLeftClip := image.Rect(QContentX, QContentY, QQRCardX-10, QContentY+QContentH)
+
+	// 问题区
+	labelY := QSepY + 32
+	drawText(canvas, "提问", QContentX+2, labelY, QLabelFont, ColorGrayText, fontCtx)
+
+	textY := labelY + 30
+	textY = drawTextMultilineLimited(canvas, sanitizeText(template.MarkdownToPlainText(question.Content)), QContentX+2, textY, QTextMaxW, QQuestionFont, ColorDarkText, fontCtx, QQuestionLineH, QQuestionMaxLine, qLeftClip)
+
+	// 回答区
+	labelY = textY + 22
+	drawText(canvas, "回答", QContentX+2, labelY, QLabelFont, ColorGrayText, fontCtx)
+
+	textY = labelY + 28
+	textY = drawTextMultilineLimited(canvas, sanitizeText(template.MarkdownToPlainText(question.Answer)), QContentX+2, textY, QTextMaxW, QAnswerFont, ColorDarkText, fontCtx, QAnswerLineH, QAnswerMaxLine, qLeftClip)
+	_ = textY
+
+	// 右侧二维码卡片
+	cardRect := image.Rect(QQRCardX, QQRCardY, QQRCardX+QQRCardW, QQRCardY+QQRCardH)
+	drawRoundedRect(canvas, cardRect, color.NRGBA{245, 245, 245, 255}, 20)
+	drawRoundedRect(canvas, cardRect, ColorWhite, 20)
+
+	questionURL := fmt.Sprintf("%s/_/%s/%d", conf.App.ExternalURL, user.Domain, question.ID)
+	qr, err := generateQR(questionURL, user, avImg)
+	if err != nil {
+		http.Error(ctx.ResponseWriter(), "二维码生成失败", http.StatusInternalServerError)
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to generate QR code for question share card")
+		return
+	}
+	qrResized := imaging.Resize(qr, QQRSize, QQRSize, imaging.NearestNeighbor)
+	qrDrawX := QQRCardX + QQRCodeX
+	// 二维码与提示语整体垂直居中（已删除底部冗余的长链接，卡片更简洁）
+	qrDrawY := QQRCardY + 40
+	draw.Draw(canvas, image.Rect(qrDrawX, qrDrawY, qrDrawX+QQRSize, qrDrawY+QQRSize), qrResized, image.Point{}, draw.Over)
+
+	hintY := qrDrawY + QQRSize + 30
+	drawTextCentered(canvas, "扫码查看回答", QQRCardX+QQRCardW/2, hintY, 17, ColorHintGray, fontCtx)
+
+	// 底部水印
+	drawTextCentered(canvas, "Powered by 狼的提问箱", CardWidth/2, QWatermarkY, FontSizeFooter, ColorFooterGray, fontCtx)
+
+	// 输出（缓存 + 响应）
+	buf := new(bytes.Buffer)
+	if err := jpeg.Encode(buf, canvas, &jpeg.Options{Quality: 88}); err != nil {
+		http.Error(ctx.ResponseWriter(), "图片生成失败", http.StatusInternalServerError)
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to encode question share card PNG")
+		return
+	}
+
+	questionShareCache.Set(cacheKey, buf.Bytes(), time.Hour)
+	writeShareCardResponse(ctx, buf.Bytes())
+}
+
+// questionShareCardCacheKey 基于问题内容与用户资料生成缓存指纹，内容/资料变更自动失效。
+func questionShareCardCacheKey(user *db.User, question *db.Question) string {
+	h := md5.New()
+	fmt.Fprintf(h, "q|%d|%s|%s|%s|%s|%s", question.ID, question.Content, question.Answer, user.Name, user.Avatar, user.Background)
+	return fmt.Sprintf("qshare:%x", h.Sum(nil))
+}
+
+// sanitizeText 将换行符替换为空格，避免绘图时排版错乱。
+func sanitizeText(text string) string {
+	return strings.ReplaceAll(text, "\n", " ")
+}
+
+// drawTextMultilineLimited 多行绘制，超过 maxLines 行时截断并追加省略号。
+// clip 限定绘制区域，防止估算换行偏差导致文字溢出到相邻元素（如右侧二维码卡片）。
+func drawTextMultilineLimited(dst *image.RGBA, text string, x, y int, maxWidth int, fontSize float64, col color.Color, ftCtx *freetype.Context, lineHeight int, maxLines int, clip image.Rectangle) int {
+	lines := splitText(text, fontSize, maxWidth)
+	if len(lines) > maxLines {
+		lines = lines[:maxLines]
+		lines[maxLines-1] = lines[maxLines-1] + "…"
+	}
+	curY := y
+	for _, line := range lines {
+		drawTextClipped(dst, line, x, curY, fontSize, col, ftCtx, clip)
+		curY += lineHeight
+	}
+	return curY
+}
diff --git a/route/service/proxy.go b/route/service/proxy.go
new file mode 100644
index 0000000..6d96987
--- /dev/null
+++ b/route/service/proxy.go
@@ -0,0 +1,148 @@
+package service
+
+import (
+	"crypto/tls"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"path"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/sirupsen/logrus"
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/propagation"
+	"go.opentelemetry.io/otel/trace"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/context"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+)
+
+// serviceTransport 复用的共享 Transport，避免每条请求新建导致连接无法复用、
+// 且无超时的资源泄漏。带响应头/空闲连接超时，防止后端挂死时请求无限期阻塞。
+var (
+	serviceTransportOnce sync.Once
+	serviceTransport     http.RoundTripper
+)
+
+func getServiceTransport() http.RoundTripper {
+	serviceTransportOnce.Do(func() {
+		serviceTransport = &http.Transport{
+			// 默认校验证书；仅当配置 tls_insecure_skip_verify=true（内网自签名证书后端）时跳过。
+			TLSClientConfig:       &tls.Config{InsecureSkipVerify: conf.Service.TLSInsecureSkipVerify},
+			ResponseHeaderTimeout: 15 * time.Second,
+			IdleConnTimeout:       30 * time.Second,
+			ExpectContinueTimeout: 2 * time.Second,
+			MaxIdleConns:          100,
+			MaxIdleConnsPerHost:   10,
+		}
+	})
+	return serviceTransport
+}
+
+// singleJoiningSlash 将基础路径与附加路径安全拼接，避免双斜杠或丢失分隔符。
+func singleJoiningSlash(a, b string) string {
+	aslash := strings.HasSuffix(a, "/")
+	bslash := strings.HasPrefix(b, "/")
+	switch {
+	case aslash && bslash:
+		return a + b[1:]
+	case !aslash && !bslash:
+		return a + "/" + b
+	}
+	return a + b
+}
+
+func Proxy(ctx context.Context) error {
+	span := trace.SpanFromContext(ctx.Request().Context())
+
+	var userID uint
+	if ctx.IsLogged {
+		userID = ctx.User.ID
+	}
+
+	if span.SpanContext().IsValid() {
+		span.SetAttributes(
+			attribute.Int("nekobox.service.user-id", int(userID)),
+		)
+	}
+
+	uri := ctx.Param("**")
+	basePath := strings.Split(uri, "/")[0]
+	forwardPath := strings.TrimPrefix(uri, basePath)
+
+	var forwardURLStr string
+	for _, backend := range conf.Service.Backends {
+		if backend.Prefix == basePath {
+			forwardURLStr = backend.ForwardURL
+			break
+		}
+	}
+	if len(forwardURLStr) == 0 {
+		return ctx.JSONError(http.StatusNotFound, i18n.T(ctx.Lang(), "proxy.errNotFound"))
+	}
+
+	forwardURL, err := url.Parse(forwardURLStr)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to parse forward URL")
+		return ctx.JSONError(http.StatusInternalServerError, i18n.T(ctx.Lang(), "proxy.errInternal"))
+	}
+
+	// 路径穿越防护：先用 path.Clean 归一化，剥离 ../ 等相对段，
+	// 确保转发路径始终相对于后端基址，不会被 ../ 越出白名单前缀。
+	forwardPath = path.Clean(forwardPath)
+	if !strings.HasPrefix(forwardPath, "/") {
+		forwardPath = "/" + forwardPath
+	}
+
+	reverseProxy := httputil.ReverseProxy{
+		Director: func(req *http.Request) {
+			req.URL = forwardURL
+			req.URL.Path = singleJoiningSlash(forwardURL.Path, forwardPath)
+			// 透传原始查询串（此前静默丢弃，导致带参请求后端收不到 query）。
+			req.URL.RawQuery = ctx.Request().URL.RawQuery
+			req.Host = forwardURL.Host
+
+			// 安全加固：不透传用户浏览器带来的敏感请求头给后端。
+			// 后端通过 X-NekoBox-User-ID 识别用户身份，不应接收用户的会话
+			// Cookie / 鉴权头，否则可能被用于横向越权或凭证泄露。
+			// 同时清除客户端伪造的 X-Forwarded-*，避免请求头注入。
+			req.Header.Del("Cookie")
+			req.Header.Del("Authorization")
+			req.Header.Del("Proxy-Authorization")
+			req.Header.Del("X-Forwarded-For")
+			req.Header.Del("X-Forwarded-Host")
+			req.Header.Del("X-Forwarded-Proto")
+
+			traceHeaders := http.Header{}
+			otel.GetTextMapPropagator().Inject(ctx.Request().Context(), propagation.HeaderCarrier(traceHeaders))
+			for key := range traceHeaders {
+				req.Header.Set(key, traceHeaders.Get(key))
+			}
+
+			req.Header.Set("X-NekoBox-From", "nekobox-gateway")
+			req.Header.Set("X-NekoBox-User-ID", strconv.Itoa(int(userID)))
+		},
+		Transport: getServiceTransport(),
+		ErrorHandler: func(writer http.ResponseWriter, request *http.Request, err error) {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to handle reverse proxy request")
+			_ = ctx.JSONError(http.StatusInternalServerError, i18n.T(ctx.Lang(), "proxy.errInternal"))
+		},
+	}
+
+	// 审计日志：记录每一次反代转发（谁、哪个前缀、哪条路径、转发到哪个后端），
+	// 便于事后排查异常访问与越权探测。
+	logrus.WithContext(ctx.Request().Context()).WithFields(logrus.Fields{
+		"user_id": userID,
+		"prefix":  basePath,
+		"path":    forwardPath,
+		"backend": forwardURLStr,
+	}).Info("Service proxy forwarding request")
+
+	reverseProxy.ServeHTTP(ctx.ResponseWriter(), ctx.Request().Request)
+	return nil
+}
diff --git a/route/user/explore.go b/route/user/explore.go
new file mode 100644
index 0000000..c7372ed
--- /dev/null
+++ b/route/user/explore.go
@@ -0,0 +1,299 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package user
+
+import (
+	stdctx "context"
+	"encoding/json"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/flamego/cache"
+	"github.com/sirupsen/logrus"
+
+	"github.com/tamakyi/TamaBox/internal/context"
+	"github.com/tamakyi/TamaBox/internal/db"
+	"github.com/tamakyi/TamaBox/internal/dbutil"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+)
+
+// hotVotesCacheKey 探索页热门投票缓存 key（缓存 60s，避免每次 COUNT 聚合）。
+// v2：改用独立 DTO 缓存，修复 db.Vote.LinkToken 因 json:"-" 在 Redis 序列化时丢失、
+// 导致热门投票链接退化为 /vote/ 的问题。
+// v3：额外保留 UserID，用于按箱主的投票功能开关过滤。
+const hotVotesCacheKey = "explore:hot_votes:v3"
+
+// hotVoteCacheItem 热门投票缓存条目：独立 DTO，显式保留 LinkToken（db.Vote 的
+// LinkToken 带 json:"-" 标签，直接 Marshal Vote 会丢失，缓存命中后链接失效）。
+type hotVoteCacheItem struct {
+	ID        uint      `json:"id"`
+	UserID    uint      `json:"user_id"`
+	Title     string    `json:"title"`
+	Type      string    `json:"type"`
+	LinkToken string    `json:"link_token"`
+	CreatedAt time.Time `json:"created_at"`
+}
+
+var tagColors = []string{
+	"uk-label-success",
+	"uk-label-warning",
+	"uk-label-danger",
+	"uk-label-primary",
+	"uk-label-secondary",
+}
+
+type exploreUser struct {
+	*db.User
+	TagList   []string
+	TagColors []string
+}
+
+// getHotVotesCached 读取探索页热门投票，带 Redis 缓存（60s）。
+// 存储格式为 JSON []byte，避免 gob 序列化对模型类型注册的依赖。
+func getHotVotesCached(ctx context.Context, c cache.Cache) ([]*db.Vote, error) {
+	if v, err := c.Get(stdctx.Background(), hotVotesCacheKey); err == nil {
+		if data, ok := v.([]byte); ok {
+			var items []*hotVoteCacheItem
+			if json.Unmarshal(data, &items) == nil && len(items) > 0 {
+				votes := make([]*db.Vote, 0, len(items))
+				for _, it := range items {
+					votes = append(votes, &db.Vote{
+						Model:     dbutil.Model{ID: it.ID, CreatedAt: it.CreatedAt},
+						UserID:    it.UserID,
+						Title:     it.Title,
+						Type:      it.Type,
+						LinkToken: it.LinkToken,
+					})
+				}
+				return votes, nil
+			}
+		}
+	}
+
+	votes, err := db.Votes.GetHot(ctx.Request().Context(), 6)
+	if err != nil {
+		return nil, err
+	}
+	items := make([]*hotVoteCacheItem, 0, len(votes))
+	for _, v := range votes {
+		items = append(items, &hotVoteCacheItem{
+			ID:        v.ID,
+			UserID:    v.UserID,
+			Title:     v.Title,
+			Type:      v.Type,
+			LinkToken: v.LinkToken,
+			CreatedAt: v.CreatedAt,
+		})
+	}
+	if data, err := json.Marshal(items); err == nil {
+		_ = c.Set(stdctx.Background(), hotVotesCacheKey, data, 60*time.Second)
+	}
+	return votes, nil
+}
+
+// filterVotesByOwnerFeature 过滤掉箱主已关闭投票功能的投票（开关 / 定时 / 定量收集），
+// 避免探索页出现点了打不开的死链。功能配置批量加载，避免逐条查询造成 N+1；
+// 加载失败时按原样返回，依赖表抖动不应导致探索页空白。
+func filterVotesByOwnerFeature(ctx context.Context, votes []*db.Vote) []*db.Vote {
+	if len(votes) == 0 {
+		return votes
+	}
+
+	ownerIDs := make([]uint, 0, len(votes))
+	seen := make(map[uint]bool, len(votes))
+	for _, v := range votes {
+		if !seen[v.UserID] {
+			seen[v.UserID] = true
+			ownerIDs = append(ownerIDs, v.UserID)
+		}
+	}
+
+	controls, err := db.FeatureControls.ListByUserIDs(ctx.Request().Context(), ownerIDs, db.FeatureVote)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Warn("Failed to batch load vote feature controls")
+		return votes
+	}
+
+	now := time.Now()
+	out := make([]*db.Vote, 0, len(votes))
+	for _, v := range votes {
+		fc, ok := controls[v.UserID]
+		if !ok {
+			fc = db.DefaultFeatureControl(v.UserID, db.FeatureVote)
+		}
+		if fc.Evaluate(now).Open {
+			out = append(out, v)
+		}
+	}
+	return out
+}
+
+// Explore 显示用户列表，支持分页和排序
+func Explore(ctx context.Context, c cache.Cache) {
+	keyword := ctx.Query("q")
+	sort := ctx.Query("sort")
+	// 白名单校验排序方式
+	if sort != "latest" && sort != "oldest" {
+		sort = "latest"
+	}
+
+	pageStr := ctx.Query("page")
+	page := 1
+	if pageStr != "" {
+		if p, err := strconv.Atoi(pageStr); err == nil && p > 0 {
+			page = p
+		}
+	}
+	pageSize := 20
+
+	var users []*db.User
+	var total int64
+	var err error
+
+	if keyword != "" {
+		users, total, err = db.Users.GetByTag(ctx.Request().Context(), keyword, page, pageSize, sort)
+	} else {
+		users, total, err = db.Users.GetShowInHome(ctx.Request().Context(), page, pageSize, sort)
+	}
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to get users for explore")
+		ctx.SetInternalError() // 设置内部错误并渲染页面
+		ctx.Success("user/explore")
+		return
+	}
+
+	// 热门投票板块（Redis 缓存 60s）
+	hotVotes, err := getHotVotesCached(ctx, c)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Warn("Failed to get hot votes")
+		hotVotes = []*db.Vote{}
+	}
+	ctx.Data["HotVotes"] = filterVotesByOwnerFeature(ctx, hotVotes)
+
+	allVotes, err := db.Votes.ListPublishedPublic(ctx.Request().Context(), 30)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Warn("Failed to get public votes for explore")
+		allVotes = []*db.Vote{}
+	}
+	ctx.Data["AllVotes"] = filterVotesByOwnerFeature(ctx, allVotes)
+
+	// 计算总页数（向上取整）
+	totalPages := (int(total) + pageSize - 1) / pageSize
+
+	// 页面越界保护
+	if page > totalPages && totalPages > 0 {
+		page = totalPages
+	}
+
+	// 构建带有标签颜色的用户列表
+	exploreUsers := make([]*exploreUser, 0, len(users))
+	for _, u := range users {
+		var tags []string
+		if u.Tags != "" {
+			tags = strings.Split(u.Tags, ",")
+		}
+		tagColorsList := make([]string, len(tags))
+		for i := range tags {
+			tagColorsList[i] = tagColors[i%len(tagColors)]
+		}
+		exploreUsers = append(exploreUsers, &exploreUser{
+			User:      u,
+			TagList:   tags,
+			TagColors: tagColorsList,
+		})
+	}
+
+	ctx.Data["Users"] = exploreUsers
+	ctx.Data["Keyword"] = keyword
+	ctx.Data["Sort"] = sort
+	ctx.Data["Page"] = page
+	ctx.Data["TotalPages"] = totalPages
+	ctx.Data["PrevPage"] = page - 1
+	ctx.Data["NextPage"] = page + 1
+
+	// 热门标签榜：统计展示在首页用户的高频标签
+	hotTags, err := db.Users.GetHotTags(ctx.Request().Context(), 12)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Warn("Failed to get hot tags")
+		hotTags = []string{}
+	}
+	ctx.Data["HotTags"] = hotTags
+
+	// 服务端直接获取随机推荐，避免前端 AJAX 往返导致"加载中"等待
+	randomUsers, err := db.Users.GetRandom(ctx.Request().Context(), 6)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Warn("Failed to get random users for sidebar")
+	}
+	recommendUsers := make([]*exploreUser, 0, len(randomUsers))
+	for _, u := range randomUsers {
+		var tags []string
+		if u.Tags != "" {
+			tags = strings.Split(u.Tags, ",")
+		}
+		tagColorsList := make([]string, len(tags))
+		for i := range tags {
+			tagColorsList[i] = tagColors[i%len(tagColors)]
+		}
+		recommendUsers = append(recommendUsers, &exploreUser{
+			User:      u,
+			TagList:   tags,
+			TagColors: tagColorsList,
+		})
+	}
+	ctx.Data["RecommendUsers"] = recommendUsers
+
+	lang := i18n.Default
+	if l, ok := ctx.Data["Lang"].(string); ok && l != "" {
+		lang = l
+	}
+	ctx.SetTitle(i18n.T(lang, "nav.explore") + " - " + i18n.T(lang, "site.title"))
+	ctx.Success("user/explore")
+}
+
+// RandomRecommend 返回6个随机推荐用户（JSON格式）
+// 前端期望的响应格式：{ "code": 0, "data": [...] }
+func RandomRecommend(ctx context.Context) {
+	users, err := db.Users.GetRandomFresh(ctx.Request().Context(), 6)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to get random users")
+		ctx.JSONError(50000, i18n.T(ctx.Lang(), "explore.errRandomUser"))
+		return
+	}
+
+	type recommendUser struct {
+		ID       uint     `json:"id"`
+		Name     string   `json:"name"`
+		Domain   string   `json:"domain"`
+		Avatar   string   `json:"avatar"`
+		Intro    string   `json:"intro"`
+		TagList  []string `json:"tag_list"`
+		TagColor []string `json:"tag_color"`
+	}
+
+	result := make([]recommendUser, 0, len(users))
+	for _, u := range users {
+		var tags []string
+		if u.Tags != "" {
+			tags = strings.Split(u.Tags, ",")
+		}
+		tagColorsList := make([]string, len(tags))
+		for i := range tags {
+			tagColorsList[i] = tagColors[i%len(tagColors)]
+		}
+		result = append(result, recommendUser{
+			ID:       u.ID,
+			Name:     u.Name,
+			Domain:   u.Domain,
+			Avatar:   u.Avatar,
+			Intro:    u.Intro,
+			TagList:  tags,
+			TagColor: tagColorsList,
+		})
+	}
+
+	// Context.JSON 已统一包装 code/data/message，这里只传业务数据，避免嵌套响应。
+	ctx.JSON(result)
+}
diff --git a/route/user/features.go b/route/user/features.go
new file mode 100644
index 0000000..4ec471b
--- /dev/null
+++ b/route/user/features.go
@@ -0,0 +1,351 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package user
+
+import (
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+
+	"github.com/tamakyi/TamaBox/internal/context"
+	"github.com/tamakyi/TamaBox/internal/db"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+)
+
+// featureTimeLayout 与 <input type="datetime-local"> 的取值格式一致。
+const featureTimeLayout = "2006-01-02T15:04"
+
+// 账号设置页的面板标识：第一个是用户设置，其余三个与受控功能一一对应，
+// 因此保存后可以直接用功能标识回跳到对应的功能面板。
+const (
+	ProfileTabAccount  = "account"
+	ProfileTabQuestion = db.FeatureQuestion
+	ProfileTabChat     = db.FeatureChat
+	ProfileTabVote     = db.FeatureVote
+)
+
+// profileURLWithTab 账号设置页 + 指定面板的回跳地址，用于保存后停留在原面板。
+func profileURLWithTab(tab string) string {
+	return "/user/profile?tab=" + ProfileTab(tab)
+}
+
+// ProfileTab 归一化账号设置页的 tab 参数，非法值回落到用户设置面板。
+func ProfileTab(tab string) string {
+	switch tab {
+	case ProfileTabQuestion, ProfileTabChat, ProfileTabVote:
+		return tab
+	}
+	return ProfileTabAccount
+}
+
+// featureView 功能管理面板里单个功能的展示模型（配置 + 实时状态 + 已格式化的时间串）。
+//
+// 面板以「点 = 本功能」的方式渲染到部分模板 user/feature-control-form，
+// 因此把渲染所需的语言与 CSRF 令牌一并带上，部分模板内无需访问根数据。
+type featureView struct {
+	Key             string
+	LangCode        string
+	NameText        string
+	StatusText      string
+	CSRFTokenHTML   interface{}
+	Control         *db.FeatureControl
+	State           db.FeatureState
+	OpenAtStr       string
+	CloseAtStr      string
+	QuotaResetAtStr string
+	ScheduleDays    string // 逗号分隔周几（0=周日…6=周六），模板据此勾选开放日
+	ScheduleStart   string // "HH:MM"
+	ScheduleEnd     string // "HH:MM"
+	Mode            string // 收集模式：always（长期开放）/ window（定时收集）/ recurring（循环定时）
+}
+
+// 收集模式取值（表单 mode 字段）。三种模式在保存时互斥：
+// 只保留所选模式的字段，其余清空，避免「一次性窗口 AND 循环定时」叠加
+// 导致一次性关闭时间成为永久硬边界、难以恢复长期开放。
+const (
+	FeatureModeAlways    = "always"    // 长期开放：不限时间
+	FeatureModeWindow    = "window"    // 定时收集：一次性开放 / 关闭窗口
+	FeatureModeRecurring = "recurring" // 循环定时：每周循环
+)
+
+// inferFeatureMode 根据字段组合推断收集模式：
+// 有循环定时配置 → recurring；有一性次时间 → window；否则 → always。
+// 用于渲染面板时从已保存配置还原模式，以及旧表单提交未携带 mode 时的兜底。
+func inferFeatureMode(openAt, closeAt *time.Time, scheduleDays, scheduleStart, scheduleEnd string) string {
+	if scheduleDays != "" || (scheduleStart != "" && scheduleEnd != "") {
+		return FeatureModeRecurring
+	}
+	if openAt != nil || closeAt != nil {
+		return FeatureModeWindow
+	}
+	return FeatureModeAlways
+}
+
+// resolveLang 取当前请求已解析好的语言代码（由 Contexter 写入 Data）。
+func resolveLang(ctx context.Context) string {
+	if l, ok := ctx.Data["Lang"].(string); ok && l != "" {
+		return l
+	}
+	return i18n.Default
+}
+
+// buildFeatureViews 读取全部受控功能的配置，按功能标识建索引；
+// 尚未落库的功能用默认值补齐，保证三个功能面板始终有数据可渲染。
+func buildFeatureViews(ctx context.Context, userID uint) map[string]*featureView {
+	lang := resolveLang(ctx)
+	now := time.Now()
+	csrf := ctx.Data["CSRFTokenHTML"]
+
+	existing := map[string]*db.FeatureControl{}
+	if list, err := db.FeatureControls.ListByUserID(ctx.Request().Context(), userID); err == nil {
+		for _, fc := range list {
+			existing[fc.Feature] = fc
+		}
+	} else {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Warn("Failed to list feature controls")
+	}
+
+	views := make(map[string]*featureView, len(db.FeatureKeys))
+	for _, key := range db.FeatureKeys {
+		fc, ok := existing[key]
+		if !ok {
+			fc = db.DefaultFeatureControl(userID, key)
+		}
+		state := fc.Evaluate(now)
+		mode := inferFeatureMode(fc.OpenAt, fc.CloseAt, fc.ScheduleDays, fc.ScheduleStart, fc.ScheduleEnd)
+		v := &featureView{
+			Key:           key,
+			LangCode:      lang,
+			NameText:      i18n.FeatureName(lang, key),
+			StatusText:    i18n.FeatureStatusText(lang, state.Reason),
+			CSRFTokenHTML: csrf,
+			Control:       fc,
+			State:         state,
+			Mode:          mode,
+		}
+		if fc.OpenAt != nil {
+			v.OpenAtStr = fc.OpenAt.Format(featureTimeLayout)
+		}
+		if fc.CloseAt != nil {
+			v.CloseAtStr = fc.CloseAt.Format(featureTimeLayout)
+		}
+		if fc.QuotaResetAt != nil {
+			v.QuotaResetAtStr = fc.QuotaResetAt.Format("2006-01-02 15:04")
+		}
+		v.ScheduleDays = fc.ScheduleDays
+		v.ScheduleStart = fc.ScheduleStart
+		v.ScheduleEnd = fc.ScheduleEnd
+		views[key] = v
+	}
+	return views
+}
+
+// InjectFeatureViews 把三个功能的配置注入账号设置页（用户设置面板不需要，但一并注入开销可忽略）。
+// 供 Profile 与保存失败后重渲染的场景复用。
+func InjectFeatureViews(ctx context.Context) {
+	views := buildFeatureViews(ctx, ctx.User.ID)
+	ctx.Data["FeatureQuestion"] = views[db.FeatureQuestion]
+	ctx.Data["FeatureChat"] = views[db.FeatureChat]
+	ctx.Data["FeatureVote"] = views[db.FeatureVote]
+	ctx.Data["QuotaLimitMax"] = db.QuotaLimitMax
+}
+
+// FeaturesUpdate 保存单个功能的开关 / 定时 / 定量设置。
+// 每个功能面板各自一张表单，只提交自己的字段，保存后回跳到该面板。
+func FeaturesUpdate(ctx context.Context) {
+	lang := resolveLang(ctx)
+	key := strings.TrimSpace(ctx.Request().FormValue("feature"))
+	if !db.IsValidFeature(key) {
+		ctx.SetErrorFlash(i18n.T(lang, "feature.errInvalid"))
+		ctx.Redirect(profileURLWithTab(ProfileTabAccount))
+		return
+	}
+
+	name := i18n.FeatureName(lang, key)
+	tab := ProfileTab(key)
+
+	openAt, err := parseTimeInput(ctx, strings.TrimSpace(ctx.Request().FormValue("open_at")))
+	if err != nil {
+		ctx.SetErrorFlash(i18n.T(lang, "feature.errTime", name))
+		ctx.Redirect(profileURLWithTab(tab))
+		return
+	}
+	closeAt, err := parseTimeInput(ctx, strings.TrimSpace(ctx.Request().FormValue("close_at")))
+	if err != nil {
+		ctx.SetErrorFlash(i18n.T(lang, "feature.errTime", name))
+		ctx.Redirect(profileURLWithTab(tab))
+		return
+	}
+
+	quota, err := parseQuotaLimit(strings.TrimSpace(ctx.Request().FormValue("quota_limit")))
+	if err != nil {
+		ctx.SetErrorFlash(i18n.T(lang, "feature.errQuota", name))
+		ctx.Redirect(profileURLWithTab(tab))
+		return
+	}
+
+	// 循环定时：开放日（逗号分隔周几）+ 每日时间段（HH:MM，需成对填写）
+	scheduleDays := normalizeScheduleDays(ctx.Request().FormValue("schedule_days"))
+	scheduleStart := strings.TrimSpace(ctx.Request().FormValue("schedule_start"))
+	scheduleEnd := strings.TrimSpace(ctx.Request().FormValue("schedule_end"))
+
+	// 收集模式三选一；未携带 mode（旧表单重放等）时按提交字段推断，保持兼容。
+	mode := strings.TrimSpace(ctx.Request().FormValue("mode"))
+	switch mode {
+	case FeatureModeAlways, FeatureModeWindow, FeatureModeRecurring:
+	default:
+		mode = inferFeatureMode(openAt, closeAt, scheduleDays, scheduleStart, scheduleEnd)
+	}
+
+	// 模式互斥：清理未选模式的字段，一次性窗口与循环定时不再叠加
+	// （旧版叠加语义下，一次性关闭时间过后功能永久结束，难以恢复长期开放）。
+	switch mode {
+	case FeatureModeAlways:
+		openAt, closeAt = nil, nil
+		scheduleDays, scheduleStart, scheduleEnd = "", "", ""
+	case FeatureModeWindow:
+		scheduleDays, scheduleStart, scheduleEnd = "", "", ""
+	case FeatureModeRecurring:
+		openAt, closeAt = nil, nil
+	}
+
+	if mode == FeatureModeWindow && openAt != nil && closeAt != nil && !closeAt.After(*openAt) {
+		ctx.SetErrorFlash(i18n.T(lang, "feature.errTimeRange", name))
+		ctx.Redirect(profileURLWithTab(tab))
+		return
+	}
+	if mode == FeatureModeRecurring {
+		if (scheduleStart == "") != (scheduleEnd == "") {
+			ctx.SetErrorFlash(i18n.T(lang, "feature.errScheduleHalf", name))
+			ctx.Redirect(profileURLWithTab(tab))
+			return
+		}
+		if scheduleStart != "" {
+			startM, err := parseHHMM(scheduleStart)
+			if err != nil {
+				ctx.SetErrorFlash(i18n.T(lang, "feature.errScheduleTime", name))
+				ctx.Redirect(profileURLWithTab(tab))
+				return
+			}
+			endM, err := parseHHMM(scheduleEnd)
+			if err != nil {
+				ctx.SetErrorFlash(i18n.T(lang, "feature.errScheduleTime", name))
+				ctx.Redirect(profileURLWithTab(tab))
+				return
+			}
+			if endM <= startM {
+				ctx.SetErrorFlash(i18n.T(lang, "feature.errScheduleRange", name))
+				ctx.Redirect(profileURLWithTab(tab))
+				return
+			}
+		}
+	}
+
+	// 私聊不提供收集上限：会话是双向对话（已有单会话消息数上限），
+	// 限制「新建会话数」对箱主意义不大。UI 已隐藏该字段，
+	// 这里强制清零，防止历史残留的上限让私聊「莫名关闭」。
+	if key == db.FeatureChat {
+		quota = 0
+	}
+
+	if err := db.FeatureControls.Save(ctx.Request().Context(), ctx.User.ID, key, db.UpdateFeatureControlOptions{
+		Enabled:       ctx.Request().FormValue("enabled") == "on",
+		OpenAt:        openAt,
+		CloseAt:       closeAt,
+		ScheduleDays:  scheduleDays,
+		ScheduleStart: scheduleStart,
+		ScheduleEnd:   scheduleEnd,
+		QuotaLimit:    quota,
+	}); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).
+			Errorf("Failed to save feature control %q", key)
+		ctx.SetInternalErrorFlash()
+		ctx.Redirect(profileURLWithTab(tab))
+		return
+	}
+
+	// 私聊开关与 users.allow_chat 双向同步：后者仍被邮件通知等既有逻辑读取，
+	// 保持两处一致，避免功能面板与旧字段表现不一致。
+	if key == db.FeatureChat {
+		if err := db.Users.UpdateAllowChat(ctx.Request().Context(), ctx.User.ID, ctx.Request().FormValue("enabled") == "on"); err != nil {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Warn("Failed to sync users.allow_chat")
+		}
+	}
+
+	ctx.SetSuccessFlash(i18n.T(lang, "feature.saved"))
+	ctx.Redirect(profileURLWithTab(tab))
+}
+
+// FeatureResetQuota 清零某功能的收集计数，开启下一轮定量收集。
+func FeatureResetQuota(ctx context.Context) {
+	lang := resolveLang(ctx)
+	key := strings.TrimSpace(ctx.Request().FormValue("feature"))
+	if !db.IsValidFeature(key) {
+		ctx.SetErrorFlash(i18n.T(lang, "feature.errInvalid"))
+		ctx.Redirect(profileURLWithTab(ProfileTabAccount))
+		return
+	}
+
+	if err := db.FeatureControls.ResetQuota(ctx.Request().Context(), ctx.User.ID, key); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).
+			Errorf("Failed to reset feature quota %q", key)
+		ctx.SetInternalErrorFlash()
+		ctx.Redirect(profileURLWithTab(key))
+		return
+	}
+
+	ctx.SetSuccessFlash(i18n.T(lang, "feature.quotaReset", i18n.FeatureName(lang, key)))
+	ctx.Redirect(profileURLWithTab(key))
+}
+
+// parseQuotaLimit 解析收集上限：空串与 0 均表示不限制。
+func parseQuotaLimit(s string) (int64, error) {
+	if s == "" {
+		return 0, nil
+	}
+	n, err := strconv.ParseInt(s, 10, 64)
+	if err != nil || n < 0 {
+		return 0, errors.New("invalid quota limit")
+	}
+	if n > db.QuotaLimitMax {
+		return 0, errors.New("quota limit too large")
+	}
+	return n, nil
+}
+
+// normalizeScheduleDays 归一化循环定时的开放日：只保留 0-6 的合法周几并去重、排序。
+// 复选框多选值形如 ["0","2","4"]（time.Weekday：0=周日…6=周六）。
+func normalizeScheduleDays(raw string) string {
+	seen := make(map[int]bool)
+	var days []string
+	for _, part := range strings.Split(raw, ",") {
+		part = strings.TrimSpace(part)
+		if part == "" {
+			continue
+		}
+		n, err := strconv.Atoi(part)
+		if err != nil || n < 0 || n > 6 || seen[n] {
+			continue
+		}
+		seen[n] = true
+		days = append(days, strconv.Itoa(n))
+	}
+	// 按周几排序，保证存储稳定、展示一致
+	sort.Strings(days)
+	return strings.Join(days, ",")
+}
+
+// parseHHMM 解析 "HH:MM" 为当天第几分钟（与 db 包内同名函数逻辑一致，路由层用于校验表单）。
+func parseHHMM(s string) (int, error) {
+	t, err := time.Parse("15:04", strings.TrimSpace(s))
+	if err != nil {
+		return 0, errors.New("invalid HH:MM")
+	}
+	return t.Hour()*60 + t.Minute(), nil
+}
diff --git a/route/user/harassment.go b/route/user/harassment.go
new file mode 100644
index 0000000..08c6e13
--- /dev/null
+++ b/route/user/harassment.go
@@ -0,0 +1,139 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package user
+
+import (
+	"strings"
+
+	"github.com/sirupsen/logrus"
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/context"
+	"github.com/tamakyi/TamaBox/internal/db"
+	"github.com/tamakyi/TamaBox/internal/form"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+)
+
+// returnTab 表单提交后回跳的账号设置面板：屏蔽词设置已分散展示在
+// 提问/私聊/投票三个面板，action 携带 ?tab= 来源参数，保存后停留原面板。
+func returnTab(ctx context.Context) string {
+	return profileURLWithTab(ProfileTab(ctx.Query("tab")))
+}
+
+// abortOnFormError 处理表单校验/反序列化失败：返回 true 表示已中止本次写入。
+//
+// 背景：form.Bind 在反序列化失败（如请求体超限、body 畸形）时只置位错误并继续执行
+// handler 链（flamego 语义：响应未写即自动续链），零值结构体会照常进入业务动作——
+// 对不检查 ctx.HasError() 的 handler，会把用户既有配置静默清空/关闭，例如：
+//   - UpdateHarassment：RegisterOnly="" → 防骚扰被改回 none（关闭"仅允许注册用户"）；
+//   - UpdateBlockWords：BlockWords="" → 全部屏蔽词被清空；
+//   - UpdateTags：Tags="" → 标签被清空、ShowInHome 被关；
+//   - UpdatePagePassword / UpdateAskPassword：Password="" → 访问/提问密码被解除。
+//
+// 错误信息已由 Bind 经 context.SetError 写入 Data["Error"]（govalid 校验错误已按界面
+// 语言翻译，解析错误为原文），此处转入 flash，保证 PRG 重定向后仍能向用户展示。
+func abortOnFormError(ctx context.Context, redirectTo string) bool {
+	if !ctx.HasError() {
+		return false
+	}
+	if msg, ok := ctx.Data["Error"].(string); ok && msg != "" {
+		ctx.SetErrorFlash(msg)
+	}
+	ctx.Redirect(redirectTo)
+	return true
+}
+
+// UpdateHarassment 仅更新「防骚扰类型」（none / register_only，即"仅允许注册用户向我提问"）。
+// 只写 harassment_setting 列；全局屏蔽词已拆分为独立入口 UpdateBlockWords，
+// 二者互不覆盖（此前同一个表单一次写两列，面板拆分后单侧保存会误清空另一侧）。
+func UpdateHarassment(ctx context.Context, f form.UpdateHarassment) {
+	// 反序列化失败（如请求体超限）时零值 RegisterOnly="" 会把防骚扰静默改回 none
+	// （若此前为 register_only）——先中止，不触碰现有设置。
+	if abortOnFormError(ctx, returnTab(ctx)) {
+		return
+	}
+
+	harassmentSettingType := db.HarassmentSettingNone
+	if f.RegisterOnly != "" {
+		harassmentSettingType = db.HarassmentSettingTypeRegisterOnly
+	}
+
+	if err := db.Users.UpdateHarassmentType(ctx.Request().Context(), ctx.User.ID, harassmentSettingType); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to update harassment setting")
+		ctx.SetInternalErrorFlash()
+		ctx.Redirect(returnTab(ctx))
+		return
+	}
+
+	ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "admin.flash.harassmentUpdated"))
+	ctx.Redirect(returnTab(ctx))
+}
+
+// UpdateBlockWords 更新全局屏蔽词表：提问、私聊（对方发给我的消息）与投票
+// 提交的开放文本共用同一份词表（users.block_words）。
+func UpdateBlockWords(ctx context.Context, f form.UpdateBlockWords) {
+	// 反序列化失败（如请求体超限）时零值 BlockWords="" 会经 sanitizeBlockWords 得到
+	// 空词表，静默清空用户全部屏蔽词——先中止，不触碰现有词表。
+	if abortOnFormError(ctx, returnTab(ctx)) {
+		return
+	}
+
+	words, errKey, errWord := sanitizeBlockWords(f.BlockWords)
+	if errKey != "" {
+		if errKey == "admin.flash.blockWordTooLong" {
+			ctx.SetErrorFlash(i18n.T(ctx.Lang(), errKey, errWord))
+		} else {
+			ctx.SetErrorFlash(i18n.T(ctx.Lang(), errKey))
+		}
+		ctx.Redirect(returnTab(ctx))
+		return
+	}
+
+	if err := db.Users.UpdateBlockWords(ctx.Request().Context(), ctx.User.ID, strings.Join(words, ",")); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to update block words")
+		ctx.SetInternalErrorFlash()
+		ctx.Redirect(returnTab(ctx))
+		return
+	}
+
+	ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "admin.flash.blockWordsUpdated"))
+	ctx.Redirect(returnTab(ctx))
+}
+
+// sanitizeBlockWords 把输入的屏蔽词串规整为去重后的词表：
+//   - 全角逗号转半角；逐词 TrimSpace；跳过空词与重复词。
+//   - 单词长度按字符（rune）计数，超限（conf.Limits.MaxBlockWordLen）返回超长提示；
+//   - 词总数超限（conf.Limits.MaxBlockWords）返回数量提示。
+//
+// 成功时 errKey 为空，errWord 为触发超长的具体词（供 flash 展示）。
+func sanitizeBlockWords(raw string) (words []string, errKey string, errWord string) {
+	blockWords := strings.ReplaceAll(raw, "，", ",")
+	blockWords = strings.TrimSpace(blockWords)
+
+	words = make([]string, 0)
+	wordSet := make(map[string]struct{})
+	for _, word := range strings.Split(blockWords, ",") {
+		word := strings.TrimSpace(word)
+		if word == "" {
+			continue
+		}
+		if _, ok := wordSet[word]; ok {
+			continue
+		}
+		wordSet[word] = struct{}{}
+
+		// 按字符（rune）计数：早期用 len(word) 按字节计数，中文一词 3 字节，
+		// 导致中文屏蔽词实际只能输 3 个字，与界面文案「最大长度为 10」不符。
+		// 上限取自 conf.Limits.MaxBlockWordLen（[limits] 配置段）。
+		if len([]rune(word)) > conf.Limits.MaxBlockWordLen {
+			return nil, "admin.flash.blockWordTooLong", word
+		}
+		words = append(words, word)
+	}
+
+	if len(words) > conf.Limits.MaxBlockWords {
+		return nil, "admin.flash.blockWordsTooMany", ""
+	}
+	return words, "", ""
+}
diff --git a/route/user/password.go b/route/user/password.go
new file mode 100644
index 0000000..9fb0aab
--- /dev/null
+++ b/route/user/password.go
@@ -0,0 +1,56 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package user
+
+import (
+	"github.com/sirupsen/logrus"
+
+	"github.com/tamakyi/TamaBox/internal/context"
+	"github.com/tamakyi/TamaBox/internal/db"
+	"github.com/tamakyi/TamaBox/internal/form"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+)
+
+// UpdatePagePassword 更新页面访问密码
+func UpdatePagePassword(ctx context.Context, f form.UpdatePagePassword) {
+	// 反序列化失败（如请求体超限）时零值 Password="" 会把密码静默解除——先中止，
+	// 不触碰现有密码。govalid 校验失败（如密码超长）同样在此拦截，避免绕过前端限制。
+	if abortOnFormError(ctx, "/user/profile") {
+		return
+	}
+
+	if err := db.Users.UpdatePagePassword(ctx.Request().Context(), ctx.User.ID, f.Password); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to update page password")
+		ctx.SetInternalErrorFlash()
+	} else {
+		if f.Password == "" {
+			ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "admin.flash.pagePwdOff"))
+		} else {
+			ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "admin.flash.pagePwdUpdated"))
+		}
+	}
+	ctx.Redirect("/user/profile")
+}
+
+// UpdateAskPassword 更新提问密码
+func UpdateAskPassword(ctx context.Context, f form.UpdateAskPassword) {
+	// 同上：反序列化失败或校验失败时零值 Password="" 会把提问密码静默解除。
+	if abortOnFormError(ctx, profileURLWithTab(ProfileTabQuestion)) {
+		return
+	}
+
+	if err := db.Users.UpdateAskPassword(ctx.Request().Context(), ctx.User.ID, f.Password); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to update ask password")
+		ctx.SetInternalErrorFlash()
+	} else {
+		if f.Password == "" {
+			ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "admin.flash.askPwdOff"))
+		} else {
+			ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "admin.flash.askPwdUpdated"))
+		}
+	}
+	// 提问密码属于提问功能的专属设置，保存后回到「提问」面板
+	ctx.Redirect(profileURLWithTab(ProfileTabQuestion))
+}
diff --git a/route/user/profile.go b/route/user/profile.go
new file mode 100644
index 0000000..1a53e43
--- /dev/null
+++ b/route/user/profile.go
@@ -0,0 +1,599 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package user
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/url"
+	"strconv"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+	"github.com/xuri/excelize/v2"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/context"
+	"github.com/tamakyi/TamaBox/internal/db"
+	"github.com/tamakyi/TamaBox/internal/form"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+	"github.com/tamakyi/TamaBox/internal/imagecheck"
+	"github.com/tamakyi/TamaBox/internal/storage"
+)
+
+// Profile 账号设置页。按面板分区：
+//   - account：用户设置（个人信息 / 个性化 / 社交 / 密码 / 导出 / 停用账号）；
+//   - question / chat / vote：三个功能的管理（开关 + 定时 + 定量 + 各自的专属设置）。
+//
+// 面板由 ?tab= 指定，非法值回落到用户设置，保证分享链接不会渲染出空页面。
+func Profile(ctx context.Context) {
+	ctx.Data["HasPagePassword"] = ctx.User.PagePassword != ""
+	ctx.Data["HasAskPassword"] = ctx.User.AskPassword != ""
+	ctx.Data["ActiveProfileTab"] = ProfileTab(ctx.Query("tab"))
+	ctx.Data["TagLimits"] = tagLimits()
+	ctx.Data["ChatLimits"] = chatLimits()
+	InjectFeatureViews(ctx)
+	ctx.Success("user/profile")
+}
+
+// tagLimits 标签与屏蔽词的数量 / 长度上限，供前端标签块输入组件做实时提示。
+// 数值来自 conf.Limits（[limits] 配置段），后端校验引用同一份配置。
+func tagLimits() map[string]int {
+	return map[string]int{
+		"MaxTags":         conf.Limits.MaxTags,
+		"MaxTagLen":       conf.Limits.MaxTagLen,
+		"MaxBlockWords":   conf.Limits.MaxBlockWords,
+		"MaxBlockWordLen": conf.Limits.MaxBlockWordLen,
+	}
+}
+
+// chatLimits 私聊面板的数值上下界，供设置表单的 number 输入框做 min/max 提示。
+// 同样来自 conf.Limits：会话条数硬顶与每日条数可设上限。
+func chatLimits() map[string]int {
+	return map[string]int{
+		"MaxChatMessages":      conf.Limits.ChatMaxMessages,
+		"DailyMessageLimitMax": conf.Limits.DailyMessageLimitMax,
+	}
+}
+
+func ProfileAPI(ctx context.Context) error {
+	return ctx.JSON(ctx.User)
+}
+
+func UpdateProfile(ctx context.Context, f form.UpdateProfile) {
+	if ctx.HasError() {
+		ctx.Success("user/profile")
+		return
+	}
+
+	// 获取当前用户信息，用于保留未修改的字段
+	currentUser, err := db.Users.GetByID(ctx.Request().Context(), ctx.User.ID)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to get current user")
+		ctx.SetInternalErrorFlash()
+		ctx.Redirect("/user/profile")
+		return
+	}
+
+	// 处理头像上传（强制 1:1，见 storage.UploadAvatarToS3）
+	avatarURL := currentUser.Avatar // 默认使用原值
+	avatarFile, avatarFileHeader, err := ctx.Request().FormFile("avatar")
+	if err == nil {
+		defer avatarFile.Close()
+		if avatarFileHeader.Size > storage.MaxAvatarSize {
+			ctx.SetError(errors.New(i18n.T(ctx.Lang(), "profile.err.avatarTooLarge")))
+			ctx.Success("user/profile")
+			return
+		}
+		uploadedURL, err := storage.UploadAvatarToS3(avatarFile, avatarFileHeader)
+		if err != nil {
+			if errors.Is(err, imagecheck.ErrImageTooLarge) {
+				ctx.SetErrorFlash(err.Error())
+				ctx.Success("user/profile")
+				return
+			}
+			if errors.Is(err, imagecheck.ErrBadAspectRatio) {
+				ctx.SetErrorFlash(i18n.T(ctx.Lang(), "profile.err.avatarRatio"))
+				ctx.Success("user/profile")
+				return
+			}
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to upload avatar")
+		} else {
+			avatarURL = uploadedURL
+		}
+	}
+
+	// 从表单读取 UseCustomQRColor 并转换为布尔值
+	useCustomQRColor := f.UseCustomQRColor == "on"
+
+	// 处理背景上传（强制 16:9，见 storage.UploadBackgroundToS3）
+	backgroundURL := currentUser.Background // 默认使用原值
+	backgroundFile, backgroundFileHeader, err := ctx.Request().FormFile("background")
+	if err == nil {
+		defer backgroundFile.Close()
+		if backgroundFileHeader.Size > storage.MaxBackgroundSize {
+			ctx.SetError(errors.New(i18n.T(ctx.Lang(), "profile.err.backgroundTooLarge")))
+			ctx.Success("user/profile")
+			return
+		}
+		uploadedURL, err := storage.UploadBackgroundToS3(backgroundFile, backgroundFileHeader)
+		if err != nil {
+			if errors.Is(err, imagecheck.ErrImageTooLarge) {
+				ctx.SetErrorFlash(err.Error())
+				ctx.Success("user/profile")
+				return
+			}
+			if errors.Is(err, imagecheck.ErrBadAspectRatio) {
+				ctx.SetErrorFlash(i18n.T(ctx.Lang(), "profile.err.backgroundRatio"))
+				ctx.Success("user/profile")
+				return
+			}
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to upload background")
+		} else {
+			backgroundURL = uploadedURL
+		}
+	}
+
+	// 处理二维码背景图上传
+	backgroundImageURL := currentUser.BackgroundImage // 默认使用原值
+	backgroundimageFile, backgroundimageFileHeader, err := ctx.Request().FormFile("backgroundimage")
+	if err == nil {
+		defer backgroundimageFile.Close()
+		if backgroundimageFileHeader.Size > storage.MaxBackgroundSize {
+			ctx.SetError(errors.New(i18n.T(ctx.Lang(), "profile.err.backgroundTooLarge")))
+			ctx.Success("user/profile")
+			return
+		}
+		uploadedURL, err := storage.UploadPictureToS3(backgroundimageFile, backgroundimageFileHeader)
+		if err != nil {
+			if errors.Is(err, imagecheck.ErrImageTooLarge) {
+				ctx.SetErrorFlash(err.Error())
+				ctx.Success("user/profile")
+				return
+			}
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to upload QRbackgroundImage")
+		} else {
+			backgroundImageURL = uploadedURL
+		}
+	}
+
+	// 密码修改逻辑（新密码非空时强制至少 8 位）。
+	// 是否真的改了密码会决定保存成功后的去向：改密则清会话登出（见文件尾部保存分支）。
+	passwordChanged := false
+	if f.NewPassword != "" {
+		if len(f.NewPassword) < 8 {
+			ctx.SetError(errors.New(i18n.T(ctx.Lang(), "profile.err.newPasswordTooShort")))
+			ctx.Success("user/profile")
+			return
+		}
+		if err := db.Users.ChangePassword(ctx.Request().Context(), ctx.User.ID, f.OldPassword, f.NewPassword); err != nil {
+			if errors.Is(err, db.ErrBadCredential) {
+				ctx.SetError(errors.New(i18n.T(ctx.Lang(), "profile.err.badOldPassword")))
+			} else {
+				logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to update password")
+				ctx.SetInternalError()
+			}
+			ctx.Success("user/profile")
+			return
+		}
+		passwordChanged = true
+	}
+
+	// 通知类型
+	var notify db.NotifyType
+	if f.NotifyEmail != "" {
+		notify = db.NotifyTypeEmail
+	} else {
+		notify = db.NotifyTypeNone
+	}
+
+	// 构建更新选项
+	if err := db.Users.Update(ctx.Request().Context(), ctx.User.ID, db.UpdateUserOptions{
+		Name:                 f.Name,
+		Avatar:               avatarURL,
+		Background:           backgroundURL,
+		Intro:                f.Intro,
+		Qrcodebackcolor:      f.Qrcodebackcolor,
+		Qrcodecolor:          f.Qrcodecolor,
+		Dotscale:             f.Dotscale,
+		BackgroundImage:      backgroundImageURL,
+		Backgroundimagealpha: f.Backgroundimagealpha,
+		Usernamecolor:        f.Usernamecolor,
+		Introcolor:           f.Introcolor,
+		Qrcodepdpcolor:       f.Qrcodepdpcolor,
+		Acfunlink:            f.Acfunlink,
+		Bililink:             f.Bililink,
+		Weibolink:            f.Weibolink,
+		Xiaohongshulink:      f.Xiaohongshulink,
+		Bloglink:             f.Bloglink,
+		UseCustomQRColor:     useCustomQRColor,
+		Notify:               notify,
+		Language:             i18n.Resolve(f.Language),
+	}); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to update user profile")
+		if passwordChanged {
+			// 密码已落库且版本号已 +1：当前会话在下次请求即失效，
+			// 主动清会话并给出明确提示后回登录页，避免用户被「请先登录」含糊文案打断。
+			ctx.Session.Flush()
+			ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "profile.flash.passwordChanged"))
+			ctx.Redirect("/login")
+			return
+		}
+		ctx.SetInternalErrorFlash()
+	} else if passwordChanged {
+		// 密码修改成功且其余资料也保存成功：强制登出重登。
+		// 顺序与 DeactivateProfileAction 保持一致：先 Flush 会话再写入 flash，随后跳登录页。
+		ctx.Session.Flush()
+		ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "profile.flash.passwordChanged"))
+		ctx.Redirect("/login")
+		return
+	} else {
+		ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "admin.flash.profileUpdated"))
+	}
+	ctx.Redirect("/user/profile")
+}
+
+// 更新私聊设置（手动读取表单，不使用 form.Bind）
+//
+// 注意：私聊的「开启 / 关闭」由账号设置页「私聊」面板统一控制（feature_controls，含定时与定量），
+// 此处不再从表单读取开关值——否则移除复选框后每次保存都会把开关重置为关闭。
+// users.allow_chat 仍按功能管理的当前值回写，保持两处一致。
+func UpdateChatSettings(ctx context.Context) {
+	maxMessagesStr := ctx.Request().FormValue("chat_max_messages")
+	dailyLimitStr := ctx.Request().FormValue("chat_daily_limit")
+
+	maxMessages, err := strconv.Atoi(maxMessagesStr)
+	if err != nil || maxMessages < 1 {
+		maxMessages = 1
+	}
+	// 会话条数上限：用户只能在自己的设置里取 1..系统硬顶（conf.Limits.ChatMaxMessages）
+	if maxMessages > conf.Limits.ChatMaxMessages {
+		maxMessages = conf.Limits.ChatMaxMessages
+	}
+
+	dailyLimit, _ := strconv.Atoi(dailyLimitStr)
+	if dailyLimit < 0 {
+		dailyLimit = 0
+	}
+	// 每日条数：0 = 不限制；否则取 1..conf.Limits.DailyMessageLimitMax
+	if dailyLimit > conf.Limits.DailyMessageLimitMax {
+		dailyLimit = conf.Limits.DailyMessageLimitMax
+	}
+
+	allowChat := db.FeatureOpen(ctx.Request().Context(), ctx.User.ID, db.FeatureChat)
+	if err := db.Users.UpdateChatSettings(ctx.Request().Context(), ctx.User.ID, allowChat, maxMessages); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to update chat settings")
+		ctx.SetInternalErrorFlash()
+	} else {
+		// 更新每日限制
+		if err := db.Users.UpdateDailyMessageLimit(ctx.Request().Context(), ctx.User.ID, dailyLimit); err != nil {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to update daily limit")
+		}
+		ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "admin.flash.chatUpdated"))
+	}
+	ctx.Redirect(profileURLWithTab(ProfileTabChat))
+}
+
+func ExportProfile(ctx context.Context) {
+	user, err := db.Users.GetByID(ctx.Request().Context(), ctx.User.ID)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to get user")
+
+		ctx.SetError(errors.New(i18n.T(ctx.Lang(), "admin.export.errUser")))
+		ctx.Success("user/profile")
+		return
+	}
+
+	questions, err := db.Questions.GetByUserID(ctx.Request().Context(), user.ID, db.GetQuestionsByUserIDOptions{
+		FilterAnswered: false,
+		ShowPrivate:    true,
+	})
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to get questions")
+
+		ctx.SetError(errors.New(i18n.T(ctx.Lang(), "admin.export.errQuestion")))
+		ctx.Success("user/profile")
+		return
+	}
+
+	f, err := createExportExcelFile(user, questions)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to create excel file")
+
+		ctx.SetError(errors.New(i18n.T(ctx.Lang(), "admin.export.errCreateExcel")))
+		ctx.Success("user/profile")
+		return
+	}
+
+	fileName := fmt.Sprintf("狼的提问箱账号信息导出-%s-%s.xlsx", user.Domain, time.Now().Format("20060102150405"))
+	ctx.ResponseWriter().Header().Set("Content-Type", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet")
+	ctx.ResponseWriter().Header().Set("Content-Disposition", "attachment; filename*=UTF-8''"+url.QueryEscape(fileName))
+
+	if err := f.Write(ctx.ResponseWriter()); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to write excel file")
+
+		ctx.SetError(errors.New(i18n.T(ctx.Lang(), "admin.export.errWriteExcel")))
+		ctx.Success("user/profile")
+		return
+	}
+}
+
+func createXLSXStreamWriter(xlsx *excelize.File, sheet string, headers []string) (*excelize.StreamWriter, error) {
+	xlsx.NewSheet(sheet)
+	sw, err := xlsx.NewStreamWriter(sheet)
+	if err != nil {
+		return nil, errors.Wrap(err, "new stream writer")
+	}
+
+	cols := make([]interface{}, 0, len(headers))
+	for _, c := range headers {
+		cols = append(cols, c)
+	}
+	err = sw.SetRow("A1", cols)
+	if err != nil {
+		return nil, errors.Wrap(err, "set header row")
+	}
+	return sw, nil
+}
+
+// sanitizeCell 防止表格软件公式注入：以 = + - @ （或控制字符）开头的单元格内容会在
+// Excel/CSV 中被当作公式执行，可能导致数据外泄或代码执行。前置单引号可让表格软件
+// 将其按纯文本处理（显示时自动隐藏该引号）。
+func sanitizeCell(s string) string {
+	if s == "" {
+		return s
+	}
+	r := []rune(s)
+	switch r[0] {
+	case '=', '+', '-', '@', '\t', '\r', '\n':
+		return "'" + s
+	}
+	return s
+}
+
+func createExportExcelFile(user *db.User, questions []*db.Question) (*excelize.File, error) {
+	f := excelize.NewFile()
+
+	sw, err := createXLSXStreamWriter(f, "账号信息", nil)
+	if err != nil {
+		return nil, errors.Wrap(err, "create xlsx stream writer: 提问")
+	}
+	// Set personal information sheet.
+	personalData := [][]interface{}{
+		{"狼的提问箱 账号信息导出", fmt.Sprintf("导出时间 %s", time.Now().Format("2006-01-02 15:04:05"))},
+		{"电子邮箱", user.Email},
+		{"昵称", user.Name},
+		{"个性域名", user.Domain},
+		{"AcFun主页", user.Acfunlink},
+		{"Bili主页", user.Bililink},
+		{"微博主页", user.Weibolink},
+		{"小红书主页", user.Xiaohongshulink},
+		{"个人博客主页", user.Bloglink},
+		{"介绍", user.Intro},
+		{"二维码背景色", user.Qrcodebackcolor},
+		{"二维码前景色", user.Qrcodecolor},
+		{"二维码点大小", user.Dotscale},
+		{"昵称颜色", user.Usernamecolor},
+		{"介绍颜色", user.Introcolor},
+		{"二维码探测图形颜色", user.Qrcodepdpcolor},
+		{"头像 URL", user.Avatar},
+		{"背景图 URL", user.Background},
+		{"注册时间", user.CreatedAt},
+	}
+	currentRow := 1
+	for _, row := range personalData {
+		// personalData 是 [][]interface{}：字符串需净化防公式注入，
+		// 非字符串（如 CreatedAt 的 time.Time）原样写入，交给 excelize 处理。
+		vals := make([]interface{}, len(row))
+		for i, v := range row {
+			if s, ok := v.(string); ok {
+				vals[i] = sanitizeCell(s)
+			} else {
+				vals[i] = v
+			}
+		}
+		cell, _ := excelize.CoordinatesToCellName(1, currentRow)
+		_ = sw.SetRow(cell, vals)
+		currentRow++
+	}
+	if err := sw.Flush(); err != nil {
+		return nil, errors.Wrap(err, "flush personal data")
+	}
+
+	// Set questions sheet.
+	sw, err = createXLSXStreamWriter(f, "提问", []string{"提问时间", "问题", "回答"})
+	if err != nil {
+		return nil, errors.Wrap(err, "create xlsx stream writer: 提问")
+	}
+
+	currentRow = 2 // Include header row.
+	for _, question := range questions {
+		question := question
+		vals := []interface{}{question.CreatedAt, sanitizeCell(question.Content), sanitizeCell(question.Answer)}
+		cell, _ := excelize.CoordinatesToCellName(1, currentRow)
+		_ = sw.SetRow(cell, vals)
+		currentRow++
+	}
+	if err := sw.Flush(); err != nil {
+		return nil, errors.Wrap(err, "flush personal data")
+	}
+
+	f.SetActiveSheet(f.GetSheetIndex("提问"))
+	f.DeleteSheet("Sheet1") // Delete default sheet.
+
+	return f, nil
+}
+
+func DeactivateProfile(ctx context.Context) {
+	ctx.Success("user/deactivate")
+}
+
+// ExportProfileJSON 以 JSON 格式全量导出账号数据（用户信息 + 提问/回答/追问 + 私聊消息），
+// 符合可携带权要求，供用户备份/迁移。
+func ExportProfileJSON(ctx context.Context) {
+	user, err := db.Users.GetByID(ctx.Request().Context(), ctx.User.ID)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to get user")
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "admin.export.errUser"))
+		ctx.Redirect("/user/profile")
+		return
+	}
+
+	// 用户提问（含私密）
+	questions, err := db.Questions.GetByUserID(ctx.Request().Context(), user.ID, db.GetQuestionsByUserIDOptions{
+		FilterAnswered: false,
+		ShowPrivate:    true,
+	})
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to get questions for export")
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "admin.export.errQuestion"))
+		ctx.Redirect("/user/profile")
+		return
+	}
+
+	type exportedQuestion struct {
+		ID        uint           `json:"id"`
+		Content   string         `json:"content"`
+		Answer    string         `json:"answer"`
+		IsPrivate bool           `json:"is_private"`
+		IsPinned  bool           `json:"is_pinned"`
+		CreatedAt time.Time      `json:"created_at"`
+		UpdatedAt time.Time      `json:"updated_at"`
+		FollowUps []*db.FollowUp `json:"follow_ups"`
+		Images    []string       `json:"images"`
+	}
+
+	// 批量拉取所有提问的追问与图片（IN 查询 + 内存分组），避免逐题查询造成 N+1。
+	questionIDs := make([]uint, 0, len(questions))
+	for _, q := range questions {
+		questionIDs = append(questionIDs, q.ID)
+	}
+	followUpMap, err := db.FollowUps.GetByQuestionIDs(ctx.Request().Context(), questionIDs)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to batch get follow ups for export")
+		followUpMap = make(map[uint][]*db.FollowUp)
+	}
+	imageMap, err := db.UploadImages.GetByQuestionIDs(ctx.Request().Context(), questionIDs)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to batch get images for export")
+		imageMap = make(map[uint][]*db.UploadImage)
+	}
+
+	exportQuestions := make([]exportedQuestion, 0, len(questions))
+	for _, q := range questions {
+		followUps := followUpMap[q.ID]
+		if followUps == nil {
+			followUps = []*db.FollowUp{}
+		}
+		imgs := imageMap[q.ID]
+		imageURLs := make([]string, 0, len(imgs))
+		for _, img := range imgs {
+			imageURLs = append(imageURLs, img.Key)
+		}
+		exportQuestions = append(exportQuestions, exportedQuestion{
+			ID:        q.ID,
+			Content:   q.Content,
+			Answer:    q.Answer,
+			IsPrivate: q.IsPrivate,
+			IsPinned:  q.IsPinned,
+			CreatedAt: q.CreatedAt,
+			UpdatedAt: q.UpdatedAt,
+			FollowUps: followUps,
+			Images:    imageURLs,
+		})
+	}
+
+	// 私聊会话与消息
+	type exportedMessage struct {
+		Content   string    `json:"content"`
+		SenderID  uint      `json:"sender_id"`
+		CreatedAt time.Time `json:"created_at"`
+	}
+	type exportedConversation struct {
+		OwnerID   uint              `json:"owner_id"`
+		AskerID   uint              `json:"asker_id"`
+		IsClosed  bool              `json:"is_closed"`
+		CreatedAt time.Time         `json:"created_at"`
+		Messages  []exportedMessage `json:"messages"`
+	}
+
+	exportConvs := make([]exportedConversation, 0)
+	allConvs := make([]*db.Conversation, 0)
+	if owned, err := db.Conversations.ListByOwner(ctx.Request().Context(), user.ID, 0, 0); err == nil {
+		allConvs = append(allConvs, owned...)
+	}
+	if asked, err := db.Conversations.ListByAsker(ctx.Request().Context(), user.ID, 0, 0); err == nil {
+		allConvs = append(allConvs, asked...)
+	}
+	// 去重并收集会话 ID，批量拉取全部消息（IN 查询 + 内存分组），避免逐会话查询造成 N+1。
+	seen := make(map[uint]bool)
+	dedupedConvs := make([]*db.Conversation, 0, len(allConvs))
+	convIDs := make([]uint, 0, len(allConvs))
+	for _, conv := range allConvs {
+		if seen[conv.ID] {
+			continue
+		}
+		seen[conv.ID] = true
+		dedupedConvs = append(dedupedConvs, conv)
+		convIDs = append(convIDs, conv.ID)
+	}
+	msgMap, err := db.Messages.GetAllByConversationIDs(ctx.Request().Context(), convIDs)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to batch get messages for export")
+		msgMap = make(map[uint][]*db.Message)
+	}
+	for _, conv := range dedupedConvs {
+		msgs := msgMap[conv.ID]
+		if msgs == nil {
+			msgs = []*db.Message{}
+		}
+		exportMsgs := make([]exportedMessage, 0, len(msgs))
+		for _, m := range msgs {
+			exportMsgs = append(exportMsgs, exportedMessage{
+				Content:   m.Content,
+				SenderID:  m.SenderID,
+				CreatedAt: m.CreatedAt,
+			})
+		}
+		exportConvs = append(exportConvs, exportedConversation{
+			OwnerID:   conv.OwnerID,
+			AskerID:   conv.AskerID,
+			IsClosed:  conv.IsClosed,
+			CreatedAt: conv.CreatedAt,
+			Messages:  exportMsgs,
+		})
+	}
+
+	payload := map[string]interface{}{
+		"exported_at":   time.Now().Format(time.RFC3339),
+		"version":       1,
+		"user":          user,
+		"questions":     exportQuestions,
+		"conversations": exportConvs,
+	}
+
+	fileName := fmt.Sprintf("提问箱账号数据-%s-%s.json", user.Domain, time.Now().Format("20060102150405"))
+	ctx.ResponseWriter().Header().Set("Content-Type", "application/json; charset=utf-8")
+	ctx.ResponseWriter().Header().Set("Content-Disposition", "attachment; filename*=UTF-8''"+url.QueryEscape(fileName))
+
+	enc := json.NewEncoder(ctx.ResponseWriter())
+	enc.SetIndent("", "  ")
+	if err := enc.Encode(payload); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to encode JSON export")
+	}
+}
+
+func DeactivateProfileAction(ctx context.Context) {
+	if err := db.Users.Deactivate(ctx.Request().Context(), ctx.User.ID); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to deactivate user")
+		ctx.SetInternalError()
+		ctx.Success("user/deactivate")
+		return
+	}
+	ctx.Session.Flush()
+	ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "admin.flash.deactivated"))
+	ctx.Redirect("/login")
+}
diff --git a/route/user/question.go b/route/user/question.go
new file mode 100644
index 0000000..0fcebf0
--- /dev/null
+++ b/route/user/question.go
@@ -0,0 +1,480 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package user
+
+import (
+	"fmt"
+	"net/url"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/sirupsen/logrus"
+
+	"github.com/tamakyi/TamaBox/internal/context"
+	"github.com/tamakyi/TamaBox/internal/db"
+	"github.com/tamakyi/TamaBox/internal/dbutil"
+)
+
+type conversationDetail struct {
+	Conversation *db.Conversation
+	OwnerDomain  string
+	OwnerName    string
+	FirstMessage string
+	IsBlocked    bool
+}
+
+type receivedItem struct {
+	Type       string // "question_public", "question_private", "chat"
+	CreatedAt  time.Time
+	Content    string
+	Link       string
+	IsAnswered bool
+	IsRead     bool   // 仅对普通提问有效：有效已读 = is_read=true 或已回答
+	IsPrivate  bool   // 仅对普通提问有效
+	IsBlocked  bool   // 仅对私聊有效
+	QuestionID uint   // 仅对普通提问有效，用于置顶操作
+	IsPinned   bool   // 仅对普通提问有效
+	PinLink    string // 仅对普通提问有效：置顶/取消置顶操作链接
+}
+
+// QuestionList 用户后台提问列表（支持筛选与全文搜索）
+func QuestionList(ctx context.Context) {
+	// 获取筛选参数
+	sortParam := ctx.Query("sort")
+	if sortParam != "latest" && sortParam != "oldest" {
+		sortParam = "latest"
+	}
+	statusParam := ctx.Query("status")
+	if statusParam != "all" && statusParam != "answered" && statusParam != "unanswered" {
+		statusParam = "all"
+	}
+	typeParam := ctx.Query("type")
+	// 私聊已独立成"私聊"标签页（见 ReceivedChats），不再参与提问列表的类型筛选；
+	// 旧的 type=chat 链接统一归一为"全部"，避免空列表。
+	if typeParam != "all" && typeParam != "public" && typeParam != "private_question" {
+		typeParam = "all"
+	}
+	readParam := ctx.Query("read")
+	if readParam != "all" && readParam != "read" && readParam != "unread" {
+		readParam = "all"
+	}
+	keyword := strings.TrimSpace(ctx.Query("q"))
+
+	// 映射排序方向
+	sortOrder := "DESC"
+	if sortParam == "oldest" {
+		sortOrder = "ASC"
+	}
+
+	// 映射回答状态
+	answeredStatus := 0 // 全部
+	if statusParam == "answered" {
+		answeredStatus = 1
+	} else if statusParam == "unanswered" {
+		answeredStatus = 2
+	}
+
+	// 映射阅读状态
+	readStatus := 0 // 全部
+	if readParam == "read" {
+		readStatus = 1
+	} else if readParam == "unread" {
+		readStatus = 2
+	}
+
+	// 管理后台进入问题详情的链接：携带 from=admin 及当前筛选参数，
+	// 使详情页底部「返回」按钮跳回带筛选条件的后台列表（保留 sort/status/type/read/q）。
+	adminLinkQuery := url.Values{}
+	adminLinkQuery.Set("from", "admin")
+	if sortParam != "latest" {
+		adminLinkQuery.Set("sort", sortParam)
+	}
+	if statusParam != "all" {
+		adminLinkQuery.Set("status", statusParam)
+	}
+	if typeParam != "all" {
+		adminLinkQuery.Set("type", typeParam)
+	}
+	if readParam != "all" {
+		adminLinkQuery.Set("read", readParam)
+	}
+	if keyword != "" {
+		adminLinkQuery.Set("q", keyword)
+	}
+	adminLinkQueryStr := adminLinkQuery.Encode()
+
+	var receivedItems []receivedItem
+
+	// 1. 获取普通提问
+	var questions []*db.Question
+	if keyword != "" {
+		results, err := db.Questions.SearchByUserID(ctx.Request().Context(), ctx.User.ID, keyword)
+		if err != nil {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to search questions")
+		} else {
+			questions = results
+		}
+	} else if typeParam == "all" || typeParam == "public" || typeParam == "private_question" {
+		privateStatus := 0 // 全部
+		if typeParam == "public" {
+			privateStatus = 1 // 仅公开
+		} else if typeParam == "private_question" {
+			privateStatus = 2 // 仅私密
+		}
+
+		// 游标分页：每页固定大小，游标为上一页最后一条提问 ID（默认按创建时间倒序，
+		// 与 db.GetQuestionsByUserID 的 id < cursor 游标一致）。避免全量返回。
+		questionsPageSize := 50
+		qCursor := parseCursorUint(ctx.Query("q_cursor"))
+		qOpts := db.GetQuestionsByUserIDOptions{
+			AnsweredStatus: answeredStatus,
+			PrivateStatus:  privateStatus,
+			// PrivateStatus=0（"全部"）时必须显式声明含私密：store 层的旧调用兼容分支
+			// 会把 "ShowPrivate=false 且未指定 PrivateStatus" 当作仅公开过滤，
+			// 导致私密提问在"全部"类型下不可见（与统计看板/内存过滤逻辑不一致）。
+			ShowPrivate: true,
+			ReadStatus:  readStatus,
+			SortOrder:   sortOrder,
+			Cursor:      &dbutil.Cursor{PageSize: questionsPageSize},
+		}
+		if qCursor > 0 {
+			qOpts.Cursor.Value = qCursor
+		}
+
+		var qs []*db.Question
+		var qErr error
+		qs, qErr = db.Questions.GetByUserID(ctx.Request().Context(), ctx.User.ID, qOpts)
+		if qErr != nil {
+			logrus.WithContext(ctx.Request().Context()).WithError(qErr).Error("Failed to get questions by user ID")
+		} else {
+			questions = qs
+		}
+		// 提问"加载更多"（仅非搜索路径支持游标分页）：满页且仍有更多时暴露下一页游标
+		if qErr == nil && len(qs) >= questionsPageSize {
+			lastQID := qs[len(qs)-1].ID
+			ctx.Data["HasMoreQuestions"] = true
+			ctx.Data["QuestionLoadMoreURL"] = buildQListPageURL(ctx.Request().URL.Query(), "q_cursor", strconv.FormatUint(uint64(lastQID), 10), "")
+		} else {
+			ctx.Data["HasMoreQuestions"] = false
+		}
+	}
+
+	// 搜索场景下关键词已在 SQL 中匹配，但类型/状态筛选需在此统一应用，
+	// 使"搜索 + 筛选"可组合（完善筛选逻辑）。非搜索场景下此处与 SQL 过滤结果一致。
+	for _, q := range questions {
+		if answeredStatus == 1 && q.Answer == "" {
+			continue
+		}
+		if answeredStatus == 2 && q.Answer != "" {
+			continue
+		}
+		if typeParam == "public" && q.IsPrivate {
+			continue
+		}
+		if typeParam == "private_question" && !q.IsPrivate {
+			continue
+		}
+		// 有效已读 = 手动已读(is_read) 或 已回答(answer != "")
+		isRead := q.IsRead || q.Answer != ""
+		if readStatus == 1 && !isRead {
+			continue
+		}
+		if readStatus == 2 && isRead {
+			continue
+		}
+		itemType := "question_public"
+		if q.IsPrivate {
+			itemType = "question_private"
+		}
+		receivedItems = append(receivedItems, receivedItem{
+			Type:       itemType,
+			CreatedAt:  q.CreatedAt,
+			Content:    q.Content,
+			Link:       "/_/" + ctx.User.Domain + "/" + fmt.Sprint(q.ID) + "?" + adminLinkQueryStr,
+			IsAnswered: q.Answer != "",
+			IsRead:     isRead,
+			IsPrivate:  q.IsPrivate,
+			QuestionID: q.ID,
+			IsPinned:   q.IsPinned,
+			PinLink:    "/_/" + ctx.User.Domain + "/" + fmt.Sprint(q.ID) + "/pin",
+		})
+	}
+
+	// 2. 私聊会话：独立"私聊"标签页展示（ReceivedChats），不再混入提问列表。
+	//    会话没有回答状态/阅读状态概念，不受提问的 sort/status/type/read/q 筛选影响。
+	// 私聊列表分页（游标=offset），避免一次拉取全部会话造成内存/DB 压力。
+	chatPageSize := 50
+	chatOffset := parseCursorUint(ctx.Query("chat_cursor"))
+
+	var receivedChats []receivedItem
+	convs, err := db.Conversations.ListByOwner(ctx.Request().Context(), ctx.User.ID, chatPageSize, int(chatOffset))
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to get owned conversations")
+	} else if len(convs) > 0 {
+		// 批量获取首条消息
+		convIDs := make([]uint, len(convs))
+		for i, c := range convs {
+			convIDs[i] = c.ID
+		}
+		firstMsgMap, err := db.Messages.GetFirstMessagesByConversationIDs(ctx.Request().Context(), convIDs)
+		if err != nil {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to batch get first messages")
+			firstMsgMap = make(map[uint]string)
+		}
+
+		// 批量判断"我拉黑了哪些 asker"，避免循环 IsUserBlocked 造成 N+1。
+		askerIDs := make([]uint, 0, len(convs))
+		for _, c := range convs {
+			askerIDs = append(askerIDs, c.AskerID)
+		}
+		blockedMap, err := db.Users.BlockedByUser(ctx.Request().Context(), ctx.User.ID, askerIDs)
+		if err != nil {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to batch check blocked askers")
+			blockedMap = make(map[uint]bool)
+		}
+
+		for _, conv := range convs {
+			receivedChats = append(receivedChats, receivedItem{
+				Type:      "chat",
+				CreatedAt: conv.CreatedAt,
+				Content:   firstMsgMap[conv.ID],
+				Link:      "/_/" + ctx.User.Domain + "/chat/" + conv.Token,
+				IsBlocked: blockedMap[conv.AskerID],
+			})
+		}
+	}
+	ctx.Data["ReceivedChats"] = receivedChats
+
+	// 私聊总数与"加载更多"判定（基于真实总数，而非当前页长度）
+	chatTotalReceived, cntErr := db.Conversations.CountByOwner(ctx.Request().Context(), ctx.User.ID)
+	if cntErr != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(cntErr).Error("Failed to count owned conversations")
+		chatTotalReceived = int64(len(convs))
+	}
+	hasMoreChats := chatTotalReceived > 0 && (chatOffset+uint(len(convs)) < uint(chatTotalReceived))
+	if hasMoreChats {
+		nextOffset := chatOffset + uint(len(convs))
+		ctx.Data["ChatLoadMoreURL"] = buildQListPageURL(ctx.Request().URL.Query(), "chat_cursor", strconv.FormatUint(uint64(nextOffset), 10), "chats")
+	}
+	ctx.Data["HasMoreChats"] = hasMoreChats
+
+	// 排序（搜索时保留搜索结果的倒序，不混合排序）
+	if keyword == "" {
+		sort.Slice(receivedItems, func(i, j int) bool {
+			if sortParam == "latest" {
+				return receivedItems[i].CreatedAt.After(receivedItems[j].CreatedAt)
+			}
+			return receivedItems[i].CreatedAt.Before(receivedItems[j].CreatedAt)
+		})
+	}
+
+	// ---------- 提问箱统计看板 ----------
+	// 独立统计（不受筛选影响），供管理页顶部展示。全部用 COUNT 查询，避免全量拉取问题记录。
+	totalCount, _ := db.Questions.Count(ctx.Request().Context(), ctx.User.ID, db.GetQuestionsCountOptions{ShowPrivate: true})
+	answeredCount, _ := db.Questions.Count(ctx.Request().Context(), ctx.User.ID, db.GetQuestionsCountOptions{FilterAnswered: true, ShowPrivate: true})
+	unansweredCount := totalCount - answeredCount
+
+	isPrivateTrue := true
+	privateCount, _ := db.Questions.Count(ctx.Request().Context(), ctx.User.ID, db.GetQuestionsCountOptions{ShowPrivate: true, IsPrivate: &isPrivateTrue})
+	isPinnedTrue := true
+	pinnedCount, _ := db.Questions.Count(ctx.Request().Context(), ctx.User.ID, db.GetQuestionsCountOptions{ShowPrivate: true, IsPinned: &isPinnedTrue})
+
+	// 阅读状态统计（不受其他筛选影响）：已读 = is_read=true 或已回答；未读 = 其余。
+	readCount, _ := db.Questions.Count(ctx.Request().Context(), ctx.User.ID, db.GetQuestionsCountOptions{ShowPrivate: true, ReadStatus: 1})
+	unreadCount, _ := db.Questions.Count(ctx.Request().Context(), ctx.User.ID, db.GetQuestionsCountOptions{ShowPrivate: true, ReadStatus: 2})
+
+	ctx.Data["Stats"] = map[string]int64{
+		"total":      totalCount,
+		"answered":   answeredCount,
+		"unanswered": unansweredCount,
+		"read":       readCount,
+		"unread":     unreadCount,
+		"private":    privateCount,
+		"pinned":     pinnedCount,
+	}
+	// 我创建的投票（提问箱「投票」面板用）—— 与投票管理列表共用富信息条目，
+	// 含参与数、有效状态（draft/published/not_started/ended/archived）、剩余时间等。
+	// 分页：每页固定大小，游标为上一页最后一条投票 ID（按创建时间倒序），避免全量返回。
+	votesPageSize := 50
+	voteCursor := parseCursorUint(ctx.Query("vote_cursor"))
+	voteListOpts := db.ListVotesOptions{Cursor: &dbutil.Cursor{PageSize: votesPageSize}}
+	if voteCursor > 0 {
+		voteListOpts.Cursor.Value = voteCursor
+	}
+	myVotesRaw, err := db.Votes.ListByUserID(ctx.Request().Context(), ctx.User.ID, voteListOpts)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to get my votes")
+		myVotesRaw = []*db.Vote{}
+	}
+	myVotes := buildVoteItems(ctx, myVotesRaw)
+	ctx.Data["MyVotes"] = myVotes
+
+	// 投票统计看板（不受筛选影响）：总数（真实全量计数）+ 本页有效进行中数
+	voteTotal, _ := db.Votes.CountByUserID(ctx.Request().Context(), ctx.User.ID)
+	votePublished := int64(0)
+	for _, it := range myVotes {
+		if it.EffectiveStatus == db.VoteStatusPublished {
+			votePublished++
+		}
+	}
+	ctx.Data["VoteStats"] = map[string]int64{
+		"total":     voteTotal,
+		"published": votePublished,
+	}
+	// 投票"加载更多"：本页满页且仍有更多时暴露下一页游标（保留筛选参数并跳回投票面板）
+	if len(myVotesRaw) >= votesPageSize {
+		lastID := myVotesRaw[len(myVotesRaw)-1].ID
+		ctx.Data["HasMoreVotes"] = true
+		ctx.Data["VoteLoadMoreURL"] = buildQListPageURL(ctx.Request().URL.Query(), "vote_cursor", strconv.FormatUint(uint64(lastID), 10), "votes")
+	} else {
+		ctx.Data["HasMoreVotes"] = false
+	}
+
+	ctx.Data["Keyword"] = keyword
+
+	ctx.Data["ReceivedItems"] = receivedItems
+	ctx.Data["SelectedSort"] = sortParam
+	ctx.Data["SelectedStatus"] = statusParam
+	ctx.Data["SelectedRead"] = readParam
+	ctx.Data["SelectedType"] = typeParam
+
+	// 我发起的私聊 — 同样使用批量查询与分页（复用 chat_cursor 游标）
+	askerConvs, err := db.Conversations.ListByAsker(ctx.Request().Context(), ctx.User.ID, chatPageSize, int(chatOffset))
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to get asked conversations")
+		askerConvs = []*db.Conversation{}
+	}
+	var askerDetails []conversationDetail
+	if len(askerConvs) > 0 {
+		askerConvIDs := make([]uint, len(askerConvs))
+		for i, c := range askerConvs {
+			askerConvIDs[i] = c.ID
+		}
+		askerFirstMsgMap, err := db.Messages.GetFirstMessagesByConversationIDs(ctx.Request().Context(), askerConvIDs)
+		if err != nil {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to batch get first messages for asker")
+			askerFirstMsgMap = make(map[uint]string)
+		}
+
+		// 批量查询所有 owner（去重），避免逐个 GetByID 造成 N+1；拉黑状态用批量关联表查询。
+		ownerIDSet := make(map[uint]struct{})
+		ownerIDs := make([]uint, 0, len(askerConvs))
+		for _, conv := range askerConvs {
+			if _, ok := ownerIDSet[conv.OwnerID]; !ok {
+				ownerIDSet[conv.OwnerID] = struct{}{}
+				ownerIDs = append(ownerIDs, conv.OwnerID)
+			}
+		}
+		ownerMap := make(map[uint]*db.User)
+		if owners, err := db.Users.GetByIDs(ctx.Request().Context(), ownerIDs); err == nil {
+			for _, u := range owners {
+				ownerMap[u.ID] = u
+			}
+		} else {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to batch get owners")
+		}
+
+		// 批量判断"哪些 owner 拉黑了我"，避免循环查询。
+		blockedByMap, err := db.Users.BlockedByAnyOf(ctx.Request().Context(), ownerIDs, ctx.User.ID)
+		if err != nil {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to batch check blocked by owners")
+			blockedByMap = make(map[uint]bool)
+		}
+
+		for _, conv := range askerConvs {
+			firstMsg := askerFirstMsgMap[conv.ID]
+			ownerDomain := "unknown"
+			ownerName := "未知用户"
+			if owner, ok := ownerMap[conv.OwnerID]; ok {
+				ownerDomain = owner.Domain
+				ownerName = owner.Name
+			}
+			askerDetails = append(askerDetails, conversationDetail{
+				Conversation: conv,
+				OwnerDomain:  ownerDomain,
+				OwnerName:    ownerName,
+				FirstMessage: firstMsg,
+				IsBlocked:    blockedByMap[conv.OwnerID],
+			})
+		}
+	}
+	ctx.Data["ConversationDetails"] = askerDetails
+
+	// 我发起的私聊总数与"加载更多"判定
+	askerTotal, cntErr := db.Conversations.CountByAsker(ctx.Request().Context(), ctx.User.ID)
+	if cntErr != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(cntErr).Error("Failed to count asked conversations")
+		askerTotal = int64(len(askerConvs))
+	}
+	hasMoreAsked := askerTotal > 0 && (chatOffset+uint(len(askerConvs)) < uint(askerTotal))
+	if hasMoreAsked {
+		nextOffset := chatOffset + uint(len(askerConvs))
+		ctx.Data["AskedChatsLoadMoreURL"] = buildQListPageURL(ctx.Request().URL.Query(), "chat_cursor", strconv.FormatUint(uint64(nextOffset), 10), "chats")
+	}
+	ctx.Data["HasMoreAskedChats"] = hasMoreAsked
+
+	// ---------- 私聊统计看板 ----------
+	// 与提问/投票看板一致，展示在「私聊」面板的顶部。全部基于已加载的会话切片计算，
+	// 不触发额外数据库查询：总数 = 我收到的(作为箱主) + 我发起的(作为提问者)；
+	// 已关闭 = 两端会话中 is_closed=true 的计数。
+	chatClosed := int64(0)
+	for _, c := range convs {
+		if c.IsClosed {
+			chatClosed++
+		}
+	}
+	for _, c := range askerConvs {
+		if c.IsClosed {
+			chatClosed++
+		}
+	}
+	ctx.Data["ChatStats"] = map[string]int64{
+		"total":     chatTotalReceived + askerTotal,
+		"received":  chatTotalReceived,
+		"initiated": askerTotal,
+		"closed":    chatClosed,
+	}
+
+	ctx.Success("user/question-list")
+}
+
+// parseCursorUint 将游标字符串安全解析为 uint；空或非法返回 0（表示从头分页）。
+func parseCursorUint(s string) uint {
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return 0
+	}
+	id, err := strconv.ParseUint(s, 10, 64)
+	if err != nil || id == 0 {
+		return 0
+	}
+	return uint(id)
+}
+
+// buildQListPageURL 在保留当前筛选/搜索参数的基础上构造"加载更多"链接，
+// 并追加锚点（anchor 指定跳转到的面板；空串表示默认提问面板）。
+// 用于投票/提问列表的游标分页，避免丢失已选的 sort/status/type/q 等筛选条件。
+func buildQListPageURL(current url.Values, key, val, anchor string) string {
+	q := url.Values{}
+	for k, vs := range current {
+		q[k] = vs
+	}
+	if val != "" {
+		q.Set(key, val)
+	} else {
+		q.Del(key)
+	}
+	qs := q.Encode()
+	path := "/user/questions"
+	if qs != "" {
+		path += "?" + qs
+	}
+	if anchor != "" {
+		path += "#" + anchor
+	}
+	return path
+}
diff --git a/route/user/tags.go b/route/user/tags.go
new file mode 100644
index 0000000..0909d27
--- /dev/null
+++ b/route/user/tags.go
@@ -0,0 +1,73 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package user
+
+import (
+	"strings"
+
+	"github.com/sirupsen/logrus"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/context"
+	"github.com/tamakyi/TamaBox/internal/db"
+	"github.com/tamakyi/TamaBox/internal/form"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+)
+
+func UpdateTags(ctx context.Context, f form.UpdateTags) {
+	// 反序列化失败（如请求体超限）时零值 Tags="" / ShowInHome="" 会静默清空标签、
+	// 关闭首页展示——先中止，不触碰现有标签。
+	if abortOnFormError(ctx, "/user/profile") {
+		return
+	}
+
+	tagsStr := f.Tags
+	tagsStr = strings.ReplaceAll(tagsStr, "，", ",")
+	tagsStr = strings.TrimSpace(tagsStr)
+
+	words := make([]string, 0)
+	wordSet := make(map[string]struct{})
+	for _, tag := range strings.Split(tagsStr, ",") {
+		tag = strings.TrimSpace(tag)
+		if tag == "" {
+			continue
+		}
+		if _, ok := wordSet[tag]; ok {
+			continue
+		}
+		wordSet[tag] = struct{}{}
+
+		if len([]rune(tag)) > conf.Limits.MaxTagLen {
+			ctx.SetErrorFlash(i18n.T(ctx.Lang(), "admin.flash.tagTooLong", tag))
+			ctx.Redirect("/user/profile")
+			return
+		}
+		words = append(words, tag)
+	}
+
+	if len(words) > conf.Limits.MaxTags {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "admin.flash.tagsTooMany"))
+		ctx.Redirect("/user/profile")
+		return
+	}
+
+	showInHome := false
+	if f.ShowInHome == "on" || f.ShowInHome == "1" || f.ShowInHome == "true" {
+		showInHome = true
+	}
+
+	if err := db.Users.UpdateTags(ctx.Request().Context(), ctx.User.ID, db.UpdateTagsOptions{
+		Tags:       strings.Join(words, ","),
+		ShowInHome: showInHome,
+	}); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to update tags")
+		ctx.SetInternalErrorFlash()
+		ctx.Redirect("/user/profile")
+		return
+	}
+
+	ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "admin.flash.tagsUpdated"))
+	ctx.Redirect("/user/profile")
+}
diff --git a/route/user/vote.go b/route/user/vote.go
new file mode 100644
index 0000000..7faba14
--- /dev/null
+++ b/route/user/vote.go
@@ -0,0 +1,1318 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package user
+
+import (
+	"encoding/csv"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"go.opentelemetry.io/otel/trace"
+
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+	"gorm.io/datatypes"
+
+	"github.com/tamakyi/TamaBox/internal/cache"
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/context"
+	"github.com/tamakyi/TamaBox/internal/db"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+	"github.com/tamakyi/TamaBox/internal/security/censor"
+	votepkg "github.com/tamakyi/TamaBox/route/vote"
+)
+
+// voteTextRepliesCache 箱主表单投票"回复明细"（逐条文本）的短 TTL 缓存。
+// 该视图仅在箱主结果页展示，且需在 Go 层逐条 json.Unmarshal 全部提交记录（O(N)），
+// 缓存可显著降低重算开销；结果页非强一致，30s 陈旧可接受。
+var voteTextRepliesCache = cache.NewTTLCache(64)
+
+// voteTextRepliesCacheTTL 回复明细缓存有效期。
+const voteTextRepliesCacheTTL = 30 * time.Second
+
+// ---------------- 表单解析 ----------------
+
+// voteFormFieldInput 表单字段的前端输入结构（vote-form.html 中的 JS 数组）。
+type voteFormFieldInput struct {
+	FieldType   string   `json:"field_type"`
+	Label       string   `json:"label"`
+	Required    bool     `json:"required"`
+	MaxLength   int      `json:"max_length"`
+	Options     []string `json:"options"`      // 选项数组（select/radio/checkbox/rank），前端逐条添加
+	AllowCustom bool     `json:"allow_custom"` // 允许补充自定义选项（radio/select/checkbox）
+}
+
+// voteForm 解析后的完整表单（含选项与表单字段）。
+type voteForm struct {
+	opts           db.CreateVoteOptions
+	options        []string
+	formFields     []db.CreateVoteFormFieldOptions
+	censorMetadata datatypes.JSON // 标题审核结果
+}
+
+// censorCheck 对单段文本做内容审核。
+// fail-closed：审核服务异常时拒绝发布（与提问/回答流程一致）；
+// 未开启 EnableTextCensor 时 censor.Text 直接放行，不影响开发环境。
+func censorCheck(ctx context.Context, text string) error {
+	resp, err := censor.Text(ctx.Request().Context(), text)
+	if err != nil {
+		return errors.New(i18n.T(ctx.Lang(), "censor.unavailable"))
+	}
+	if !resp.Pass {
+		return errors.New(resp.ErrorMessage())
+	}
+	return nil
+}
+
+// parseTimeInput 解析 "YYYY-MM-DDTHH:MM"（HTML datetime-local 格式），空字符串返回 nil。
+// 使用 time.Local 解析：datetime-local 提交的是无时区信息的时间串，按服务端本地时区解释，
+// 与 Evaluate 中 time.Now() 的比较基准保持一致（旧的 time.Parse 会解析成 UTC，产生时区偏移）。
+func parseTimeInput(ctx context.Context, s string) (*time.Time, error) {
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return nil, nil
+	}
+	t, err := time.ParseInLocation("2006-01-02T15:04", s, time.Local)
+	if err != nil {
+		return nil, errors.New(i18n.T(ctx.Lang(), "vote.err.timeFormat"))
+	}
+	return &t, nil
+}
+
+// parseVoteForm 手动解析投票表单（完整：元信息 + 类型 + 选项/字段）。
+// 说明：不使用 form.Bind —— Bind 的反射绑定会把 string 直接赋给 int 字段导致 panic，
+// 且选项/表单字段数组需要 JSON 解析，手动解析更安全。
+// draft=true 时放宽“选项/字段数量”与内容审核要求（详见 parseVoteMeta/parseOptions/parseFormFields），
+// 使草稿可随时暂存、不丢失已填内容。
+func parseVoteForm(ctx context.Context, draft bool) (*voteForm, error) {
+	form, err := parseVoteMeta(ctx, draft)
+	if err != nil {
+		return nil, err
+	}
+
+	voteType := strings.TrimSpace(ctx.Request().FormValue("type"))
+	switch voteType {
+	case db.VoteTypeSingle, db.VoteTypeMultiple, db.VoteTypeRating, db.VoteTypeRank, db.VoteTypeForm:
+	default:
+		return nil, errors.New(i18n.T(ctx.Lang(), "vote.err.type"))
+	}
+	form.opts.Type = voteType
+
+	maxChoices := 1
+	if voteType == db.VoteTypeMultiple {
+		maxChoices, _ = strconv.Atoi(strings.TrimSpace(ctx.Request().FormValue("max_choices")))
+		if maxChoices < 1 {
+			maxChoices = 1
+		}
+		if maxChoices > 20 {
+			return nil, errors.New(i18n.T(ctx.Lang(), "vote.err.maxChoicesLimit"))
+		}
+	}
+	form.opts.MaxChoices = maxChoices
+
+	// 选项 / 表单字段解析与校验
+	if voteType == db.VoteTypeForm {
+		if err := parseFormFields(ctx, form, draft); err != nil {
+			return nil, err
+		}
+	} else {
+		if err := parseOptions(ctx, form, voteType, maxChoices, draft); err != nil {
+			return nil, err
+		}
+	}
+
+	return form, nil
+}
+
+// parseVoteMetaForm 仅解析元信息（发布后编辑用）：标题/描述/可见性/范围/结果策略/
+// 自定义开关/时间窗/防刷/验证码。类型与选项/字段发布后不可修改（避免破坏历史数据归因）。
+func parseVoteMetaForm(ctx context.Context) (*voteForm, error) {
+	return parseVoteMeta(ctx, false)
+}
+
+// parseVoteMeta 解析投票元信息（不含类型与选项/字段）。
+// draft=true 时放宽校验并跳过内容审核：草稿为私有内容，保存时不应因审核服务抖动而丢失；
+// 审核统一在发布（VotePublish）时执行，确保对外公开内容仍受管控。
+func parseVoteMeta(ctx context.Context, draft bool) (*voteForm, error) {
+	get := func(name string) string { return strings.TrimSpace(ctx.Request().FormValue(name)) }
+
+	title := get("title")
+	// 草稿允许暂存空标题（发布前再补全）；非草稿必须填写
+	if title == "" && !draft {
+		return nil, errors.New(i18n.T(ctx.Lang(), "vote.err.titleRequired"))
+	}
+	if len([]rune(title)) > 100 {
+		return nil, errors.New(i18n.T(ctx.Lang(), "vote.err.titleTooLong"))
+	}
+	description := get("description")
+	if len([]rune(description)) > 5000 {
+		return nil, errors.New(i18n.T(ctx.Lang(), "vote.err.descriptionTooLong"))
+	}
+
+	// 内容审核（fail-closed）：非草稿执行；草稿跳过（见上说明）
+	var censorMeta datatypes.JSON
+	if !draft {
+		titleCensor, err := censor.Text(ctx.Request().Context(), title)
+		if err != nil {
+			return nil, errors.New("内容审核服务暂时不可用，请稍后再试")
+		}
+		if !titleCensor.Pass {
+			return nil, errors.New(titleCensor.ErrorMessage())
+		}
+		censorMeta = datatypes.JSON(titleCensor.ToJSON())
+		if description != "" {
+			if err := censorCheck(ctx, description); err != nil {
+				return nil, err
+			}
+		}
+	}
+
+	visibility := get("visibility")
+	switch visibility {
+	case db.VoteVisibilityPublic, db.VoteVisibilityLinkOnly:
+	default:
+		return nil, errors.New(i18n.T(ctx.Lang(), "vote.err.visibility"))
+	}
+
+	voterScope := get("voter_scope")
+	switch voterScope {
+	case db.VoteVoterScopeAnyone, db.VoteVoterScopeRegisteredOnly:
+	default:
+		return nil, errors.New(i18n.T(ctx.Lang(), "vote.err.voterScope"))
+	}
+
+	showResult := get("show_result")
+	switch showResult {
+	case db.VoteShowResultAfterVote, db.VoteShowResultAfterEnd, db.VoteShowResultOwnerOnly:
+	default:
+		return nil, errors.New(i18n.T(ctx.Lang(), "vote.err.showResult"))
+	}
+
+	allowCustom := get("allow_custom") == "on"
+	// 匿名投票始终要求验证码（决策 #3 / P2-2）：忽略客户端开关，强制开启，关闭复选框无法解除。
+	requireCaptcha := true
+
+	// 该策略由业务规则固定为一人一票；不从客户端读取已废弃的配置字段，
+	// 避免旧页面或手工请求写入与数据库约束冲突的多票语义。
+	maxVotes := 1
+
+	startAt, err := parseTimeInput(ctx, get("start_at"))
+	if err != nil {
+		return nil, err
+	}
+	endAt, err := parseTimeInput(ctx, get("end_at"))
+	if err != nil {
+		return nil, err
+	}
+	if startAt != nil && endAt != nil && !endAt.After(*startAt) {
+		return nil, errors.New(i18n.T(ctx.Lang(), "vote.err.timeRange"))
+	}
+
+	// 定量收集上限：收集到指定份数后自动结束该投票（0 = 不限制）
+	quotaLimit, err := parseQuotaLimit(get("quota_limit"))
+	if err != nil {
+		return nil, errors.New(i18n.T(ctx.Lang(), "vote.err.quota"))
+	}
+
+	return &voteForm{
+		opts: db.CreateVoteOptions{
+			UserID:                 ctx.User.ID,
+			Title:                  title,
+			Description:            description,
+			Visibility:             visibility,
+			VoterScope:             voterScope,
+			ShowResult:             showResult,
+			AllowCustom:            allowCustom,
+			StartAt:                startAt,
+			EndAt:                  endAt,
+			MaxVotesPerFingerprint: maxVotes,
+			RequireCaptcha:         requireCaptcha,
+			QuotaLimit:             int(quotaLimit),
+		},
+		censorMetadata: censorMeta,
+	}, nil
+}
+
+func parseOptions(ctx context.Context, form *voteForm, voteType string, maxChoices int, draft bool) error {
+	raw := strings.TrimSpace(ctx.Request().FormValue("options"))
+	if raw == "" {
+		// 草稿允许暂未添加选项；非草稿必须至少 2 个
+		if !draft {
+			return errors.New(i18n.T(ctx.Lang(), "vote.err.optionsTooFew"))
+		}
+		form.options = nil
+		return nil
+	}
+	var options []string
+	if err := json.Unmarshal([]byte(raw), &options); err != nil {
+		return errors.New(i18n.T(ctx.Lang(), "vote.err.optionsFormat"))
+	}
+
+	cleaned := make([]string, 0, len(options))
+	for _, o := range options {
+		o = strings.TrimSpace(o)
+		if o == "" {
+			continue
+		}
+		if len([]rune(o)) > conf.Limits.VoteOptionLen {
+			return errors.New(i18n.T(ctx.Lang(), "vote.err.optionTooLong", conf.Limits.VoteOptionLen))
+		}
+		// 选项内容审核（fail-closed）：草稿跳过，发布时统一审核
+		if !draft {
+			if err := censorCheck(ctx, o); err != nil {
+				return err
+			}
+		}
+		cleaned = append(cleaned, o)
+	}
+
+	// 评分题不需要选项（固定 1-10 分）
+	if voteType == db.VoteTypeRating {
+		form.options = nil
+		return nil
+	}
+
+	// 草稿允许暂存少于 2 个选项；非草稿必须至少 2 个
+	if !draft && len(cleaned) < 2 {
+		return errors.New(i18n.T(ctx.Lang(), "vote.err.optionsTooFew"))
+	}
+	if voteType == db.VoteTypeMultiple && maxChoices > len(cleaned) {
+		return errors.New(i18n.T(ctx.Lang(), "vote.err.maxChoicesExceed"))
+	}
+	form.options = cleaned
+	return nil
+}
+
+func parseFormFields(ctx context.Context, form *voteForm, draft bool) error {
+	raw := strings.TrimSpace(ctx.Request().FormValue("form_fields"))
+	if raw == "" {
+		// 草稿允许暂未添加字段；非草稿必须至少 1 个
+		if !draft {
+			return errors.New(i18n.T(ctx.Lang(), "vote.err.fieldsTooFew"))
+		}
+		return nil
+	}
+	var inputs []voteFormFieldInput
+	if err := json.Unmarshal([]byte(raw), &inputs); err != nil {
+		return errors.New(i18n.T(ctx.Lang(), "vote.err.fieldsFormat"))
+	}
+	if len(inputs) == 0 {
+		if !draft {
+			return errors.New(i18n.T(ctx.Lang(), "vote.err.fieldsTooFew"))
+		}
+		return nil
+	}
+	if len(inputs) > 50 {
+		return errors.New(i18n.T(ctx.Lang(), "vote.err.fieldsTooMany"))
+	}
+
+	// label 必须唯一：FormData 以 label 为 key，重复会导致提交数据互相覆盖
+	seenLabels := make(map[string]bool, len(inputs))
+	for i, in := range inputs {
+		switch in.FieldType {
+		case db.VoteFormFieldTypeText, db.VoteFormFieldTypeTextarea, db.VoteFormFieldTypeSelect,
+			db.VoteFormFieldTypeRadio, db.VoteFormFieldTypeCheckbox, db.VoteFormFieldTypeNumber,
+			db.VoteFormFieldTypeRating, db.VoteFormFieldTypeRank:
+		default:
+			return errors.New(i18n.T(ctx.Lang(), "vote.err.fieldType"))
+		}
+		label := strings.TrimSpace(in.Label)
+		if label == "" {
+			return errors.New(i18n.T(ctx.Lang(), "vote.err.fieldLabelMissing", i+1))
+		}
+		if len([]rune(label)) > 100 {
+			return errors.New(i18n.T(ctx.Lang(), "vote.err.fieldLabelTooLong", i+1))
+		}
+		if seenLabels[label] {
+			return errors.New(i18n.T(ctx.Lang(), "vote.err.fieldLabelDuplicate", label))
+		}
+		seenLabels[label] = true
+		if in.MaxLength < 0 || in.MaxLength > 2000 {
+			return errors.New(i18n.T(ctx.Lang(), "vote.err.fieldMaxLength", i+1))
+		}
+		// 字段标签审核（fail-closed）：草稿跳过，发布时统一审核
+		if !draft {
+			if err := censorCheck(ctx, label); err != nil {
+				return err
+			}
+		}
+
+		field := db.CreateVoteFormFieldOptions{
+			FieldType:   in.FieldType,
+			Label:       label,
+			Required:    in.Required,
+			MaxLength:   in.MaxLength,
+			SortOrder:   i,
+			AllowCustom: in.AllowCustom,
+		}
+
+		switch in.FieldType {
+		case db.VoteFormFieldTypeSelect, db.VoteFormFieldTypeRadio, db.VoteFormFieldTypeCheckbox, db.VoteFormFieldTypeRank:
+			var opts []string
+			for _, raw := range in.Options {
+				opts = append(opts, splitOptionTokens(raw)...)
+			}
+			// "其他"保留标记不允许作为预设选项内容（参与端用它触发自定义输入）
+			for _, o := range opts {
+				if o == db.CustomFieldMarker {
+					return errors.New(i18n.T(ctx.Lang(), "vote.err.fieldReservedOption", i+1, label))
+				}
+				// 单个选项长度与单选/多选选项同规则（vote-form.html 前端 maxlength 同源，
+				// 此前仅有前端软限制，这里补齐后端兜底校验）
+				if len([]rune(o)) > conf.Limits.VoteOptionLen {
+					return errors.New(i18n.T(ctx.Lang(), "vote.err.optionTooLong", conf.Limits.VoteOptionLen))
+				}
+			}
+			if len(opts) < 1 {
+				// 草稿允许暂未填写字段选项；非草稿必须至少 1 个
+				if !draft {
+					return errors.New(i18n.T(ctx.Lang(), "vote.err.fieldOptionsTooFew", i+1, label))
+				}
+			}
+			if in.FieldType == db.VoteFormFieldTypeRank && len(opts) < 2 {
+				if !draft {
+					return errors.New(i18n.T(ctx.Lang(), "vote.err.fieldRankTooFew", i+1, label))
+				}
+			}
+			// 预置选项审核：草稿跳过，发布时统一审核
+			if !draft {
+				for _, o := range opts {
+					if err := censorCheck(ctx, o); err != nil {
+						return err
+					}
+				}
+			}
+			optsJSON, err := json.Marshal(opts)
+			if err != nil {
+				return errors.New(i18n.T(ctx.Lang(), "vote.err.fieldSerialize"))
+			}
+			field.Options = string(optsJSON)
+		}
+		form.formFields = append(form.formFields, field)
+	}
+	return nil
+}
+
+// ---------------- 归属校验 ----------------
+
+// getOwnedVote 获取当前登录用户拥有的投票，校验归属。
+func getOwnedVote(ctx context.Context, voteIDStr string) (*db.Vote, error) {
+	voteID, err := strconv.ParseUint(voteIDStr, 10, 64)
+	if err != nil {
+		return nil, errors.New(i18n.T(ctx.Lang(), "vote.err.invalidID"))
+	}
+	vote, err := db.Votes.GetByID(ctx.Request().Context(), uint(voteID))
+	if err != nil {
+		return nil, errors.New(i18n.T(ctx.Lang(), "vote.err.notExist"))
+	}
+	if vote.UserID != ctx.User.ID {
+		return nil, errors.New(i18n.T(ctx.Lang(), "vote.err.noPermission"))
+	}
+	return vote, nil
+}
+
+// ---------------- 处理器 ----------------
+
+// VoteList 投票管理列表（含每票参与数统计）。
+// effectiveVoteStatus 计算投票的有效展示状态（status + 时间窗联合判断）：
+// published 且未到开始时间 → 未开始；published 且已过结束时间 → 已结束；
+// 其余与 status 字段一致。管理列表据此展示，避免"已过结束时间仍显示进行中"。
+func effectiveVoteStatus(v *db.Vote, now time.Time) string {
+	if v.Status != db.VoteStatusPublished {
+		return v.Status
+	}
+	if v.StartAt != nil && now.Before(*v.StartAt) {
+		return db.VoteStatusNotStarted
+	}
+	if v.EndAt != nil && !now.Before(*v.EndAt) {
+		return db.VoteStatusEnded
+	}
+	return db.VoteStatusPublished
+}
+
+// formatRemaining 格式化投票剩余时间（如"剩余 2 天 3 小时"），多语言文案。
+func formatRemaining(lang string, endAt time.Time, now time.Time) string {
+	d := endAt.Sub(now)
+	if d <= 0 {
+		return ""
+	}
+	days := int(d.Hours()) / 24
+	hours := int(d.Hours()) % 24
+	mins := int(d.Minutes()) % 60
+	parts := []string{}
+	if days > 0 {
+		parts = append(parts, fmt.Sprintf("%d%s", days, i18n.T(lang, "vote.durationDay")))
+	}
+	if hours > 0 {
+		parts = append(parts, fmt.Sprintf("%d%s", hours, i18n.T(lang, "vote.durationHour")))
+	}
+	if mins > 0 && days == 0 {
+		parts = append(parts, fmt.Sprintf("%d%s", mins, i18n.T(lang, "vote.durationMinute")))
+	}
+	if len(parts) == 0 {
+		return ""
+	}
+	return i18n.T(lang, "vote.remainLabel") + strings.Join(parts, " ")
+}
+
+// voteItem 管理面板/投票列表所需的富信息条目（参与数、有效状态、剩余时间）。
+type voteItem struct {
+	*db.Vote
+	SubmissionCount int64
+	OptionCount     int64
+	EffectiveStatus string
+	RemainingText   string // 有效进行中：剩余时间；无结束时间：无限期；其余为空
+}
+
+// buildVoteItems 将投票列表转换为管理面板所需的富信息条目。
+// QuestionList 的「我的提问箱 · 投票」面板与此前独立的投票管理列表共用，避免重复统计逻辑。
+//
+// 性能：参与数与选项数通过 CountByVoteIDs 批量聚合（2 条 WHERE vote_id IN (...)），
+// 替代原先对每票各发 2 次 COUNT 的 N+1 查询，N 张投票从 2N 条 SQL 降为 2 条。
+func buildVoteItems(ctx context.Context, votes []*db.Vote) []*voteItem {
+	lang := i18n.Default
+	if l, ok := ctx.Data["Lang"].(string); ok && l != "" {
+		lang = l
+	}
+
+	now := time.Now()
+	items := make([]*voteItem, 0, len(votes))
+
+	// 批量预取参与数与选项数（避免 N+1）
+	ids := make([]uint, 0, len(votes))
+	for _, v := range votes {
+		ids = append(ids, v.ID)
+	}
+	subCounts := map[uint]int64{}
+	optCounts := map[uint]int64{}
+	if len(ids) > 0 {
+		if m, err := db.VoteSubmissions.CountByVoteIDs(ctx.Request().Context(), ids); err != nil {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Warn("Failed to batch count submissions")
+		} else {
+			subCounts = m
+		}
+		if m, err := db.VoteOptions.CountByVoteIDs(ctx.Request().Context(), ids); err != nil {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Warn("Failed to batch count options")
+		} else {
+			optCounts = m
+		}
+	}
+
+	for _, v := range votes {
+		count := subCounts[v.ID]
+		optionCount := optCounts[v.ID]
+		eff := effectiveVoteStatus(v, now)
+		remaining := ""
+		if eff == db.VoteStatusPublished {
+			if v.EndAt != nil {
+				remaining = formatRemaining(lang, *v.EndAt, now)
+			} else {
+				remaining = i18n.T(lang, "vote.perpetual")
+			}
+		}
+		items = append(items, &voteItem{
+			Vote:            v,
+			SubmissionCount: count,
+			OptionCount:     optionCount,
+			EffectiveStatus: eff,
+			RemainingText:   remaining,
+		})
+	}
+	return items
+}
+
+// VoteList 投票管理列表（保留以兼容旧链接）：投票管理已合并到「我的提问箱」的投票面板，
+// 直接跳转 /user/questions#votes，避免两套功能重复的页面。
+func VoteList(ctx context.Context) {
+	ctx.Redirect("/user/questions#votes")
+}
+
+// VoteNew 新建投票页面。
+func VoteNew(ctx context.Context) {
+	ctx.Data["Title"] = "新建投票"
+	ctx.Data["IsEdit"] = false
+	ctx.Data["MaxVoteOptionLen"] = conf.Limits.VoteOptionLen // 选项输入框 maxlength 同源（vote-form.html JS）
+	// 默认投票类型为表单收集（用户要求）；同时给定模板零值兜底，避免切到多选时 max_choices 显示 0。
+	ctx.Data["Vote"] = &db.Vote{
+		Type:                   db.VoteTypeForm,
+		MaxChoices:             3,
+		MaxVotesPerFingerprint: 1,
+	}
+	ctx.Data["InitialOptions"] = []string{}
+	ctx.Data["InitialFields"] = []voteFormFieldInput{}
+	ctx.Success("user/vote-form")
+}
+
+// renderVoteFormWithInput 在保存失败时重新渲染投票表单并回填用户已提交的内容，
+// 避免校验/审核/数据库错误导致整页输入被清空（原先 Redirect("/user/votes/new") 会丢失全部数据）。
+// isEdit=true 时回填 vote.ID，保留编辑动作的提交地址。
+//
+// flashMsg/internal 用于在同请求内直接写入 c.Data 的错误提示（而非 session flash）：
+// 本项目的 flash 在请求开始时读取进 c.Data，随后写入 session 的 flash 不会被本次渲染读到，
+// 且会残留到下一次请求造成"陈旧错误"串页；故错误回填采用直接写 c.Data 的方式。
+func renderVoteFormWithInput(ctx context.Context, isEdit bool, voteID uint, flashMsg string, internal bool) {
+	ctx.Data["MaxVoteOptionLen"] = conf.Limits.VoteOptionLen // 选项输入框 maxlength 同源（vote-form.html JS）
+	get := func(n string) string { return strings.TrimSpace(ctx.Request().FormValue(n)) }
+	title := get("title")
+	description := get("description")
+	voteType := get("type")
+	visibility := get("visibility")
+	voterScope := get("voter_scope")
+	showResult := get("show_result")
+	maxChoices, _ := strconv.Atoi(get("max_choices"))
+	if maxChoices < 1 {
+		maxChoices = 1
+	}
+	// 与数据库唯一索引保持一致；该策略不再由表单配置。
+	maxVotes := 1
+	allowCustom := get("allow_custom") == "on"
+	// 匿名投票始终要求验证码（决策 #3 / P2-2）：忽略客户端开关，强制开启。
+	requireCaptcha := true
+	startAt, _ := parseTimeInput(ctx, get("start_at"))
+	endAt, _ := parseTimeInput(ctx, get("end_at"))
+	quotaLimit, _ := parseQuotaLimit(get("quota_limit"))
+
+	var initialOptions []string
+	if raw := strings.TrimSpace(ctx.Request().FormValue("options")); raw != "" {
+		_ = json.Unmarshal([]byte(raw), &initialOptions)
+	}
+	var initialFields []voteFormFieldInput
+	if raw := strings.TrimSpace(ctx.Request().FormValue("form_fields")); raw != "" {
+		_ = json.Unmarshal([]byte(raw), &initialFields)
+	}
+
+	vote := &db.Vote{
+		Title:                  title,
+		Description:            description,
+		Type:                   voteType,
+		Visibility:             visibility,
+		VoterScope:             voterScope,
+		ShowResult:             showResult,
+		MaxChoices:             maxChoices,
+		MaxVotesPerFingerprint: maxVotes,
+		AllowCustom:            allowCustom,
+		RequireCaptcha:         requireCaptcha,
+		StartAt:                startAt,
+		EndAt:                  endAt,
+		QuotaLimit:             int(quotaLimit),
+	}
+	if isEdit {
+		vote.ID = voteID
+	}
+
+	ctx.Data["Title"] = "新建投票"
+	if isEdit {
+		ctx.Data["Title"] = "编辑投票"
+	}
+	ctx.Data["IsEdit"] = isEdit
+	ctx.Data["Vote"] = vote
+	ctx.Data["LockedContent"] = false
+	ctx.Data["InitialOptions"] = initialOptions
+	ctx.Data["InitialFields"] = initialFields
+	if startAt != nil {
+		ctx.Data["StartAtStr"] = startAt.Format("2006-01-02T15:04")
+	}
+	if endAt != nil {
+		ctx.Data["EndAtStr"] = endAt.Format("2006-01-02T15:04")
+	}
+
+	// 同请求错误提示：直接写入 c.Data（见函数注释，不能用 session flash）
+	if internal {
+		ctx.Data["HasError"] = true
+		ctx.Data["Error"] = "服务内部错误，请稍后重试。"
+		span := trace.SpanFromContext(ctx.Request().Context())
+		ctx.Data["FlashTip"] = fmt.Sprintf("若问题一直出现，请带上该段字符 %s 提交反馈。", span.SpanContext().TraceID().String())
+	} else if flashMsg != "" {
+		ctx.Data["HasError"] = true
+		ctx.Data["Error"] = flashMsg
+	}
+
+	ctx.Success("user/vote-form")
+}
+
+// VoteCreate 创建投票（默认草稿状态）。
+// 草稿保存放宽校验并跳过内容审核（见 parseVoteForm/parseVoteMeta）；任何错误均回填表单而非清空输入。
+// action=publish 时：先按草稿保存，再执行发布校验（结构 + 审核），通过则直接发布；失败则保留草稿并停留在编辑页，避免重复创建。
+func VoteCreate(ctx context.Context) {
+	action := strings.TrimSpace(ctx.Request().FormValue("action"))
+
+	form, err := parseVoteForm(ctx, true)
+	if err != nil {
+		renderVoteFormWithInput(ctx, false, 0, err.Error(), false)
+		return
+	}
+	form.opts.CensorMetadata = form.censorMetadata
+
+	vote, err := db.Votes.Create(ctx.Request().Context(), form.opts)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to create vote")
+		renderVoteFormWithInput(ctx, false, 0, "", true)
+		return
+	}
+
+	if len(form.options) > 0 {
+		if _, err := db.VoteOptions.BulkCreate(ctx.Request().Context(), vote.ID, form.options); err != nil {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to create vote options")
+			_ = db.Votes.DeleteByID(ctx.Request().Context(), vote.ID) // 回滚本次已建的空草稿，避免孤儿记录
+			renderVoteFormWithInput(ctx, false, 0, "", true)
+			return
+		}
+	}
+	if len(form.formFields) > 0 {
+		for i := range form.formFields {
+			form.formFields[i].VoteID = vote.ID
+		}
+		if _, err := db.VoteFormFields.BulkCreate(ctx.Request().Context(), vote.ID, form.formFields); err != nil {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to create vote form fields")
+			_ = db.Votes.DeleteByID(ctx.Request().Context(), vote.ID) // 回滚本次已建的空草稿，避免孤儿记录
+			renderVoteFormWithInput(ctx, false, 0, "", true)
+			return
+		}
+	}
+
+	editURL := "/user/votes/" + fmt.Sprint(vote.ID) + "/edit"
+
+	// action=publish：已保存为草稿，再做发布校验；失败则保留草稿并停留在编辑页，避免重复创建
+	if action == "publish" {
+		if err := validateForPublish(ctx, vote); err != nil {
+			ctx.SetErrorFlash(err.Error())
+			ctx.Redirect(editURL)
+			return
+		}
+		if err := db.Votes.UpdateStatus(ctx.Request().Context(), vote.ID, db.VoteStatusPublished); err != nil {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to publish vote")
+			ctx.SetInternalErrorFlash()
+			ctx.Redirect(editURL)
+			return
+		}
+		shareURL := fmt.Sprintf("%s/vote/%s", strings.TrimRight(conf.App.ExternalURL, "/"), vote.LinkToken)
+		ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "vote.flash.published", shareURL))
+		ctx.Redirect("/user/questions#votes")
+		return
+	}
+
+	// 草稿保存成功：停留在编辑页，使用页面 toast 提示，避免 success flash 与 toast 重复展示。
+	ctx.Redirect(editURL + "?saved=1")
+}
+
+// VoteEdit 编辑投票页面（预填选项与表单字段）。
+func VoteEdit(ctx context.Context) {
+	vote, err := getOwnedVote(ctx, ctx.Param("voteID"))
+	if err != nil {
+		ctx.SetErrorFlash(err.Error())
+		ctx.Redirect("/user/questions#votes")
+		return
+	}
+
+	ctx.Data["Vote"] = vote
+	ctx.Data["IsEdit"] = true
+	ctx.Data["MaxVoteOptionLen"] = conf.Limits.VoteOptionLen // 选项输入框 maxlength 同源（vote-form.html JS）
+	ctx.Data["Title"] = "编辑投票"
+	// 草稿保存成功仅通过本次 URL 参数驱动统一 alert，不使用 session flash。
+	if ctx.Query("saved") == "1" {
+		ctx.Data["Success"] = i18n.T(ctx.Lang(), "vote.flash.draftSaved")
+		ctx.Data["DraftSaved"] = true
+	}
+	// 发布后的投票锁定类型与选项/字段（避免破坏历史投票数据归因），仅可编辑元信息
+	ctx.Data["LockedContent"] = vote.Status == db.VoteStatusPublished
+
+	// 选项 / 表单字段回填：传结构化数据，模板经 toJSON（template.JS）注入 <script>，
+	// 避免 template.HTML 在 script 上下文中被 html/template JS 转义导致初始化失效。
+	// 发布后的投票编辑器被锁定，回填数据不展示但保持 JS 初始化安全（非空数组）。
+	options, _ := db.VoteOptions.ListByVoteID(ctx.Request().Context(), vote.ID)
+	ctx.Data["InitialOptions"] = optionsContent(options)
+
+	fields, _ := db.VoteFormFields.ListByVoteID(ctx.Request().Context(), vote.ID)
+	ctx.Data["InitialFields"] = fieldsContent(fields)
+
+	// 时间回填：Go 模板直接输出 time.Time 不符合 datetime-local 格式，预先格式化
+	if vote.StartAt != nil {
+		ctx.Data["StartAtStr"] = vote.StartAt.Format("2006-01-02T15:04")
+	}
+	if vote.EndAt != nil {
+		ctx.Data["EndAtStr"] = vote.EndAt.Format("2006-01-02T15:04")
+	}
+
+	ctx.Success("user/vote-form")
+}
+
+// optionsContent 提取选项内容数组（模板回填用）。
+func optionsContent(options []*db.VoteOption) []string {
+	out := make([]string, 0, len(options))
+	for _, o := range options {
+		out = append(out, o.Content)
+	}
+	return out
+}
+
+// fieldsContent 提取表单字段数组（模板回填用）。
+func fieldsContent(fields []*db.VoteFormField) []voteFormFieldInput {
+	out := make([]voteFormFieldInput, 0, len(fields))
+	for _, f := range fields {
+		out = append(out, voteFormFieldInput{
+			FieldType:   f.FieldType,
+			Label:       f.Label,
+			Required:    f.Required,
+			MaxLength:   f.MaxLength,
+			Options:     parseJSONStringArray(f.Options),
+			AllowCustom: f.AllowCustom,
+		})
+	}
+	return out
+}
+
+// parseJSONStringArray 解析 JSON 字符串数组，失败返回空数组。
+func parseJSONStringArray(raw string) []string {
+	var out []string
+	if raw == "" {
+		return out
+	}
+	if err := json.Unmarshal([]byte(raw), &out); err != nil {
+		return []string{}
+	}
+	return out
+}
+
+// splitOptionTokens 将单条选项文本按英文逗号、中文逗号、顿号或换行拆分为多条，
+// 兼容用户误用中文逗号/顿号输入的情况；逐项去空格并丢弃空串。
+func splitOptionTokens(s string) []string {
+	parts := strings.FieldsFunc(s, func(r rune) bool {
+		return r == ',' || r == '，' || r == '、' || r == '\n' || r == '\r'
+	})
+	out := make([]string, 0, len(parts))
+	for _, p := range parts {
+		if p = strings.TrimSpace(p); p != "" {
+			out = append(out, p)
+		}
+	}
+	return out
+}
+
+// VoteUpdate 更新投票。
+// 状态分级（方案 A）：草稿可完整编辑（含事务重建选项/字段）；进行中仅可编辑元信息
+// （类型与选项/字段锁定，避免破坏历史投票数据归因）；已结束/归档完全禁止。
+func VoteUpdate(ctx context.Context) {
+	vote, err := getOwnedVote(ctx, ctx.Param("voteID"))
+	if err != nil {
+		ctx.SetErrorFlash(err.Error())
+		ctx.Redirect("/user/questions#votes")
+		return
+	}
+	// 已结束/归档的投票不允许编辑
+	if vote.Status == db.VoteStatusEnded || vote.Status == db.VoteStatusArchived {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "vote.err.editClosed"))
+		ctx.Redirect("/user/questions#votes")
+		return
+	}
+
+	// 进行中：仅解析元信息（标题/描述/可见性/范围/结果策略/时间窗/防刷/验证码）
+	if vote.Status == db.VoteStatusPublished {
+		form, err := parseVoteMetaForm(ctx)
+		if err != nil {
+			ctx.SetErrorFlash(err.Error())
+			ctx.Redirect("/user/votes/" + fmt.Sprint(vote.ID) + "/edit")
+			return
+		}
+		if err := db.Votes.Update(ctx.Request().Context(), vote.ID, db.UpdateVoteOptions{
+			Title:       form.opts.Title,
+			Description: form.opts.Description,
+			// 发布后类型/选项不可改（见 parseVoteMetaForm 注释）。db.Votes.Update 对 nil 指针字段
+			// 跳过写入，故此处不传 Type/MaxChoices 即保留原值；即便将来新增更新调用漏传，也不会
+			// 再把 type 写成 ""。选项本身由 ReplaceByVoteID 托管，本分支不触碰。
+			Visibility:             form.opts.Visibility,
+			VoterScope:             form.opts.VoterScope,
+			ShowResult:             form.opts.ShowResult,
+			AllowCustom:            form.opts.AllowCustom,
+			StartAt:                form.opts.StartAt,
+			EndAt:                  form.opts.EndAt,
+			MaxVotesPerFingerprint: form.opts.MaxVotesPerFingerprint,
+			RequireCaptcha:         form.opts.RequireCaptcha,
+			CensorMetadata:         form.censorMetadata,
+			QuotaLimit:             form.opts.QuotaLimit,
+		}); err != nil {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to update vote meta")
+			ctx.SetInternalErrorFlash()
+			ctx.Redirect("/user/votes/" + fmt.Sprint(vote.ID) + "/edit")
+			return
+		}
+		ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "vote.flash.updated"))
+		ctx.Redirect("/user/questions#votes")
+		return
+	}
+
+	// 草稿：完整编辑（含选项/字段事务重建）；草稿放宽校验，错误时回填表单不丢输入
+	form, err := parseVoteForm(ctx, true)
+	if err != nil {
+		renderVoteFormWithInput(ctx, true, vote.ID, err.Error(), false)
+		return
+	}
+
+	if err := db.Votes.Update(ctx.Request().Context(), vote.ID, db.UpdateVoteOptions{
+		Title:                  form.opts.Title,
+		Description:            form.opts.Description,
+		Type:                   &form.opts.Type,
+		Visibility:             form.opts.Visibility,
+		VoterScope:             form.opts.VoterScope,
+		ShowResult:             form.opts.ShowResult,
+		AllowCustom:            form.opts.AllowCustom,
+		MaxChoices:             &form.opts.MaxChoices,
+		StartAt:                form.opts.StartAt,
+		EndAt:                  form.opts.EndAt,
+		MaxVotesPerFingerprint: form.opts.MaxVotesPerFingerprint,
+		RequireCaptcha:         form.opts.RequireCaptcha,
+		CensorMetadata:         form.censorMetadata,
+		QuotaLimit:             form.opts.QuotaLimit,
+	}); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to update vote")
+		renderVoteFormWithInput(ctx, true, vote.ID, "", true)
+		return
+	}
+
+	// 事务重建选项与表单字段（草稿阶段无历史数据，删除重建安全）
+	if err := db.VoteOptions.ReplaceByVoteID(ctx.Request().Context(), vote.ID, form.options); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to replace vote options")
+		renderVoteFormWithInput(ctx, true, vote.ID, i18n.T(ctx.Lang(), "vote.err.optionUpdateFailed"), false)
+		return
+	}
+	for i := range form.formFields {
+		form.formFields[i].VoteID = vote.ID
+	}
+	if err := db.VoteFormFields.ReplaceByVoteID(ctx.Request().Context(), vote.ID, form.formFields); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to replace vote form fields")
+		renderVoteFormWithInput(ctx, true, vote.ID, i18n.T(ctx.Lang(), "vote.err.fieldUpdateFailed"), false)
+		return
+	}
+
+	// 选项/字段已重建，结果聚合可能变化：主动失效该投票的结果缓存。
+	votepkg.InvalidateResultsCache(vote.ID)
+
+	action := strings.TrimSpace(ctx.Request().FormValue("action"))
+	editURL := "/user/votes/" + fmt.Sprint(vote.ID) + "/edit"
+
+	// action=preview：草稿已保存，跳转到预览页。
+	// 预览仅对草稿有意义（发布态由 VotePreview 内部直接跳转真实参与页）；
+	// 此处草稿保存已先完成，可安全预览最新编辑内容。
+	if action == "preview" {
+		ctx.Redirect("/user/votes/" + fmt.Sprint(vote.ID) + "/preview")
+		return
+	}
+
+	// action=publish：已保存为草稿，再执行发布校验；失败则保留草稿并停留在编辑页
+	if action == "publish" {
+		// 用刚保存的内容刷新 vote 结构，供审核与结构校验读取最新标题/类型
+		vote.Title = form.opts.Title
+		vote.Description = form.opts.Description
+		vote.Type = form.opts.Type
+		if err := validateForPublish(ctx, vote); err != nil {
+			ctx.SetErrorFlash(err.Error())
+			ctx.Redirect(editURL)
+			return
+		}
+		if err := db.Votes.UpdateStatus(ctx.Request().Context(), vote.ID, db.VoteStatusPublished); err != nil {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to publish vote")
+			ctx.SetInternalErrorFlash()
+			ctx.Redirect(editURL)
+			return
+		}
+		shareURL := fmt.Sprintf("%s/vote/%s", strings.TrimRight(conf.App.ExternalURL, "/"), vote.LinkToken)
+		ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "vote.flash.published", shareURL))
+		ctx.Redirect("/user/questions#votes")
+		return
+	}
+
+	// 草稿保存成功：停留在编辑页，使用页面 toast 提示，避免 success flash 与 toast 重复展示。
+	ctx.Redirect(editURL + "?saved=1")
+}
+
+// VotePublish 发布投票（draft → published）。
+// 草稿保存阶段已跳过内容审核，发布（对外公开）前在此统一执行结构校验 + fail-closed 内容审核，
+// 确保公开内容仍受管控；校验通过后再发布。
+func VotePublish(ctx context.Context) {
+	vote, err := getOwnedVote(ctx, ctx.Param("voteID"))
+	if err != nil {
+		ctx.SetErrorFlash(err.Error())
+		ctx.Redirect("/user/questions#votes")
+		return
+	}
+	if vote.Status != db.VoteStatusDraft {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "vote.err.publishDraftOnly"))
+		ctx.Redirect("/user/questions#votes")
+		return
+	}
+
+	if err := validateForPublish(ctx, vote); err != nil {
+		ctx.SetErrorFlash(err.Error())
+		ctx.Redirect("/user/questions#votes")
+		return
+	}
+
+	if err := db.Votes.UpdateStatus(ctx.Request().Context(), vote.ID, db.VoteStatusPublished); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to publish vote")
+		ctx.SetInternalErrorFlash()
+		ctx.Redirect("/user/questions#votes")
+		return
+	}
+
+	shareURL := fmt.Sprintf("%s/vote/%s", strings.TrimRight(conf.App.ExternalURL, "/"), vote.LinkToken)
+	ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "vote.flash.published", shareURL))
+	ctx.Redirect("/user/questions#votes")
+}
+
+// validateForPublish 发布前的完整校验：结构合法性（标题/选项数/字段数/排序题选项数）+ 内容审核（fail-closed）。
+// 草稿保存已放宽校验，发布时统一补齐，确保对外公开的投票结构合法且内容合规。
+func validateForPublish(ctx context.Context, vote *db.Vote) error {
+	if strings.TrimSpace(vote.Title) == "" {
+		return errors.New(i18n.T(ctx.Lang(), "vote.err.publishTitleRequired"))
+	}
+	if vote.Type == db.VoteTypeForm {
+		count, err := db.VoteFormFields.CountByVoteID(ctx.Request().Context(), vote.ID)
+		if err != nil || count < 1 {
+			return errors.New(i18n.T(ctx.Lang(), "vote.err.publishFormFieldsRequired"))
+		}
+		fields, _ := db.VoteFormFields.ListByVoteID(ctx.Request().Context(), vote.ID)
+		for i, f := range fields {
+			if f.FieldType == db.VoteFormFieldTypeRank {
+				if len(parseJSONStringArray(f.Options)) < 2 {
+					return errors.New(i18n.T(ctx.Lang(), "vote.err.fieldRankTooFew", i+1, f.Label))
+				}
+			}
+		}
+	} else if vote.Type != db.VoteTypeRating {
+		count, err := db.VoteOptions.CountByVoteID(ctx.Request().Context(), vote.ID)
+		if err != nil || count < 2 {
+			return errors.New(i18n.T(ctx.Lang(), "vote.err.publishOptionsRequired"))
+		}
+	}
+	if err := censorVoteForPublish(ctx, vote); err != nil {
+		return err
+	}
+	return nil
+}
+
+// censorVoteForPublish 发布前对投票全部可见文本做内容审核（fail-closed）。
+// 草稿保存阶段跳过了审核，发布（对外公开）时必须补齐，确保公开内容受管控。
+func censorVoteForPublish(ctx context.Context, vote *db.Vote) error {
+	if vote.Title != "" {
+		resp, err := censor.Text(ctx.Request().Context(), vote.Title)
+		if err != nil {
+			return errors.New(i18n.T(ctx.Lang(), "censor.unavailable"))
+		}
+		if !resp.Pass {
+			return errors.New(resp.ErrorMessage())
+		}
+	}
+	if vote.Description != "" {
+		if err := censorCheck(ctx, vote.Description); err != nil {
+			return err
+		}
+	}
+	options, _ := db.VoteOptions.ListByVoteID(ctx.Request().Context(), vote.ID)
+	for _, o := range options {
+		if err := censorCheck(ctx, o.Content); err != nil {
+			return err
+		}
+	}
+	fields, _ := db.VoteFormFields.ListByVoteID(ctx.Request().Context(), vote.ID)
+	for _, f := range fields {
+		if err := censorCheck(ctx, f.Label); err != nil {
+			return err
+		}
+		// 预置选项（select/radio/checkbox/rank）也纳入审核
+		for _, fo := range parseJSONStringArray(f.Options) {
+			if fo == "" {
+				continue
+			}
+			if err := censorCheck(ctx, fo); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+func VoteClose(ctx context.Context) {
+	vote, err := getOwnedVote(ctx, ctx.Param("voteID"))
+	if err != nil {
+		ctx.SetErrorFlash(err.Error())
+		ctx.Redirect("/user/questions#votes")
+		return
+	}
+	if vote.Status != db.VoteStatusPublished {
+		ctx.SetErrorFlash(i18n.T(ctx.Lang(), "vote.err.closePublishedOnly"))
+		ctx.Redirect("/user/questions#votes")
+		return
+	}
+	if err := db.Votes.UpdateStatus(ctx.Request().Context(), vote.ID, db.VoteStatusEnded); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to close vote")
+		ctx.SetInternalErrorFlash()
+		ctx.Redirect("/user/questions#votes")
+		return
+	}
+	ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "vote.flash.closed"))
+	ctx.Redirect("/user/questions#votes")
+}
+
+// VoteDelete 删除投票（级联删除选项、表单字段与提交记录）。
+func VoteDelete(ctx context.Context) {
+	vote, err := getOwnedVote(ctx, ctx.Param("voteID"))
+	if err != nil {
+		ctx.SetErrorFlash(err.Error())
+		ctx.Redirect("/user/questions#votes")
+		return
+	}
+
+	if err := db.VoteOptions.DeleteByVoteID(ctx.Request().Context(), vote.ID); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to delete vote options")
+	}
+	if err := db.VoteFormFields.DeleteByVoteID(ctx.Request().Context(), vote.ID); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to delete vote form fields")
+	}
+	if err := db.VoteSubmissions.DeleteByVoteID(ctx.Request().Context(), vote.ID); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to delete vote submissions")
+	}
+	// 投票已删除：失效其结果缓存（即便竞态下仍能命中也已无意义）。
+	votepkg.InvalidateResultsCache(vote.ID)
+	if err := db.Votes.DeleteByID(ctx.Request().Context(), vote.ID); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to delete vote")
+		ctx.SetInternalErrorFlash()
+		ctx.Redirect("/user/questions#votes")
+		return
+	}
+
+	ctx.SetSuccessFlash(i18n.T(ctx.Lang(), "vote.flash.deleted"))
+	ctx.Redirect("/user/questions#votes")
+}
+
+// textReplyView 文本类字段单条提交内容的展示视图（按字段归类，内联在题目下方折叠展示）。
+type textReplyView struct {
+	CreatedAt time.Time
+	Text      string
+}
+
+// VotePreview 草稿预览：箱主在发布前查看参与页面样例（提交禁用）。
+// 仅草稿状态可预览；发布后直接跳真实参与页。
+func VotePreview(ctx context.Context) {
+	vote, err := getOwnedVote(ctx, ctx.Param("voteID"))
+	if err != nil {
+		ctx.SetErrorFlash(err.Error())
+		ctx.Redirect("/user/questions#votes")
+		return
+	}
+	if vote.Status != db.VoteStatusDraft {
+		ctx.Redirect("/vote/" + vote.LinkToken)
+		return
+	}
+
+	ctx.Data["Vote"] = vote
+	ctx.Data["IsOwner"] = true
+	ctx.Data["PreviewMode"] = true
+	ctx.Data["NotStarted"] = false
+	ctx.Data["Ended"] = false
+	ctx.Data["VoteScopeRegisteredOnly"] = vote.VoterScope == db.VoteVoterScopeRegisteredOnly
+	ctx.Data["IsLogged"] = true // 预览按登录态渲染，避免登录提示干扰样例
+
+	owner, err := db.Users.GetByID(ctx.Request().Context(), vote.UserID)
+	if err == nil {
+		ctx.Data["Owner"] = owner
+	}
+
+	if vote.Type == db.VoteTypeForm {
+		fields, _ := db.VoteFormFields.ListByVoteID(ctx.Request().Context(), vote.ID)
+		ctx.Data["FormFields"] = fields
+	} else if vote.Type != db.VoteTypeRating {
+		options, _ := db.VoteOptions.ListByVoteID(ctx.Request().Context(), vote.ID)
+		ctx.Data["Options"] = options
+	}
+	// "其他/自定义选项"保留标记（与参与端 Page 一致）
+	ctx.Data["CustomFieldMarker"] = db.CustomFieldMarker
+
+	ctx.Data["HasVoted"] = false
+	ctx.Data["CanVote"] = true
+	ctx.Data["ShowResults"] = false
+	ctx.Data["Title"] = "预览：" + vote.Title
+	ctx.Success("vote/page")
+}
+
+// VoteResults 投票结果页：选项型（单选/多选/评分/排序）走统一聚合统计，
+// 表单类型展示回复明细（仅箱主可见）。
+func VoteResults(ctx context.Context) {
+	vote, err := getOwnedVote(ctx, ctx.Param("voteID"))
+	if err != nil {
+		ctx.SetErrorFlash(err.Error())
+		ctx.Redirect("/user/questions#votes")
+		return
+	}
+
+	total, err := db.VoteSubmissions.CountByVoteID(ctx.Request().Context(), vote.ID)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to count submissions")
+		total = 0
+	}
+
+	var formFields []*db.VoteFormField
+	// 文本类字段的逐条提交内容按"字段标签"归类，内联在题目下方折叠展示；
+	// 选择/评分/排序字段已在上方聚合统计，无需逐条展示。
+	textReplies := map[string][]textReplyView{}
+	// 所有类型统一走 LoadResults：选项型拿统计；表单型拿 FormFieldStats（字段级聚合）
+	results, err := votepkg.LoadResults(ctx, vote)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to load vote results")
+	}
+
+	if vote.Type == db.VoteTypeForm {
+		formFields, _ = db.VoteFormFields.ListByVoteID(ctx.Request().Context(), vote.ID)
+		// 短 TTL 缓存回复明细解析结果（逐条 json.Unmarshal 全部提交记录的 O(N) 开销）。
+		replyKey := strconv.FormatUint(uint64(vote.ID), 10)
+		if cached, ok := voteTextRepliesCache.Get(replyKey); ok {
+			textReplies = cached.(map[string][]textReplyView)
+		} else {
+			submissions, _ := db.VoteSubmissions.ListByVoteID(ctx.Request().Context(), vote.ID, nil)
+			for _, s := range submissions {
+				var data map[string]interface{}
+				if len(s.FormData) > 0 {
+					_ = json.Unmarshal(s.FormData, &data)
+				}
+				for _, f := range formFields {
+					if f.FieldType == db.VoteFormFieldTypeText || f.FieldType == db.VoteFormFieldTypeTextarea {
+						if val, ok := data[f.Label].(string); ok && strings.TrimSpace(val) != "" {
+							textReplies[f.Label] = append(textReplies[f.Label], textReplyView{CreatedAt: s.CreatedAt, Text: val})
+						}
+					}
+				}
+			}
+			voteTextRepliesCache.Set(replyKey, textReplies, voteTextRepliesCacheTTL)
+		}
+	}
+
+	ctx.Data["Vote"] = vote
+	ctx.Data["Total"] = total
+	ctx.Data["Results"] = results
+	ctx.Data["FormFields"] = formFields
+	ctx.Data["TextReplies"] = textReplies
+	ctx.Data["Title"] = "投票结果"
+	ctx.Success("user/vote-results")
+}
+
+// sanitizeCSVCell 防止 CSV 公式注入：单元格内容以 = + - @ 等开头时，
+// Excel/Numbers 会将其解析为公式执行（参与者可在文本字段注入恶意公式）。
+// 前置单引号强制按纯文本处理。
+func sanitizeCSVCell(s string) string {
+	if s == "" {
+		return s
+	}
+	r := []rune(s)[0]
+	if r == '=' || r == '+' || r == '-' || r == '@' {
+		return "'" + s
+	}
+	return s
+}
+
+// formatFieldValue 将表单字段值格式化为可读文本（CSV 导出用）：
+// 多选数组 → "A、B"；排序 map → "首选:1；次选:2"（按键排序保证稳定）；其余原样。
+func formatFieldValue(v interface{}) string {
+	switch val := v.(type) {
+	case []interface{}:
+		parts := make([]string, 0, len(val))
+		for _, x := range val {
+			parts = append(parts, fmt.Sprint(x))
+		}
+		return strings.Join(parts, "、")
+	case map[string]interface{}:
+		keys := make([]string, 0, len(val))
+		for k := range val {
+			keys = append(keys, k)
+		}
+		sort.Strings(keys)
+		parts := make([]string, 0, len(keys))
+		for _, k := range keys {
+			parts = append(parts, fmt.Sprintf("%s:%v", k, val[k]))
+		}
+		return strings.Join(parts, "；")
+	default:
+		return fmt.Sprint(v)
+	}
+}
+
+// VoteExportCSV 导出投票结果 CSV：
+//   - 选项型（单选/多选/评分/排序）：每选项一行（内容 + 票数/均值），末行总参与；
+//   - 表单型：每行一条回复（提交时间 + 各字段列）。
+//
+// 前置 UTF-8 BOM，保证 Excel 打开中文不乱码。
+func VoteExportCSV(ctx context.Context) {
+	vote, err := getOwnedVote(ctx, ctx.Param("voteID"))
+	if err != nil {
+		ctx.SetErrorFlash(err.Error())
+		ctx.Redirect("/user/questions#votes")
+		return
+	}
+
+	var buf strings.Builder
+	buf.WriteString("\xef\xbb\xbf") // UTF-8 BOM
+	w := csv.NewWriter(&buf)
+
+	if vote.Type == db.VoteTypeForm {
+		fields, _ := db.VoteFormFields.ListByVoteID(ctx.Request().Context(), vote.ID)
+		header := []string{"提交时间"}
+		for _, f := range fields {
+			header = append(header, f.Label)
+		}
+		_ = w.Write(header)
+
+		submissions, _ := db.VoteSubmissions.ListByVoteID(ctx.Request().Context(), vote.ID, nil)
+		for _, s := range submissions {
+			var data map[string]interface{}
+			_ = json.Unmarshal(s.FormData, &data)
+			row := []string{s.CreatedAt.Format("2006-01-02 15:04:05")}
+			for _, f := range fields {
+				row = append(row, sanitizeCSVCell(formatFieldValue(data[f.Label])))
+			}
+			_ = w.Write(row)
+		}
+	} else {
+		res, err := votepkg.LoadResults(ctx, vote)
+		if err != nil {
+			ctx.SetInternalErrorFlash()
+			ctx.Redirect("/user/questions#votes")
+			return
+		}
+		_ = w.Write([]string{"选项", "票数"})
+		switch res.Type {
+		case db.VoteTypeSingle, db.VoteTypeMultiple:
+			for _, o := range res.Options {
+				_ = w.Write([]string{o.Option.Content, strconv.FormatInt(o.Count, 10)})
+			}
+		case db.VoteTypeRating:
+			for _, r := range res.Ratings {
+				_ = w.Write([]string{fmt.Sprintf("%d 分", r.Score), strconv.FormatInt(r.Count, 10)})
+			}
+			_ = w.Write([]string{"平均分", fmt.Sprintf("%.2f", res.AvgRating)})
+		case db.VoteTypeRank:
+			for _, r := range res.Rankings {
+				_ = w.Write([]string{r.Option.Content, fmt.Sprintf("%.2f", r.AvgRank)})
+			}
+			_ = w.Write([]string{"平均排名", fmt.Sprintf("%.2f", res.AvgRank)})
+		}
+		// 自定义补充选项（开启 AllowCustom 时）
+		if len(res.CustomStats) > 0 {
+			_ = w.Write([]string{"自定义补充", "次数"})
+			for _, c := range res.CustomStats {
+				_ = w.Write([]string{sanitizeCSVCell(c.Text), strconv.FormatInt(c.Count, 10)})
+			}
+		}
+		_ = w.Write([]string{"总参与", strconv.FormatInt(res.Total, 10)})
+	}
+
+	w.Flush()
+
+	ctx.ResponseWriter().Header().Set("Content-Type", "text/csv; charset=utf-8")
+	ctx.ResponseWriter().Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename="vote_%d.csv"`, vote.ID))
+	ctx.ResponseWriter().Header().Set("X-Content-Type-Options", "nosniff")
+	ctx.ResponseWriter().WriteHeader(http.StatusOK)
+	_, _ = ctx.ResponseWriter().Write([]byte(buf.String()))
+}
diff --git a/route/vote/vote.go b/route/vote/vote.go
new file mode 100644
index 0000000..b187b93
--- /dev/null
+++ b/route/vote/vote.go
@@ -0,0 +1,1128 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package vote
+
+import (
+	stdctx "context"
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/flamego/recaptcha"
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+	"gorm.io/datatypes"
+
+	"github.com/tamakyi/TamaBox/internal/cache"
+	"github.com/tamakyi/TamaBox/internal/captcha"
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/context"
+	"github.com/tamakyi/TamaBox/internal/db"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+	"github.com/tamakyi/TamaBox/internal/mail"
+	"github.com/tamakyi/TamaBox/internal/security/censor"
+	"github.com/tamakyi/TamaBox/internal/shared"
+)
+
+// ctxLang 取当前请求已解析好的语言代码（由 Contexter 写入 Data）。
+func ctxLang(ctx context.Context) string {
+	if l, ok := ctx.Data["LangCode"].(string); ok && l != "" {
+		return l
+	}
+	return i18n.Default
+}
+
+// resultsCache 投票结果聚合统计的短 TTL 进程内缓存。
+// 结果统计需在 Go 层逐条 json.Unmarshal 全部提交记录（O(N)），缓存可显著降低数据库实时重算与 CPU 开销；
+// 结果页非强一致，30s 陈旧可接受（新提交最多延迟 30s 反映）。多实例部署时各实例独立缓存，不影响正确性。
+var resultsCache = cache.NewTTLCache(256)
+
+// resultsCacheTTL 结果缓存有效期。
+const resultsCacheTTL = 30 * time.Second
+
+// InvalidateResultsCache 主动失效某投票的结果聚合缓存（写穿式）。
+// 投票提交、选项/字段变更、投票删除等会改变结果的操作都应调用，
+// 避免结果页在 TTL 内显示陈旧数据（多实例部署下各实例独立失效自身缓存）。
+func InvalidateResultsCache(voteID uint) {
+	resultsCache.Delete(strconv.FormatUint(uint64(voteID), 10))
+}
+
+// censorCheck 对开放文本做内容审核（fail-closed；EnableTextCensor=false 时自动放行）。
+func censorCheck(ctx context.Context, lang, text string) error {
+	resp, err := censor.Text(ctx.Request().Context(), text)
+	if err != nil {
+		return errors.New(i18n.T(lang, "censor.unavailable"))
+	}
+	if !resp.Pass {
+		return errors.New(resp.ErrorMessage())
+	}
+	return nil
+}
+
+// blockWordCheck 校验开放文本是否命中投票发起人的全局屏蔽词表
+// （users.block_words，与提问/私聊共用同一份词表，owner 为投票发起人）。
+// 命中即返回提示，供调用方以表单错误形式中断提交。
+func blockWordCheck(owner *db.User, lang, text string) error {
+	if owner == nil {
+		return nil
+	}
+	if _, hit := shared.BlockWordHit(owner.BlockWords, text); hit {
+		return errors.New(i18n.T(lang, "vote.err.blockWords"))
+	}
+	return nil
+}
+
+// voterCookieName 匿名投票指纹 Cookie（服务端签发，防伪造；HttpOnly 防脚本读取）。
+const voterCookieName = "vote_fp"
+
+// voterTokenSecret 使用启动时强制配置的 XSRF key 作为 Cookie 签名密钥。
+// Cookie 本身仍不是强身份凭证，匿名提交同时受 IP 限流保护。
+func voterTokenSecret() []byte {
+	return []byte(conf.Server.XSRFKey)
+}
+
+func signVoterToken(nonce string) string {
+	mac := hmac.New(sha256.New, voterTokenSecret())
+	_, _ = mac.Write([]byte(nonce))
+	return base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
+}
+
+// newVoterToken 生成带 HMAC 的匿名指纹 token。
+func newVoterToken() string {
+	b := make([]byte, 32)
+	if _, err := rand.Read(b); err != nil {
+		// crypto/rand 失败时使用时间戳摘要兜底，保持固定 token 格式；提交端的 IP 限流仍生效。
+		fallback := sha256.Sum256([]byte(fmt.Sprintf("%d", time.Now().UnixNano())))
+		copy(b, fallback[:])
+	}
+	nonce := hex.EncodeToString(b)
+	return nonce + "." + signVoterToken(nonce)
+}
+
+func validVoterToken(token string) bool {
+	parts := strings.Split(token, ".")
+	if len(parts) != 2 || len(parts[0]) != 64 || len(parts[1]) == 0 {
+		return false
+	}
+	if _, err := hex.DecodeString(parts[0]); err != nil {
+		return false
+	}
+	expected := signVoterToken(parts[0])
+	return hmac.Equal([]byte(parts[1]), []byte(expected))
+}
+
+// ensureVoterToken 读取或签发匿名指纹 Cookie；无效/伪造值会被覆盖。
+func ensureVoterToken(ctx context.Context) string {
+	if c, err := ctx.Request().Cookie(voterCookieName); err == nil && validVoterToken(c.Value) {
+		return c.Value
+	}
+	token := newVoterToken()
+	http.SetCookie(ctx.ResponseWriter(), &http.Cookie{
+		Name:     voterCookieName,
+		Value:    token,
+		Path:     "/",
+		MaxAge:   30 * 24 * 3600,
+		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
+	})
+	return token
+}
+
+// currentVoterToken 仅返回服务端签发且签名有效的 Cookie。
+func currentVoterToken(ctx context.Context) string {
+	if c, err := ctx.Request().Cookie(voterCookieName); err == nil && validVoterToken(c.Value) {
+		return c.Value
+	}
+	return ""
+}
+
+// VoterTokenRateLimitKey 返回有效匿名 token 的限流标识。
+// 无效或缺失的 Cookie 返回空串，由调用方回退到 IP 兜底限流。
+func VoterTokenRateLimitKey(r *http.Request) string {
+	if r == nil {
+		return ""
+	}
+	c, err := r.Cookie(voterCookieName)
+	if err != nil || !validVoterToken(c.Value) {
+		return ""
+	}
+	return c.Value
+}
+
+// ---------------- 状态与结果策略 ----------------
+
+func isVoteActive(v *db.Vote, now time.Time) bool {
+	if v.Status != db.VoteStatusPublished {
+		return false
+	}
+	if v.StartAt != nil && now.Before(*v.StartAt) {
+		return false
+	}
+	if v.EndAt != nil && !now.Before(*v.EndAt) {
+		return false
+	}
+	return true
+}
+
+func isVoteEnded(v *db.Vote, now time.Time) bool {
+	if v.Status == db.VoteStatusEnded {
+		return true
+	}
+	return v.EndAt != nil && !now.Before(*v.EndAt)
+}
+
+// ---------------- 结果统计 ----------------
+
+type OptionStat struct {
+	Option  *db.VoteOption
+	Count   int64
+	Percent int
+	AvgRank float64 // rank 题型：该选项的平均排名
+}
+
+type RatingStat struct {
+	Score int
+	Count int64
+}
+
+type RankStat struct {
+	Option  *db.VoteOption
+	AvgRank float64
+}
+
+// CustomStat 自定义补充选项统计（AllowCustom 时参与者填写的自由文本）。
+type CustomStat struct {
+	Text  string
+	Count int64
+}
+
+// FormFieldStat 表单投票（混合问卷）中单个字段的聚合统计。
+type FormFieldStat struct {
+	Field           *db.VoteFormField
+	Total           int64         // 有效回答数（参与该字段的人数）
+	TotalSelections int64         // 多选(checkbox)总勾选数，作为百分比分母；单选/评分/排序恒为 0
+	OptionStats     []*OptionStat // radio/select/checkbox 选项票数；rank 为"被排次数"
+	CustomStats     []CustomStat  // 允许补充自定义选项的字段：自定义文本（按文本去重计数）
+	AvgRating       float64       // rating 平均分
+	RatingCounts    []*RatingStat // rating 分布（1-10）
+	AvgRank         float64       // rank 全部选项的平均排名
+	AvgNumber       float64       // number 平均值
+	TextCount       int64         // text/textarea 填写数（内容不展示，保护隐私）
+}
+
+type Results struct {
+	Type           string
+	Total          int64
+	Options        []*OptionStat // single / multiple
+	Ratings        []*RatingStat // rating
+	AvgRating      float64
+	Rankings       []*RankStat // rank
+	AvgRank        float64
+	CustomStats    []CustomStat // 自定义补充选项（按文本去重计数）
+	FormCount      int64        // form：参与总数
+	FormFields     []*db.VoteFormField
+	FormFieldStats []*FormFieldStat // form：各字段聚合统计（混合问卷）
+}
+
+// LoadResults 按投票类型聚合统计（参与端结果页与管理后台结果页共用）。
+func LoadResults(ctx context.Context, v *db.Vote) (*Results, error) {
+	// 短 TTL 缓存：避免每次请求都逐条 json.Unmarshal 全部提交记录（O(N) 重算）。
+	cacheKey := strconv.FormatUint(uint64(v.ID), 10)
+	if cached, ok := resultsCache.Get(cacheKey); ok {
+		return cached.(*Results), nil
+	}
+
+	res := &Results{Type: v.Type}
+	total, err := db.VoteSubmissions.CountByVoteID(ctx.Request().Context(), v.ID)
+	if err != nil {
+		return nil, errors.Wrap(err, "count submissions")
+	}
+	res.Total = total
+
+	switch v.Type {
+	case db.VoteTypeSingle:
+		options, _ := db.VoteOptions.ListByVoteID(ctx.Request().Context(), v.ID)
+		// 一次分组查询替代逐选项 COUNT（避免 N+1）
+		counts, err := db.VoteSubmissions.CountGroupByOptionID(ctx.Request().Context(), v.ID)
+		if err != nil {
+			return nil, errors.Wrap(err, "count options")
+		}
+		for _, o := range options {
+			count := counts[o.ID]
+			percent := 0
+			if total > 0 {
+				percent = int(count * 100 / total)
+			}
+			res.Options = append(res.Options, &OptionStat{Option: o, Count: count, Percent: percent})
+		}
+
+	case db.VoteTypeMultiple:
+		options, _ := db.VoteOptions.ListByVoteID(ctx.Request().Context(), v.ID)
+		counts := make(map[uint]int64, len(options))
+		submissions, _ := db.VoteSubmissions.ListByVoteID(ctx.Request().Context(), v.ID, nil)
+		var totalSelections int64
+		for _, s := range submissions {
+			var data struct {
+				Options []uint `json:"options"`
+			}
+			_ = json.Unmarshal(s.FormData, &data)
+			seen := make(map[uint]struct{}, len(data.Options))
+			for _, id := range data.Options {
+				if _, exists := seen[id]; exists {
+					continue
+				}
+				seen[id] = struct{}{}
+				counts[id]++
+				totalSelections++
+			}
+		}
+		for _, o := range options {
+			count := counts[o.ID]
+			percent := 0
+			// 多选：百分比分母取"总勾选数"（各项相加≈100%，符合"票数分布"直觉）；
+			// res.Total 仍是参与人数，用于"总参与"展示。
+			if totalSelections > 0 {
+				percent = int(count * 100 / totalSelections)
+			}
+			res.Options = append(res.Options, &OptionStat{Option: o, Count: count, Percent: percent})
+		}
+
+	case db.VoteTypeRating:
+		scoreCounts := make(map[int]int64)
+		var sum int64
+		submissions, _ := db.VoteSubmissions.ListByVoteID(ctx.Request().Context(), v.ID, nil)
+		for _, s := range submissions {
+			var data struct {
+				Rating int `json:"rating"`
+			}
+			_ = json.Unmarshal(s.FormData, &data)
+			if data.Rating >= 1 && data.Rating <= 10 {
+				scoreCounts[data.Rating]++
+				sum += int64(data.Rating)
+			}
+		}
+		for score := 1; score <= 10; score++ {
+			res.Ratings = append(res.Ratings, &RatingStat{Score: score, Count: scoreCounts[score]})
+		}
+		if total > 0 {
+			res.AvgRating = float64(sum) / float64(total)
+		}
+
+	case db.VoteTypeRank:
+		options, _ := db.VoteOptions.ListByVoteID(ctx.Request().Context(), v.ID)
+		rankSums := make(map[uint]float64, len(options))
+		rankCounts := make(map[uint]int64, len(options))
+		submissions, _ := db.VoteSubmissions.ListByVoteID(ctx.Request().Context(), v.ID, nil)
+		for _, s := range submissions {
+			var data struct {
+				Ranking map[string]float64 `json:"ranking"`
+			}
+			_ = json.Unmarshal(s.FormData, &data)
+			for idStr, r := range data.Ranking {
+				id, _ := strconv.ParseUint(idStr, 10, 64)
+				rankSums[uint(id)] += r
+				rankCounts[uint(id)]++
+			}
+		}
+		for _, o := range options {
+			var avg float64
+			if rankCounts[o.ID] > 0 {
+				avg = rankSums[o.ID] / float64(rankCounts[o.ID])
+			}
+			res.Rankings = append(res.Rankings, &RankStat{Option: o, AvgRank: avg})
+		}
+		var rankSum float64
+		for _, r := range res.Rankings {
+			rankSum += r.AvgRank
+		}
+		if len(res.Rankings) > 0 {
+			res.AvgRank = rankSum / float64(len(res.Rankings))
+		}
+
+	case db.VoteTypeForm:
+		res.FormFields, _ = db.VoteFormFields.ListByVoteID(ctx.Request().Context(), v.ID)
+		res.FormCount = total
+		res.FormFieldStats = aggregateFormFieldStats(ctx, res.FormFields)
+	}
+
+	// 自定义补充选项聚合（single/multiple/rank 且开启 AllowCustom；评分/表单不适用）
+	if v.AllowCustom && (v.Type == db.VoteTypeSingle || v.Type == db.VoteTypeMultiple || v.Type == db.VoteTypeRank) {
+		res.CustomStats = aggregateCustomStats(ctx, v)
+	}
+
+	resultsCache.Set(cacheKey, res, resultsCacheTTL)
+	return res, nil
+}
+
+// aggregateFormFieldStats 统计表单投票（混合问卷）各字段的聚合结果：
+// radio/select/checkbox → 选项票数；rating → 分布 + 平均分；rank → 各选项被排次数 + 平均排名；
+// number → 平均值；text/textarea → 填写数（内容不聚合展示，保护隐私）。
+func aggregateFormFieldStats(ctx context.Context, fields []*db.VoteFormField) []*FormFieldStat {
+	if len(fields) == 0 {
+		return nil
+	}
+	// 必须加载全部提交记录：radio/select/checkbox/rating/rank/number 等字段的统计
+	// 同样依赖 submissions，不能只在存在 text/textarea 字段时才加载。
+	// 否则无文本字段的表单投票结果页会全部显示为 0（缺陷）。
+	submissions, _ := db.VoteSubmissions.ListByVoteID(ctx.Request().Context(), fields[0].VoteID, nil)
+	return aggregateFormFieldStatsWithSubs(fields, submissions)
+}
+
+// aggregateFormFieldStatsWithSubs 统计核心（无 context 依赖，便于单元测试）。
+func aggregateFormFieldStatsWithSubs(fields []*db.VoteFormField, submissions []*db.VoteSubmission) []*FormFieldStat {
+	stats := make([]*FormFieldStat, 0, len(fields))
+	for _, f := range fields {
+		stat := &FormFieldStat{Field: f}
+		var fieldOpts []string
+		if f.Options != "" {
+			_ = json.Unmarshal([]byte(f.Options), &fieldOpts)
+		}
+		hasSubmissions := submissions != nil
+
+		switch f.FieldType {
+		case db.VoteFormFieldTypeRadio, db.VoteFormFieldTypeSelect:
+			counts := make(map[string]int64, len(fieldOpts))
+			presetSet := make(map[string]bool, len(fieldOpts))
+			for _, o := range fieldOpts {
+				presetSet[o] = true
+			}
+			if hasSubmissions {
+				for _, s := range submissions {
+					var data map[string]interface{}
+					_ = json.Unmarshal(s.FormData, &data)
+					if val, ok := data[f.Label].(string); ok && val != "" {
+						stat.Total++
+						// 开启"允许补充自定义选项"时，非预置值视为自定义补充文本（按文本去重计数）
+						if f.AllowCustom && !presetSet[val] {
+							stat.CustomStats = addCustomStat(stat.CustomStats, val)
+							continue
+						}
+						counts[val]++
+					}
+				}
+			}
+			for _, o := range fieldOpts {
+				stat.OptionStats = append(stat.OptionStats, &OptionStat{Option: &db.VoteOption{Content: o}, Count: counts[o]})
+			}
+
+		case db.VoteFormFieldTypeCheckbox:
+			counts := make(map[string]int64, len(fieldOpts))
+			presetSet := make(map[string]bool, len(fieldOpts))
+			for _, o := range fieldOpts {
+				presetSet[o] = true
+			}
+			var totalSelections int64
+			if hasSubmissions {
+				for _, s := range submissions {
+					var data map[string]interface{}
+					_ = json.Unmarshal(s.FormData, &data)
+					if arr, ok := data[f.Label].([]interface{}); ok && len(arr) > 0 {
+						stat.Total++
+						for _, v := range arr {
+							totalSelections++
+							val := fmt.Sprint(v)
+							// 开启"允许补充自定义选项"时，非预置值视为自定义补充文本（按文本去重计数）
+							if f.AllowCustom && !presetSet[val] {
+								stat.CustomStats = addCustomStat(stat.CustomStats, val)
+								continue
+							}
+							counts[val]++
+						}
+					}
+				}
+			}
+			// 多选(checkbox)：百分比分母用"总勾选数"而非参与人数，使各项相加≈100%
+			stat.TotalSelections = totalSelections
+			for _, o := range fieldOpts {
+				stat.OptionStats = append(stat.OptionStats, &OptionStat{Option: &db.VoteOption{Content: o}, Count: counts[o]})
+			}
+
+		case db.VoteFormFieldTypeRating:
+			scoreCounts := make(map[int]int64, 10)
+			var sum int64
+			if hasSubmissions {
+				for _, s := range submissions {
+					var data map[string]interface{}
+					_ = json.Unmarshal(s.FormData, &data)
+					if n, ok := data[f.Label].(float64); ok && n >= 1 && n <= 10 {
+						scoreCounts[int(n)]++
+						sum += int64(n)
+						stat.Total++
+					}
+				}
+			}
+			for score := 1; score <= 10; score++ {
+				stat.RatingCounts = append(stat.RatingCounts, &RatingStat{Score: score, Count: scoreCounts[score]})
+			}
+			if stat.Total > 0 {
+				stat.AvgRating = float64(sum) / float64(stat.Total)
+			}
+
+		case db.VoteFormFieldTypeRank:
+			rankSums := make(map[string]float64, len(fieldOpts))
+			rankCounts := make(map[string]int64, len(fieldOpts))
+			if hasSubmissions {
+				for _, s := range submissions {
+					var data map[string]interface{}
+					_ = json.Unmarshal(s.FormData, &data)
+					if m, ok := data[f.Label].(map[string]interface{}); ok && len(m) > 0 {
+						stat.Total++
+						for opt, r := range m {
+							if rv, ok := r.(float64); ok {
+								rankSums[opt] += rv
+								rankCounts[opt]++
+							}
+						}
+					}
+				}
+			}
+			var allSum float64
+			var allCnt int64
+			for _, o := range fieldOpts {
+				var avg float64
+				if rankCounts[o] > 0 {
+					avg = rankSums[o] / float64(rankCounts[o])
+				}
+				stat.OptionStats = append(stat.OptionStats, &OptionStat{Option: &db.VoteOption{Content: o}, Count: rankCounts[o], AvgRank: avg})
+				allSum += rankSums[o]
+				allCnt += rankCounts[o]
+			}
+			if allCnt > 0 {
+				stat.AvgRank = allSum / float64(allCnt)
+			}
+
+		case db.VoteFormFieldTypeNumber:
+			var sum float64
+			if hasSubmissions {
+				for _, s := range submissions {
+					var data map[string]interface{}
+					_ = json.Unmarshal(s.FormData, &data)
+					if n, ok := data[f.Label].(float64); ok {
+						sum += n
+						stat.Total++
+					}
+				}
+			}
+			if stat.Total > 0 {
+				stat.AvgNumber = sum / float64(stat.Total)
+			}
+
+		case db.VoteFormFieldTypeText, db.VoteFormFieldTypeTextarea:
+			if hasSubmissions {
+				for _, s := range submissions {
+					var data map[string]interface{}
+					_ = json.Unmarshal(s.FormData, &data)
+					if val, ok := data[f.Label].(string); ok && val != "" {
+						// 文本字段的"回答数"等于"已填写数"，故 Total 与 TextCount 同步递增，
+						// 避免结果页出现"回答数: 0 已填写: N"的矛盾展示。
+						stat.Total++
+						stat.TextCount++
+					}
+				}
+			}
+		}
+		stats = append(stats, stat)
+	}
+	return stats
+}
+
+// addCustomStat 向自定义补充选项统计追加一条（按文本去重计数，保持首现顺序）。
+func addCustomStat(stats []CustomStat, text string) []CustomStat {
+	for i := range stats {
+		if stats[i].Text == text {
+			stats[i].Count++
+			return stats
+		}
+	}
+	return append(stats, CustomStat{Text: text, Count: 1})
+}
+
+// aggregateCustomStats 统计自定义补充选项（按文本去重计数，保持首现顺序）。
+func aggregateCustomStats(ctx context.Context, v *db.Vote) []CustomStat {
+	submissions, err := db.VoteSubmissions.ListByVoteID(ctx.Request().Context(), v.ID, nil)
+	if err != nil {
+		return nil
+	}
+	counts := make(map[string]int64)
+	var order []string
+	for _, s := range submissions {
+		text := strings.TrimSpace(s.CustomText)
+		if text == "" {
+			continue
+		}
+		if _, ok := counts[text]; !ok {
+			order = append(order, text)
+		}
+		counts[text]++
+	}
+	stats := make([]CustomStat, 0, len(order))
+	for _, text := range order {
+		stats = append(stats, CustomStat{Text: text, Count: counts[text]})
+	}
+	return stats
+}
+
+// ---------------- 页面 ----------------
+
+// Page 投票页。
+func Page(ctx context.Context) {
+	vote, err := db.Votes.GetByToken(ctx.Request().Context(), ctx.Param("token"))
+	if err != nil {
+		ctx.SetErrorFlash(i18n.T(ctxLang(ctx), "vote.flash.notFound"))
+		ctx.Redirect("/")
+		return
+	}
+	// 草稿 / 归档不可访问（仅链接分享场景同样不可见）
+	if vote.Status == db.VoteStatusDraft || vote.Status == db.VoteStatusArchived {
+		ctx.SetErrorFlash(i18n.T(ctxLang(ctx), "vote.flash.notFound"))
+		ctx.Redirect("/")
+		return
+	}
+
+	now := time.Now()
+	isOwner := ctx.IsLogged && ctx.User.ID == vote.UserID
+
+	// 箱主侧的投票功能开关（开关 / 定时开放 / 定量收集）：关闭时访客不可参与，
+	// 页面本身仍可访问（结果展示策略不受影响）。
+	voteState := db.FeatureStateOf(ctx.Request().Context(), vote.UserID, db.FeatureVote)
+	if !voteState.Open {
+		ctx.Data["FeatureClosedMessage"] = i18n.FeatureClosedMessage(ctxLang(ctx), db.FeatureVote, voteState.Reason)
+	}
+
+	ctx.Data["Vote"] = vote
+	ctx.Data["IsOwner"] = isOwner
+	ctx.Data["NotStarted"] = vote.Status == db.VoteStatusPublished && vote.StartAt != nil && now.Before(*vote.StartAt)
+	ctx.Data["Ended"] = isVoteEnded(vote, now)
+	ctx.Data["VoteScopeRegisteredOnly"] = vote.VoterScope == db.VoteVoterScopeRegisteredOnly
+
+	// 箱主信息
+	owner, err := db.Users.GetByID(ctx.Request().Context(), vote.UserID)
+	if err == nil {
+		ctx.Data["Owner"] = owner
+	}
+
+	// 选项 / 表单字段
+	if vote.Type == db.VoteTypeForm {
+		fields, _ := db.VoteFormFields.ListByVoteID(ctx.Request().Context(), vote.ID)
+		ctx.Data["FormFields"] = fields
+	} else if vote.Type != db.VoteTypeRating {
+		options, _ := db.VoteOptions.ListByVoteID(ctx.Request().Context(), vote.ID)
+		ctx.Data["Options"] = options
+	}
+	// "其他/自定义选项"保留标记（模板参与端表单与 JS 联动使用，避免硬编码漂移）
+	ctx.Data["CustomFieldMarker"] = db.CustomFieldMarker
+	// 自定义补充选项的字数上限：参与端模板据此渲染实时计数与超限提示，
+	// 与后端校验共用 conf.Limits.CustomAnswerLen，避免前后端上限漂移。
+	ctx.Data["MaxCustomTextLen"] = conf.Limits.CustomAnswerLen
+
+	// 已投判断（登录按账号；匿名按指纹 Cookie）
+	hasVoted := false
+	if ctx.IsLogged {
+		hasVoted, _ = db.VoteSubmissions.HasUserVoted(ctx.Request().Context(), vote.ID, ctx.User.ID)
+	} else if token := currentVoterToken(ctx); token != "" {
+		hasVoted, _ = db.VoteSubmissions.HasTokenVoted(ctx.Request().Context(), vote.ID, token)
+	}
+	ctx.Data["HasVoted"] = hasVoted
+	ctx.Data["CanVote"] = isVoteActive(vote, now) && voteState.Open && !hasVoted && !ctx.Data["NotStarted"].(bool)
+
+	// 匿名首次访问签发指纹
+	if !ctx.IsLogged {
+		ensureVoterToken(ctx)
+	}
+
+	// 结果可见性
+	showResults := false
+	switch vote.ShowResult {
+	case db.VoteShowResultAfterVote:
+		showResults = hasVoted
+	case db.VoteShowResultAfterEnd:
+		showResults = ctx.Data["Ended"].(bool)
+	case db.VoteShowResultOwnerOnly:
+		showResults = isOwner
+	}
+	ctx.Data["ShowResults"] = showResults
+	if showResults {
+		res, err := LoadResults(ctx, vote)
+		if err != nil {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Warn("Failed to load vote results")
+		} else {
+			ctx.Data["Results"] = res
+		}
+	}
+
+	ctx.Data["Title"] = vote.Title
+	ctx.Success("vote/page")
+}
+
+// ---------------- 提交 ----------------
+
+type formFieldInput struct {
+	FieldType string
+	Label     string
+	Required  bool
+	MaxLength int
+	Options   []string
+}
+
+// Submit 提交投票。
+func Submit(ctx context.Context, recaptcha recaptcha.RecaptchaV3) {
+	lang := ctxLang(ctx)
+	vote, err := db.Votes.GetByToken(ctx.Request().Context(), ctx.Param("token"))
+	if err != nil {
+		ctx.SetErrorFlash(i18n.T(lang, "vote.flash.notFound"))
+		ctx.Redirect("/")
+		return
+	}
+
+	// 箱主关闭投票功能（开关 / 定时 / 定量）时拒绝参与，避免绕过页面上的禁用态直接 POST。
+	if voteState := db.FeatureStateOf(ctx.Request().Context(), vote.UserID, db.FeatureVote); !voteState.Open {
+		ctx.SetErrorFlash(i18n.FeatureClosedMessage(lang, db.FeatureVote, voteState.Reason))
+		ctx.Redirect("/vote/" + vote.LinkToken)
+		return
+	}
+
+	now := time.Now()
+	if !isVoteActive(vote, now) {
+		switch vote.Status {
+		case db.VoteStatusDraft:
+			ctx.SetErrorFlash(i18n.T(lang, "vote.flash.notPublished"))
+		case db.VoteStatusArchived:
+			ctx.SetErrorFlash(i18n.T(lang, "vote.flash.archived"))
+		default:
+			if isVoteEnded(vote, now) {
+				ctx.SetErrorFlash(i18n.T(lang, "vote.flash.ended"))
+			} else {
+				ctx.SetErrorFlash(i18n.T(lang, "vote.flash.notStarted"))
+			}
+		}
+		ctx.Redirect("/vote/" + vote.LinkToken)
+		return
+	}
+
+	// 仅注册用户可投：未登录跳登录页
+	if vote.VoterScope == db.VoteVoterScopeRegisteredOnly && !ctx.IsLogged {
+		ctx.SetErrorFlash(i18n.T(lang, "vote.page.loginRequired"))
+		ctx.Redirect("/login?to=" + ctx.Request().Request.RequestURI)
+		return
+	}
+
+	// 已投检查（应用层预检，返回友好提示；最终防重由数据库唯一索引兜底）
+	if ctx.IsLogged {
+		hasVoted, _ := db.VoteSubmissions.HasUserVoted(ctx.Request().Context(), vote.ID, ctx.User.ID)
+		if hasVoted {
+			ctx.SetErrorFlash(i18n.T(lang, "vote.page.alreadyVoted"))
+			ctx.Redirect("/vote/" + vote.LinkToken)
+			return
+		}
+	} else {
+		if token := currentVoterToken(ctx); token != "" {
+			hasVoted, _ := db.VoteSubmissions.HasTokenVoted(ctx.Request().Context(), vote.ID, token)
+			if hasVoted {
+				ctx.SetErrorFlash(i18n.T(lang, "vote.page.alreadyVoted"))
+				ctx.Redirect("/vote/" + vote.LinkToken)
+				return
+			}
+		}
+	}
+
+	ip := shared.ResolveClientIP(ctx.Request().Request)
+
+	// 匿名：验证码（可配置）+ token 防重；IP 不再作为"一票封顶"依据，避免共享出口误伤。
+	var voterToken *string
+	if !ctx.IsLogged {
+		// 匿名：始终要求验证码（决策 #3 + P2-2 修复：清除 Cookie 换 token 的刷票依赖验证码兜底）；
+		// 仅当全局已配置验证码（CaptchaType 非空）时强制，未配置则不阻断，避免无密钥部署整崩。
+		// token 防重 + IP 高阈值兜底限流保持不变。
+		if conf.Recaptcha.CaptchaType != "" {
+			ok, err := captcha.Verify(ctx.Request().FormValue("g-recaptcha-response"), ip, ctx.Session, recaptcha, lang)
+			if err != nil {
+				ctx.SetErrorFlash(err.Error())
+				ctx.Redirect("/vote/" + vote.LinkToken)
+				return
+			}
+			if !ok {
+				ctx.SetErrorFlash(i18n.T(lang, "captcha.error"))
+				ctx.Redirect("/vote/" + vote.LinkToken)
+				return
+			}
+		}
+		// IP 仅由投票提交中间件承担高阈值兜底限流，不再按"一票封顶"拦截。
+		// 这样同一局域网的不同匿名浏览器可凭各自签名 token 正常参与。
+		token := ensureVoterToken(ctx)
+		voterToken = &token
+	}
+
+	// 解析提交内容。
+	// 先取投票发起人的全局屏蔽词表（users.block_words）：投票提交中的开放文本
+	// （自定义补充选项、表单“其他”文本、文本/长文本字段）需要与提问/私聊一样
+	// 命中即拒，因此把 owner 一并传入 parseSubmission 做本地词表检查。
+	owner, err := db.Users.GetByID(ctx.Request().Context(), vote.UserID)
+	if err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to get vote owner")
+		ctx.SetInternalErrorFlash()
+		ctx.Redirect("/vote/" + vote.LinkToken)
+		return
+	}
+	submission, err := parseSubmission(ctx, vote, owner)
+	if err != nil {
+		ctx.SetErrorFlash(err.Error())
+		ctx.Redirect("/vote/" + vote.LinkToken)
+		return
+	}
+	submission.VoteID = vote.ID
+	submission.VoterIP = ip
+	submission.UserID = nil
+	if ctx.IsLogged {
+		uid := ctx.User.ID
+		submission.UserID = &uid
+	}
+	submission.VoterToken = voterToken
+
+	if _, err := db.VoteSubmissions.Create(ctx.Request().Context(), *submission); err != nil {
+		if errors.Is(err, db.ErrVoteAlreadyVoted) {
+			ctx.SetErrorFlash(i18n.T(lang, "vote.page.alreadyVoted"))
+		} else {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Error("Failed to create vote submission")
+			ctx.SetInternalErrorFlash()
+		}
+		ctx.Redirect("/vote/" + vote.LinkToken)
+		return
+	}
+
+	// 写穿式失效：新提交成功后立即清除该投票的结果缓存，
+	// 避免结果页在 TTL 内显示陈旧计数，并把 O(N) 重算成本收敛到"每次新投票一次"。
+	InvalidateResultsCache(vote.ID)
+
+	// 定量收集：箱主级累计一份；单份投票设置上限后达到即自动结束该投票。
+	if err := db.FeatureControls.IncrementQuota(ctx.Request().Context(), vote.UserID, db.FeatureVote, 1); err != nil {
+		logrus.WithContext(ctx.Request().Context()).WithError(err).Warn("Failed to increment vote feature quota")
+	}
+	if vote.QuotaLimit > 0 {
+		count, err := db.VoteSubmissions.CountByVoteID(ctx.Request().Context(), vote.ID)
+		if err != nil {
+			logrus.WithContext(ctx.Request().Context()).WithError(err).Warn("Failed to count vote submissions for quota")
+		} else if count >= int64(vote.QuotaLimit) {
+			if err := db.Votes.UpdateStatus(ctx.Request().Context(), vote.ID, db.VoteStatusEnded); err != nil {
+				logrus.WithContext(ctx.Request().Context()).WithError(err).Warn("Failed to auto end vote on quota reached")
+			}
+		}
+	}
+
+	// 表单类型投票：异步通知箱主查看新回复（开启邮件通知时）
+	if vote.Type == db.VoteTypeForm {
+		owner, err := db.Users.GetByID(ctx.Request().Context(), vote.UserID)
+		if err == nil && owner.Notify == db.NotifyTypeEmail {
+			email := owner.Email
+			title := vote.Title
+			voteID := vote.ID
+			shared.SafeGo(func() {
+				if err := mail.SendNewVoteSubmissionMail(email, title, voteID); err != nil {
+					logrus.WithContext(stdctx.Background()).WithError(err).Error("Failed to send new vote submission mail")
+				}
+			})
+		}
+	}
+
+	ctx.SetSuccessFlash(i18n.T(lang, "vote.flash.success"))
+	ctx.Redirect("/vote/" + vote.LinkToken)
+}
+
+// parseMultipleOptionIDs 解析多选参数并拒绝重复选项，避免同一提交被重复计票。
+func parseMultipleOptionIDs(ids []string, maxChoices int, validOptions map[uint]bool, lang string) ([]uint, error) {
+	if len(ids) == 0 {
+		return nil, errors.New(i18n.T(lang, "vote.err.noChoice"))
+	}
+	if maxChoices < 1 {
+		maxChoices = 1
+	}
+	if len(ids) > maxChoices {
+		return nil, fmt.Errorf(i18n.T(lang, "vote.err.tooManyChoices"), maxChoices)
+	}
+
+	chosen := make([]uint, 0, len(ids))
+	seen := make(map[uint]struct{}, len(ids))
+	for _, s := range ids {
+		parsed, err := strconv.ParseUint(strings.TrimSpace(s), 10, 64)
+		optionID := uint(parsed)
+		if err != nil || uint64(optionID) != parsed || !validOptions[optionID] {
+			return nil, errors.New(i18n.T(lang, "vote.err.invalidOption"))
+		}
+		if _, exists := seen[optionID]; exists {
+			return nil, errors.New(i18n.T(lang, "vote.err.optionDuplicate"))
+		}
+		seen[optionID] = struct{}{}
+		chosen = append(chosen, optionID)
+	}
+	return chosen, nil
+}
+
+// parseSubmission 按投票类型解析并校验提交内容，构造 VoteSubmission。
+// owner 为投票发起人（用于其全局屏蔽词表对开放文本的本地过滤）。
+func parseSubmission(ctx context.Context, v *db.Vote, owner *db.User) (*db.CreateVoteSubmissionOptions, error) {
+	lang := ctxLang(ctx)
+	get := func(name string) string { return strings.TrimSpace(ctx.Request().FormValue(name)) }
+	sub := &db.CreateVoteSubmissionOptions{}
+	formData := map[string]interface{}{}
+
+	// 选项合法性集合
+	validOptions := map[uint]bool{}
+	if v.Type == db.VoteTypeSingle || v.Type == db.VoteTypeMultiple || v.Type == db.VoteTypeRank {
+		options, _ := db.VoteOptions.ListByVoteID(ctx.Request().Context(), v.ID)
+		for _, o := range options {
+			validOptions[o.ID] = true
+		}
+	}
+
+	switch v.Type {
+	case db.VoteTypeSingle:
+		optID := get("option_id")
+		id, err := strconv.ParseUint(optID, 10, 64)
+		if err != nil || !validOptions[uint(id)] {
+			return nil, errors.New(i18n.T(lang, "vote.err.pickOne"))
+		}
+		sub.OptionID = uint(id)
+
+	case db.VoteTypeMultiple:
+		ids := ctx.Request().Form["option_ids"]
+		chosen, err := parseMultipleOptionIDs(ids, v.MaxChoices, validOptions, lang)
+		if err != nil {
+			return nil, err
+		}
+		sub.OptionID = chosen[0] // 展示用
+		formData["options"] = chosen
+
+	case db.VoteTypeRating:
+		score, err := strconv.Atoi(get("rating_value"))
+		if err != nil || score < 1 || score > 10 {
+			return nil, errors.New(i18n.T(lang, "vote.err.ratingRequired"))
+		}
+		formData["rating"] = score
+
+	case db.VoteTypeRank:
+		options, _ := db.VoteOptions.ListByVoteID(ctx.Request().Context(), v.ID)
+		ranking := map[string]float64{}
+		used := map[float64]bool{}
+		for _, o := range options {
+			r, err := strconv.ParseFloat(get(fmt.Sprintf("rank_%d", o.ID)), 64)
+			if err != nil || r < 1 || r > float64(len(options)) {
+				return nil, fmt.Errorf(i18n.T(lang, "vote.err.rankRequired"), len(options))
+			}
+			if used[r] {
+				return nil, errors.New(i18n.T(lang, "vote.err.rankDuplicate"))
+			}
+			used[r] = true
+			ranking[fmt.Sprint(o.ID)] = r
+		}
+		formData["ranking"] = ranking
+
+	case db.VoteTypeForm:
+		fields, _ := db.VoteFormFields.ListByVoteID(ctx.Request().Context(), v.ID)
+		for _, f := range fields {
+			// 字段选项集合
+			validFieldOptions := map[string]bool{}
+			var fieldOpts []string
+			if f.Options != "" {
+				_ = json.Unmarshal([]byte(f.Options), &fieldOpts)
+				for _, o := range fieldOpts {
+					validFieldOptions[o] = true
+				}
+			}
+
+			values := ctx.Request().Form["field_"+fmt.Sprint(f.ID)]
+			// 单选类字段（radio/select）取单值；多选 checkbox 允许多值
+			if f.FieldType == db.VoteFormFieldTypeRadio || f.FieldType == db.VoteFormFieldTypeSelect {
+				val := ""
+				if len(values) > 0 {
+					val = strings.TrimSpace(values[0])
+				}
+				// 空值视为未填写：非必填跳过，必填报"请填写"。
+				// 注意：下拉框未选择时表单会提交空字符串（values 非空但 val=""），
+				// 直接走选项校验会误报"选项无效"，这里必须先归一化。
+				if val == "" {
+					if f.Required {
+						return nil, errors.New(i18n.T(lang, "vote.err.fieldRequired", f.Label))
+					}
+					continue
+				}
+				// "其他/自定义选项"：选中保留标记时读取参与者填写的文本
+				if f.AllowCustom && val == db.CustomFieldMarker {
+					custom := strings.TrimSpace(ctx.Request().FormValue(fmt.Sprintf("field_%d_custom", f.ID)))
+					if custom == "" {
+						return nil, errors.New(i18n.T(lang, "vote.err.fieldCustomRequired", f.Label))
+					}
+					if len([]rune(custom)) > conf.Limits.CustomAnswerLen {
+						return nil, errors.New(i18n.T(lang, "vote.err.fieldCustomTooLong", f.Label, conf.Limits.CustomAnswerLen))
+					}
+					// 发起人全局屏蔽词（提问/私聊/投票共用一份词表）
+					if err := blockWordCheck(owner, lang, custom); err != nil {
+						return nil, err
+					}
+					// 开放文本内容审核（fail-closed）
+					if err := censorCheck(ctx, lang, custom); err != nil {
+						return nil, err
+					}
+					formData[f.Label] = custom
+					continue
+				}
+				if !validFieldOptions[val] {
+					return nil, errors.New(i18n.T(lang, "vote.err.fieldInvalidOption", f.Label))
+				}
+				formData[f.Label] = val
+				continue
+			}
+
+			// 多选 checkbox
+			if f.FieldType == db.VoteFormFieldTypeCheckbox {
+				var chosen []string
+				for _, val := range values {
+					val = strings.TrimSpace(val)
+					if val == "" {
+						continue // 忽略空值（非必填未勾选时不应误报"选项无效"）
+					}
+					// "其他/自定义选项"：勾选保留标记时读取参与者填写的文本
+					if f.AllowCustom && val == db.CustomFieldMarker {
+						custom := strings.TrimSpace(ctx.Request().FormValue(fmt.Sprintf("field_%d_custom", f.ID)))
+						if custom == "" {
+							return nil, errors.New(i18n.T(lang, "vote.err.fieldCustomRequired", f.Label))
+						}
+						if len([]rune(custom)) > conf.Limits.CustomAnswerLen {
+							return nil, errors.New(i18n.T(lang, "vote.err.fieldCustomTooLong", f.Label, conf.Limits.CustomAnswerLen))
+						}
+						// 发起人全局屏蔽词（提问/私聊/投票共用一份词表）：
+						// checkbox 的「其他/自定义」同样属自由文本，须与 radio/select 分支一致拦截。
+						if err := blockWordCheck(owner, lang, custom); err != nil {
+							return nil, err
+						}
+						// 开放文本内容审核（fail-closed）
+						if err := censorCheck(ctx, lang, custom); err != nil {
+							return nil, err
+						}
+						chosen = append(chosen, custom)
+						continue
+					}
+					if !validFieldOptions[val] {
+						return nil, errors.New(i18n.T(lang, "vote.err.fieldInvalidOption", f.Label))
+					}
+					chosen = append(chosen, val)
+				}
+				if len(chosen) == 0 && f.Required {
+					return nil, errors.New(i18n.T(lang, "vote.err.fieldRequired", f.Label))
+				}
+				if len(chosen) > 0 {
+					formData[f.Label] = chosen
+				}
+				continue
+			}
+
+			// 排序题 rank：每个选项一个排名输入（name=field_{id}_{i}），校验 1..N 且不重复
+			if f.FieldType == db.VoteFormFieldTypeRank {
+				if len(fieldOpts) < 2 {
+					return nil, errors.New(i18n.T(lang, "vote.err.fieldConfigError", f.Label))
+				}
+				ranking := map[string]float64{}
+				used := map[float64]bool{}
+				for i, opt := range fieldOpts {
+					raw := strings.TrimSpace(ctx.Request().FormValue(fmt.Sprintf("field_%d_%d", f.ID, i)))
+					if raw == "" {
+						if f.Required {
+							return nil, errors.New(i18n.T(lang, "vote.err.fieldRankIncomplete", f.Label))
+						}
+						continue
+					}
+					r, err := strconv.ParseFloat(raw, 64)
+					if err != nil || r < 1 || r > float64(len(fieldOpts)) {
+						return nil, errors.New(i18n.T(lang, "vote.err.fieldRankRange", f.Label, len(fieldOpts)))
+					}
+					if used[r] {
+						return nil, errors.New(i18n.T(lang, "vote.err.fieldRankDuplicate", f.Label))
+					}
+					used[r] = true
+					ranking[opt] = r
+				}
+				if len(ranking) > 0 {
+					formData[f.Label] = ranking
+				}
+				continue
+			}
+
+			// 文本 / 数字 / 评分
+			val := ""
+			if len(values) > 0 {
+				val = strings.TrimSpace(values[0])
+			}
+			if f.Required && val == "" {
+				return nil, errors.New(i18n.T(lang, "vote.err.fieldRequired", f.Label))
+			}
+			if val == "" {
+				continue
+			}
+			if f.MaxLength > 0 && len([]rune(val)) > f.MaxLength {
+				return nil, errors.New(i18n.T(lang, "vote.err.fieldTooLong", f.Label, f.MaxLength))
+			}
+			switch f.FieldType {
+			case db.VoteFormFieldTypeNumber:
+				n, err := strconv.ParseFloat(val, 64)
+				if err != nil {
+					return nil, errors.New(i18n.T(lang, "vote.err.fieldNotNumber", f.Label))
+				}
+				formData[f.Label] = n
+			case db.VoteFormFieldTypeRating:
+				score, err := strconv.Atoi(val)
+				if err != nil || score < 1 || score > 10 {
+					return nil, errors.New(i18n.T(lang, "vote.err.fieldRating", f.Label))
+				}
+				formData[f.Label] = score
+			default:
+				// 发起人全局屏蔽词（提问/私聊/投票共用一份词表）
+				if err := blockWordCheck(owner, lang, val); err != nil {
+					return nil, err
+				}
+				// 开放文本内容审核（fail-closed）
+				if err := censorCheck(ctx, lang, val); err != nil {
+					return nil, err
+				}
+				formData[f.Label] = val
+			}
+		}
+
+	default:
+		return nil, errors.New(i18n.T(lang, "vote.err.unknownType"))
+	}
+
+	// 自定义补充选项（single/multiple/rank 且 AllowCustom）
+	if v.AllowCustom && (v.Type == db.VoteTypeSingle || v.Type == db.VoteTypeMultiple || v.Type == db.VoteTypeRank) {
+		if custom := strings.TrimSpace(ctx.Request().FormValue("custom")); custom != "" {
+			if len([]rune(custom)) > conf.Limits.CustomAnswerLen {
+				return nil, errors.New(i18n.T(lang, "vote.err.customTooLong"))
+			}
+			// 发起人全局屏蔽词（提问/私聊/投票共用一份词表）
+			if err := blockWordCheck(owner, lang, custom); err != nil {
+				return nil, err
+			}
+			// 开放文本内容审核（fail-closed）
+			if err := censorCheck(ctx, lang, custom); err != nil {
+				return nil, err
+			}
+			sub.CustomText = custom
+		}
+	}
+
+	if len(formData) > 0 {
+		data, err := json.Marshal(formData)
+		if err != nil {
+			return nil, errors.New(i18n.T(lang, "vote.err.serialize"))
+		}
+		sub.FormData = datatypes.JSON(data)
+	}
+	return sub, nil
+}
diff --git a/route/vote/vote_stats_test.go b/route/vote/vote_stats_test.go
new file mode 100644
index 0000000..4372b3a
--- /dev/null
+++ b/route/vote/vote_stats_test.go
@@ -0,0 +1,262 @@
+package vote
+
+import (
+	stdctx "context"
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/db"
+	"github.com/tamakyi/TamaBox/internal/dbutil"
+	"github.com/tamakyi/TamaBox/internal/i18n"
+)
+
+// mockVoteSubmissions 仅实现 aggregateFormFieldStats 依赖的 ListByVoteID。
+type mockVoteSubmissions struct {
+	submissions []*db.VoteSubmission
+}
+
+func (m *mockVoteSubmissions) ListByVoteID(ctx stdctx.Context, voteID uint, cursor *dbutil.Cursor) ([]*db.VoteSubmission, error) {
+	return m.submissions, nil
+}
+func (m *mockVoteSubmissions) Create(ctx stdctx.Context, opts db.CreateVoteSubmissionOptions) (*db.VoteSubmission, error) {
+	return nil, nil
+}
+func (m *mockVoteSubmissions) GetByID(ctx stdctx.Context, id uint) (*db.VoteSubmission, error) {
+	return nil, nil
+}
+func (m *mockVoteSubmissions) CountByVoteID(ctx stdctx.Context, voteID uint) (int64, error) {
+	return 0, nil
+}
+func (m *mockVoteSubmissions) CountByVoteIDs(ctx stdctx.Context, voteIDs []uint) (map[uint]int64, error) {
+	return nil, nil
+}
+func (m *mockVoteSubmissions) CountByOptionID(ctx stdctx.Context, voteID, optionID uint) (int64, error) {
+	return 0, nil
+}
+func (m *mockVoteSubmissions) CountGroupByOptionID(ctx stdctx.Context, voteID uint) (map[uint]int64, error) {
+	return nil, nil
+}
+func (m *mockVoteSubmissions) CountByIP(ctx stdctx.Context, voteID uint, ip string, since time.Time) (int64, error) {
+	return 0, nil
+}
+func (m *mockVoteSubmissions) HasUserVoted(ctx stdctx.Context, voteID, userID uint) (bool, error) {
+	return false, nil
+}
+func (m *mockVoteSubmissions) HasTokenVoted(ctx stdctx.Context, voteID uint, token string) (bool, error) {
+	return false, nil
+}
+func (m *mockVoteSubmissions) DeleteByVoteID(ctx stdctx.Context, voteID uint) error { return nil }
+
+func formData(t *testing.T, v map[string]interface{}) []byte {
+	t.Helper()
+	b, err := json.Marshal(v)
+	if err != nil {
+		t.Fatalf("marshal form data: %v", err)
+	}
+	return b
+}
+
+func TestParseMultipleOptionIDsRejectsDuplicates(t *testing.T) {
+	valid := map[uint]bool{1: true, 2: true, 3: true}
+	chosen, err := parseMultipleOptionIDs([]string{"1", "2"}, 2, valid, i18n.Default)
+	if err != nil {
+		t.Fatalf("valid multiple options rejected: %v", err)
+	}
+	if len(chosen) != 2 || chosen[0] != 1 || chosen[1] != 2 {
+		t.Fatalf("unexpected parsed options: %#v", chosen)
+	}
+
+	cases := []struct {
+		name string
+		ids  []string
+		want string
+	}{
+		{"duplicate", []string{"1", "1"}, "选项不能重复选择"},
+		{"too-many", []string{"1", "2", "3"}, "最多只能选择 2 个选项"},
+		{"invalid", []string{"1", "99"}, "存在无效的选项"},
+		{"overflow", []string{"18446744073709551616"}, "存在无效的选项"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := parseMultipleOptionIDs(tc.ids, 2, valid, i18n.Default)
+			if err == nil || err.Error() != tc.want {
+				t.Fatalf("parseMultipleOptionIDs(%v) error = %v, want %q", tc.ids, err, tc.want)
+			}
+		})
+	}
+}
+
+func TestVoterTokenSignatureValidation(t *testing.T) {
+	oldKey := conf.Server.XSRFKey
+	conf.Server.XSRFKey = "test-voter-token-secret"
+	defer func() { conf.Server.XSRFKey = oldKey }()
+
+	token := newVoterToken()
+	if !validVoterToken(token) {
+		t.Fatalf("new voter token should validate: %q", token)
+	}
+	if len(token) != 108 {
+		t.Fatalf("new voter token length = %d, want 108", len(token))
+	}
+	if validVoterToken(token + "x") {
+		t.Fatal("tampered voter token should be rejected")
+	}
+	parts := strings.Split(token, ".")
+	if len(parts) != 2 || validVoterToken(parts[0]+"."+strings.Repeat("A", len(parts[1]))) {
+		t.Fatal("token with forged signature should be rejected")
+	}
+}
+
+func TestAggregateFormFieldStats(t *testing.T) {
+	fields := []*db.VoteFormField{
+		{Model: dbutil.Model{ID: 1}, VoteID: 9, FieldType: db.VoteFormFieldTypeRadio, Label: "满意度", Options: `["满意","一般"]`},
+		{Model: dbutil.Model{ID: 2}, VoteID: 9, FieldType: db.VoteFormFieldTypeCheckbox, Label: "多选", Options: `["A","B"]`},
+		{Model: dbutil.Model{ID: 3}, VoteID: 9, FieldType: db.VoteFormFieldTypeRating, Label: "评分"},
+		{Model: dbutil.Model{ID: 4}, VoteID: 9, FieldType: db.VoteFormFieldTypeRank, Label: "排序", Options: `["X","Y","Z"]`},
+		{Model: dbutil.Model{ID: 5}, VoteID: 9, FieldType: db.VoteFormFieldTypeNumber, Label: "数量"},
+		{Model: dbutil.Model{ID: 6}, VoteID: 9, FieldType: db.VoteFormFieldTypeTextarea, Label: "建议"},
+	}
+	old := db.VoteSubmissions
+	defer func() { db.VoteSubmissions = old }()
+
+	subs := []*db.VoteSubmission{
+		{VoteID: 9, FormData: formData(t, map[string]interface{}{
+			"满意度": "满意", "多选": []string{"A", "B"}, "评分": 9, "排序": map[string]float64{"X": 1, "Y": 2, "Z": 3}, "数量": 3, "建议": "很好",
+		})},
+		{VoteID: 9, FormData: formData(t, map[string]interface{}{
+			"满意度": "满意", "多选": []string{"A"}, "评分": 7, "排序": map[string]float64{"X": 2, "Y": 1, "Z": 3}, "数量": 5, "建议": "",
+		})},
+		{VoteID: 9, FormData: formData(t, map[string]interface{}{
+			"满意度": "一般", "评分": 8, "排序": map[string]float64{"X": 3, "Y": 2, "Z": 1}, "数量": 10,
+		})},
+	}
+	db.VoteSubmissions = &mockVoteSubmissions{submissions: subs}
+
+	stats := aggregateFormFieldStatsWithSubs(fields, subs)
+	if len(stats) != 6 {
+		t.Fatalf("expected 6 field stats, got %d", len(stats))
+	}
+
+	// radio：满意 2 / 一般 1
+	radio := stats[0]
+	if radio.Total != 3 || len(radio.OptionStats) != 2 {
+		t.Fatalf("radio stats wrong: total=%d opts=%d", radio.Total, len(radio.OptionStats))
+	}
+	if radio.OptionStats[0].Count != 2 || radio.OptionStats[1].Count != 1 {
+		t.Fatalf("radio counts wrong: %+v", radio.OptionStats)
+	}
+
+	// checkbox：A 2 / B 1，回答数 2，总勾选数 3（A、B、A）
+	cb := stats[1]
+	if cb.Total != 2 || cb.OptionStats[0].Count != 2 || cb.OptionStats[1].Count != 1 {
+		t.Fatalf("checkbox stats wrong: total=%d %+v", cb.Total, cb.OptionStats)
+	}
+	if cb.TotalSelections != 3 {
+		t.Fatalf("checkbox TotalSelections wrong: got %d, want 3", cb.TotalSelections)
+	}
+
+	// rating：均值 (9+7+8)/3=8.0，总 3
+	rating := stats[2]
+	if rating.Total != 3 || rating.AvgRating < 7.99 || rating.AvgRating > 8.01 {
+		t.Fatalf("rating stats wrong: total=%d avg=%f", rating.Total, rating.AvgRating)
+	}
+	if len(rating.RatingCounts) != 10 {
+		t.Fatalf("rating counts must have 10 buckets, got %d", len(rating.RatingCounts))
+	}
+
+	// rank：X 平均 2，Y 平均 5/3≈1.67，Z 平均 7/3≈2.33，整体平均 2.0
+	rank := stats[3]
+	if rank.Total != 3 || rank.AvgRank < 1.99 || rank.AvgRank > 2.01 {
+		t.Fatalf("rank avg wrong: total=%d avg=%f", rank.Total, rank.AvgRank)
+	}
+	if rank.OptionStats[0].AvgRank < 1.99 || rank.OptionStats[0].AvgRank > 2.01 {
+		t.Fatalf("rank option X avg wrong: %f", rank.OptionStats[0].AvgRank)
+	}
+	if rank.OptionStats[1].AvgRank < 1.66 || rank.OptionStats[1].AvgRank > 1.68 {
+		t.Fatalf("rank option Y avg wrong: %f", rank.OptionStats[1].AvgRank)
+	}
+
+	// number：均值 (3+5+10)/3=6
+	num := stats[4]
+	if num.Total != 3 || num.AvgNumber < 5.99 || num.AvgNumber > 6.01 {
+		t.Fatalf("number stats wrong: total=%d avg=%f", num.Total, num.AvgNumber)
+	}
+
+	// textarea：填写 1；文本字段的"回答数"(Total) 应与"已填写数"(TextCount) 一致
+	text := stats[5]
+	if text.TextCount != 1 {
+		t.Fatalf("textarea count wrong: %d", text.TextCount)
+	}
+	if text.Total != text.TextCount {
+		t.Fatalf("textarea total should equal filled count, got total=%d filled=%d", text.Total, text.TextCount)
+	}
+}
+
+func TestAggregateFormFieldStatsEmpty(t *testing.T) {
+	fields := []*db.VoteFormField{
+		{Model: dbutil.Model{ID: 1}, VoteID: 9, FieldType: db.VoteFormFieldTypeRadio, Label: "满意度", Options: `["满意","一般"]`},
+	}
+	old := db.VoteSubmissions
+	defer func() { db.VoteSubmissions = old }()
+	db.VoteSubmissions = &mockVoteSubmissions{submissions: []*db.VoteSubmission{}}
+
+	stats := aggregateFormFieldStatsWithSubs(fields, nil)
+	if len(stats) != 1 || stats[0].Total != 0 || stats[0].OptionStats[0].Count != 0 {
+		t.Fatalf("empty stats wrong: %+v", stats)
+	}
+}
+
+// TestAggregateFormFieldStatsCustom 验证"允许补充自定义选项"字段：非预置值归入 CustomStats（按文本去重计数）。
+func TestAggregateFormFieldStatsCustom(t *testing.T) {
+	fields := []*db.VoteFormField{
+		{Model: dbutil.Model{ID: 1}, VoteID: 9, FieldType: db.VoteFormFieldTypeRadio, Label: "满意度", Options: `["满意","一般"]`, AllowCustom: true},
+		{Model: dbutil.Model{ID: 2}, VoteID: 9, FieldType: db.VoteFormFieldTypeCheckbox, Label: "多选", Options: `["A","B"]`, AllowCustom: true},
+		// 未开启 AllowCustom 的字段：非预置值仍按普通值计数（不归入 CustomStats）
+		{Model: dbutil.Model{ID: 3}, VoteID: 9, FieldType: db.VoteFormFieldTypeRadio, Label: "无自定义", Options: `["X"]`},
+	}
+	subs := []*db.VoteSubmission{
+		{VoteID: 9, FormData: formData(t, map[string]interface{}{
+			"满意度": "满意", "多选": []string{"A", "自定义甲"}, "无自定义": "X",
+		})},
+		{VoteID: 9, FormData: formData(t, map[string]interface{}{
+			"满意度": "自定义乙", "多选": []string{"自定义甲", "B"},
+		})},
+		{VoteID: 9, FormData: formData(t, map[string]interface{}{
+			"满意度": "自定义乙", "多选": []string{"A"},
+		})},
+	}
+	stats := aggregateFormFieldStatsWithSubs(fields, subs)
+
+	// radio（AllowCustom）：满意 1 / 一般 0 / 自定义乙 2 / 自定义甲 0 → CustomStats 仅"自定义乙"计 2
+	radio := stats[0]
+	if radio.Total != 3 {
+		t.Fatalf("radio total wrong: %d", radio.Total)
+	}
+	if radio.OptionStats[0].Count != 1 || radio.OptionStats[1].Count != 0 {
+		t.Fatalf("radio preset counts wrong: %+v", radio.OptionStats)
+	}
+	if len(radio.CustomStats) != 1 || radio.CustomStats[0].Text != "自定义乙" || radio.CustomStats[0].Count != 2 {
+		t.Fatalf("radio custom stats wrong: %+v", radio.CustomStats)
+	}
+
+	// checkbox（AllowCustom）：A 2 / B 1 / 自定义甲 2（两条提交各选一次）→ CustomStats 计 2
+	cb := stats[1]
+	if cb.Total != 3 || cb.TotalSelections != 5 {
+		t.Fatalf("checkbox total/selections wrong: total=%d sel=%d", cb.Total, cb.TotalSelections)
+	}
+	if cb.OptionStats[0].Count != 2 || cb.OptionStats[1].Count != 1 {
+		t.Fatalf("checkbox preset counts wrong: %+v", cb.OptionStats)
+	}
+	if len(cb.CustomStats) != 1 || cb.CustomStats[0].Text != "自定义甲" || cb.CustomStats[0].Count != 2 {
+		t.Fatalf("checkbox custom stats wrong: %+v", cb.CustomStats)
+	}
+
+	// 未开启 AllowCustom 的字段：非预置值不应出现（提交校验已拦截），即使出现也只按普通值计数
+	noCustom := stats[2]
+	if noCustom.Total != 1 || len(noCustom.CustomStats) != 0 {
+		t.Fatalf("no-custom field should not produce CustomStats: %+v", noCustom)
+	}
+}
diff --git a/scripts/edgeone-origin-whitelist.sh b/scripts/edgeone-origin-whitelist.sh
new file mode 100644
index 0000000..a4dcc34
--- /dev/null
+++ b/scripts/edgeone-origin-whitelist.sh
@@ -0,0 +1,522 @@
+#!/usr/bin/env bash
+# =============================================================================
+# edgeone-origin-whitelist.sh
+# EdgeOne 回源端口白名单自动维护脚本（Linux / iptables + ipset）
+#
+# 背景
+#   TamaBox 源站对公网开放了一个回源端口给腾讯 EdgeOne 回源使用。
+#   若不做任何限制，任何人都可直连"服务器 IP + 端口"绕过 CDN 直打源站。
+#   本脚本把该端口收敛为白名单：仅放行 EdgeOne 回源网段（+ 本机回环，
+#   供 cloudflared Tunnel 本地回连），其余一律拒绝（tcp-reset）。
+#
+# 设计要点
+#   1. 白名单存放于 ipset 集合 EO_ORIGIN（hash:net / IPv4）。
+#      更新采用「临时集合填充 -> ipset swap -> 销毁临时集合」原子替换，
+#      iptables 规则全程引用同名集合，更新过程零规则窗口、失败不影响现网。
+#   2. iptables 自建链 EO_IN 只建立一次（幂等，内容恒定）：
+#         -m set EO_ORIGIN src            -> ACCEPT  (EdgeOne 回源)
+#         其余 (-p tcp)                   -> REJECT tcp-reset
+#      （注：iptables-nft 要求 --reject-with tcp-reset 必须带 -p tcp，否则 EINVAL）
+#      INPUT 跳转默认【只对公网网卡 eth0 生效】（见 EO_IFACE 配置）：
+#         -i lo    -p tcp --dport <PORT>  -> ACCEPT  (cloudflared Tunnel 本机回连)
+#         -i eth0  -p tcp --dport <PORT>  -> EO_IN   (仅判定 eth0 入站流量)
+#      EO_IFACE 留空 = 不限网卡（EO_IN 内另有 127.0.0.0/8 -> ACCEPT 兜回环，
+#      即脚本早期行为）。之后白名单增删只改 ipset 集合，EO_IN 与 INPUT 规则永不动。
+#   3. 清单来源（可同时启用，取并集）：
+#      - 本地文件 CIDR_FILE：每行一个 IPv4 CIDR，# 开头为注释（裸 IP 视作 /32 亦可）
+#      - 远程 URL CIDR_URL：返回纯文本、每行一个 IPv4 CIDR
+#      官方来源说明：EdgeOne「源站防护(Origin ACL)」是唯一官方回源网段
+#      来源，但仅付费套餐支持（免费版不提供，见腾讯文档 1552/76086）。
+#      🔴 免费档方案定稿（2026-09-03 实测）：EO 回源出口是海量轮换节点池
+#      （一次 23s tcpdump 见 13 出口、散布多个 /16），逐 IP 采种白名单=打地鼠，
+#      必然间歇漏放 → 境内 521。请直接放行腾讯云 EO 大段（脚本原生支持 CIDR）：
+#      实测生效清单 = 43.146/43.152/43.168/43.174/43.175 五个 /16（521 消失）。
+#      learn/auto 降级为「新段预警」：月度跑 auto，采到清单外 IP 时 whois 归段
+#      （属腾讯云 EO 则整段补入 cidr.txt 再 sync）。升级付费档后 API 结果写清单即可。
+#   4. fail-safe：清单为空 / 全部非法 / 拉取失败 -> 直接退出(非 0)，
+#      绝不触碰现网规则（宁可保持旧白名单，不可误删导致裸奔）。
+#   5. IPv6 说明：脚本只管理 IPv4（iptables / ipset family inet），IPv6 流量
+#      不受本脚本任何规则影响。TamaBox 部署为 listen=0.0.0.0（仅 IPv4 监听、
+#      无 AAAA），IPv6 上根本不存在该回源端口 —— IPv6 用户经 CDN 访问时由
+#      CDN 边缘走 IPv4 回源到本机，一切正常，无需任何 ip6tables 规则。
+#      若日后改为监听 [::]:PORT 并向 EO 开放 IPv6 回源，才需另行扩展
+#      ip6tables + family inet6 的 ipset（等价镜像本脚本逻辑）。
+#
+# 用法
+#   默认只对公网网卡 eth0 生效；网卡不同请改脚本头 EO_IFACE，或运行时覆盖：
+#   sudo EO_IFACE=ens3 ./edgeone-origin-whitelist.sh sync
+#   sudo ./edgeone-origin-whitelist.sh sync          # 更新白名单（供 cron/systemd 周期调用；段级清单推荐每 3 天）
+#   sudo ./edgeone-origin-whitelist.sh sync --dry-run# 演练：只打印将执行的动作，不触碰系统
+#   sudo ./edgeone-origin-whitelist.sh auto          # 新段预警：采集回源 IP → 合并清单 → 有新增即 sync
+#   sudo ./edgeone-origin-whitelist.sh learn         # 即时观测：当前连接回源端口 18080 的来源 IP（不必用于日常维护）
+#   sudo ./edgeone-origin-whitelist.sh show          # 查看当前白名单与规则状态
+#   sudo ./edgeone-origin-whitelist.sh flush         # 移除本脚本管理的全部规则与集合（回滚）
+#
+# 依赖: bash, ipset, iptables, (可选) curl 或 wget
+#   Debian/Ubuntu:  apt-get install -y ipset iptables curl
+#   说明: 本机为低配服务器，可先用 `sudo apt-get install -y ipset` 补齐。
+#
+# 2026-09-03  TamaBox 项目
+# =============================================================================
+
+set -u
+
+# ---- 可配置区（按需修改，或用环境变量覆盖）----------------------------------
+# 目标回源端口（务必改成你 EO 回源配置里填写的实际端口！）
+: "${EO_PORT:=5877}"
+# 入站网卡限定：只对【该网卡】入站的回源端口流量执行白名单。默认 eth0。
+#   ⚠️ 公网网卡不叫 eth0 时务必改（`ip route get 1.1.1.1` 可确认网卡名），
+#      否则跳转规则永不命中，该端口等于对全世界裸奔！
+#   留空 = 不限网卡（所有网卡入站都判定，即脚本早期行为）。
+: "${EO_IFACE:=eth0}"
+# 本脚本管理的 ipset 集合名与 iptables 链名（一般无需改动）
+: "${EO_SET:=EO_ORIGIN}"
+: "${EO_CHAIN:=EO_IN}"
+# 本地清单文件：每行一个 IPv4 CIDR，# 开头为注释（不存在则忽略）
+: "${EO_CIDR_FILE:=/etc/edgeone-origin/cidr.txt}"
+# 远程清单 URL（可选）：返回纯文本、每行一个 IPv4 CIDR。留空则仅用本地文件
+: "${EO_CIDR_URL:=}"
+# 日志文件
+: "${EO_LOG:=/var/log/eo-origin-whitelist.log}"
+# 放行本机回环到回源端口（cloudflared Tunnel 本机回连需要，保持 true）
+: "${EO_ALLOW_LOOPBACK:=true}"
+# auto 子命令的 tcpdump 采样窗口（秒）。0=不抓包（默认，仅 ss+conntrack 瞬时采样）。
+#   回源是短连接、瞬时采样易错过 → 若 auto 常采不到 IP，设如 60~300：每次 auto
+#   先抓一段窗口内的回源 SYN 再合并（需已装 tcpdump；期间 auto 会阻塞该秒数）。
+: "${EO_SAMPLE_SECONDS:=0}"
+# ---- 可配置区结束 -----------------------------------------------------------
+
+CMD="${1:-sync}"
+shift 2>/dev/null || true
+DRY=0
+for a in "$@"; do
+  case "$a" in
+    --dry-run) DRY=1 ;;
+    *) echo "未知参数: $a" >&2; exit 2 ;;
+  esac
+done
+
+log() { echo "[$(date '+%F %T')] $*" | tee -a "$EO_LOG" >&2; }
+need_root() {
+  if [ "$(id -u)" -ne 0 ]; then
+    echo "错误：需要 root 权限运行（iptables/ipset 需要）。请使用 sudo。" >&2
+    exit 3
+  fi
+}
+
+# 校验是否为合法 IPv4 地址/CIDR；裸 IP（无前缀）按 /32 视为合法
+# （learn 子命令输出的就是裸 IP，必须能被清单接受）
+valid_v4_cidr() {
+  local c="$1" ip pfx o1 o2 o3 o4 o
+  case "$c" in
+    ''|*[!0-9./]*|*.*.*.*.*) return 1 ;;
+  esac
+  ip="${c%/*}"
+  pfx="${c#*/}"
+  if [ "$ip" = "$c" ]; then
+    pfx=32                       # 无 / 前缀 -> 单 IP，等价 /32
+  fi
+  case "$pfx" in
+    ''|*[!0-9]*) return 1 ;;
+  esac
+  [ "$pfx" -ge 0 ] 2>/dev/null && [ "$pfx" -le 32 ] 2>/dev/null || return 1
+  IFS=. read -r o1 o2 o3 o4 <<<"$ip"
+  for o in "$o1" "$o2" "$o3" "$o4"; do
+    case "$o" in
+      ''|*[!0-9]*) return 1 ;;
+    esac
+    [ "$o" -ge 0 ] 2>/dev/null && [ "$o" -le 255 ] 2>/dev/null || return 1
+  done
+  return 0
+}
+
+# 收集全部合法 CIDR：本地文件 + 远程 URL 的并集（去重）
+collect_cidrs() {
+  local tmp
+  tmp="$(mktemp)"
+  local ok=1
+  if [ -f "$EO_CIDR_FILE" ]; then
+    grep -vE '^[[:space:]]*(#|$)' "$EO_CIDR_FILE" 2>/dev/null | sed 's/[[:space:]]//g' >>"$tmp" || true
+  fi
+  if [ -n "$EO_CIDR_URL" ]; then
+    if command -v curl >/dev/null 2>&1; then
+      curl -fsSL --max-time 20 "$EO_CIDR_URL" 2>/dev/null >>"$tmp" || ok=0
+    elif command -v wget >/dev/null 2>&1; then
+      wget -qO- --timeout=20 "$EO_CIDR_URL" 2>/dev/null >>"$tmp" || ok=0
+    else
+      echo "警告：未安装 curl/wget，无法拉取远程清单 $EO_CIDR_URL" >&2
+      ok=0
+    fi
+  fi
+  # 过滤合法 CIDR 并去重
+  local out
+  out="$(mktemp)"
+  while IFS= read -r line || [ -n "$line" ]; do
+    if valid_v4_cidr "$line"; then echo "$line" >>"$out"; fi
+  done <"$tmp"
+  rm -f "$tmp"
+  sort -u -t. -k1,1n -k2,2n -k3,3n -k4,4n "$out"
+  rm -f "$out"
+  return $ok
+}
+
+# 一次性建立 iptables 骨架（幂等；已存在则跳过，永不在 sync 中重建，保证零窗口）
+setup_iptables() {
+  # 0. 先确保 ipset 集合存在 —— 🔴 iptables-nft(nf_tables) 硬性要求：
+  #    引用集合的规则只能在集合已存在时添加；顺序反了会报
+  #    "Set XXX doesn't exist" / "RULE_APPEND failed (Invalid argument)"，
+  #    且失败残留会让后续 sync 无法自愈（曾实测踩坑，2026-09-03）。
+  #    集合创建失败则中止，绝不带着残缺骨架继续。
+  if ! ipset list "$EO_SET" >/dev/null 2>&1; then
+    ipset create "$EO_SET" hash:net family inet hashsize 1024 maxelem 65536 || {
+      log "错误：创建 ipset $EO_SET 失败"; return 1; }
+    log "已创建 ipset 集合 $EO_SET（当前为空，等待 sync 填充）"
+  fi
+  local tmp
+  tmp="$(iptables -L "$EO_CHAIN" -n >/dev/null 2>&1; echo $?)"
+  if [ "$tmp" -ne 0 ]; then
+    log "建立自建链 $EO_CHAIN ..."
+    iptables -N "$EO_CHAIN" || { log "错误：创建链 $EO_CHAIN 失败"; return 1; }
+  fi
+  # 自建链内容（恒定，仅首次填充；若因故为空则重建）
+  #   127.0.0.0/8 回环行：仅「不限网卡模式」经 EO_IN 命中；限定网卡模式（默认）
+  #   下回环改由 INPUT 的 -i lo ACCEPT 负责，本行保留但不会被命中（冗余无害）。
+  if ! iptables -C "$EO_CHAIN" -s 127.0.0.0/8 -j ACCEPT >/dev/null 2>&1; then
+    iptables -A "$EO_CHAIN" -s 127.0.0.0/8 -j ACCEPT
+  fi
+  if ! iptables -C "$EO_CHAIN" -m set --match-set "$EO_SET" src -j ACCEPT >/dev/null 2>&1; then
+    iptables -A "$EO_CHAIN" -m set --match-set "$EO_SET" src -j ACCEPT
+  fi
+  # 🔴 兜底拒绝必须带 -p tcp：iptables-nft(nf_tables) 下 --reject-with tcp-reset
+  #    要求规则已匹配 TCP 协议，否则内核校验失败报
+  #    "RULE_APPEND failed (Invalid argument)"（实测踩坑，2026-09-03）。
+  #    链尾缺此行 = 非白名单流量落回 INPUT 默认策略，白名单形同虚设！
+  #    本链仅接收 INPUT 中 -p tcp --dport <PORT> 跳转的流量，加 -p tcp 语义不变。
+  if ! iptables -C "$EO_CHAIN" -p tcp -j REJECT --reject-with tcp-reset >/dev/null 2>&1; then
+    iptables -A "$EO_CHAIN" -p tcp -j REJECT --reject-with tcp-reset
+  fi
+  # INPUT 跳转规则（幂等）。默认「仅公网网卡 eth0」：-i lo 单独放行（cloudflared
+  # 回环回连，与网卡限定解耦），-i eth0 的入站流量才进 EO_IN 判定。
+  if [ -n "$EO_IFACE" ]; then
+    # 升级清理：若曾按「不限网卡」模式插过旧跳转，先移除（不存在则忽略）
+    iptables -D INPUT -p tcp --dport "$EO_PORT" -j "$EO_CHAIN" >/dev/null 2>&1
+    if [ "$EO_ALLOW_LOOPBACK" = "true" ]; then
+      if ! iptables -C INPUT -p tcp --dport "$EO_PORT" -i lo -j ACCEPT >/dev/null 2>&1; then
+        iptables -I INPUT 1 -p tcp --dport "$EO_PORT" -i lo -j ACCEPT
+        log "INPUT 已插入(回环放行): -p tcp --dport $EO_PORT -i lo -j ACCEPT"
+      fi
+    fi
+    if ! iptables -C INPUT -p tcp --dport "$EO_PORT" -i "$EO_IFACE" -j "$EO_CHAIN" >/dev/null 2>&1; then
+      iptables -I INPUT 1 -p tcp --dport "$EO_PORT" -i "$EO_IFACE" -j "$EO_CHAIN"
+      log "INPUT 已插入: -p tcp --dport $EO_PORT -i $EO_IFACE -j $EO_CHAIN"
+    fi
+  else
+    # 不限网卡模式（早期行为）：回环由 EO_IN 首行 127.0.0.0/8 -> ACCEPT 负责
+    if ! iptables -C INPUT -p tcp --dport "$EO_PORT" -j "$EO_CHAIN" >/dev/null 2>&1; then
+      iptables -I INPUT 1 -p tcp --dport "$EO_PORT" -j "$EO_CHAIN"
+      log "INPUT 已插入: -p tcp --dport $EO_PORT -j $EO_CHAIN"
+    fi
+  fi
+  return 0
+}
+
+# 原子替换集合内容（临时集合 -> swap -> 销毁；iptables 引用同名集合不受影响）
+sync_set() {
+  local tmp_set list n=0
+  tmp_set="${EO_SET}_tmp_$$"
+  list="$(mktemp)"
+  cat >"$list"                            # 从 stdin 读入 CIDR
+  n="$(wc -l <"$list")"
+  if [ "$n" -eq 0 ]; then
+    log "错误：清单为空，拒绝更新（保持现有白名单不变）"
+    rm -f "$list"; return 1
+  fi
+  if [ "$DRY" -eq 1 ]; then
+    log "[dry-run] 将加载 $n 个 CIDR 到 $EO_SET"
+    sed 's/^/    + /' "$list"
+    rm -f "$list"; return 0
+  fi
+  ipset create "$tmp_set" hash:net family inet hashsize 1024 maxelem 65536 2>/dev/null || {
+    log "错误：创建临时集合 $tmp_set 失败"; rm -f "$list"; return 1; }
+  local line rc=0
+  while IFS= read -r line || [ -n "$line" ]; do
+    ipset add "$tmp_set" "$line" 2>/dev/null || rc=1
+  done <"$list"
+  rm -f "$list"
+  if [ "$rc" -ne 0 ]; then
+    log "警告：个别 CIDR 添加失败（可能已存在或语法异常），继续执行"
+  fi
+  ipset swap "$EO_SET" "$tmp_set" || { log "错误：ipset swap 失败"; ipset destroy "$tmp_set" 2>/dev/null; return 1; }
+  ipset destroy "$tmp_set" 2>/dev/null
+  return 0
+}
+
+# 检测 ufw 等可能存在的"全局放行该端口"的规则，提醒用户收敛
+warn_open_rules() {
+  if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -qE "^$EO_PORT\b|:$EO_PORT\b"; then
+    log "⚠️ 检测到 ufw 正在放行端口 $EO_PORT（ANYWHERE）。请执行 ufw delete allow $EO_PORT 撤掉全局放行，"
+    log "   否则白名单形同虚设（虽然本脚本的 REJECT 兜底仍会先拦截非白名单，但规则冗余易误判）。"
+  fi
+  if iptables -S INPUT | grep -E -- "--dport $EO_PORT([ /]|$)" | grep -vE "jump $EO_CHAIN|set| -i lo" | grep -qE "ACCEPT|ALLOW"; then
+    log "⚠️ INPUT 中存在非本脚本管理的放行规则匹配端口 $EO_PORT，请人工核对是否应删除。"
+  fi
+}
+
+cmd_sync() {
+  need_root
+  # 1. 校验依赖
+  for b in ipset iptables; do
+    command -v "$b" >/dev/null 2>&1 || { echo "错误：缺少依赖 $b。Debian/Ubuntu 执行: apt-get install -y $b" >&2; exit 4; }
+  done
+  # 2. 收集清单（本地 + 远程）。collect_cidrs 返回 0 = 出现过来源失败，1 = 来源均正常
+  local cidrs ok
+  cidrs="$(mktemp)"
+  collect_cidrs >"$cidrs"
+  ok=$?
+  local n
+  n="$(wc -l <"$cidrs")"
+  # 真·来源全部失败：配置了 URL 且拉取失败，同时本地文件无任何条目
+  if [ "$ok" -eq 0 ] && [ "$n" -eq 0 ]; then
+    log "错误：清单来源全部失败（EO_CIDR_URL=${EO_CIDR_URL:-未配置} 拉取失败，且本地文件 $EO_CIDR_FILE 无有效条目）"
+    rm -f "$cidrs"; exit 1
+  fi
+  if [ "$n" -eq 0 ]; then
+    local src_msg
+    if [ -f "$EO_CIDR_FILE" ]; then
+      src_msg="文件 $EO_CIDR_FILE 存在但无有效 IPv4/CIDR 条目"
+    else
+      src_msg="文件 $EO_CIDR_FILE 不存在"
+    fi
+    log "错误：清单为空（$src_msg；EO_CIDR_URL=${EO_CIDR_URL:-未配置}）——保持现网白名单不变（fail-safe）"
+    log "提示：空清单拒绝更新是保护机制（绝不拿空白名单上线）。若尚未生成清单："
+    log "      段级定稿方案（2026-09-03 实测，勿再逐 IP 采种）：cidr.txt 直接放行"
+    log "      EO 所属腾讯云大段，实测生效：43.146/43.152/43.168/43.174/43.175 五个 /16，"
+    log "      逐行写入 $EO_CIDR_FILE 后重试本命令（脚本原生支持 CIDR；详细见脚本头注释 3）"
+    rm -f "$cidrs"; exit 1
+  fi
+  log "收集到 $n 个合法 IPv4 CIDR（来源: $EO_CIDR_FILE${EO_CIDR_URL:+ + $EO_CIDR_URL}）"
+  # 3. 建立骨架（幂等）
+  setup_iptables || { rm -f "$cidrs"; exit 1; }
+  # 4. 原子更新集合
+  if [ "$DRY" -eq 0 ]; then
+    sync_set <"$cidrs" || { rm -f "$cidrs"; exit 1; }
+    log "白名单已更新（swap 完成），当前生效 $(ipset list "$EO_SET" -t 2>/dev/null | awk '/Number of entries/{print $NF}') 个条目"
+  else
+    sync_set <"$cidrs"
+  fi
+  rm -f "$cidrs"
+  warn_open_rules
+  log "sync 完成"
+}
+
+cmd_learn() {
+  need_root
+  echo "# EdgeOne 回源端口 $EO_PORT 当前活跃连接来源 IP（$(date '+%F %T')）" >&2
+  echo "# 说明：以下 IP 是此刻正在回源到本机的 EO 边缘出口 IP。可多时段多次执行" >&2
+  echo "#      并去重合并后作为种子清单写入 $EO_CIDR_FILE；人工审阅后启用白名单。" >&2
+  echo "#      仅输出 IPv4（脚本白名单只管理 IPv4，见头注释 5）。" >&2
+  local out
+  out="$(ss -Htn state established "( sport = :$EO_PORT )" 2>/dev/null \
+    | awk '{print $5}' \
+    | sed -E 's/^\[([0-9a-fA-F:]+)\]:.*/\1/; s/:[0-9]+$//' \
+    | grep -vE '^127\.|^::1$' \
+    | grep -v ':' \
+    | sort -u)"
+  if [ -z "$out" ]; then
+    echo "（0 条活跃连接：当前没有正在回源的 EO 连接）" >&2
+    echo "排查提示：" >&2
+    echo "  ① 端口核对：TamaBox 实际监听端口是否 = EO_PORT=$EO_PORT？" >&2
+    echo "     执行: ss -tlnp | grep LISTEN（应看到 0.0.0.0:$EO_PORT 的监听行）" >&2
+    echo "  ② 制造流量：需【境内网络】访问站点才会走 EO 直连回源（境外访问走 CF Tunnel，" >&2
+    echo "     对端是 127.0.0.1 会被过滤）。访问后立刻重跑本命令；回源是短连接，错过即无。" >&2
+    echo "  ③ 看含 TIME-WAIT 的痕迹（访问后 60 秒内）：ss -Htan | grep :$EO_PORT" >&2
+    echo "  ④ 最稳办法：tcpdump -ni <网卡> tcp port $EO_PORT and 'tcp[tcpflags] & tcp-syn != 0'" >&2
+    echo "     然后触发一次境内访问，出现的源 IP 即 EO 回源 IP。" >&2
+  else
+    echo "$out"
+  fi
+}
+
+# 采集「正在/近期」回源到本机 $EO_PORT 的出口 IP（并集，尽力而为，允许部分来源缺失）：
+#   ① ss established   —— 此刻活跃连接（与 learn 同源）
+#   ② conntrack        —— 近期连接（窗口比 ss 宽：TIME_WAIT 等保留态；工具缺失时读 /proc/net/nf_conntrack）
+#   ③ tcpdump 采样窗口 —— EO_SAMPLE_SECONDS>0 时抓窗口内回源 SYN（回源短连接错过即无，抓包最稳）
+#   仅输出 IPv4 裸 IP（去重）；IPv6/回环/本机地址一律剔除。
+collect_live_ips() {
+  local tmp
+  tmp="$(mktemp)"
+  # ① ss（此刻活跃）
+  ss -Htn state established "( sport = :$EO_PORT )" 2>/dev/null \
+    | awk '{print $5}' \
+    | sed -E 's/^\[([0-9a-fA-F:]+)\].*/\1/; s/:[0-9]+$//' >>"$tmp"
+  # ② conntrack（近期；优先工具，缺失回退 /proc）
+  if command -v conntrack >/dev/null 2>&1; then
+    conntrack -L -p tcp --dport "$EO_PORT" 2>/dev/null \
+      | awk '{for(i=1;i<=NF;i++) if($i~/^src=/){split($i,a,"="); print a[2]; break}}' >>"$tmp"
+  elif [ -r /proc/net/nf_conntrack ]; then
+    awk -v p="$EO_PORT" '
+      { for(i=1;i<=NF;i++){
+          if($i ~ /^dport=/){
+            split($i,a,"=")
+            if(a[2]==p){ for(j=1;j<i;j++) if($j~/^src=/){split($j,b,"="); print b[2]; break} break }
+          } } }' /proc/net/nf_conntrack >>"$tmp"
+  fi
+  # ③ tcpdump 窗口（可选）：EO_SAMPLE_SECONDS 必须为正整数秒
+  if [ -n "${EO_SAMPLE_SECONDS:-}" ]; then
+    case "$EO_SAMPLE_SECONDS" in
+      ''|*[!0-9]*)
+        log "提示：EO_SAMPLE_SECONDS 必须为正整数秒（当前值: ${EO_SAMPLE_SECONDS}），已跳过 tcpdump 窗口采样"
+        ;;
+      *)
+        if [ "$EO_SAMPLE_SECONDS" -gt 0 ] 2>/dev/null; then
+          if command -v tcpdump >/dev/null 2>&1; then
+            log "tcpdump 采样 ${EO_SAMPLE_SECONDS}s（网卡 ${EO_IFACE:-any}），请稍候 ..."
+            # 🔴 坑（实测，2026-09-03）：filter 必须不带引号！手动执行时单引号由 shell
+            #    吃掉；脚本里写在双引号内会变成【字面单引号】传给 tcpdump，pcap 编译器
+            #    不认识引号 → syntax error 立即退出 → 表现为「没等窗口就结束、采到 0 个」。
+            #    双引号内写裸 filter 即可（无空格歧义，变量已展开）。
+            timeout "$EO_SAMPLE_SECONDS" tcpdump -ni "${EO_IFACE:-any}" \
+                "tcp port $EO_PORT and tcp[tcpflags] & tcp-syn != 0" 2>/dev/null \
+              | awk '{ for (i=1; i<NF; i++) if ($(i+1) == ">") { print $i; break } }' \
+              | sed -E 's/\.[0-9]+$//' >>"$tmp"
+            log "tcpdump 采样结束"
+          else
+            log "提示：EO_SAMPLE_SECONDS=$EO_SAMPLE_SECONDS 但未安装 tcpdump，跳过窗口采样（apt-get install -y tcpdump）"
+          fi
+        fi
+        ;;
+    esac
+  fi
+  # 统一清洗：IPv6(含冒号) / 回环 / 非 IP 剔除，去重
+  grep -vE '^127\.|^::1$' "$tmp" | grep -v ':' | sort -u
+  rm -f "$tmp"
+}
+
+# 把采样到的 IP 增量合并进清单文件（只增不删）。返回码：
+#   0 = 有新增（文件已更新，调用方应触发 sync）；1 = 无新增；2 = 采到为空且清单无条目；3 = 写入失败
+merge_live_ips() {
+  local ips="$1" old new n_old n_new
+  old="$(mktemp)"; new="$(mktemp)"
+  if [ -f "$EO_CIDR_FILE" ]; then
+    grep -vE '^[[:space:]]*(#|$)' "$EO_CIDR_FILE" | sed 's/[[:space:]]//g' | sort -u >"$old"
+  fi
+  # 新集合 = 旧条目 ∪ 本次采样（逐条过合法性校验）
+  { cat "$old"; printf '%s\n' "$ips"; } \
+    | while IFS= read -r l || [ -n "$l" ]; do
+        if [ -n "$l" ] && valid_v4_cidr "$l"; then echo "$l"; fi
+      done | sort -u >"$new"
+  n_new="$(wc -l <"$new")"
+  if [ "$n_new" -eq 0 ]; then
+    rm -f "$old" "$new"; return 2
+  fi
+  if [ "$DRY" -eq 1 ]; then
+    local added
+    added="$(comm -13 "$old" "$new")"
+    if [ -n "$added" ]; then
+      echo "将新增到 $EO_CIDR_FILE："
+      echo "$added" | sed 's/^/    + /'
+    else
+      echo "无新增（清单与采样一致）"
+    fi
+    rm -f "$old" "$new"; return 0
+  fi
+  n_old="$(wc -l <"$old")"
+  # 无变化：不写文件（保留原时间戳/注释），返回 1
+  if [ "$n_old" -eq "$n_new" ] && ! comm -3 "$old" "$new" | grep -q .; then
+    rm -f "$old" "$new"; return 1
+  fi
+  # 写回：原 # 注释行（若有）置于文件头，其后为排序后的条目；原子替换
+  mkdir -p "$(dirname "$EO_CIDR_FILE")" || { rm -f "$old" "$new"; return 3; }
+  { grep -E '^[[:space:]]*#' "$EO_CIDR_FILE" 2>/dev/null; cat "$new"; } \
+    >"${EO_CIDR_FILE}.tmp" || { rm -f "$old" "$new"; return 3; }
+  mv "${EO_CIDR_FILE}.tmp" "$EO_CIDR_FILE" || { rm -f "$old" "$new"; return 3; }
+  comm -13 "$old" "$new" | sed 's/^/    + /'
+  rm -f "$old" "$new"
+  return 0
+}
+
+# 自动收集并应用（定时入口，推荐 cron/systemd 每天调用）：
+#   采集回源 IP -> 增量合并进清单（只增不删）-> 有新增则 sync 应用。
+#   说明：失效/旧节点条目不在此自动移除（地址属 EO、无安全风险，见 guide §4.4）；
+#   人工删掉清单条目后，本命令内的 sync 会自动完成剔除落地。
+cmd_auto() {
+  need_root
+  log "auto 开始：采集 EO 回源 IP 并合并白名单 ..."
+  local ips n rc
+  ips="$(collect_live_ips)"
+  n=0
+  [ -n "$ips" ] && n="$(printf '%s\n' "$ips" | wc -l)"
+  log "采样到 $n 个回源 IP（ss${EO_SAMPLE_SECONDS:+ + tcpdump $EO_SAMPLE_SECONDS s}，conntrack 视可用性）"
+  merge_live_ips "$ips"
+  rc=$?
+  case "$rc" in
+    0)
+      log "清单已更新（只增不删，不影响既有条目）；调用 sync 应用 ..."
+      cmd_sync
+      ;;
+    1)
+      log "无新增回源 IP，清单与白名单保持现状"
+      ;;
+    2)
+      log "未采到任何回源 IP（清单也为空）——不生成空清单（fail-safe），保持现状"
+      echo "  排查提示：" >&2
+      echo "  ① auto 依赖真实 EO 回源流量：需【境内网络】访问站点触发 EO 直连回源" >&2
+      echo "    （境外访问走 CF Tunnel，对端 127.0.0.1 被过滤，永远采不到）；" >&2
+      echo "  ② 端口核对：TamaBox 监听端口是否 = EO_PORT=$EO_PORT（ss -tlnp | grep LISTEN）；" >&2
+      echo "  ③ 提高命中率：设 EO_SAMPLE_SECONDS=60~300 让每次 auto 附带抓包窗口" >&2
+      echo "    （需 apt-get install -y tcpdump），或把定时改到境内访问高峰时段。" >&2
+      ;;
+    3)
+      log "错误：清单文件写入失败"
+      exit 1
+      ;;
+  esac
+  log "auto 完成"
+}
+
+cmd_show() {
+  need_root
+  echo "== ipset 集合 $EO_SET =="
+  if ipset list "$EO_SET" >/dev/null 2>&1; then
+    ipset list "$EO_SET" -t
+    echo "-- 条目 --"
+    ipset list "$EO_SET" | sed -n '/Members:/,$p' | grep -v '^Members:' | grep -vE '^$' | head -40
+  else
+    echo "（集合不存在，尚未初始化）"
+  fi
+  echo
+  echo "== iptables INPUT 相关规则 =="
+  iptables -S INPUT | grep -E -- "--dport $EO_PORT|jump $EO_CHAIN|^-A INPUT -i lo" || echo "（无）"
+  echo
+  echo "== 自建链 $EO_CHAIN =="
+  iptables -S "$EO_CHAIN" 2>/dev/null || echo "（链不存在）"
+}
+
+cmd_flush() {
+  need_root
+  echo "将移除：INPUT 跳转规则、自建链 $EO_CHAIN、ipset 集合 $EO_SET（仅本脚本管理部分）"
+  if [ "$DRY" -eq 1 ]; then echo "[dry-run] 未执行任何操作"; return 0; fi
+  # 删除 INPUT 中所有指向本链的规则（含历史多端口残留）
+  iptables-save | grep -E -- "^-A INPUT .*-j $EO_CHAIN" | while IFS= read -r rule; do
+    args="${rule#-A INPUT }"
+    iptables -D INPUT $args 2>/dev/null && echo "已删除: -A INPUT $args"
+  done
+  # 删除限定网卡模式插入的回环放行规则（不存在则忽略）
+  iptables -D INPUT -p tcp --dport "$EO_PORT" -i lo -j ACCEPT 2>/dev/null && echo "已删除: 回环放行(-i lo)"
+  iptables -F "$EO_CHAIN" 2>/dev/null
+  iptables -X "$EO_CHAIN" 2>/dev/null && echo "已删除链 $EO_CHAIN"
+  ipset destroy "$EO_SET" 2>/dev/null && echo "已销毁集合 $EO_SET"
+  echo "回滚完成。原"开放+端口"策略若由 ufw 管理，请确认 ufw allow $EO_PORT 规则仍存在（本脚本不触碰 ufw）。"
+}
+
+case "$CMD" in
+  sync)  cmd_sync ;;
+  learn) cmd_learn ;;
+  auto)  cmd_auto ;;
+  show)  cmd_show ;;
+  flush) cmd_flush ;;
+  -h|--help|help)
+    sed -n '2,60p' "$0" | sed 's/^# \{0,1\}//'
+    ;;
+  *) echo "用法: $0 {sync|learn|auto|show|flush} [--dry-run]" >&2; exit 2 ;;
+esac
diff --git a/static/favicon.ico b/static/favicon.ico
new file mode 100644
index 0000000..41aa8b5
Binary files /dev/null and b/static/favicon.ico differ
diff --git a/static/fs.go b/static/fs.go
new file mode 100644
index 0000000..650e19e
--- /dev/null
+++ b/static/fs.go
@@ -0,0 +1,12 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package static
+
+import (
+	"embed"
+)
+
+//go:embed favicon.ico sitemap.xml llms.txt llms-full.txt robots.txt tamabox.changelogs.json index-now/66e5e0911b0941f2ba7dbfbbd961e9be.txt
+var FS embed.FS
diff --git a/static/index-now/66e5e0911b0941f2ba7dbfbbd961e9be.txt b/static/index-now/66e5e0911b0941f2ba7dbfbbd961e9be.txt
new file mode 100644
index 0000000..e579dd9
--- /dev/null
+++ b/static/index-now/66e5e0911b0941f2ba7dbfbbd961e9be.txt
@@ -0,0 +1 @@
+66e5e0911b0941f2ba7dbfbbd961e9be
\ No newline at end of file
diff --git a/static/llms-full.txt b/static/llms-full.txt
new file mode 100644
index 0000000..7578a6b
--- /dev/null
+++ b/static/llms-full.txt
@@ -0,0 +1,121 @@
+# 狼的提问箱 / Wolf's Question Box — 完整说明
+
+狼的提问箱（Wolf's Question Box）是一个免费、无需注册的匿名提问箱服务，是 NekoBox 的社区分支（community fork）。访客无需下载 App、绑定社交账号或提供邮箱，即可向箱主匿名提问；箱主可公开或私密回答，并与提问者进行追问式的多轮对话。
+
+> 隐私声明：单个提问箱内的问答内容属于用户隐私，不对外公开索引，也不写入 sitemap。本文件仅使用站点的公开功能信息，不包含任何具体提问箱或提问内容。
+
+## 1. 服务定位
+
+- 面向个人创作者、UP 主、博主等，提供一个让粉丝/陌生人匿名提问的入口。
+- 匿名是核心：提问者不需要任何账号、邮箱或社交登录。
+- 多语言界面：简体中文、繁体中文、英文、日文。
+- 内置浅色 / 深色主题切换。
+
+## 2. 核心功能详解
+
+### 2.1 匿名提问
+访客打开任意箱主的提问箱页面即可直接提问，全程无需登录。提问内容以纯文本或 Markdown 提交。
+
+### 2.2 回答与追问（多轮对话）
+- 箱主可对问题进行公开回答。
+- 提问者可就同一问题「继续追问」，箱主可再次回复，形成来回多轮对话，适合连续交流、澄清或访谈场景。
+- 已回答的追问，箱主可随时「更新回答」。
+
+### 2.3 Markdown 渲染
+问题与回答支持 Markdown 显示（标题、列表、引用、代码块、表格、图片等），保留排版格式。
+
+### 2.4 置顶
+箱主可将重要或精彩的问题「置顶」，固定展示在提问箱顶部，便于新访客一眼看到。
+
+### 2.5 访问密码 / 提问密码
+- **查看密码**：访问提问箱页面时需要输入密码，适合仅对特定人群开放。
+- **提问密码**：向某提问箱提问时需要输入密码，防止陌生人随意刷屏。
+- 密码采用加密方式存储，不保存明文。
+
+### 2.6 二维码分享
+每个问题页均可生成分享二维码，箱主可自定义二维码的背景图与颜色，方便线下或社媒直接扫码访问。
+
+### 2.7 标签与探索页
+- 箱主最多可设置 5 个标签，并选择是否展示在「探索」页面。
+- 「探索」页（`/explore`）按用户与标签发现其他公开提问箱，是站内唯一的公开内容发现入口。
+
+### 2.8 私聊
+箱主与访客之间可进行一对一的连续私密对话（私聊），区别于公开问答，内容不对外展示。
+
+### 2.9 多语言
+界面支持简体中文、繁体中文、英文、日文四种语言，跟随用户选择或浏览器/站点偏好。
+
+### 2.10 深色模式
+全站内置浅色 / 深色主题切换，偏好记忆在本地 cookie。
+
+### 2.11 验证码与图片上传
+- 为兼顾国内外用户，已弃用对国内不友好的 reCAPTCHA，改用更友好的验证方式（如算数验证码 / Turnstile）。
+- 提问与回答支持图片上传，上传前会做像素总量校验以防解压炸弹。
+
+## 3. 使用流程
+
+### 创建提问箱（箱主）
+1. 访问 `/register` 注册一个免费账号，获得专属提问箱与二级域名（如 `/_/你的用户名`）。
+2. 在 `/user/profile` 设置用户名、头像、简介与标签。
+3. 按需开启「查看密码」或「提问密码」，并设置是否参与探索页。
+
+### 匿名提问（访客）
+1. 打开某箱主的提问箱页面（如 `/_/用户名`）。
+2. 若箱主设置了提问密码，先输入密码。
+3. 填写问题并提交（可勾选邮件通知，但邮箱非必填）。
+4. 等待箱主公开回答；如需补充，可使用「追问」。
+
+### 分享
+- 复制提问箱链接，或使用问题页二维码分享。
+- 推荐国内用户使用主域名 `https://box.shiroko.one`。
+
+## 4. 常见问题（FAQ）
+
+### 4.1 给提问者（访客）
+
+- **提问需要注册吗？** 不需要。任何人都能匿名提问；只有创建与管理提问箱（注册账号）才需要登录。
+- **我的匿名性能保证吗？** 提问者无需提供账号或邮箱即可提问；是否填写通知邮箱完全可选，不填也能正常使用。
+- **我可以追问吗？** 可以。对箱主已公开回答的问题，你可「继续追问」，箱主再次回复后形成来回多轮对话，适合澄清、访谈或连续交流。
+- **我能收到回答通知吗？** 可以。提问时若留下邮箱（可选），箱主首次公开回答后你会收到邮件通知；邮件内含一条私密链接，可凭其查看该问题、接收回复并继续追问。
+- **提问有数量限制吗？** 有基础频率限制（约 30 条/分钟/IP）以防刷屏滥用，正常使用基本无感。
+- **能上传图片吗？** 能。提问与回答均支持图片上传，上传前会做像素总量等安全校验以防解压炸弹。
+- **需要验证码吗？** 需要。提问前需通过验证码（算数验证码 / Turnstile），已弃用对国内不友好的 reCAPTCHA，兼顾国内外用户。
+- **提问内容会被搜索引擎收录吗？** 不会。单个提问箱及其问答内容属于用户隐私，已排除在索引与 sitemap 之外；仅首页、注册、登录、探索页等公开页可被收录。
+
+### 4.2 给箱主（创作者）
+
+- **如何创建提问箱？** 注册一个免费账号，即可获得专属路径（如 `/_/你的用户名`），作为你的匿名提问箱。
+- **如何设置个人资料？** 在 `/user/profile` 设置用户名、头像、简介与标签。
+- **如何限制谁能访问或提问？** 可开启「查看密码」（访问页面需密码）与「提问密码」（提问需密码），均以加密形式存储，服务端不保存明文。
+- **我能删除某条提问吗？** 可以。箱主可删除提问箱内的任意提问。
+- **我能隐藏某条提问/回答吗？** 可以。单条问题可设为「私密」不对外公开展示，也可随时改回公开。
+- **如何把精彩问题置顶？** 使用「置顶」功能，将重要或精彩的问题固定在提问箱顶部，便于新访客一眼看到。
+- **如何出现在探索页？** 设置最多 5 个标签，并选择是否展示在「探索」页（`/explore`），这是站内唯一的公开内容发现入口。
+- **我能和访客私聊吗？** 可以。支持一对一连续私密对话（区别于公开问答）；可拉黑对方、或删除整个对话，被拉黑方将无法继续发送。
+- **有新提问/新消息会通知我吗？** 会。若你已设置邮箱，有新提问、新私聊消息时会收到邮件通知。
+- **分享卡片 / 二维码能自定义吗？** 可以。问题页与提问箱页面均可生成分享卡片与二维码，并自定义二维码背景图与颜色，方便线下或社媒直接扫码访问。
+- **内容审核如何运作？** 采用自动与人工结合的审核，对垃圾信息、广告、辱骂、涉政、暴恐、色情、违禁及无意义灌水内容进行处置与删除。
+
+### 4.3 通用
+
+- **支持哪些语言？** 简体中文、繁体中文、英文、日文；可在页面切换，偏好记忆于本地 cookie。
+- **支持深色模式吗？** 支持。全站内置浅色 / 深色主题切换，偏好同样记忆于本地 cookie。
+- **这是 NekoBox 吗？** 不是。TamaBox（狼的提问箱）是 NekoBox 的社区分支（community fork），在功能与多语言方面做了扩展。
+- **收费吗？** 免费。
+- **数据安全吗？** 密码加密存储，图片上传前后均做安全校验，单个提问箱内容不对外索引。
+- **如何分享我的提问箱？** 复制提问箱链接，或使用页面二维码、分享卡片；国内用户推荐使用主域名 `https://box.shiroko.one`。
+- **忘记密码怎么办？** 登录页提供找回密码流程（通过注册邮箱重置），具体以登录页提示为准。
+
+## 5. 隐私与使用政策
+
+- **隐私**：单个提问箱内容属于用户隐私，不对外索引、不写入 sitemap。
+- **内容规范**：禁止垃圾信息、广告、辱骂、涉政、暴恐、色情、违禁、无意义或灌水内容；违规内容将被删除。
+- **数据安全**：图片上传前后均做安全校验，密码加密存储。
+
+## 6. 资源
+
+- 更新日志（功能更新记录）：https://blog.shiroko.one/record/tamabox_changelog_20260813
+- 站点首页：https://box.shiroko.one/
+- 探索页：https://box.shiroko.one/explore
+- 注册：https://box.shiroko.one/register
+- 登录：https://box.shiroko.one/login
diff --git a/static/llms.txt b/static/llms.txt
new file mode 100644
index 0000000..30edf97
--- /dev/null
+++ b/static/llms.txt
@@ -0,0 +1,29 @@
+# 狼的提问箱 / Wolf's Question Box
+
+> 狼的提问箱（Wolf's Question Box）是一个免费、无需注册的匿名提问箱服务。访客无需下载 App、绑定社交账号或提供邮箱，即可向箱主匿名提问；箱主可公开或私密回答，并与提问者进行追问式的多轮对话。本站为 NekoBox 的社区分支（community fork）。单个提问箱内的问答内容属于用户隐私，不对外公开索引。
+
+## 概述
+- [首页](https://box.shiroko.one/): 站点介绍与多语言落地页。
+- [探索](https://box.shiroko.one/explore): 按用户与标签发现公开的提问箱。
+- [注册](https://box.shiroko.one/register): 免费创建自己的提问箱。
+- [登录](https://box.shiroko.one/login): 登录以管理你的提问箱。
+
+## 核心功能
+- 匿名提问：无需账号、邮箱或社交登录即可提问。
+- 回答与追问：箱主可公开回答；提问者可继续追问，箱主可回复，形成多轮来回对话。
+- Markdown 渲染：问题与回答支持 Markdown 显示。
+- 访问控制：可分别设置「查看提问箱密码」与「提问密码」，密码加密存储。
+- 置顶：将重要问题置顶展示。
+- 二维码分享：每个问题页生成可分享二维码，背景图与颜色可自定义。
+- 标签与发现：最多添加 5 个标签，展示于探索页。
+- 私聊：与箱主一对一的连续私密对话。
+- 多语言界面：简体中文、繁体中文、英文、日文。
+- 深色模式：内置浅色 / 深色主题切换。
+
+## 资源
+- [完整说明 (llms-full.txt)](https://box.shiroko.one/llms-full.txt): 站点完整功能说明、使用流程、FAQ 与隐私政策。
+- [更新日志](https://blog.shiroko.one/record/tamabox_changelog_20260813): 近期功能更新（追问、多语言、Markdown、置顶等）。
+
+## 使用政策
+- 隐私：单个提问箱内容属于隐私，已排除在搜索引擎索引与 sitemap 之外。
+- 内容规范：禁止垃圾信息、广告、辱骂、涉政、暴恐、色情、违禁、无意义或灌水内容，违规内容将被删除。
diff --git a/static/robots.txt b/static/robots.txt
new file mode 100644
index 0000000..4728d67
--- /dev/null
+++ b/static/robots.txt
@@ -0,0 +1,7 @@
+User-agent: *
+Disallow: /_/
+Disallow: /user/
+Allow: /explore
+Allow: /llms.txt
+Allow: /llms-full.txt
+Sitemap: https://box.shiroko.one/sitemap.xml
diff --git a/static/sitemap.xml b/static/sitemap.xml
new file mode 100644
index 0000000..2d5e1c4
--- /dev/null
+++ b/static/sitemap.xml
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<urlset
+    xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://www.sitemaps.org/schemas/sitemap/0.9
+       http://www.sitemaps.org/schemas/sitemap/0.9/sitemap.xsd"
+>
+
+<!-- 域名迁移（box.tama.guru → box.shiroko.one）：lastmod 全量刷新，触发搜索引擎重抓。
+     注意：/_/{domain} 已被 robots.txt 的 Disallow: /_/ 禁止，故不再提交（原 /_/tamakyi 条目移除）。 -->
+
+<url>
+ <loc>https://box.shiroko.one/</loc>
+ <priority>0.3</priority>
+ <lastmod>2026-09-06</lastmod>
+ <changefreq>weekly</changefreq>
+</url>
+
+<url>
+ <loc>https://box.shiroko.one/explore</loc>
+ <priority>0.3</priority>
+ <lastmod>2026-09-06</lastmod>
+ <changefreq>weekly</changefreq>
+</url>
+
+<url>
+ <loc>https://box.shiroko.one/register</loc>
+ <priority>0.3</priority>
+ <lastmod>2026-09-06</lastmod>
+ <changefreq>weekly</changefreq>
+</url>
+
+<url>
+ <loc>https://box.shiroko.one/login</loc>
+ <priority>0.3</priority>
+ <lastmod>2026-09-06</lastmod>
+ <changefreq>weekly</changefreq>
+</url>
+
+<url>
+ <loc>https://box.shiroko.one/change-logs</loc>
+ <priority>0.3</priority>
+ <lastmod>2026-09-06</lastmod>
+ <changefreq>weekly</changefreq>
+</url>
+
+</urlset>
diff --git a/static/tamabox.changelogs.json b/static/tamabox.changelogs.json
new file mode 100644
index 0000000..2a38318
--- /dev/null
+++ b/static/tamabox.changelogs.json
@@ -0,0 +1,44 @@
+{
+  "page": 1,
+  "perPage": 3,
+  "totalItems": 4,
+  "totalPages": 2,
+  "items": [
+    {
+      "collectionId": "tamabox",
+      "collectionName": "tamabox-changelogs",
+      "content": "新增：安全告警邮件展示扫描来源 IP 的网络归属（CDN / 云厂商 / WAF，基于离线指纹库，零外部请求）。<br>\n新增：来源 IP 命中 CDN / 代理网络时，告警邮件提示「封禁可能无法拦截真实来源」。",
+      "created": "2026-09-08 12:30:00.000Z",
+      "id": "none",
+      "published_at": "2026-09-08 12:30:00.000Z",
+      "updated": "2026-09-08 12:30:00.000Z"
+    },
+    {
+      "collectionId": "tamabox",
+      "collectionName": "tamabox-changelogs",
+      "content": "新增：用户私信功能上线，可在「我的」页查看匿名来信。<br>\n修复：移动端问题列表间距过窄的问题。<br>\n优化：首页加载速度提升约 30%。",
+      "created": "2024-03-04 21:45:55.000Z",
+      "id": "none",
+      "published_at": "2024-03-04 21:45:55.000Z",
+      "updated": "2024-03-04 21:45:55.000Z"
+    },
+    {
+      "collectionId": "tamabox",
+      "collectionName": "tamabox-changelogs",
+      "content": "修复：部分旧浏览器下时间显示异常。<br>\n新增：修改记录页（本页），将完整更新历史从首页挪出，保持首页简洁。",
+      "created": "2024-02-29 00:00:55.000Z",
+      "id": "none",
+      "published_at": "2024-02-29 00:00:55.000Z",
+      "updated": "2024-02-29 00:00:55.000Z"
+    },
+    {
+      "collectionId": "tamabox",
+      "collectionName": "tamabox-changelogs",
+      "content": "项目初始化：匿名提问 / 回答的基础流程跑通。",
+      "created": "2023-06-03 13:11:55.000Z",
+      "id": "none",
+      "published_at": "2023-06-03 13:11:55.000Z",
+      "updated": "2023-06-03 13:11:55.000Z"
+    }
+  ]
+}
diff --git a/tamabox.go b/tamabox.go
new file mode 100644
index 0000000..2dede39
--- /dev/null
+++ b/tamabox.go
@@ -0,0 +1,30 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package main
+
+import (
+	"os"
+
+	"github.com/sirupsen/logrus"
+	"github.com/urfave/cli/v2"
+
+	"github.com/tamakyi/TamaBox/internal/cmd"
+)
+
+func main() {
+	app := cli.NewApp()
+	app.Name = "TamaBox"
+	app.Description = "Anonymous question box"
+
+	app.Commands = []*cli.Command{
+		cmd.Web,
+		cmd.Censor,
+		cmd.Uid,
+		cmd.Ban,
+	}
+	if err := app.Run(os.Args); err != nil {
+		logrus.WithError(err).Fatal("Failed to start application")
+	}
+}
diff --git a/templates/about-me.html b/templates/about-me.html
new file mode 100644
index 0000000..3dedeff
--- /dev/null
+++ b/templates/about-me.html
@@ -0,0 +1,11 @@
+{{template "base/header" .}}
+<div class="uk-card uk-card-default uk-card-body">
+  <h2>关于我</h2>
+  <div>
+    <p>建立本站初衷是为了找一个自己出道时用的提问箱，当时正赶上很多提问箱崩掉，剩下的一些都是要么需要下载APP，需要登陆注册的那种很臃肿的提问箱。</p>
+    <p>那如果提问需要后台实名，和在直播间直接提问有什么区别？就只是让主播看不到你的ID？那还不如开小号方便。</p>
+    <p>另一方面，提问和回答只是个简简单单的流程，需要再单独下载个APP吗？只需要一个浏览器，谁都能直接用，这是最好的选择。</p>
+    <p>本站原先使用的是<a href="https://github.com/Xinrea/JoiAsk">JoiAsk</a>的提问箱，也是一款开源的，无需注册和APP的提问箱，但无问题回复功能，估计是给答主直播回答用的，同时因为当时并未能找到一个合适的存储桶，一些静态资源加载缓慢，后面就弃用了。一段时间之后终于找到了Nekobox这个网站，内容很简单但是很完善，可惜2023年作者因为自身原因关站一段时间。好在它是开源的，一番捣鼓之后也正常运行了，在加上图片功能之后已经接近我心中理想的提问箱了。感恩作者。</p>
+  </div>
+</div>
+{{template "base/footer" .}}
diff --git a/templates/auth/forgot-password-sent.html b/templates/auth/forgot-password-sent.html
new file mode 100644
index 0000000..d5761d2
--- /dev/null
+++ b/templates/auth/forgot-password-sent.html
@@ -0,0 +1,6 @@
+{{template "base/header" .}}
+<legend class="uk-legend">{{t .LangCode "auth.forgot.title"}}</legend>
+<h5>
+  {{t .LangCode "auth.forgot.sent" .email}}
+</h5>
+{{template "base/footer" .}}
diff --git a/templates/auth/forgot-password.html b/templates/auth/forgot-password.html
new file mode 100644
index 0000000..299c904
--- /dev/null
+++ b/templates/auth/forgot-password.html
@@ -0,0 +1,23 @@
+{{template "base/header" .}}
+<form method="post" id="form">
+  <fieldset class="uk-fieldset">
+    {{ .CSRFTokenHTML }}
+    <legend class="uk-legend">{{t .LangCode "auth.forgot.title"}}</legend>
+    {{template "base/alert" .}}
+    <div class="uk-margin">
+      <label class="uk-form-label" for="email">{{t .LangCode "auth.forgot.email"}}</label>
+      <input name="email" id="email" class="uk-input" type="text">
+    </div>
+    <div class="uk-margin">
+      {{ if eq .CaptchaType "math" }}
+      <input type="hidden" name="g-recaptcha-response" id="g-recaptcha-response" value="">
+      <button type="button" class="uk-button uk-button-primary math-captcha-trigger">{{t .LangCode "auth.forgot.submitBtn"}}</button>
+      {{ else }}
+      <button type="submit" class="uk-button uk-button-primary g-recaptcha" data-sitekey="{{.RecaptchaSiteKey}}"
+              data-callback="onSubmit">{{t .LangCode "auth.forgot.submitBtn"}}
+      </button>
+      {{ end }}
+    </div>
+  </fieldset>
+</form>
+{{template "base/footer" .}}
diff --git a/templates/auth/login.html b/templates/auth/login.html
new file mode 100644
index 0000000..08d5e4f
--- /dev/null
+++ b/templates/auth/login.html
@@ -0,0 +1,29 @@
+{{template "base/header" .}}
+<form method="post" id="form">
+  <fieldset class="uk-fieldset">
+    {{ .CSRFTokenHTML }}
+    <legend class="uk-legend">{{t .LangCode "auth.login.title"}}</legend>
+    {{template "base/alert" .}}
+    <div class="uk-margin">
+      <label class="uk-form-label" for="email">{{t .LangCode "auth.login.email"}}</label>
+      <input name="email" id="email" class="uk-input" type="text" value="{{.email}}">
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label" for="password">{{t .LangCode "auth.login.password"}}</label>
+      <input type="password" name="password" id="password" class="uk-input">
+    </div>
+    <div class="uk-margin">
+      {{ if eq .CaptchaType "math" }}
+      <input type="hidden" name="g-recaptcha-response" id="g-recaptcha-response" value="">
+      <button type="button" class="uk-button uk-button-primary math-captcha-trigger">{{t .LangCode "auth.login.submit"}}</button>
+      {{ else }}
+      <button type="submit" class="uk-button uk-button-primary g-recaptcha" data-sitekey="{{.RecaptchaSiteKey}}"
+              data-callback="onSubmit">{{t .LangCode "auth.login.submit"}}
+      </button>
+      {{ end }}
+      <a href="/forgot-password" class="uk-button uk-button-default">{{t .LangCode "auth.login.forgot"}}
+      </a>
+    </div>
+  </fieldset>
+</form>
+{{template "base/footer" .}}
diff --git a/templates/auth/password-recovery.html b/templates/auth/password-recovery.html
new file mode 100644
index 0000000..b080bdf
--- /dev/null
+++ b/templates/auth/password-recovery.html
@@ -0,0 +1,23 @@
+{{template "base/header" .}}
+<form method="post" id="form">
+  <fieldset class="uk-fieldset">
+    {{ .CSRFTokenHTML }}
+    <legend class="uk-legend">{{t .LangCode "auth.recover.title"}}</legend>
+    {{template "base/alert" .}}
+    <div class="uk-margin">
+      {{t .LangCode "auth.recover.greeting" .User.Name}}
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label" for="new_password">{{t .LangCode "auth.recover.password"}}</label>
+      <input type="password" name="new_password" id="new_password" class="uk-input">
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label" for="repeat_password">{{t .LangCode "auth.recover.confirm"}}</label>
+      <input type="password" name="repeat_password" id="repeat_password" class="uk-input">
+    </div>
+    <div class="uk-margin">
+      <button type="submit" class="uk-button uk-button-primary">{{t .LangCode "auth.recover.submit"}}</button>
+    </div>
+  </fieldset>
+</form>
+{{template "base/footer" .}}
diff --git a/templates/auth/register.html b/templates/auth/register.html
new file mode 100644
index 0000000..2c0045e
--- /dev/null
+++ b/templates/auth/register.html
@@ -0,0 +1,61 @@
+{{template "base/header" .}}
+<style>
+  .tb-domain-sep {
+    background-color: #ffe0e0;
+    color: #c0392b;
+    padding: 0 4px;
+    border-radius: 4px;
+    font-weight: 600;
+  }
+  html[data-theme="dark"] .tb-domain-sep {
+    background-color: rgba(231, 76, 60, 0.25);
+    color: #ff8a80;
+  }
+</style>
+<form method="post" id="form">
+  {{ .CSRFTokenHTML }}
+  <fieldset class="uk-fieldset">
+    <legend class="uk-legend">{{t .LangCode "auth.register.title"}}</legend>
+    {{template "base/alert" .}}
+    <div class="uk-margin">
+      <label class="uk-form-label" for="email">{{t .LangCode "auth.register.email"}}</label>
+      <input name="email" id="email" class="uk-input" type="text" value="{{.email}}">
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label" for="domain">{{t .LangCode "auth.register.domain.prefix" .ExternalURL}}<span class="tb-domain-sep">/_/</span>{{t .LangCode "auth.register.domain.suffix"}}</label>
+      <input name="domain" id="domain" class="uk-input" type="text" value="{{.domain}}">
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label" for="name">{{t .LangCode "auth.register.name"}}</label>
+      <input name="name" id="name" class="uk-input" type="text" value="{{.name}}">
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label" for="password">{{t .LangCode "auth.register.password"}}</label>
+      <input type="password" name="password" id="password" class="uk-input">
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label" for="repeat_password">{{t .LangCode "auth.register.confirm"}}</label>
+      <input type="password" name="repeat_password" id="repeat_password" class="uk-input">
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label" for="language">{{t .LangCode "auth.register.language"}}</label>
+      <select name="language" id="language" class="uk-select">
+        <option value="">{{t .LangCode "auth.register.languageDefault"}}</option>
+        {{ range .SupportedLangs }}
+        <option value="{{ .Code }}" {{ if eq .Code $.LangCode }}selected{{ end }}>{{ .Name }}</option>
+        {{ end }}
+      </select>
+    </div>
+    <div class="uk-margin">
+      {{ if eq .CaptchaType "math" }}
+      <input type="hidden" name="g-recaptcha-response" id="g-recaptcha-response" value="">
+      <button type="button" class="uk-button uk-button-primary math-captcha-trigger">{{t .LangCode "auth.register.submit"}}</button>
+      {{ else }}
+      <button type="submit" class="uk-button uk-button-primary g-recaptcha" data-sitekey="{{.RecaptchaSiteKey}}"
+              data-callback="onSubmit">{{t .LangCode "auth.register.submit"}}
+      </button>
+      {{ end }}
+    </div>
+  </fieldset>
+</form>
+{{template "base/footer" .}}
diff --git a/templates/base/alert.html b/templates/base/alert.html
new file mode 100644
index 0000000..ff0dbcb
--- /dev/null
+++ b/templates/base/alert.html
@@ -0,0 +1,32 @@
+{{if .Error}}
+<div class="uk-alert-danger" uk-alert>
+  <a class="uk-alert-close" uk-close></a>
+  <div>{{.Error}}</div>
+  {{ if .FlashTip }}<span class="uk-text-left uk-text-small">{{.FlashTip}}</span> {{ end }}
+</div>
+{{end}}
+
+{{if .Warning}}
+<div class="uk-alert-warning" uk-alert>
+  <a class="uk-alert-close" uk-close></a>
+  <div>{{.Warning}}</div>
+  {{ if .FlashTip }}<span class="uk-text-left uk-text-small">{{.FlashTip}}</span> {{ end }}
+</div>
+{{end}}
+
+{{if .Success}}
+<div class="uk-alert-success" uk-alert>
+  <a class="uk-alert-close" uk-close></a>
+  <div>{{.Success}}</div>
+  {{ if .FlashTip }}<span class="uk-text-left uk-text-small">{{.FlashTip}}</span> {{ end }}
+</div>
+{{end}}
+
+{{if .Info}}
+<div class="uk-alert-primary" uk-alert>
+  <a class="uk-alert-close" uk-close></a>
+  <div>{{.Info}}</div>
+  {{ if .FlashTip }}<span class="uk-text-left uk-text-small">{{.FlashTip}}</span> {{ end }}
+</div>
+{{end}}
+
diff --git a/templates/base/footer.html b/templates/base/footer.html
new file mode 100644
index 0000000..3f3a6a6
--- /dev/null
+++ b/templates/base/footer.html
@@ -0,0 +1,102 @@
+<p class="{{ if .IsPixel }}uk-container{{end}} uk-text-right uk-text-muted uk-text-small">
+  <br>Powered by NekoBox | {{ ICP }}<br>{{t .LangCode "site.footer.runtime"}}：<span id="box_runtime"></span>
+  <br>
+  <!--<a href="/pixel">画板</a> | -->
+  <a href="https://box.shiroko.one/_/tamakyi" target="_blank">{{t .LangCode "site.footer.admin"}}</a>
+  | <a href="https://blog.shiroko.one" target="_blank">{{t .LangCode "site.footer.notice"}}</a>
+  | <a href="https://chat.shiroko.one" target="_blank">{{t .LangCode "site.footer.chat"}}</a>
+  | <a href="https://share.shiroko.one" target="_blank">{{t .LangCode "site.footer.drive"}}</a>
+  | <a href="https://status.shiroko.one" target="_blank">{{t .LangCode "site.footer.status"}}</a>
+  | <a href="https://shiroko.one" target="_blank">{{t .LangCode "site.footer.nav"}}</a>
+</p>
+
+<script>
+// 页脚「提问箱已成功存活」倒计时：原 R2 cdn/time.box.js（1.6KB）内联于此，
+// 消除全站每页一个 R2 慢 defer（实测 0.7-1.7s 波动）。相对原脚本两处修复：
+// 1) 先判空再写入（原版先赋值后判空，box_runtime 缺失时会抛 ReferenceError 中断脚本）；
+// 2) 首帧立即填充（原版 DOMContentLoaded + 首个 1s 间隔后才显示，首秒为空）。
+(function () {
+  var create = Math.round(Date.UTC(2023, 6, 1, 18, 15, 43) / 1000); // 提问箱创建时刻(UTC)
+  function tick() {
+    var el = document.getElementById("box_runtime");
+    if (!el) return;
+    var s = Math.round((Date.now() + 8 * 3600 * 1000) / 1000) - create; // UTC+8 秒级存活
+    var t = [0, 0, 0, 0, 0];
+    if (s >= 31536000) { t[0] = s / 31536000 | 0; s %= 31536000; }
+    if (s >= 86400)    { t[1] = s / 86400    | 0; s %= 86400; }
+    if (s >= 3600)     { t[2] = s / 3600     | 0; s %= 3600; }
+    if (s >= 60)       { t[3] = s / 60       | 0; s %= 60; }
+    if (s > 0)         { t[4] = s; }
+    el.innerHTML = t[0] + '年 ' + t[1] + '天 ' + t[2] + '时 ' + t[3] + '分 ' + t[4] + '秒 ';
+  }
+  tick();
+  setInterval(tick, 1000);
+})();
+</script>
+<br>
+</div>
+
+<script>
+  // 提交反馈（P0）：点击任意表单的提交按钮后，立即把触发按钮变成「转圈 + 本地化文字」，
+  // 并禁用表单内全部按钮，物理阻止在上传/网络慢时的重复点击与重复提交。
+  // 浏览器前进/后退（bfcache）回到本页时自动复位，避免停留在禁用或转圈状态。
+  // 纯内联反馈，不使用全屏遮罩。
+  var SUBMIT_I18N = {
+    submitting: '{{t .LangCode "common.submitting"}}',
+    uploading:  '{{t .LangCode "common.uploading"}}'
+  };
+
+  function tbResetSubmitButtons() {
+    document.querySelectorAll('button[data-tb-submitting]').forEach(function(b) {
+      b.disabled = false;
+      b.removeAttribute('data-tb-submitting');
+      var orig = b.getAttribute('data-tb-restore');
+      if (orig !== null) {
+        b.innerHTML = orig;
+        b.removeAttribute('data-tb-restore');
+      }
+    });
+  }
+
+  document.addEventListener('submit', function(e) {
+    var form = e.target;
+    if (!form || form.tagName !== 'FORM') return;
+
+    // 页面级提交反馈必须尊重前置校验：投票编辑页等 onsubmit 返回 false 时，
+    // submit 事件仍可能继续到达此监听器；此时绝不能切换到“提交中”状态。
+    if (e.defaultPrevented || form.getAttribute('data-tb-skip-submit-feedback') === '1') {
+      form.removeAttribute('data-tb-skip-submit-feedback');
+      return;
+    }
+
+    // 下载 / 新窗口类表单（target="_blank"，如导出）：当前页不发生导航，也没有 bfcache
+    // 复位机会，进入“提交中”状态后按钮会永远卡在转圈 + 禁用。这类表单直接跳过提交反馈。
+    if (form.getAttribute('target') === '_blank') return;
+
+    // 触发提交的按钮（programmatic submit 时 e.submitter 为 null，回退到首个 submit 按钮）
+    var trigger = e.submitter || form.querySelector('button[type="submit"]');
+
+    // 表单含已选中的文件 → 提示“上传中”，否则“提交中”
+    var hasFile = false;
+    form.querySelectorAll('input[type="file"]').forEach(function(f) {
+      if (f.files && f.files.length > 0) hasFile = true;
+    });
+    var label = hasFile ? SUBMIT_I18N.uploading : SUBMIT_I18N.submitting;
+
+    if (trigger && trigger.tagName === 'BUTTON') {
+      trigger.setAttribute('data-tb-restore', trigger.innerHTML);
+      trigger.innerHTML = '<span uk-spinner="ratio: 0.6"></span> ' + label;
+    }
+
+    // 禁用表单内所有按钮，防止重复提交
+    form.querySelectorAll('button').forEach(function(b) {
+      b.disabled = true;
+      b.setAttribute('data-tb-submitting', '1');
+    });
+  });
+
+  // bfcache 还原时复位按钮
+  window.addEventListener('pageshow', tbResetSubmitButtons);
+</script>
+</body>
+</html>
diff --git a/templates/base/header.html b/templates/base/header.html
new file mode 100644
index 0000000..b50b75f
--- /dev/null
+++ b/templates/base/header.html
@@ -0,0 +1,1031 @@
+<!DOCTYPE html>
+<html lang="{{.LangCode}}">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width">
+  <title>{{ .Title }}</title>
+  <meta name="msvalidate.01" content="2F185E8E63C93635F50B3574F3B31E42" />
+  <meta name="description" content="{{ if .MetaDescription }}{{ .MetaDescription }}{{ else }}{{ t .LangCode "site.description" }}{{ end }}">
+  <meta name="keywords" content="{{ t .LangCode "site.keywords" }}">
+  <!-- 预连接：UIkit 走公共 CDN（cdnjs.snrat.com），其余自托管库仍在本站 R2，均需预连接 -->
+  <link rel="preconnect" href="https://r2.337845818.best" crossorigin>
+  <link rel="preconnect" href="https://cdnjs.snrat.com" crossorigin>
+  <!-- UIkit 3.3.3 切到公共 CDN（cdnjs.snrat.com，国内实测全量下载 ~0.25s，原 R2 自建 ~1.4-2.0s） -->
+  <link rel="stylesheet" href="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/css/uikit.min.css"/>
+  <!-- Waline 评论区样式：非阻塞加载，不阻塞首屏渲染 -->
+  <link rel="stylesheet" href="https://r2.337845818.best/tamabox/cdn/waline/client/v2/waline-no-commits.css" media="print" onload="this.media='all'"/>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/js/uikit.min.js"></script>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/uikit/3.3.3/js/uikit-icons.min.js"></script>
+  <!-- UIkit 补丁：复刻原自建版 "modify-black-font"（官方版与自建版仅 3 处颜色差异——把有色容器内默认白字/白标题改为黑字）。
+       模板当前只用到 .uk-light 容器（用户背景封面，question/list.html、question-not-found.html；
+       其中 h3/p 已由 #usernamecolor/#introcolor 内联 style 覆盖），故只需补该容器的 3 处投影即可保持渲染一致。
+       若日后新增 .uk-card-primary/.uk-card-secondary/.uk-section-primary/.uk-tile-*/.uk-overlay-primary 等容器且需黑字，须同步扩展。 -->
+  <style>
+      .uk-light { color: rgba(0,0,0,.7); }
+      .uk-light .uk-h1, .uk-light .uk-h2, .uk-light .uk-h3, .uk-light .uk-h4, .uk-light .uk-h5, .uk-light .uk-h6,
+      .uk-light .uk-heading-2xlarge, .uk-light .uk-heading-large, .uk-light .uk-heading-medium, .uk-light .uk-heading-small, .uk-light .uk-heading-xlarge,
+      .uk-light h1, .uk-light h2, .uk-light h3, .uk-light h4, .uk-light h5, .uk-light h6 { color: #000; }
+      .uk-light .uk-table th { color: rgba(0,0,0,.7); }
+  </style>
+  <!-- dayjs/alpinejs/vconsole/waline.js 已迁 cdnjs.snrat.com（sha256 与官方一致，国内实测快 2-7x） -->
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/dayjs/1.10.8/dayjs.min.js"></script>
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/alpinejs/3.9.0/cdn.min.js"></script>
+  {{ if .VConsole }}
+  <script src="https://cdnjs.snrat.com/ajax/libs/vConsole/3.12.1/vconsole.min.js" type="application/javascript"></script>
+  <script>new window.VConsole()</script>
+  {{ end }}
+  <!-- jQuery 已改为按需加载：仅 easy.qrcode 二维码页（list/question-not-found/profile）自行引入 -->
+  <script defer src="https://cdnjs.snrat.com/ajax/libs/waline/2.15.8/waline.js"></script>
+  {{ if eq .CaptchaType "math" }}
+  <!-- 算数验证码：弹窗模式，不影响原布局 -->
+  <style>
+      .captcha-equation-box {
+          display: inline-flex;
+          align-items: center;
+          background: #f0f2f5;
+          border: 1px solid #dcdcdc;
+          border-radius: 8px;
+          padding: 8px 8px 8px 16px;
+          gap: 6px;
+          transition: border-color 0.2s;
+      }
+      .captcha-equation-box:focus-within {
+          border-color: #1e87f0;
+          box-shadow: 0 0 0 3px rgba(30,135,240,0.12);
+      }
+      .math-captcha-modal-question {
+          font-size: 1.4rem;
+          font-family: "Courier New", monospace;
+          font-weight: 700;
+          color: #333;
+          letter-spacing: 1px;
+          white-space: nowrap;
+      }
+      #captcha-modal-answer {
+          width: 80px;
+          padding: 6px 10px;
+          text-align: center;
+          font-size: 1.2rem;
+          font-family: "Courier New", monospace;
+          font-weight: 600;
+          border: 1px solid #ccc;
+          border-radius: 5px;
+          outline: none;
+          transition: border-color 0.15s, box-shadow 0.15s;
+          background: #fff;
+      }
+      #captcha-modal-answer:focus {
+          border-color: #1e87f0;
+          box-shadow: 0 0 0 2px rgba(30,135,240,0.2);
+      }
+      /* 隐藏数字输入框的上下箭头 */
+      #captcha-modal-answer::-webkit-inner-spin-button,
+      #captcha-modal-answer::-webkit-outer-spin-button {
+          -webkit-appearance: none;
+          margin: 0;
+      }
+      #captcha-modal-answer {
+          -moz-appearance: textfield;
+      }
+  </style>
+  {{ else if .RecaptchaTurnstileStyle }}
+  <script src="https://challenges.cloudflare.com/turnstile/v0/api.js?compat=recaptcha" async defer></script>
+  <script>
+      document.addEventListener('DOMContentLoaded', function () {
+          document.querySelectorAll('.g-recaptcha').forEach(item => {
+              item.disabled = true;
+          });
+      });
+
+      function onSubmit() {
+          document.querySelectorAll('.g-recaptcha').forEach(item => {
+              item.disabled = false;
+          })
+      }</script>
+  {{ else }}
+  <script src="{{.RecaptchaDomain}}/recaptcha/api.js" async defer></script>
+  <script>function onSubmit() {document.getElementById('form').submit();}</script>
+  {{ end }}
+  {{ if ne SentryDSN "" }}
+  <script
+          src="https://browser.sentry-cdn.com/7.37.2/bundle.tracing.replay.min.js"
+          integrity="sha384-o0mU2P+zsvXua0Y6f/J55PKWZt3sZCv3qDqJe6J5lZklyIQkpgjBVqNnPWYWqGhf"
+          crossorigin="anonymous"
+  ></script>
+  <script>
+      Sentry.init({
+          dsn: "{{ SentryDSN }}",
+          integrations: [new Sentry.BrowserTracing(), new Sentry.Replay()],
+          tracesSampleRate: 1.0,
+          replaysSessionSampleRate: 0.1,
+          replaysOnErrorSampleRate: 1.0,
+      });
+  </script>
+  {{ end }}
+  <style>
+      .grecaptcha-badge {visibility: hidden;}
+      .icon-container {
+         display: flex;
+         justify-content: center;
+         width: 100%;
+  }
+      .icon {
+         margin-left: 10px;
+         width: 20px; /* 设置图标的宽度 */
+         height: auto; /* 保持图标的高度自动调整 */
+      }
+      .emoji-placeholder {
+         display: inline-block;
+         animation: jump 0.5s ease-in-out;
+      }
+
+      @keyframes jump {
+         0%, 100% { transform: translateY(0); }
+         50% { transform: translateY(-5px); }
+      }
+     /* 防止 UIkit Dropbar 初始闪烁 */
+     .uk-dropbar {
+       opacity: 0;
+       visibility: hidden;
+       transition: opacity 0.2s ease, visibility 0.2s ease;
+     }
+     
+     .uk-dropbar.uk-open {
+       opacity: 1;
+       visibility: visible;
+     }
+     
+     a.uk-button.uk-button-link {
+       text-transform: none;
+     }
+
+     /* 移动端优化：缩小字体和间距，避免右侧空白 */
+     @media (max-width: 640px) {
+         .uk-logo {
+             font-size: 1rem;
+         }
+         .uk-navbar-nav a {
+             font-size: 0.78rem;
+             padding: 0 4px;
+         }
+         .emoji-placeholder {
+             font-size: 1rem;
+         }
+         /* 移动端用户名限宽省略，避免长英文用户名撑爆顶栏 */
+         .tb-nav-username {
+             max-width: 64px;
+             overflow: hidden;
+             text-overflow: ellipsis;
+             white-space: nowrap;
+             display: inline-block;
+             vertical-align: middle;
+         }
+     }
+  </style>
+
+  <!-- 深色模式：html[data-theme="dark"] 时覆盖 UIkit 3.3.3 编译主题的关键颜色 -->
+  <style>
+      html[data-theme="dark"] {
+          --tb-bg: #1a1d23;
+          --tb-surface: #242830;
+          --tb-surface-2: #2d323c;
+          --tb-border: #3a404c;
+          --tb-text: #d8dce4;
+          --tb-text-muted: #8b93a1;
+          --tb-primary: #5c8dff;
+      }
+      /* 根元素与 body 一起覆盖，确保整个视口（含内容不足一屏时的空白区）都是深色背景 */
+      html[data-theme="dark"],
+      html[data-theme="dark"] body {
+          background-color: var(--tb-bg) !important;
+          color: var(--tb-text) !important;
+      }
+      /* 通用表面容器 */
+      html[data-theme="dark"] .uk-card,
+      html[data-theme="dark"] .uk-card-default,
+      html[data-theme="dark"] .uk-card-secondary,
+      html[data-theme="dark"] .uk-dropbar,
+      html[data-theme="dark"] .uk-navbar-dropdown,
+      html[data-theme="dark"] .uk-modal-dialog,
+      html[data-theme="dark"] .uk-dropdown,
+      html[data-theme="dark"] .uk-offcanvas-bar,
+      html[data-theme="dark"] .uk-section,
+      html[data-theme="dark"] .uk-tile,
+      html[data-theme="dark"] .uk-panel,
+      html[data-theme="dark"] .uk-background-default,
+      html[data-theme="dark"] .uk-search-default .uk-search-input {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-navbar-container {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-navbar-nav > li > a,
+      html[data-theme="dark"] .uk-card a,
+      html[data-theme="dark"] .uk-link,
+      html[data-theme="dark"] a.uk-button-link,
+      html[data-theme="dark"] .uk-navbar-dropdown-nav > li > a,
+      html[data-theme="dark"] .uk-dropdown-nav > li > a,
+      html[data-theme="dark"] .uk-list a {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-navbar-nav > li > a:hover,
+      html[data-theme="dark"] .uk-card a:hover,
+      html[data-theme="dark"] .uk-navbar-dropdown-nav > li > a:hover,
+      html[data-theme="dark"] .uk-dropdown-nav > li > a:hover {
+          color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .uk-input,
+      html[data-theme="dark"] .uk-textarea,
+      html[data-theme="dark"] .uk-select {
+          background-color: var(--tb-surface-2) !important;
+          color: var(--tb-text) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] .uk-input:focus,
+      html[data-theme="dark"] .uk-textarea:focus,
+      html[data-theme="dark"] .uk-select:focus {
+          border-color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .uk-text-muted,
+      html[data-theme="dark"] .uk-text-meta,
+      html[data-theme="dark"] .uk-text-secondary,
+      html[data-theme="dark"] .uk-text-muted a,
+      html[data-theme="dark"] .uk-text-small.uk-text-muted {
+          color: var(--tb-text-muted) !important;
+      }
+      html[data-theme="dark"] .uk-divider-icon::after,
+      html[data-theme="dark"] hr,
+      html[data-theme="dark"] .uk-table th,
+      html[data-theme="dark"] .uk-table td,
+      html[data-theme="dark"] .uk-list-divider > li:nth-child(n+2) {
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] .uk-button-default {
+          background-color: var(--tb-surface-2) !important;
+          color: var(--tb-text) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] .uk-modal-title,
+      html[data-theme="dark"] h1, html[data-theme="dark"] h2, html[data-theme="dark"] h3,
+      html[data-theme="dark"] h4, html[data-theme="dark"] h5, html[data-theme="dark"] h6,
+      html[data-theme="dark"] .uk-card-title {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .uk-alert-warning,
+      html[data-theme="dark"] .uk-alert-danger,
+      html[data-theme="dark"] .uk-alert-success,
+      html[data-theme="dark"] .uk-alert-primary {
+          background-color: var(--tb-surface-2) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .uk-modal-dialog {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .captcha-equation-box {
+          background-color: var(--tb-surface-2) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .math-captcha-modal-question {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-answer {
+          background-color: var(--tb-surface) !important;
+          color: var(--tb-text) !important;
+          border-color: var(--tb-border) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-answer::placeholder {
+          color: var(--tb-text-muted) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal .uk-text-meta,
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-refresh {
+          color: var(--tb-text-muted) !important;
+      }
+      html[data-theme="dark"] #math-captcha-modal #captcha-modal-refresh:hover {
+          color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .uk-label {
+          color: #fff !important;
+      }
+      /* 自定义组件（探索页推荐卡片等）深色覆盖 */
+      html[data-theme="dark"] .recommend-card,
+      html[data-theme="dark"] .recommend-card:hover {
+          background-color: var(--tb-surface-2) !important;
+      }
+      html[data-theme="dark"] .explore-name a {
+          color: var(--tb-text) !important;
+      }
+      html[data-theme="dark"] .explore-name a:hover {
+          color: var(--tb-primary) !important;
+      }
+      html[data-theme="dark"] .explore-intro {
+          color: var(--tb-text-muted) !important;
+      }
+      /* 切换按钮图标切换 */
+      #theme-toggle .tb-icon-dark, #theme-toggle-mobile .tb-icon-dark { display: none; }
+      html[data-theme="dark"] #theme-toggle .tb-icon-light,
+      html[data-theme="dark"] #theme-toggle-mobile .tb-icon-light { display: none; }
+      html[data-theme="dark"] #theme-toggle .tb-icon-dark,
+      html[data-theme="dark"] #theme-toggle-mobile .tb-icon-dark { display: inline; }
+  </style>
+
+  <!-- 顶栏自适应：导航全部直接显示，窄屏时分级缩小字号/间距，保证英文/日文等长文字不溢出 -->
+  <style>
+      .uk-navbar-nav a {
+          font-size: 0.95rem;
+          padding: 0 10px;
+      }
+      /* 未登录移动端占位：桌面端隐藏，仅 ≤640px 显示（见下方 media 查询）。
+         桌面端布局与改动前完全一致，不受影响。 */
+      .tb-mobile-balancer { display: none; }
+      /* 桌面端保持 UIkit 原生居中三列布局（无需额外 CSS） */
+      .tb-navbar .uk-logo {
+          white-space: nowrap;
+      }
+      @media (max-width: 1200px) {
+          .uk-navbar-nav a {
+              font-size: 0.88rem;
+              padding: 0 8px;
+          }
+      }
+      @media (max-width: 1000px) {
+          .uk-navbar-nav a {
+              font-size: 0.82rem;
+              padding: 0 6px;
+          }
+          .uk-logo {
+              font-size: 1.1rem;
+          }
+          /* 登录用户名限宽，过长省略号截断 */
+          .tb-nav-username {
+              max-width: 110px;
+              overflow: hidden;
+              text-overflow: ellipsis;
+              white-space: nowrap;
+              display: inline-block;
+              vertical-align: middle;
+          }
+      }
+      @media (max-width: 800px) {
+          .uk-navbar-nav a {
+              font-size: 0.78rem;
+              padding: 0 4px;
+          }
+          .uk-logo {
+              font-size: 1rem;
+          }
+          .tb-nav-username {
+              max-width: 80px;
+          }
+      }
+      /* 手机端（≤640px）：沿用 UIkit 桌面端 navbar 的原生三列定位。
+         不再重写 .uk-navbar-center / center-left / center-right 的定位，
+         避免 logo 被挤到下一行；底部语言与深色模式按钮仍由下方独立栏承载。 */
+      @media (max-width: 640px) {
+          .tb-navbar {
+              position: relative;
+              min-height: 56px;
+              overflow: visible;
+          }
+          .tb-navbar > .uk-navbar-center {
+              position: relative !important;
+              top: auto !important;
+              left: auto !important;
+              right: auto !important;
+              bottom: auto !important;
+              transform: none !important;
+              display: flex !important;
+              align-items: center;
+              justify-content: center;
+              width: 100%;
+              min-height: 56px;
+              white-space: nowrap;
+              flex-wrap: nowrap;
+          }
+          .tb-navbar .uk-navbar-center-left,
+          .tb-navbar .uk-navbar-center-right {
+              position: static !important;
+              top: auto !important;
+              left: auto !important;
+              right: auto !important;
+              bottom: auto !important;
+              transform: none !important;
+              display: flex !important;
+              align-items: center;
+              flex: 0 0 auto;
+              white-space: nowrap;
+          }
+          .tb-navbar .uk-navbar-center-left > div,
+          .tb-navbar .uk-navbar-center-right > div {
+              display: flex;
+              align-items: center;
+              white-space: nowrap;
+          }
+          .tb-navbar .uk-navbar-nav {
+              display: flex;
+              flex-wrap: nowrap;
+              flex: 0 0 auto;
+          }
+          .tb-navbar .uk-navbar-nav > li > a,
+          .tb-navbar .uk-logo {
+              white-space: nowrap;
+          }
+          /* 未登录：移动端显示与「我的」等宽的隐藏占位，使左栏「探索+占位」与
+             右栏「注册/登录」两项等宽，logo 真正居中，左右视觉平衡 */
+          .tb-mobile-balancer { display: block; }
+      }
+  </style>
+
+  <!-- 标签样式的按钮（管理页置顶等）：
+       尺寸完全继承 .uk-label（font-size/padding/line-height/text-transform 等），
+       仅覆盖 button 元素特有的默认样式（边框/字体族/光标等），保证与相邻 span 标签完全一致。 -->
+  <style>
+      .tb-label-btn {
+          border: none !important;
+          cursor: pointer;
+          font-family: inherit;
+          margin: 0;
+          vertical-align: middle;
+          outline: none;
+          background-image: none;
+          box-sizing: border-box;
+          -webkit-appearance: none;
+          appearance: none;
+      }
+      .tb-label-btn:hover {
+          opacity: 0.85;
+      }
+      /* 公开页置顶小图标：仅一个图钉，不占行高、不影响原布局 */
+      .tb-pin-flag {
+          font-size: 0.9em;
+          margin-right: 4px;
+          vertical-align: -1px;
+          cursor: default;
+      }
+  </style>
+
+  <!-- Markdown 渲染排版（问题/回答/追问正文，左对齐以保留排版格式） -->
+  <style>
+      /* 纯文本列表：保留换行与连续空格（pre-wrap），不渲染 Markdown 大字号/彩色 */
+      .tb-preline {
+          white-space: pre-wrap;
+      }
+      /* 纯文本列表：超过 5 行截断并显示省略号（不足 5 行则完整显示） */
+      .tb-clamp-5 {
+          display: -webkit-box;
+          -webkit-box-orient: vertical;
+          -webkit-line-clamp: 5;
+          overflow: hidden;
+      }
+      .md-body {
+          line-height: 1.7;
+          text-align: left;
+          word-break: break-word;
+      }
+      .md-body p { margin: 0.5em 0; }
+      .md-body h1, .md-body h2, .md-body h3,
+      .md-body h4, .md-body h5, .md-body h6 {
+          margin: 0.8em 0 0.4em;
+          font-weight: 600;
+          line-height: 1.4;
+      }
+      .md-body ul, .md-body ol { padding-left: 1.6em; margin: 0.5em 0; }
+      .md-body li { margin: 0.2em 0; }
+      .md-body blockquote {
+          border-left: 3px solid #d3d1c7;
+          margin: 0.6em 0;
+          padding: 0.2em 1em;
+          color: #5f5e5a;
+      }
+      .md-body pre {
+          background: #f5f5f5;
+          padding: 0.8em 1em;
+          border-radius: 6px;
+          overflow-x: auto;
+          margin: 0.6em 0;
+      }
+      .md-body code {
+          background: #f0f0f0;
+          padding: 0.1em 0.35em;
+          border-radius: 4px;
+          font-size: 0.9em;
+      }
+      .md-body pre code { background: none; padding: 0; }
+      .md-body img { max-width: 100%; height: auto; }
+      .md-body table { border-collapse: collapse; margin: 0.6em 0; }
+      .md-body th, .md-body td {
+          border: 1px solid #ddd;
+          padding: 0.4em 0.8em;
+      }
+      .md-body hr { margin: 1em 0; }
+      html[data-theme="dark"] .md-body blockquote {
+          border-color: #3a404c;
+          color: #8b93a1;
+      }
+      html[data-theme="dark"] .md-body pre,
+      html[data-theme="dark"] .md-body code { background: #2d323c; }
+      html[data-theme="dark"] .md-body th,
+      html[data-theme="dark"] .md-body td { border-color: #3a404c; }
+  </style>
+
+  <!-- 投票结果占比条：UIkit 3 已无 .uk-progressbar 类（那是 UIkit 2 的），
+       模板用 <div class="uk-progress"><div class="uk-progressbar"> 结构，需补一套填充样式，
+       否则内层填充无高度/背景，所有占比条都只剩外层灰色轨道，看起来一模一样。 -->
+  <style>
+      .uk-progress {
+          -webkit-appearance: none;
+          -moz-appearance: none;
+          appearance: none;
+          height: 10px;
+          margin: 0;
+          border: none;
+          border-radius: 6px;
+          background-color: #e5e5e5;
+          overflow: hidden;
+          box-shadow: none;
+      }
+      .uk-progressbar {
+          display: block;
+          height: 100%;
+          background-color: #1e87f0;
+          border-radius: 6px 0 0 6px;
+          transition: width 0.3s ease;
+      }
+      html[data-theme="dark"] .uk-progress {
+          background-color: var(--tb-border);
+      }
+      html[data-theme="dark"] .uk-progressbar {
+          background-color: var(--tb-primary);
+      }
+  </style>
+
+  <!-- 移动端底部操作栏：固定底栏承载语言切换与深色模式，桌面端隐藏 -->
+  <style>
+      #tb-mobile-utils {
+          display: none;
+      }
+      @media (max-width: 640px) {
+          /* 顶栏不再容纳语言/深色按钮，恢复原有导航空间 */
+          .tb-nav-utils {
+              display: none !important;
+          }
+          /* 手机端隐藏登录用户名（左边仅保留"探索"），保证 logo 居中、
+             两侧各不超过 2 个短按钮，避免用户名宽度挤压布局 */
+          .tb-nav-username {
+              display: none !important;
+          }
+          /* 固定底部操作栏 */
+          #tb-mobile-utils {
+              display: flex;
+              position: fixed;
+              left: 0;
+              right: 0;
+              bottom: 0;
+              z-index: 1000;
+              justify-content: center;
+              align-items: center;
+              gap: 10px;
+              padding: 8px 12px calc(8px + env(safe-area-inset-bottom));
+              background: rgba(255, 255, 255, 0.92);
+              -webkit-backdrop-filter: blur(8px);
+              backdrop-filter: blur(8px);
+              box-shadow: 0 -2px 12px rgba(0, 0, 0, 0.08);
+          }
+          #tb-mobile-utils .uk-select {
+              width: 110px;
+          }
+          html[data-theme="dark"] #tb-mobile-utils {
+              background: rgba(36, 40, 48, 0.92);
+              box-shadow: 0 -2px 12px rgba(0, 0, 0, 0.4);
+          }
+          /* 给页面底部预留空间，避免页脚内容被固定底栏遮挡 */
+          body {
+              padding-bottom: 56px;
+          }
+      }
+  </style>
+
+<!-- Commit 6d0a3ad -->
+  <meta property="og:site_name" content="{{ t .LangCode "site.title" }}" />
+  <meta property="og:type" content="website" />
+  <meta property="og:title" content="{{ if .IsUserPage }}{{ .PageUser.Name }} - {{ t .LangCode "site.title" }}{{ else }}{{ t .LangCode "site.title" }}{{ end }}" />
+  <meta property="og:url" content="{{ .ExternalURL }}{{ .CurrentURI }}" />
+  <meta property="og:description" content="{{ if .IsUserPage }}{{ .PageUser.Name }} - {{ t .LangCode "site.description" }}{{ else }}{{ t .LangCode "site.description" }}{{ end }}" />
+  {{ if .NoIndex }}<meta name="robots" content="noindex">{{ end }}
+  {{ if .IsUserPage }}
+   <meta property="og:image" content="{{ .PageUser.Avatar }}?og-image=1" />
+   <meta property="og:image:alt" content="{{ .PageUser.Name }}" />
+   <meta itemprop="image" content="{{ .PageUser.Avatar }}?og-image=1"/>
+   <meta name="msapplication-TileImage" content="{{ .PageUser.Avatar }}"/>
+   <link rel="shortcut icon" href="{{ .PageUser.Avatar }}?og-image=1"/>
+   <link rel="apple-touch-icon" href="{{ .PageUser.Avatar }}?og-image=1"/>
+   <link rel="icon" sizes="192x192" href="{{ .PageUser.Avatar }}?og-image=1">
+   <meta name="twitter:image:src" content="{{ .PageUser.Avatar }}?og-image=1" />
+   {{ else }}
+  <meta itemprop="image" content="https://r2.337845818.best/tamabox/tamabox_low.png"/>
+  <meta name="msapplication-TileImage" content="https://r2.337845818.best/tamabox/tamabox_low.png"/>
+  <link rel="shortcut icon" href="https://r2.337845818.best/tamabox/tamabox_low.png" />
+  <link rel="apple-touch-icon" href="https://r2.337845818.best/tamabox/tamabox_low.png"/>
+  <link rel="icon" sizes="192x192" href="https://r2.337845818.best/tamabox/tamabox_low.png">
+  <meta name="twitter:image:src" content="https://r2.337845818.best/tamabox/tamabox_low.png" />
+   {{ end }}
+
+<!-- Google and Bing 站点验证：token 与域名绑定，
+       域名迁移（box.tama.guru → box.shiroko.one）后须用新域重新验证并替换下面的 content。
+       注：msvalidate.01 在本文件第 7 行重复了一份，可保留（无害）或一并清理。 -->
+  <meta name="google-site-verification" content="fEPwRRJfiGsgwc5SINBQwZhPK8F0cwRaOvRx0YRurI4" />
+  <meta name="msvalidate.01" content="2F185E8E63C93635F50B3574F3B31E42" />
+  <!-- 站点统计（umami）：非关键资源，window load 后再动态注入，避免 mami.shiroko.one
+       （Vercel 托管、无国内节点）在高峰/冷访问时阻塞 DOMContentLoaded 与 load -->
+  <script>
+      window.addEventListener("load", function () {
+          var s = document.createElement("script");
+          s.src = "https://mami.shiroko.one/tamami.js";
+          s.setAttribute("data-website-id", "c42ebe8b-9281-4da0-83a4-8f18b3e710fe");
+          document.body.appendChild(s);
+      });
+  </script>
+</head>
+<body>
+<script>
+// 二维码降级渲染（P0-②）：easy.qrcode 的 logo（用户头像）/ 背景图加载失败或极慢时，
+// 库内部仅 console.error 且无降级 → 二维码区域会永久空白。
+// 策略：未知状态的远程图先不画（基础码立即可扫）→ 后台探针（Image 预载）→
+//       判定完成后再重绘带 logo/背景的升级版；失败则保持基础码，绝不空白。
+// 同会话记忆：探针结果按 URL 记忆（good/bad），编辑页拖动滑块高频重绘时零等待、不闪降级。
+// 使用：window.tbRenderQR(el, function(){ return options; })  // options 含完整 logo/backgroundImage
+window.tbRenderQR = function (el, getOptions) {
+  if (!el || typeof QRCode === 'undefined') return;
+  var opts = getOptions();
+  function remoteOf(o, key) {
+    var v = o[key];
+    return (typeof v === 'string' && v.indexOf('http') === 0) ? v : '';
+  }
+  var good = window._tbQrGood || (window._tbQrGood = {}); // URL -> true（可 CORS 加载）
+  var bad = window._tbQrBad || (window._tbQrBad = {});    // URL -> true（加载失败）
+  // 每层状态：''=无需, 1=已知可用, 0=已知失败, null=未知需探针
+  function layerState(url) { return !url ? '' : (good[url] ? 1 : (bad[url] ? 0 : null)); }
+  var layers = [
+    { url: remoteOf(opts, 'logo'), st: null, present: function (o, on) {
+        if (on) { /* 保留 */ } else { o.logo = undefined; o.logoWidth = undefined; o.logoHeight = undefined; o.logoBackgroundTransparent = undefined; }
+      } },
+    { url: remoteOf(opts, 'backgroundImage'), st: null, present: function (o, on) {
+        if (on) { /* 保留 */ } else { o.backgroundImage = undefined; o.backgroundImageAlpha = undefined; }
+      } }
+  ];
+  var needProbe = false;
+  for (var i = 0; i < layers.length; i++) {
+    layers[i].st = layerState(layers[i].url);
+    if (layers[i].st === null) needProbe = true;
+  }
+  function paint(states) {
+    var o = {};
+    for (var k in opts) o[k] = opts[k];
+    for (var j = 0; j < layers.length; j++) layers[j].present(o, states[j] === 1);
+    el.innerHTML = '';
+    new QRCode(el, o);
+  }
+  // 已知可用层立即带上；未知层先省略 → 立即绘制（logo 记忆命中时不会闪降级）
+  var initStates = [];
+  for (var n = 0; n < layers.length; n++) initStates.push(layers[n].st === 1 ? 1 : 0);
+  paint(initStates);
+  if (!needProbe) return;
+  // 后台探针未知层；全部判定后若有变化再重绘一次升级版
+  var pending = 0, cross = opts.crossOrigin || 'anonymous';
+  layers.forEach(function (L) {
+    if (L.st !== null) return;
+    pending++;
+    var im = new Image();
+    im.onload = function () { good[L.url] = true; L.st = 1; onDone(); };
+    im.onerror = function () { bad[L.url] = true; L.st = 0; onDone(); };
+    if (cross) im.crossOrigin = cross;
+    im.src = L.url;
+  });
+  function onDone() {
+    if (--pending > 0) return;
+    var finalStates = [];
+    for (var m = 0; m < layers.length; m++) finalStates.push(layers[m].st === 1 ? 1 : 0);
+    var changed = false;
+    for (var q = 0; q < finalStates.length; q++) if (finalStates[q] !== initStates[q]) changed = true;
+    if (changed) paint(finalStates);
+  }
+  // 超时保险：个别挂起连接永不回调时，3s 后按当前已知状态收尾（基础码早已可扫）
+  setTimeout(function () { if (pending > 0) { pending = 0; onDone(); } }, 3000);
+};
+</script>
+<nav class="uk-navbar-container uk-margin tb-navbar" uk-navbar>
+  <div class="uk-navbar-center">
+    <div class="uk-navbar-center-left">
+      <div>
+        <ul class="uk-navbar-nav">
+          <!-- 探索链接，始终显示 -->
+          <li><a href="/explore">{{t .LangCode "nav.explore"}}</a></li>
+          {{ if .IsLogged }}
+          <!-- 我的：进入自己的提问箱主页（与右侧「提问/设置」形成左右均衡） -->
+          <li><a href="/_/{{ .LoggedUser.Domain }}">{{t .LangCode "nav.mine"}}</a></li>
+          {{ else }}
+          <!-- 移动端占位：未登录时左栏仅「探索」一项，与右栏「注册/登录」两项不等宽，
+               导致 logo 整体被拉向左（偏左）。移动端(≤640px)显示一个与「我的」等宽的隐藏占位，
+               使左右视觉平衡；桌面端由 .tb-mobile-balancer 隐藏，保持原布局完全不变。 -->
+          <li class="tb-mobile-balancer" aria-hidden="true"><a tabindex="-1" style="visibility:hidden">{{t .LangCode "nav.mine"}}</a></li>
+          {{ end }}
+        </ul>
+      </div>
+    </div>
+
+    <a class="uk-navbar-item uk-logo" href="/"><span class="emoji-placeholder" aria-label="random animal">🐺</span>{{t .LangCode "site.logoSuffix"}}</a>
+
+    <div class="uk-navbar-center-right">
+      <div>
+        {{ if .IsLogged }}
+        <ul class="uk-navbar-nav">
+          <li><a href="/user/questions">{{t .LangCode "nav.ask"}}</a></li>
+        </ul>
+        <ul class="uk-navbar-nav">
+          <li><a href="/user/profile">{{t .LangCode "nav.settings"}}</a></li>
+        </ul>
+        {{ else}}
+        <ul class="uk-navbar-nav">
+          <li><a href="/register">{{t .LangCode "nav.register"}}</a></li>
+        </ul>
+        <ul class="uk-navbar-nav">
+          <li><a href="/login">{{t .LangCode "nav.login"}}</a></li>
+        </ul>
+        {{ end }}
+        {{ if not .IsUserPage }}
+        <!-- 语言切换（紧凑图标，点击展开；移动端隐藏，见底部操作栏） -->
+        <ul class="uk-navbar-nav tb-nav-utils">
+          <li>
+            <a href="#" aria-label="{{t .LangCode "common.lang"}}" title="{{t .LangCode "common.lang"}}">🌐</a>
+            <div class="uk-navbar-dropdown" uk-drop="mode: click; pos: bottom-right">
+              <ul class="uk-nav uk-navbar-dropdown-nav">
+                {{ range .SupportedLangs }}
+                <li class="{{ if eq .Code $.LangCode }}uk-active{{ end }}">
+                  <a href="/i18n/{{ .Code }}?to={{ urlquery $.CurrentURI }}">{{ .Name }}</a>
+                </li>
+                {{ end }}
+              </ul>
+            </div>
+          </li>
+        </ul>
+        {{ end }}
+        <!-- 深色模式切换（紧凑图标；移动端隐藏，见底部操作栏） -->
+        <ul class="uk-navbar-nav tb-nav-utils">
+          <li>
+            <a href="#" id="theme-toggle" title="{{t .LangCode "common.theme"}}" aria-label="{{t .LangCode "common.theme"}}">
+              <span class="tb-icon-light">🌙</span><span class="tb-icon-dark">☀️</span>
+            </a>
+          </li>
+        </ul>
+      </div>
+    </div>
+  </div>
+</nav>
+
+<script>
+document.addEventListener("DOMContentLoaded", function() {
+    const emojis = ["🐺","🐗","🐻","🐨","🐼","🐹","🐭","🐰","🦊","🐮","🐷","🐽","🐸","🐒","🦍","🐔","🐧","🐦","🐤","🐦‍⬛","🦅","🦉","🦇","🐴","🦄","🐝","🦎","🦖","🦕","🐙","🦑","🦐","🦞","🦀","🐡","🐠","🐟","🐬","🐳","🐋","🦈","🐊","🐅","🐆","🦓","🦍","🦧","🐘","🦛","🦏","🐪","🐫","🦒","🦘","🐃","🐂","🐄","🐎","🐖","🐏","🐑","🦙","🐐","🦌","🐕","🐩","🦮","🐕‍🦺","🐈","🐋","🐳","🐬","🐉","🐲"];
+    const placeholder = document.querySelector('.emoji-placeholder');
+    if (placeholder) {
+        placeholder.textContent = emojis[Math.floor(Math.random() * emojis.length)];
+    }
+});
+</script>
+
+<!-- 移动端固定底部操作栏：语言切换 + 深色模式（桌面端隐藏） -->
+<div id="tb-mobile-utils">
+  {{ if not .IsUserPage }}
+  <select id="mobile-lang-select" class="uk-select uk-form-small" aria-label="{{t .LangCode "common.lang"}}">
+    {{ range .SupportedLangs }}
+    <option value="{{ .Code }}" {{ if eq .Code $.LangCode }}selected{{ end }}>{{ .Name }}</option>
+    {{ end }}
+  </select>
+  {{ end }}
+  <button type="button" id="theme-toggle-mobile" class="uk-button uk-button-default uk-button-small"
+          title="{{t .LangCode "common.theme"}}" aria-label="{{t .LangCode "common.theme"}}">
+    <span class="tb-icon-light">🌙</span><span class="tb-icon-dark">☀️</span>
+  </button>
+</div>
+
+<script>
+(function() {
+    // 深色模式：读取 cookie 应用主题，按钮切换并持久化
+    var THEME_COOKIE = 'theme';
+    function getTheme() {
+        var m = document.cookie.match(/(?:^|;\s*)theme=([^;]*)/);
+        return m ? m[1] : '';
+    }
+    function applyTheme(theme) {
+        if (theme === 'dark') {
+            document.documentElement.setAttribute('data-theme', 'dark');
+        } else {
+            document.documentElement.removeAttribute('data-theme');
+        }
+    }
+    function toggleTheme() {
+        var next = getTheme() === 'dark' ? 'light' : 'dark';
+        applyTheme(next);
+        var expires = new Date(Date.now() + 365 * 24 * 3600 * 1000).toUTCString();
+        document.cookie = THEME_COOKIE + '=' + next + '; path=/; max-age=' + (365 * 24 * 3600) + '; SameSite=Lax';
+    }
+    // 首屏前应用，避免闪烁
+    applyTheme(getTheme());
+    document.addEventListener('DOMContentLoaded', function() {
+        // 桌面顶栏按钮与移动端底部按钮都绑定
+        var buttons = document.querySelectorAll('#theme-toggle, #theme-toggle-mobile');
+        buttons.forEach(function(btn) {
+            btn.addEventListener('click', function(e) {
+                e.preventDefault();
+                toggleTheme();
+            });
+        });
+
+        // 移动端底部语言切换：onchange 跳转到 /i18n/{code}，保留当前页面位置
+        var langSel = document.getElementById('mobile-lang-select');
+        if (langSel) {
+            langSel.addEventListener('change', function() {
+                if (!this.value) return;
+                var to = window.location.pathname + window.location.search;
+                window.location.href = '/i18n/' + encodeURIComponent(this.value) + '?to=' + encodeURIComponent(to);
+            });
+        }
+    });
+})();
+</script>
+
+{{ if .IsPixel }}
+<div>
+{{ else }}
+<div class="uk-container uk-container-xsmall">
+{{ end }}
+
+{{ if eq .CaptchaType "math" }}
+<!-- 算数验证码弹窗 --><div id="math-captcha-modal" uk-modal>
+  <div class="uk-modal-dialog uk-modal-body uk-text-center">
+    <h3 class="uk-modal-title">{{t .LangCode "captcha.title"}}</h3>
+    <p class="uk-text-meta">{{t .LangCode "captcha.hint"}}</p>
+    <div class="captcha-equation-box">
+      <span id="captcha-modal-question" class="math-captcha-modal-question">{{t .LangCode "captcha.loading"}}</span>
+      <input type="number" id="captcha-modal-answer" placeholder="?" autocomplete="off" inputmode="numeric">
+    </div>
+    <div style="margin-top:6px;">
+      <button type="button" class="uk-button uk-button-text uk-text-small" id="captcha-modal-refresh">{{t .LangCode "captcha.refresh"}}</button>
+    </div>
+    <div id="captcha-modal-error" class="uk-text-danger uk-text-small" style="display:none;min-height:20px;"></div>
+    <div class="uk-margin-small-top">
+      <button type="button" class="uk-button uk-button-primary" id="captcha-modal-submit">{{t .LangCode "captcha.submit"}}</button>
+      <button type="button" class="uk-button uk-button-default uk-modal-close">{{t .LangCode "common.cancel"}}</button>
+    </div>
+  </div>
+</div>
+
+<script>
+var CAPTCHA_I18N = {
+  loading: "{{t .LangCode "captcha.loading"}}",
+  loadFailed: "{{t .LangCode "captcha.loadFailed"}}",
+  loadRetry: "{{t .LangCode "captcha.loadRetry"}}",
+  inputAnswer: "{{t .LangCode "captcha.inputAnswer"}}",
+  wrongAnswer: "{{t .LangCode "captcha.wrongAnswer"}}",
+  verifyFailed: "{{t .LangCode "captcha.verifyFailed"}}",
+  needPassword: "{{t .LangCode "ask.needPassword"}}",
+  needEmail: "{{t .LangCode "ask.pleaseEmail"}}"
+};
+</script>
+
+<script>
+(function() {
+  var captchaId = '';
+  var pendingForm = null;
+  var pendingNeedPassword = false;
+  var verifying = false;
+
+  function fetchCaptcha() {
+    var qEl = document.getElementById('captcha-modal-question');
+    var errEl = document.getElementById('captcha-modal-error');
+    var ansEl = document.getElementById('captcha-modal-answer');
+    qEl.textContent = CAPTCHA_I18N.loading;
+    fetch('/api/captcha/generate')
+      .then(function(r) { return r.json(); })
+      .then(function(data) {
+        if (data.code === 0 && data.data) {
+          captchaId = data.data.id;
+          qEl.textContent = data.data.question;
+          if (errEl) errEl.style.display = 'none';
+          if (ansEl) { ansEl.value = ''; ansEl.focus(); }
+        } else {
+          qEl.textContent = CAPTCHA_I18N.loadFailed;
+        }
+      })
+      .catch(function() {
+        qEl.textContent = CAPTCHA_I18N.loadRetry;
+      });
+  }
+
+  function getCSRFToken() {
+    var input = document.querySelector('input[name="_csrf"]');
+    return input ? input.value : '';
+  }
+
+  function doSubmit(form) {
+    // 将 captcha 答案填入隐藏字段
+    var ans = document.getElementById('captcha-modal-answer').value.trim();
+    var hidden = form.querySelector('[name="g-recaptcha-response"]');
+    if (hidden) hidden.value = captchaId + ':' + (ans || '0');
+
+    UIkit.modal('#math-captcha-modal').hide();
+
+    // 处理 AskPassword（提问箱密码）
+    if (pendingNeedPassword) {
+      UIkit.modal.prompt(CAPTCHA_I18N.needPassword, '', 'password')
+        .then(function(password) {
+          if (password) {
+            var pwInput = document.getElementById('ask_password_input');
+            if (pwInput) pwInput.value = password;
+            form.submit();
+          }
+        });
+    } else {
+      form.submit();
+    }
+  }
+
+  // 验证按钮
+  document.getElementById('captcha-modal-submit').addEventListener('click', function() {
+    if (verifying) return;
+    var ans = document.getElementById('captcha-modal-answer').value.trim();
+    if (!ans) {
+      var errEl = document.getElementById('captcha-modal-error');
+      errEl.textContent = CAPTCHA_I18N.inputAnswer;
+      errEl.style.display = 'block';
+      return;
+    }
+    verifying = true;
+    fetch('/api/captcha/verify', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'X-CSRF-Token': getCSRFToken()
+      },
+      body: JSON.stringify({ id: captchaId, answer: parseInt(ans, 10) })
+    })
+    .then(function(r) { return r.json(); })
+    .then(function(data) {
+      verifying = false;
+      if (data.correct) {
+        if (pendingForm) doSubmit(pendingForm);
+      } else {
+        var errEl = document.getElementById('captcha-modal-error');
+        errEl.textContent = CAPTCHA_I18N.wrongAnswer;
+        errEl.style.display = 'block';
+        fetchCaptcha(); // 自动刷新题目
+      }
+    })
+    .catch(function() {
+      verifying = false;
+      var errEl = document.getElementById('captcha-modal-error');
+      errEl.textContent = CAPTCHA_I18N.verifyFailed;
+      errEl.style.display = 'block';
+      fetchCaptcha();
+    });
+  });
+
+  // 回车提交
+  document.getElementById('captcha-modal-answer').addEventListener('keydown', function(e) {
+    if (e.key === 'Enter') {
+      e.preventDefault();
+      document.getElementById('captcha-modal-submit').click();
+    }
+  });
+
+  // 刷新按钮
+  document.getElementById('captcha-modal-refresh').addEventListener('click', fetchCaptcha);
+
+  // 拦截所有带 class="math-captcha-trigger" 的按钮
+  document.addEventListener('click', function(e) {
+    var btn = e.target.closest('.math-captcha-trigger');
+    if (!btn) return;
+    e.preventDefault();
+
+    var form = btn.closest('form');
+    if (!form) return;
+    pendingForm = form;
+
+    // 检查是否需要提问密码
+    pendingNeedPassword = !!(form.querySelector('#ask_password_input'));
+
+    // 邮箱校验（提问页面）
+    var notifyCb = document.getElementById('notify-checkbox');
+    var emailInput = document.getElementById('email-input');
+    if (notifyCb && notifyCb.checked && emailInput && emailInput.value.trim() === '') {
+      UIkit.modal.alert(CAPTCHA_I18N.needEmail);
+      return;
+    }
+
+    fetchCaptcha();
+    UIkit.modal('#math-captcha-modal').show();
+  });
+})();
+</script>
+{{ end }}
\ No newline at end of file
diff --git a/templates/change-logs.html b/templates/change-logs.html
new file mode 100644
index 0000000..57c3bac
--- /dev/null
+++ b/templates/change-logs.html
@@ -0,0 +1,15 @@
+{{template "base/header" .}}
+<div class="uk-card uk-card-default uk-card-body">
+  <h2>修改记录</h2>
+  <div>
+    <p>为使首页更为简洁，今后修改的相关记录存档在此处（主要信息仍然会在首页提示）。</p>
+  </div>
+  <hr>
+  <br>
+  <div x-data="{ c: '' }" x-init="c = await (async () => {
+    let log = (await(await fetch('/static/tamabox.changelogs.json')).json()).items[0];
+    return `<p class=uk-article-meta>修改记录 - ${new Date(log.published_at).toLocaleDateString()}</p><span class=uk-text-small>${log.content}</span>`;
+  })()" x-html="c">
+  </div>
+</div>
+{{template "base/footer" .}}
diff --git a/templates/chat/conversation.html b/templates/chat/conversation.html
new file mode 100644
index 0000000..1d220e7
--- /dev/null
+++ b/templates/chat/conversation.html
@@ -0,0 +1,195 @@
+{{template "base/header" .}}
+<style>
+  /* 自定义灯箱样式 */
+  .custom-lightbox {
+    display: none;
+    position: fixed;
+    top: 0;
+    left: 0;
+    width: 100%;
+    height: 100%;
+    background: rgba(0,0,0,0.85);
+    z-index: 9999;
+    align-items: center;
+    justify-content: center;
+    flex-direction: column;
+  }
+  .custom-lightbox.active {
+    display: flex;
+  }
+  .custom-lightbox img {
+    max-width: 90%;
+    max-height: 80%;
+    border-radius: 8px;
+    box-shadow: 0 0 30px rgba(0,0,0,0.5);
+  }
+  .custom-lightbox .close-btn {
+    position: absolute;
+    top: 20px;
+    right: 30px;
+    color: #fff;
+    font-size: 40px;
+    cursor: pointer;
+    font-weight: bold;
+  }
+  .custom-lightbox .caption {
+    color: #ccc;
+    margin-top: 10px;
+    font-size: 14px;
+  }
+</style>
+
+<div class="uk-container uk-container-small uk-margin-top">
+  <h2 class="uk-text-center">
+    {{ if .IsOwner }}{{t .LangCode "chat.withAsker"}}{{ else }}{{t .LangCode "chat.withUser" .PageUser.Name}}{{ end }}
+  </h2>
+  <p class="uk-text-center uk-text-meta">
+    {{ if .Conversation.IsClosed }}
+      <span class="uk-label uk-label-danger">{{t .LangCode "chat.closed"}}</span>
+    {{ else }}
+      {{t .LangCode "chat.remaining" (sub .Conversation.MaxMessages .Conversation.MessageCount) .Conversation.MaxMessages}}
+    {{ end }}
+  </p>
+
+  <div class="uk-card uk-card-default uk-card-body uk-margin uk-padding-small">
+    <ul class="uk-list uk-list-divider">
+      {{ range .Messages }}
+      {{ $isMyMessage := eq .SenderID $.LoggedUser.ID }}
+      <li class="uk-margin-small-bottom">
+        <div class="uk-flex {{ if $isMyMessage }}uk-flex-right{{ else }}uk-flex-left{{ end }}">
+          <div class="uk-card uk-card-hover uk-card-body uk-padding-small uk-margin-small-left uk-margin-small-right" 
+               style="max-width: 75%; border-radius: 12px; background-color: {{ if $isMyMessage }}#e6ffe6{{ else }}#f0f8ff{{ end }};">
+            <div class="uk-flex uk-flex-middle uk-margin-small-bottom">
+              <span class="uk-icon" uk-icon="user"></span>
+              <strong class="uk-margin-small-left">
+                {{ if $isMyMessage }}{{t $.LangCode "chat.me"}}{{ else }}{{t $.LangCode "chat.other"}}{{ end }}
+              </strong>
+              <span class="uk-text-meta uk-margin-small-left" style="font-size: 0.75rem;">
+                {{ .CreatedAt.Format "01-02 15:04" }}
+              </span>
+            </div>
+            {{ if and $.IsOwner $.IsBlocked (eq .SenderID $.Conversation.AskerID) }}
+              <p class="uk-margin-remove"><span class="uk-text-muted uk-text-italic">{{t $.LangCode "chat.userBlocked"}}</span></p>
+            {{ else }}
+              {{ if .Content }}
+              <p class="uk-margin-remove">{{ .Content }}</p>
+              {{ end }}
+              {{ range (index $.MessageImages .ID) }}
+              <div class="uk-margin-small-top">
+                <img src="{{ .URL }}" alt="{{ .FileName }}" 
+                     style="max-width: 200px; max-height: 200px; border-radius: 8px; cursor: pointer;" 
+                     onclick="openLightbox('{{ .URL }}', '{{ .FileName }}')" />
+              </div>
+              {{ end }}
+            {{ end }}
+          </div>
+        </div>
+      </li>
+      {{ end }}
+    </ul>
+  </div>
+
+  {{ if .CanSend }}
+  <div class="uk-card uk-card-default uk-card-body uk-margin-top">
+    <form method="post" action="/_/{{.PageUser.Domain}}/chat/{{.Conversation.Token}}/send" enctype="multipart/form-data">
+      {{ .CSRFTokenHTML }}
+      <textarea name="content" class="uk-textarea" rows="3" placeholder="{{t .LangCode "chat.input"}}" maxlength="{{ .ChatMessageLimit }}"></textarea>
+      
+      <div class="uk-margin-small-top" style="display: flex; align-items: center; gap: 10px;">
+        <div uk-form-custom>
+          <a href="#" class="uk-icon-link" uk-icon="image"></a>
+          <span style="font-size: 13px; color: #666;">{{t .LangCode "chat.addImage"}}</span>
+          <input type="file" name="image" accept="image/*">
+        </div>
+        <span class="uk-text-meta" id="file-name"></span>
+      </div>
+
+      <div class="uk-margin-small-top uk-text-right">
+        <button type="submit" class="uk-button uk-button-primary">{{t .LangCode "chat.send"}}</button>
+      </div>
+    </form>
+  </div>
+  {{ else }}
+  <div class="uk-text-center uk-margin-top">
+    <p class="uk-text-warning">{{t .LangCode "chat.closedNoSend"}}</p>
+    <a href="/_/{{.PageUser.Domain}}" class="uk-button uk-button-default">{{t .LangCode "common.backHome"}}</a>
+  </div>
+  {{ end }}
+
+  {{ if .IsOwner }}
+  <div class="uk-margin-top uk-text-center">
+      <a class="uk-button uk-button-{{ if .IsBlocked }}default{{ else }}warning{{ end }} uk-button-small" href="#">
+          {{ if .IsBlocked }}{{t .LangCode "chat.unblock"}}{{ else }}{{t .LangCode "chat.block"}}{{ end }}
+      </a>
+      <div class="uk-dropbar uk-dropbar-top" uk-drop="stretch: x; mode: click">
+          <div class="uk-card uk-card-default uk-card-body">
+              <h3 class="uk-card-title">{{ if .IsBlocked }}{{t .LangCode "chat.unblock"}}{{ else }}{{t .LangCode "chat.block"}}{{ end }}？</h3>
+              <p>{{ if .IsBlocked }}{{t .LangCode "chat.confirmUnblock"}}{{ else }}{{t .LangCode "chat.confirmBlock"}}{{ end }}</p>
+              <form method="post" action="/_/{{.PageUser.Domain}}/chat/{{.Conversation.Token}}/block">
+                  {{ .CSRFTokenHTML }}
+                  <button type="submit" class="uk-button uk-button-{{ if .IsBlocked }}primary{{ else }}danger{{ end }}">
+                      {{t .LangCode "chat.confirm"}}{{ if .IsBlocked }}{{t .LangCode "chat.unblock"}}{{ else }}{{t .LangCode "chat.block"}}{{ end }}
+                  </button>
+              </form>
+          </div>
+      </div>
+
+      <a class="uk-button uk-button-danger uk-button-small" href="#">{{t .LangCode "chat.delete"}}</a>
+      <div class="uk-dropbar uk-dropbar-top" uk-drop="stretch: x; mode: click">
+          <div class="uk-card uk-card-default uk-card-body">
+              <h3 class="uk-card-title">{{t .LangCode "qitem.danger"}}</h3>
+              <p>{{t .LangCode "chat.deleteConfirm"}}</p>
+              <form method="post" action="/_/{{.PageUser.Domain}}/chat/{{.Conversation.Token}}/delete">
+                  {{ .CSRFTokenHTML }}
+                  <button type="submit" class="uk-button uk-button-danger">{{t .LangCode "qitem.deleteConfirmBtn"}}</button>
+              </form>
+          </div>
+      </div>
+  </div>
+  {{ end }}
+
+</div>
+
+<!-- 自定义灯箱结构 -->
+<div id="customLightbox" class="custom-lightbox" onclick="closeLightbox()">
+  <span class="close-btn" onclick="closeLightbox()">&times;</span>
+  <img id="lightboxImg" src="" alt="" />
+  <div id="lightboxCaption" class="caption"></div>
+</div>
+
+<script>
+  // 显示已选文件名
+  var fileInput = document.querySelector('input[name="image"]');
+  var fileNameSpan = document.getElementById('file-name');
+  if (fileInput && fileNameSpan) {
+    fileInput.addEventListener('change', function() {
+      if (fileInput.files.length > 0) {
+        fileNameSpan.textContent = fileInput.files[0].name;
+      } else {
+        fileNameSpan.textContent = '';
+      }
+    });
+  }
+
+  // 自定义灯箱函数
+  function openLightbox(src, caption) {
+    document.getElementById('lightboxImg').src = src;
+    document.getElementById('lightboxCaption').textContent = caption || '';
+    document.getElementById('customLightbox').classList.add('active');
+  }
+
+  function closeLightbox() {
+    document.getElementById('customLightbox').classList.remove('active');
+    // 清空图片避免后台加载消耗
+    document.getElementById('lightboxImg').src = '';
+  }
+
+  // ESC 关闭
+  document.addEventListener('keydown', function(e) {
+    if (e.key === 'Escape') {
+      closeLightbox();
+    }
+  });
+</script>
+
+{{template "base/footer" .}}
\ No newline at end of file
diff --git a/templates/embed.go b/templates/embed.go
new file mode 100644
index 0000000..284f679
--- /dev/null
+++ b/templates/embed.go
@@ -0,0 +1,12 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package templates
+
+import (
+	"embed"
+)
+
+//go:embed auth base mail question user chat vote home.html about-me.html sponsor.html change-logs.html pixel.html maintenance-mode.html
+var FS embed.FS
diff --git a/templates/home.html b/templates/home.html
new file mode 100644
index 0000000..a43f14f
--- /dev/null
+++ b/templates/home.html
@@ -0,0 +1,123 @@
+{{template "base/header" .}}
+<div class="uk-card uk-card-default uk-card-body">
+  <h1 class="uk-heading-small">{{t .LangCode "site.title"}}</h1>
+  <p style="color: red;">重大消息！本站已切换到<a href="https://box.shiroko.one/">box.shiroko.one</a>，原域名将在2026年12月24日到期，期间将通过301转发指向新域名，到期后旧域名将彻底不在使用。<br>问：为什么？答：.guru域名连续涨价，现在一年三百出头了遭不住。<br>问：我该做什么？答：记住新域名，如果之前有通过二维码分享出去的，记得替换成新的二维码。</p><hr>
+  <p><br>⭐一个无需注册即可提问的匿名提问箱。你不需要下载App，不需要绑定社交账号，甚至连邮箱都不需要是真的。<br>⭐本站在原版的基础上新增了问题页面的二维码、私聊、投票、追加提问等功能以及更多自定义内容。各位用户可自行修改二维码背景图、颜色等个性化配置。<br>⭐可以到站长唯一提问提问箱链接<a href="//box.shiroko.one/_/tamakyi">小狼的提问箱</a>尝试相关功能或给我提意见。<br>⭐可以加群：<a href="http://qm.qq.com/cgi-bin/qm/qr?_wv=1027&k=rRy9g5XY34LIzOITGGmQHjX6BIICFpam&authKey=EjyNjp60KyG8BtKZGN8BXJaf1jl8okkCcUhVF2zAnGPRjhvuSdopnVqOSfSymnGg&noverify=0&group_code=777163254">小狼的群</a>一起水群。<br></p>
+  <hr><p style="color: red;">近期将国内段访问交由EdgeOne接管，境外访问照旧由CloudFlare提供，经测试国内访问速度有所提升。但因EdgeOne Free套餐不提供CIDR列表，IP放行采取自动抓取手动维护模式，如果出现521错误请刷新一下页面，过几天应该就好了。</p>
+  <hr><p style="color: red; font-weight: bold;">近期更新:<br>⭐2026.9 增加了提问、投票、私聊的总开关，可以设置定时收集、定量收集或关闭功能，顺便调整了前后端显示，看起来更易用了一些。<br>⭐2026.8 新增了<a href="https://box.shiroko.one/vote/sANyLkiBNUGN">投票功能</a>、追加提问、多语言、<a href="https://box.shiroko.one/_/tamakyi/2894">Markdown显示</a>、置顶显示等多个功能，详情见<a href="https://blog.shiroko.one/record/tamabox_changelog_20260813">这里</a>。<br>⭐2026.8 放弃使用recaptcha等对国内用户非常不友好的验证方式，更新了密码加密方式，修复了图片上传等一系列问题。<br>⭐2026.5 增加了私聊功能，可进行连续性对话，详见<a href="https://blog.shiroko.one/record/tamabox-update-20260513">介绍</a>；另有增加提问箱的卡片分享，更直观和美观。<br>⭐2026.2 新增了用户展示和标签功能，如果你希望陌生人给你提问，可以在设置页面给自己贴上5个标签并选择是否展示在探索页面：<a href="https://box.shiroko.one/explore">点我访问</a>，详情见<a href="https://blog.shiroko.one/record/tamabox-tags">狼的公告板</a><br></p>
+  <hr><p>一点提醒：<br>⭐本站唯一指定认证站长：<a href="//box.shiroko.one/_/tamakyi">小狼</a>，注意不要被骗。
+  <br>⭐本站不允许垃圾信息、广告、辱骂、涉政、暴恐、色情、违禁、无意义、灌水提问的出现，如有涉证或不良言论将直接删除。</p>
+</div>
+<p>{{t .LangCode "site.stats"}}:<pre style="overflow: hidden;" id="site-stats-text">{{if .SiteStats}}{{.SiteStats.Text}}{{end}}</pre></p>
+<script type="text/javascript">
+    // 首页统计已改为程序内直接计算（服务端 30 分钟缓存），这里每 30 分钟定时拉取最新值刷新，
+    // 与原来 crontab 生成 question.count.txt 的节奏一致，且不再依赖外部静态文件。
+    document.addEventListener('DOMContentLoaded', function () {
+        setInterval(function () {
+            fetch("/api/v1/site-stats")
+                .then(function (r) { return r.json(); })
+                .then(function (resp) {
+                    var d = resp.data;
+                    if (!d || !d.text) return;
+                    var el = document.getElementById("site-stats-text");
+                    if (el) el.textContent = d.text;
+                })
+                .catch(function () {});
+        }, 30 * 60 * 1000);
+    });
+</script>
+<!--<script src="https://r2.337845818.best/oss-to-r2/nekobox/cdn/waline/client/v2/waline.js"></script>
+<link href='https://r2.337845818.best/oss-to-r2/nekobox/cdn/waline/client/v2/waline-no-commits.css' rel='stylesheet' />-->
+ <div id="waline"></div>
+ <script>
+     document.addEventListener('DOMContentLoaded', function () {
+     const waline = Waline.init({
+         el: '#waline',
+         //后端服务器地址
+         serverURL: 'https://waline.337845818.best/',
+         path: window.location.href,
+             // 中文默认
+         locale: {
+           nick: '昵称',
+           nickError: '昵称不能少于3个字符',
+           mail: '邮箱',
+           mailError: '请填写正确的邮件地址',
+           link: '网址',
+           optional: '可选',
+           placeholder: '欢迎评论（可以无需登录，但需要手工审核，不会立即展现）',
+           sofa: '来发评论吧~',
+           submit: '提交',
+           like: '喜欢',
+           cancelLike: '取消喜欢',
+           reply: '回复',
+           cancelReply: '取消回复',
+           comment: '评论',
+           refresh: '刷新',
+           more: '加载更多...',
+           preview: '预览',
+           emoji: '表情',
+           uploadImage: '上传图片',
+           seconds: '秒前',
+           minutes: '分钟前',
+           hours: '小时前',
+           days: '天前',
+           now: '刚刚',
+           uploading: '正在上传',
+           login: '登录',
+           logout: '退出',
+           admin: '博主',
+           sticky: '置顶',
+           word: '字',
+           wordHint: '评论字数应在 $0 到 $1 字之间！\n当前字数：$2',
+           anonymous: '无名小狼',
+           level0: '潜水',
+           level1: '冒泡',
+           level2: '吐槽',
+           level3: '活跃',
+           level4: '话痨',
+           level5: '传说',
+           gif: '表情包',
+           gifSearchPlaceholder: '搜索表情包',
+           profile: '个人资料',
+           approved: '通过',
+           waiting: '待审核',
+           spam: '垃圾',
+           unsticky: '取消置顶',
+           oldest: '按倒序',
+           latest: '按正序',
+           hottest: '按热度',
+           reactionTitle: '',
+           reaction0: '哇哦',
+           reaction1: 'prpr',
+           reaction2: '流汗',
+           reaction3: '生气',
+           reaction4: '流鼻血',
+           reaction5: 'あべ',
+         },
+         reaction: [
+          'https://ali-imgs.acfun.cn/kimg/bs2/zt-image-host/ChYwOGQ3OTRhYzRjMTBkZmZhZDVmZTA1EIjM1y8.gif',
+          'https://ali-imgs.acfun.cn/kimg/bs2/zt-image-host/ChQwOGEyOTlhYzRjMTBmOWFkZjAwYRCIzNcv.gif',
+          'https://ali-imgs.acfun.cn/kimg/bs2/zt-image-host/ChYwOGRhOTVhYzRjMTBkNmViYTVlNTA2EIjM1y8.gif',
+          'https://ali-imgs.acfun.cn/kimg/bs2/zt-image-host/ChYwOGU1OTJhYzRjMTBmMzk3ZmVmNTAyEIjM1y8.gif',
+          'https://ali-imgs.acfun.cn/kimg/bs2/zt-image-host/ChYwOGNkODdhYzRjMTBjYmEwOTFjNjAxEIjM1y8.gif',
+          'https://ali-imgs.acfun.cn/kimg/bs2/zt-image-host/ChQwODliOGVhYzRjMTBmOGM0ZWY1ZRCIzNcv.gif',
+         ],
+         meta: ['nick','mail'],
+         requiredMeta: ['mail'],
+         pageview: true,
+         search: false,
+         login: 'enable',
+         wordLimit: 50,
+         pageSize: 5,
+         avatar: 'identicon',
+         emoji: [
+             'https://gcore.jsdelivr.net/gh/tamakyi/emoji-collection@main/acfun-color/60x60',
+         ],
+         //禁止图片上传按钮
+         imageUploader: false,
+         //不显示版权标志
+         copyright: false,
+     });
+     });
+ </script>
+ {{template "base/footer" .}}
\ No newline at end of file
diff --git a/templates/mail/new-answer.html b/templates/mail/new-answer.html
new file mode 100644
index 0000000..be78e5c
--- /dev/null
+++ b/templates/mail/new-answer.html
@@ -0,0 +1,120 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+  <meta name="format-detection" content="email=no"/>
+  <meta name="format-detection" content="date=no"/>
+  <style>.awl a {
+      color: #FFFFFF;
+      text-decoration: none;
+  }
+
+  .abml a {
+      color: #000000;
+      font-family: Roboto-Medium, Helvetica, Arial, sans-serif;
+      font-weight: bold;
+      text-decoration: none;
+  }
+
+  .adgl a {
+      color: rgba(0, 0, 0, 0.87);
+      text-decoration: none;
+  }
+
+  .afal a {
+      color: #b0b0b0;
+      text-decoration: none;
+  }
+
+  @media screen and (min-width: 600px) {
+      .v2sp {
+          padding: 6px 30px 0px;
+      }
+
+      .v2rsp {
+          padding: 0px 10px;
+      }
+  }
+
+  @media screen and (min-width: 600px) {
+      .mdv2rw {
+          padding: 40px 40px;
+      }
+  } </style>
+  <link href="//fonts.loli.net/css?family=Google+Sans" rel="stylesheet" type="text/css"/>
+</head>
+<body style="margin: 0; padding: 0;" bgcolor="#FFFFFF">
+<table width="100%" height="100%" style="min-width: 348px;" border="0" cellspacing="0" cellpadding="0" lang="zh-CN">
+  <tbody>
+  <tr height="32" style="height: 32px;">
+    <td></td>
+  </tr>
+  <tr align="center">
+        <td>
+            <table border="0" cellspacing="0" cellpadding="0"
+             style="padding-bottom: 20px;max-width: 516px;min-width: 220px;">
+        <tbody>
+        <tr>
+          <td width="8" style="width: 8px;"></td>
+          <td>
+            <div style="border-style: solid; border-width: thin; border-color:#dadce0; border-radius: 8px; padding: 40px 20px;"
+                 align="center" class="mdv2rw">
+              <div style="font-family: 'Google Sans',Roboto,RobotoDraft,Helvetica,Arial,sans-serif;border-bottom: thin solid #dadce0; color: rgba(0,0,0,0.87); line-height: 32px; padding-bottom: 24px;text-align: center; word-break: break-word;">
+                <div style="font-size: 24px;">
+                  您在 狼的提问箱 的提问有了回复
+                </div>
+                <table align="center" style="margin-top:8px;">
+                  <tbody>
+                  <tr style="line-height: normal;">
+                    <td>
+                      <p style="font-family: 'Google Sans',Roboto,RobotoDraft,Helvetica,Arial,sans-serif;color: rgba(0,0,0,0.87); font-size: 14px; line-height: 20px; font-weight: bolder">
+                        {{.question}}</p>
+                    </td>
+                  </tr>
+                  </tbody>
+                </table>
+                <table align="center" style="margin-top:8px;">
+                  <tbody>
+                  <tr style="line-height: normal;">
+                    <td>
+                      <p style="font-family: 'Google Sans',Roboto,RobotoDraft,Helvetica,Arial,sans-serif;color: rgba(0,0,0,0.87); font-size: 14px; line-height: 20px;">
+                        {{.answer}}</p>
+                    </td>
+                  </tr>
+                  </tbody>
+                </table>
+              </div>
+              <div style="font-family: Roboto-Regular,Helvetica,Arial,sans-serif; font-size: 14px; color: rgba(0,0,0,0.87); line-height: 20px;padding-top: 20px; text-align: center;">
+                <div style="text-align: center;">
+                  <a href="{{.link}}" target="_blank"
+                     link-id="main-button-link"
+                     style="font-family: 'Google Sans',Roboto,RobotoDraft,Helvetica,Arial,sans-serif; line-height: 16px; color: #ffffff; font-weight: 400; text-decoration: none;font-size: 14px;display:inline-block;padding: 10px 24px;background-color: #4184F3; border-radius: 5px; min-width: 90px;">
+                    查看提问
+                  </a>
+                </div>
+                <br/>
+              </div>
+            </div>
+            <div style="text-align: left;">
+              <div style="font-family: Roboto-Regular,Helvetica,Arial,sans-serif;color: rgba(0,0,0,0.54);font-size: 11px; line-height: 18px; padding-top: 12px; text-align: center;">
+                <div>
+                  我们向您发送这封邮件来告诉您在 狼的提问箱 的活动状态，若您未曾使用过 狼的提问箱，请忽略本邮件。
+                </div>
+                <div style="direction: ltr;">
+                  {{ .year }} 狼的提问箱
+                </div>
+              </div>
+            </div>
+          </td>
+          <td width="8" style="width: 8px;"></td>
+        </tr>
+        </tbody>
+      </table>
+    </td>
+  </tr>
+  <tr height="32" style="height: 32px;">
+    <td></td>
+  </tr>
+  </tbody>
+</table>
+</body>
+</html>
diff --git a/templates/mail/new-conversation.html b/templates/mail/new-conversation.html
new file mode 100644
index 0000000..6e5449e
--- /dev/null
+++ b/templates/mail/new-conversation.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head><meta charset="UTF-8"></head>
+<body>
+  <p>您好！</p>
+  <p>您收到一个新的私聊对话，内容如下：</p>
+  <div style="border-left: 4px solid #e0e0e0; padding: 12px; margin: 12px 0; background-color: #f9f9f9; border-radius: 4px; color: #333333;">
+    {{.content}}
+  </div>
+  <p>点击下方链接查看并回复：</p>
+  <p><a href="{{.link}}">{{.link}}</a></p>
+  <br>
+  <p style="color: #999999; font-size: 12px;">此邮件由系统自动发送，请勿回复。<br>© {{.year}} 狼的提问箱</p>
+</body>
+</html>
\ No newline at end of file
diff --git a/templates/mail/new-follow-up.html b/templates/mail/new-follow-up.html
new file mode 100644
index 0000000..978d070
--- /dev/null
+++ b/templates/mail/new-follow-up.html
@@ -0,0 +1,112 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta name="format-detection" content="email=no"/>
+    <meta name="format-detection" content="date=no"/>
+    <style>.awl a {
+            color: #FFFFFF;
+            text-decoration: none;
+        }
+
+        .abml a {
+            color: #000000;
+            font-family: Roboto-Medium, Helvetica, Arial, sans-serif;
+            font-weight: bold;
+            text-decoration: none;
+        }
+
+        .adgl a {
+            color: rgba(0, 0, 0, 0.87);
+            text-decoration: none;
+        }
+
+        .afal a {
+            color: #b0b0b0;
+            text-decoration: none;
+        }
+
+        @media screen and (min-width: 600px) {
+            .v2sp {
+                padding: 6px 30px 0px;
+            }
+
+            .v2rsp {
+                padding: 0px 10px;
+            }
+        }
+
+        @media screen and (min-width: 600px) {
+            .mdv2rw {
+                padding: 40px 40px;
+            }
+        } </style>
+    <link href="//fonts.loli.net/css?family=Google+Sans" rel="stylesheet" type="text/css"/>
+</head>
+<body style="margin: 0; padding: 0;" bgcolor="#FFFFFF">
+<table width="100%" height="100%" style="min-width: 348px;" border="0" cellspacing="0" cellpadding="0" lang="zh-CN">
+    <tbody>
+    <tr height="32" style="height: 32px;">
+        <td></td>
+    </tr>
+    <tr align="center">
+        <td>
+            <table border="0" cellspacing="0" cellpadding="0"
+                   style="padding-bottom: 20px;max-width: 516px;min-width: 220px;">
+                <tbody>
+                <tr>
+                    <td width="8" style="width: 8px;"></td>
+                    <td>
+                        <div style="border-style: solid; border-width: thin; border-color:#dadce0; border-radius: 8px; padding: 40px 20px;"
+                             align="center" class="mdv2rw">
+                            <div style="font-family: 'Google Sans',Roboto,RobotoDraft,Helvetica,Arial,sans-serif;border-bottom: thin solid #dadce0; color: rgba(0,0,0,0.87); line-height: 32px; padding-bottom: 24px;text-align: center; word-break: break-word;">
+                                <div style="font-size: 24px;">
+                                    您的提问有了一条追问
+                                </div>
+                                <table align="center" style="margin-top:8px;">
+                                    <tbody>
+                                    <tr style="line-height: normal;">
+                                        <td>
+                                            <p style="font-family: 'Google Sans',Roboto,RobotoDraft,Helvetica,Arial,sans-serif;color: rgba(0,0,0,0.87); font-size: 14px; line-height: 20px;">
+                                                原提问：{{.question}}</p>
+                                            <p style="font-family: 'Google Sans',Roboto,RobotoDraft,Helvetica,Arial,sans-serif;color: rgba(0,0,0,0.54); font-size: 14px; line-height: 20px;">
+                                                追问：{{.followup}}</p>
+                                        </td>
+                                    </tr>
+                                    </tbody>
+                                </table>
+                            </div>
+                            <div style="font-family: Roboto-Regular,Helvetica,Arial,sans-serif; font-size: 14px; color: rgba(0,0,0,0.87); line-height: 20px;padding-top: 20px; text-align: center;">
+                                <div style="text-align: center;">
+                                    <a href="{{.link}}" target="_blank"
+                                       link-id="main-button-link"
+                                       style="font-family: 'Google Sans',Roboto,RobotoDraft,Helvetica,Arial,sans-serif; line-height: 16px; color: #ffffff; font-weight: 400; text-decoration: none;font-size: 14px;display:inline-block;padding: 10px 24px;background-color: #4184F3; border-radius: 5px; min-width: 90px;">
+                                        查看追问
+                                    </a>
+                                </div>
+                                <br/>
+                            </div>
+                        </div>
+                        <div style="text-align: left;">
+                            <div style="font-family: Roboto-Regular,Helvetica,Arial,sans-serif;color: rgba(0,0,0,0.54);font-size: 11px; line-height: 18px; padding-top: 12px; text-align: center;">
+                                <div>
+                                    我们向您发送这封邮件来告诉您账号的状态，若您未曾在 狼的提问箱 注册过账号，请忽略本邮件。
+                                </div>
+                                <div style="direction: ltr;">
+                                    {{ .year }} 狼的提问箱
+                                </div>
+                            </div>
+                        </div>
+                    </td>
+                    <td width="8" style="width: 8px;"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+    <tr height="32" style="height: 32px;">
+        <td></td>
+    </tr>
+    </tbody>
+</table>
+</body>
+</html>
diff --git a/templates/mail/new-message.html b/templates/mail/new-message.html
new file mode 100644
index 0000000..eaa8e2c
--- /dev/null
+++ b/templates/mail/new-message.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head><meta charset="UTF-8"></head>
+<body>
+  <p>您好！</p>
+  <p>您收到一条私聊新消息：</p>
+  <div style="border-left: 4px solid #e0e0e0; padding: 12px; margin: 12px 0; background-color: #f9f9f9; border-radius: 4px; color: #333333;">
+    {{.content}}
+  </div>
+  <p>点击下方链接查看对话：</p>
+  <p><a href="{{.link}}">{{.link}}</a></p>
+  <br>
+  <p style="color: #999999; font-size: 12px;">此邮件由系统自动发送，请勿回复。<br>© {{.year}} 狼的提问箱</p>
+</body>
+</html>
\ No newline at end of file
diff --git a/templates/mail/new-question-to-user.html b/templates/mail/new-question-to-user.html
new file mode 100644
index 0000000..66a7c88
--- /dev/null
+++ b/templates/mail/new-question-to-user.html
@@ -0,0 +1,109 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta name="format-detection" content="email=no"/>
+    <meta name="format-detection" content="date=no"/>
+    <style>.awl a {
+            color: #FFFFFF;
+            text-decoration: none;
+        }
+
+        .abml a {
+            color: #000000;
+            font-family: Roboto-Medium, Helvetica, Arial, sans-serif;
+            font-weight: bold;
+            text-decoration: none;
+        }
+
+        .adgl a {
+            color: rgba(0, 0, 0, 0.87);
+            text-decoration: none;
+        }
+
+        .afal a {
+            color: #b0b0b0;
+            text-decoration: none;
+        }
+
+        @media screen and (min-width: 600px) {
+            .v2sp {
+                padding: 6px 30px 0px;
+            }
+
+            .v2rsp {
+                padding: 0px 10px;
+            }
+        }
+
+        @media screen and (min-width: 600px) {
+            .mdv2rw {
+                padding: 40px 40px;
+            }
+        } </style>
+    <link href="//fonts.loli.net/css?family=Google+Sans" rel="stylesheet" type="text/css"/>
+</head>
+<body style="margin: 0; padding: 0;" bgcolor="#FFFFFF">
+<table width="100%" height="100%" style="min-width: 348px;" border="0" cellspacing="0" cellpadding="0" lang="zh-CN">
+    <tbody>
+    <tr height="32" style="height: 32px;">
+        <td></td>
+    </tr>
+    <tr align="center">
+        <td>
+            <table border="0" cellspacing="0" cellpadding="0"
+                   style="padding-bottom: 20px;max-width: 516px;min-width: 220px;">
+                <tbody>
+                <tr>
+                    <td width="8" style="width: 8px;"></td>
+                    <td>
+                        <div style="border-style: solid; border-width: thin; border-color:#dadce0; border-radius: 8px; padding: 40px 20px;"
+                             align="center" class="mdv2rw">
+                            <div style="font-family: 'Google Sans',Roboto,RobotoDraft,Helvetica,Arial,sans-serif;border-bottom: thin solid #dadce0; color: rgba(0,0,0,0.87); line-height: 32px; padding-bottom: 24px;text-align: center; word-break: break-word;">
+                                <div style="font-size: 24px;">
+                                    您在 狼的提问箱 发送了一个提问
+                                </div>
+                                <table align="center" style="margin-top:8px;">
+                                    <tbody>
+                                    <tr style="line-height: normal;">
+                                        <td>
+                                            <p style="font-family: 'Google Sans',Roboto,RobotoDraft,Helvetica,Arial,sans-serif;color: rgba(0,0,0,0.87); font-size: 14px; line-height: 20px;">{{.question}}</p>
+                                        </td>
+                                    </tr>
+                                    </tbody>
+                                </table>
+                            </div>
+                            <div style="font-family: Roboto-Regular,Helvetica,Arial,sans-serif; font-size: 14px; color: rgba(0,0,0,0.87); line-height: 20px;padding-top: 20px; text-align: center;">
+                                <div style="text-align: center;">
+                                    <a href="{{.link}}" target="_blank"
+                                       link-id="main-button-link"
+                                       style="font-family: 'Google Sans',Roboto,RobotoDraft,Helvetica,Arial,sans-serif; line-height: 16px; color: #ffffff; font-weight: 400; text-decoration: none;font-size: 14px;display:inline-block;padding: 10px 24px;background-color: #4184F3; border-radius: 5px; min-width: 90px;">
+                                        查看提问
+                                    </a>
+                                </div>
+                                <br/>
+                            </div>
+                        </div>
+                        <div style="text-align: left;">
+                            <div style="font-family: Roboto-Regular,Helvetica,Arial,sans-serif;color: rgba(0,0,0,0.54);font-size: 11px; line-height: 18px; padding-top: 12px; text-align: center;">
+                                <div>
+                                    我们向您发送这封邮件来告诉您账号的状态，若您未曾在 狼的提问箱 进行过提问，请忽略本邮件。
+                                </div>
+                                <div style="direction: ltr;">
+                                    {{ .year }} 狼的提问箱
+                                </div>
+                            </div>
+                        </div>
+                    </td>
+                    <td width="8" style="width: 8px;"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+    <tr height="32" style="height: 32px;">
+        <td></td>
+    </tr>
+    </tbody>
+</table>
+</body>
+</html>
diff --git a/templates/mail/new-question.html b/templates/mail/new-question.html
new file mode 100644
index 0000000..8bef529
--- /dev/null
+++ b/templates/mail/new-question.html
@@ -0,0 +1,109 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta name="format-detection" content="email=no"/>
+    <meta name="format-detection" content="date=no"/>
+    <style>.awl a {
+            color: #FFFFFF;
+            text-decoration: none;
+        }
+
+        .abml a {
+            color: #000000;
+            font-family: Roboto-Medium, Helvetica, Arial, sans-serif;
+            font-weight: bold;
+            text-decoration: none;
+        }
+
+        .adgl a {
+            color: rgba(0, 0, 0, 0.87);
+            text-decoration: none;
+        }
+
+        .afal a {
+            color: #b0b0b0;
+            text-decoration: none;
+        }
+
+        @media screen and (min-width: 600px) {
+            .v2sp {
+                padding: 6px 30px 0px;
+            }
+
+            .v2rsp {
+                padding: 0px 10px;
+            }
+        }
+
+        @media screen and (min-width: 600px) {
+            .mdv2rw {
+                padding: 40px 40px;
+            }
+        } </style>
+    <link href="//fonts.loli.net/css?family=Google+Sans" rel="stylesheet" type="text/css"/>
+</head>
+<body style="margin: 0; padding: 0;" bgcolor="#FFFFFF">
+<table width="100%" height="100%" style="min-width: 348px;" border="0" cellspacing="0" cellpadding="0" lang="zh-CN">
+    <tbody>
+    <tr height="32" style="height: 32px;">
+        <td></td>
+    </tr>
+    <tr align="center">
+        <td>
+            <table border="0" cellspacing="0" cellpadding="0"
+                   style="padding-bottom: 20px;max-width: 516px;min-width: 220px;">
+                <tbody>
+                <tr>
+                    <td width="8" style="width: 8px;"></td>
+                    <td>
+                        <div style="border-style: solid; border-width: thin; border-color:#dadce0; border-radius: 8px; padding: 40px 20px;"
+                             align="center" class="mdv2rw">
+                            <div style="font-family: 'Google Sans',Roboto,RobotoDraft,Helvetica,Arial,sans-serif;border-bottom: thin solid #dadce0; color: rgba(0,0,0,0.87); line-height: 32px; padding-bottom: 24px;text-align: center; word-break: break-word;">
+                                <div style="font-size: 24px;">
+                                    您的 狼的提问箱 收到一个新的提问
+                                </div>
+                                <table align="center" style="margin-top:8px;">
+                                    <tbody>
+                                    <tr style="line-height: normal;">
+                                        <td>
+                                            <p style="font-family: 'Google Sans',Roboto,RobotoDraft,Helvetica,Arial,sans-serif;color: rgba(0,0,0,0.87); font-size: 14px; line-height: 20px;">{{.question}}</p>
+                                        </td>
+                                    </tr>
+                                    </tbody>
+                                </table>
+                            </div>
+                            <div style="font-family: Roboto-Regular,Helvetica,Arial,sans-serif; font-size: 14px; color: rgba(0,0,0,0.87); line-height: 20px;padding-top: 20px; text-align: center;">
+                                <div style="text-align: center;">
+                                    <a href="{{.link}}" target="_blank"
+                                       link-id="main-button-link"
+                                       style="font-family: 'Google Sans',Roboto,RobotoDraft,Helvetica,Arial,sans-serif; line-height: 16px; color: #ffffff; font-weight: 400; text-decoration: none;font-size: 14px;display:inline-block;padding: 10px 24px;background-color: #4184F3; border-radius: 5px; min-width: 90px;">
+                                        查看提问
+                                    </a>
+                                </div>
+                                <br/>
+                            </div>
+                        </div>
+                        <div style="text-align: left;">
+                            <div style="font-family: Roboto-Regular,Helvetica,Arial,sans-serif;color: rgba(0,0,0,0.54);font-size: 11px; line-height: 18px; padding-top: 12px; text-align: center;">
+                                <div>
+                                    我们向您发送这封邮件来告诉您账号的状态，若您未曾在 狼的提问箱 注册过账号，请忽略本邮件。
+                                </div>
+                                <div style="direction: ltr;">
+                                    {{ .year }} 狼的提问箱
+                                </div>
+                            </div>
+                        </div>
+                    </td>
+                    <td width="8" style="width: 8px;"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+    <tr height="32" style="height: 32px;">
+        <td></td>
+    </tr>
+    </tbody>
+</table>
+</body>
+</html>
diff --git a/templates/mail/new-vote.html b/templates/mail/new-vote.html
new file mode 100644
index 0000000..10c3d62
--- /dev/null
+++ b/templates/mail/new-vote.html
@@ -0,0 +1,75 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta name="format-detection" content="email=no"/>
+    <meta name="format-detection" content="date=no"/>
+    <link href="//fonts.loli.net/css?family=Google+Sans" rel="stylesheet" type="text/css"/>
+</head>
+<body style="margin: 0; padding: 0;" bgcolor="#FFFFFF">
+<table width="100%" height="100%" style="min-width: 348px;" border="0" cellspacing="0" cellpadding="0" lang="zh-CN">
+    <tbody>
+    <tr height="32" style="height: 32px;">
+        <td></td>
+    </tr>
+    <tr align="center">
+        <td>
+            <table border="0" cellspacing="0" cellpadding="0"
+                   style="padding-bottom: 20px;max-width: 516px;min-width: 220px;">
+                <tbody>
+                <tr>
+                    <td width="8" style="width: 8px;"></td>
+                    <td>
+                        <div style="border-style: solid; border-width: thin; border-color:#dadce0; border-radius: 8px; padding: 40px 20px;"
+                             align="center" class="mdv2rw">
+                            <div style="font-family: 'Google Sans',Roboto,RobotoDraft,Helvetica,Arial,sans-serif;border-bottom: thin solid #dadce0; color: rgba(0,0,0,0.87); line-height: 32px; padding-bottom: 24px;text-align: center; word-break: break-word;">
+                                <div style="font-size: 24px;">
+                                    您的投票收到了新回复
+                                </div>
+                                <table align="center" style="margin-top:8px;">
+                                    <tbody>
+                                    <tr style="line-height: normal;">
+                                        <td>
+                                            <p style="font-family: 'Google Sans',Roboto,RobotoDraft,Helvetica,Arial,sans-serif;color: rgba(0,0,0,0.87); font-size: 14px; line-height: 20px;">投票《{{.title}}》收到了一条新的表单回复，点击下方按钮查看。</p>
+                                        </td>
+                                    </tr>
+                                    </tbody>
+                                </table>
+                            </div>
+                            <div style="font-family: Roboto-Regular,Helvetica,Arial,sans-serif; font-size: 14px; color: rgba(0,0,0,0.87); line-height: 20px;padding-top: 20px; text-align: center;">
+                                <div style="text-align: center;">
+                                    <a href="{{.link}}" target="_blank"
+                                       style="font-family: 'Google Sans',Roboto,RobotoDraft,Helvetica,Arial,sans-serif; line-height: 16px; color: #ffffff; font-weight: 400; text-decoration: none;font-size: 14px;display:inline-block;padding: 10px 24px;background-color: #4184F3; border-radius: 5px; min-width: 90px;">
+                                        查看回复
+                                    </a>
+                                </div>
+                                <div style="margin-top: 16px; padding: 10px 12px; border-radius: 6px; background-color: #fff8e1; color: #7a5b00; font-family: Roboto-Regular,Helvetica,Arial,sans-serif; font-size: 12px; line-height: 18px; text-align: left;">
+                                    提示：直接回复此邮件不能提交回答，请点击上方“查看回复”按钮完成操作。
+                                </div>
+                                <br/>
+                            </div>
+                        </div>
+                        <div style="text-align: left;">
+                            <div style="font-family: Roboto-Regular,Helvetica,Arial,sans-serif;color: rgba(0,0,0,0.54);font-size: 11px; line-height: 18px; padding-top: 12px; text-align: center;">
+                                <div>
+                                    此邮件由系统自动发送，请勿直接回复。直接回复邮件不能实现回答，请通过邮件中的按钮访问页面。<br/>
+                                    若您未曾在 狼的提问箱 创建过投票，请忽略本邮件。
+                                </div>
+                                <div style="direction: ltr;">
+                                    {{ .year }} 狼的提问箱
+                                </div>
+                            </div>
+                        </div>
+                    </td>
+                    <td width="8" style="width: 8px;"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+    <tr height="32" style="height: 32px;">
+        <td></td>
+    </tr>
+    </tbody>
+</table>
+</body>
+</html>
diff --git a/templates/mail/password-recovery.html b/templates/mail/password-recovery.html
new file mode 100644
index 0000000..ebb5235
--- /dev/null
+++ b/templates/mail/password-recovery.html
@@ -0,0 +1,109 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta name="format-detection" content="email=no"/>
+    <meta name="format-detection" content="date=no"/>
+    <style>.awl a {
+            color: #FFFFFF;
+            text-decoration: none;
+        }
+
+        .abml a {
+            color: #000000;
+            font-family: Roboto-Medium, Helvetica, Arial, sans-serif;
+            font-weight: bold;
+            text-decoration: none;
+        }
+
+        .adgl a {
+            color: rgba(0, 0, 0, 0.87);
+            text-decoration: none;
+        }
+
+        .afal a {
+            color: #b0b0b0;
+            text-decoration: none;
+        }
+
+        @media screen and (min-width: 600px) {
+            .v2sp {
+                padding: 6px 30px 0px;
+            }
+
+            .v2rsp {
+                padding: 0px 10px;
+            }
+        }
+
+        @media screen and (min-width: 600px) {
+            .mdv2rw {
+                padding: 40px 40px;
+            }
+        } </style>
+    <link href="//fonts.loli.net/css?family=Google+Sans" rel="stylesheet" type="text/css"/>
+</head>
+<body style="margin: 0; padding: 0;" bgcolor="#FFFFFF">
+<table width="100%" height="100%" style="min-width: 348px;" border="0" cellspacing="0" cellpadding="0" lang="zh-CN">
+    <tbody>
+    <tr height="32" style="height: 32px;">
+        <td></td>
+    </tr>
+    <tr align="center">
+        <td>
+            <table border="0" cellspacing="0" cellpadding="0"
+                   style="padding-bottom: 20px;max-width: 516px;min-width: 220px;">
+                <tbody>
+                <tr>
+                    <td width="8" style="width: 8px;"></td>
+                    <td>
+                        <div style="border-style: solid; border-width: thin; border-color:#dadce0; border-radius: 8px; padding: 40px 20px;"
+                             align="center" class="mdv2rw">
+                            <div style="font-family: 'Google Sans',Roboto,RobotoDraft,Helvetica,Arial,sans-serif;border-bottom: thin solid #dadce0; color: rgba(0,0,0,0.87); line-height: 32px; padding-bottom: 24px;text-align: center; word-break: break-word;">
+                                <div style="font-size: 24px;">
+                                    您正在找回 狼的提问箱 注册账号的密码
+                                </div>
+                                <table align="center" style="margin-top:8px;">
+                                    <tbody>
+                                    <tr style="line-height: normal;">
+                                        <td>
+                                            <a style="font-family: 'Google Sans',Roboto,RobotoDraft,Helvetica,Arial,sans-serif;color: rgba(0,0,0,0.87); font-size: 14px; line-height: 20px;">{{.email}}</a>
+                                        </td>
+                                    </tr>
+                                    </tbody>
+                                </table>
+                            </div>
+                            <div style="font-family: Roboto-Regular,Helvetica,Arial,sans-serif; font-size: 14px; color: rgba(0,0,0,0.87); line-height: 20px;padding-top: 20px; text-align: center;">
+                                <div style="text-align: center;">
+                                    <a href="{{.link}}" target="_blank"
+                                       link-id="main-button-link"
+                                       style="font-family: 'Google Sans',Roboto,RobotoDraft,Helvetica,Arial,sans-serif; line-height: 16px; color: #ffffff; font-weight: 400; text-decoration: none;font-size: 14px;display:inline-block;padding: 10px 24px;background-color: #4184F3; border-radius: 5px; min-width: 90px;">
+                                        重新设置密码
+                                    </a>
+                                </div>
+                                <br/>
+                            </div>
+                        </div>
+                        <div style="text-align: left;">
+                            <div style="font-family: Roboto-Regular,Helvetica,Arial,sans-serif;color: rgba(0,0,0,0.54);font-size: 11px; line-height: 18px; padding-top: 12px; text-align: center;">
+                                <div>
+                                    我们向您发送这封邮件来告诉您账号的状态，若您未曾在 狼的提问箱 注册过账号，请忽略本邮件。
+                                </div>
+                                <div style="direction: ltr;">
+                                    {{ .year }} 狼的提问箱
+                                </div>
+                            </div>
+                        </div>
+                    </td>
+                    <td width="8" style="width: 8px;"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+    <tr height="32" style="height: 32px;">
+        <td></td>
+    </tr>
+    </tbody>
+</table>
+</body>
+</html>
diff --git a/templates/mail/security-alert.html b/templates/mail/security-alert.html
new file mode 100644
index 0000000..c185711
--- /dev/null
+++ b/templates/mail/security-alert.html
@@ -0,0 +1,70 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta name="format-detection" content="email=no"/>
+    <meta name="format-detection" content="date=no"/>
+</head>
+<body style="margin: 0; padding: 0;" bgcolor="#FFFFFF">
+<table width="100%" height="100%" style="min-width: 348px;" border="0" cellspacing="0" cellpadding="0" lang="zh-CN">
+    <tbody>
+    <tr height="32" style="height: 32px;">
+        <td></td>
+    </tr>
+    <tr align="center">
+        <td>
+            <table border="0" cellspacing="0" cellpadding="0"
+                   style="padding-bottom: 20px;max-width: 516px;min-width: 220px;">
+                <tbody>
+                <tr>
+                    <td width="8" style="width: 8px;"></td>
+                    <td>
+                        <div style="border-style: solid; border-width: thin; border-color:#dadce0; border-radius: 8px; padding: 40px 20px;"
+                             align="center">
+                            <div style="font-family: 'Google Sans',Roboto,RobotoDraft,Helvetica,Arial,sans-serif;border-bottom: thin solid #dadce0; color: rgba(0,0,0,0.87); line-height: 32px; padding-bottom: 24px;text-align: center; word-break: break-word;">
+                                <div style="font-size: 24px;">
+                                    检测到疑似批量扫描
+                                </div>
+                                <div style="font-size: 13px; color: rgba(0,0,0,0.54); margin-top: 6px;">
+                                    {{.time}}
+                                </div>
+                            </div>
+                            <div style="font-family: Roboto-Regular,Helvetica,Arial,sans-serif; font-size: 14px; color: rgba(0,0,0,0.87); line-height: 22px; padding-top: 20px; text-align: left;">
+                                <div style="padding: 12px 14px; border-radius: 6px; background-color: #fdecea; border: 1px solid #f5c6cb; margin-bottom: 14px;">
+                                    <div><b>来源 IP：</b>{{.ip}}</div>
+                                    <div style="margin-top: 4px;"><b>网络归属：</b>{{.provider}}</div>
+                                    <div style="margin-top: 4px;"><b>处置：</b>已自动临时封禁 <b>{{.duration}}</b> 分钟，到期自动解除</div>
+                                    {{if .proxy_hint}}
+                                    <div style="margin-top: 8px; font-size: 13px; color: #b71c1c;">⚠️ 该 IP 属于 CDN / 代理网络，攻击者可随时更换出口 IP，本次封禁可能无法拦截真实来源。</div>
+                                    {{end}}
+                                </div>
+                                <div style="font-size: 13px; color: rgba(0,0,0,0.54);">命中路径样本：</div>
+                                <div style="font-family: monospace; font-size: 12px; color: #333; background-color: #f7f7f7; padding: 10px 12px; border-radius: 6px; margin-top: 6px; word-break: break-all;">
+                                    {{.paths}}
+                                </div>
+                                <div style="font-size: 12px; color: rgba(0,0,0,0.54); margin-top: 12px;">
+                                    该 IP 在统计窗口内频繁访问后台/敏感路径或产生大量 404，已自动加入临时封禁名单。如属误报，请检查服务器访问日志确认。
+                                </div>
+                            </div>
+                        </div>
+                        <div style="text-align: left;">
+                            <div style="font-family: Roboto-Regular,Helvetica,Arial,sans-serif;color: rgba(0,0,0,0.54);font-size: 11px; line-height: 18px; padding-top: 12px; text-align: center;">
+                                <div>
+                                    此邮件由系统自动发送，请勿直接回复。<br/>
+                                    {{ .year }} 狼的提问箱
+                                </div>
+                            </div>
+                        </div>
+                    </td>
+                    <td width="8" style="width: 8px;"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+    <tr height="32" style="height: 32px;">
+        <td></td>
+    </tr>
+    </tbody>
+</table>
+</body>
+</html>
diff --git a/templates/maintenance-mode.html b/templates/maintenance-mode.html
new file mode 100644
index 0000000..0de4842
--- /dev/null
+++ b/templates/maintenance-mode.html
@@ -0,0 +1,8 @@
+{{template "base/header" .}}
+<div class="uk-card uk-card-default uk-card-body">
+    <h2>{{t .LangCode "maintenance.title"}}</h2>
+    <div>
+        <p>{{t .LangCode "maintenance.desc"}}</p>
+    </div>
+</div>
+{{template "base/footer" .}}
\ No newline at end of file
diff --git a/templates/percent_check_test.go b/templates/percent_check_test.go
new file mode 100644
index 0000000..ec42fff
--- /dev/null
+++ b/templates/percent_check_test.go
@@ -0,0 +1,148 @@
+package templates
+
+import (
+	"bytes"
+	gotemplate "html/template"
+	"testing"
+	"time"
+
+	"github.com/flamego/template"
+
+	"github.com/tamakyi/TamaBox/internal/db"
+	"github.com/tamakyi/TamaBox/internal/dbutil"
+	templatepkg "github.com/tamakyi/TamaBox/internal/template"
+)
+
+// TestPercentRender 渲染投票结果页并检查百分比与进度条是否真实输出。
+func TestPercentRender(t *testing.T) {
+	fs, err := template.EmbedFS(FS, ".", []string{".html"})
+	if err != nil {
+		t.Fatalf("EmbedFS: %v", err)
+	}
+	tpl := gotemplate.New("Flamego.Template")
+	for _, f := range fs.Files() {
+		tt := tpl.New(f.Name())
+		for _, funcMap := range templatepkg.FuncMap() {
+			tt.Funcs(funcMap)
+		}
+		dataBytes, err := f.Data()
+		if err != nil {
+			t.Fatalf("get data of %q: %v", f.Name(), err)
+		}
+		if _, err := tt.Parse(string(dataBytes)); err != nil {
+			t.Fatalf("parse %q: %v", f.Name(), err)
+		}
+	}
+
+	data := map[string]interface{}{
+		"LangCode":      "zh-CN",
+		"IsUserPage":    true,
+		"Vote":          &db.Vote{Model: dbutil.Model{ID: 1}, Title: "表单结果", Type: db.VoteTypeForm},
+		"Total":         int64(1),
+		"HasTextFields": true,
+		"FormFields": []*db.VoteFormField{
+			{Label: "满意度", FieldType: db.VoteFormFieldTypeRadio, Options: `["满意","一般"]`},
+		},
+		"Results": map[string]interface{}{
+			"Type": "form", "FormCount": int64(1), "FormFieldStats": []interface{}{
+				map[string]interface{}{
+					"Field": map[string]interface{}{"Label": "满意度", "FieldType": "radio"},
+					"Total": int64(3),
+					"OptionStats": []interface{}{
+						map[string]interface{}{"Option": map[string]interface{}{"Content": "满意"}, "Count": int64(2)},
+						map[string]interface{}{"Option": map[string]interface{}{"Content": "一般"}, "Count": int64(1)},
+					},
+				},
+			},
+		},
+		"Submissions": []interface{}{
+			map[string]interface{}{"CreatedAt": time.Now(), "Fields": map[string]interface{}{"满意度": "满意"}},
+		},
+		"CSRFTokenHTML": gotemplate.HTML(""),
+	}
+
+	var buf bytes.Buffer
+	if err := tpl.ExecuteTemplate(&buf, "user/vote-results", data); err != nil {
+		t.Fatalf("execute: %v", err)
+	}
+	html := buf.String()
+
+	// 2/3 取整 = 66%，1/3 取整 = 33%；进度条宽度同步渲染
+	for _, want := range []string{"（66%）", "（33%）", "width: 66%", "width: 33%", "uk-progressbar"} {
+		if !bytes.Contains([]byte(html), []byte(want)) {
+			t.Errorf("HTML missing %q", want)
+		}
+	}
+}
+
+// TestInlineTextRepliesRender 验证表单结果页：文本类字段的逐条提交内容内联在题目
+// 下方、默认收起（含 hidden 属性），点击"查看文本提交（N）"展开。
+func TestInlineTextRepliesRender(t *testing.T) {
+	fs, err := template.EmbedFS(FS, ".", []string{".html"})
+	if err != nil {
+		t.Fatalf("EmbedFS: %v", err)
+	}
+	tpl := gotemplate.New("Flamego.Template")
+	for _, f := range fs.Files() {
+		tt := tpl.New(f.Name())
+		for _, funcMap := range templatepkg.FuncMap() {
+			tt.Funcs(funcMap)
+		}
+		dataBytes, err := f.Data()
+		if err != nil {
+			t.Fatalf("get data of %q: %v", f.Name(), err)
+		}
+		if _, err := tt.Parse(string(dataBytes)); err != nil {
+			t.Fatalf("parse %q: %v", f.Name(), err)
+		}
+	}
+
+	data := map[string]interface{}{
+		"LangCode":   "zh-CN",
+		"IsUserPage": true,
+		"Vote":       &db.Vote{Model: dbutil.Model{ID: 1}, Title: "表单结果", Type: db.VoteTypeForm},
+		"Total":      int64(1),
+		"FormFields": []*db.VoteFormField{
+			{Model: dbutil.Model{ID: 10}, Label: "建议", FieldType: db.VoteFormFieldTypeTextarea},
+		},
+		"Results": map[string]interface{}{
+			"Type": "form", "FormCount": int64(1), "FormFieldStats": []interface{}{
+				map[string]interface{}{
+					"Field":      map[string]interface{}{"ID": int64(10), "Label": "建议", "FieldType": "textarea"},
+					"Total":      int64(2),
+					"TextCount":  int64(2),
+				},
+			},
+		},
+		"TextReplies": map[string]interface{}{
+			"建议": []interface{}{
+				map[string]interface{}{"CreatedAt": time.Now(), "Text": "希望增加夜间模式"},
+				map[string]interface{}{"CreatedAt": time.Now(), "Text": "页面很清爽"},
+			},
+		},
+		"CSRFTokenHTML": gotemplate.HTML(""),
+	}
+
+	var buf bytes.Buffer
+	if err := tpl.ExecuteTemplate(&buf, "user/vote-results", data); err != nil {
+		t.Fatalf("execute: %v", err)
+	}
+	html := buf.String()
+
+	// 内联折叠入口 + 两则文本均存在 + 默认收起（hidden）
+	for _, want := range []string{
+		"查看文本提交（2）",
+		"希望增加夜间模式",
+		"页面很清爽",
+		`id="replies-10"`,
+		`id="caret-10"`,
+	} {
+		if !bytes.Contains([]byte(html), []byte(want)) {
+			t.Errorf("HTML missing %q", want)
+		}
+	}
+	// 折叠内容默认 hidden，不随页面始终铺在底部
+	if !bytes.Contains([]byte(html), []byte(`id="replies-10" hidden`)) {
+		t.Errorf("inline text replies should be hidden by default")
+	}
+}
diff --git a/templates/pixel.html b/templates/pixel.html
new file mode 100644
index 0000000..03575c9
--- /dev/null
+++ b/templates/pixel.html
@@ -0,0 +1,19 @@
+{{template "base/header" .}}
+<link rel="stylesheet" href="https://r2.337845818.best/tamabox/cdn/lib/neko-pixel/0.0.21/style.css"/>
+<div class="uk-alert-warning uk-container uk-text-small" uk-alert>
+  <p>
+    请各位用户知悉并确认在使用画板功能时，不会发起及/或参与以下内容：
+    1. 涉及地域、种族、性别、宗教、政治等方面的歧视性内容；
+    2. 侮辱、诽谤他人，侵害他人合法权益的内容；
+    3. 含有淫秽色情、血腥暴力、赌博的内容；
+    4. 其他在法律法规中禁止的或不适宜的内容。
+    如果您实施了违反上述规范的行为，我们将视情况采取相关措施，并保留移交司法机关或者行政机关的权利。
+  </p>
+</div>
+
+<div id="app"></div>
+<script>
+  var NEKO_CONFIG = {pixelBaseURL: '/api/v1/pixel'}
+</script>
+<script src="https://r2.337845818.best/tamabox/cdn/lib/neko-pixel/0.0.21/neko-pixel-app.umd.js"></script>
+{{template "base/footer" .}}
\ No newline at end of file
diff --git a/templates/question/history-template.html b/templates/question/history-template.html
new file mode 100644
index 0000000..ee27070
--- /dev/null
+++ b/templates/question/history-template.html
@@ -0,0 +1,83 @@
+{{$pinTitle := t .LangCode "ask.pinned"}}
+<div id="question-list">
+  {{range $index, $elem := .PageQuestions}}
+  <div data-qid="{{$elem.ID}}">
+    <hr>
+    <a class="uk-button uk-button-default uk-button-small uk-float-right"
+       href="/_/{{$.PageUser.Domain}}/{{$elem.ID}}">查看回答</a>
+    <div class="uk-text-left uk-text-small uk-text-muted">
+      {{if $elem.IsPinned}}<span class="tb-pin-flag" title="{{t $.LangCode "ask.pinned"}}">⭐</span>{{end}}
+      {{Date $elem.CreatedAt "Y-m-d H:i:s"}}
+    </div>
+    <p class="uk-text-small uk-text-break tb-preline tb-clamp-5">{{MarkdownPlainText $elem.Content}}</p>
+  </div>
+  {{end}}
+</div>
+<!-- 翻页游标与服务端 EncodePinCursor 保持一致：
+     isPinned(0/1) + createdAt 的 UnixNano + id 组成的复合键集游标。 -->
+<!-- 初始 more 由服务端给出：首屏已展示全部提问时按钮直接不渲染，
+     之后每次加载以接口返回的 has_more 为准，最后一页加载完立即隐藏按钮。 -->
+<div x-data="{ more: {{ if .PageQuestionHasMore }}true{{ else }}false{{ end }}, loading: false, cursor: '{{.PageQuestionCursor}}' }">
+  <button x-show="more" x-bind:disabled="loading" x-on:click.debounce="() => {
+          if (loading) return
+          loading = true
+          fetch(`/api/v1/user/{{.PageUser.Domain}}/questions?cursor=${cursor}`)
+            .then(response => response.json())
+            .then(resp => {
+              loading = false
+              // 外层为 ctx.JSON 的统一包装 {code, data, message}，内层才是分页负载；
+              // code !== 0（接口报错）时保持 more 不变，仅复位 loading，下次可重试。
+              if (!resp || resp.code !== 0) return
+              const payload = resp.data || {}
+              let items = Array.isArray(payload.data) ? payload.data : []
+              if (items.length === 0) {
+                more = false
+                return
+              }
+
+              // 防重兜底：先扫描 #question-list 下全部已渲染条目（含服务端首屏与既往
+              // 追加）的 data-qid 构造“已见”集合，仅追加未出现过的提问。若服务端因游标
+              // 未前进等原因返回了与已见内容相同的批次（重复加载历史 bug 的表现形态），
+              // 直接按“到底”处理并隐藏按钮，杜绝无限重复追加。
+              const seenQIDs = new Set()
+              document.querySelectorAll('#question-list [data-qid]').forEach(el => seenQIDs.add(Number(el.dataset.qid)))
+              items = items.filter(q => !seenQIDs.has(q.id))
+              if (items.length === 0) {
+                more = false
+                return
+              }
+
+              // 服务端下发复合键集游标（见上方注释），前端不自行拼接；
+              // has_more 由服务端多取一条探测得出，最后一页加载完立即隐藏按钮。
+              more = payload.has_more !== false
+              cursor = payload.next_cursor || cursor
+              items.forEach(question => {
+                const div = document.createElement('div')
+                div.dataset.qid = question.id
+                div.innerHTML = `
+                  <div>
+                    <hr>
+                    <a class='uk-button uk-button-default uk-button-small uk-float-right'
+                       href='/_/{{.PageUser.Domain}}/${question.id}'>查看回答</a>
+                    <div class='uk-text-left uk-text-small uk-text-muted'>
+                      ${question.is_pinned ? '<span class=\'tb-pin-flag\' title=\'{{$pinTitle}}\'>⭐</span>' : ''}
+                      ${dayjs(question.created_at).format('YYYY-MM-DD HH:mm:ss')}
+                    </div>
+                    <p class='uk-text-small uk-text-break tb-preline tb-clamp-5'></p>
+                  </div>`
+                div.getElementsByTagName('p')[0].innerText = question.content
+                document.getElementById('question-list').appendChild(div)
+              })
+            })
+            // 网络失败/响应非法 JSON 时复位 loading，避免按钮永远停留在加载中状态
+            .catch(() => { loading = false })
+        }" class="uk-button uk-button-default uk-width-1-1 uk-margin-small-bottom">
+    <span x-show="!loading">加载更多</span>
+    <span x-show="loading"><div uk-spinner="ratio: 0.8"></div> 加载中...</span>
+  </button>
+  <div x-show="!more" class="uk-text-meta uk-text-center">
+    <hr>
+    无更多留言
+    <br><br>
+  </div>
+</div>
diff --git a/templates/question/item.html b/templates/question/item.html
new file mode 100644
index 0000000..54d5591
--- /dev/null
+++ b/templates/question/item.html
@@ -0,0 +1,425 @@
+{{template "base/header" .}}
+<link rel="shortcut icon"
+      href="{{.PageUser.Avatar}}?x-oss-process=image/auto-orient,1/quality,q_70/sharpen,200/resize,limit_0,m_fill,w_200,h_200"/>
+<link rel="apple-touch-icon"
+      href="{{.PageUser.Avatar}}?x-oss-process=image/auto-orient,1/quality,q_70/sharpen,200/resize,limit_0,m_fill,w_200,h_200"/>
+<link rel="icon" sizes="192x192"
+      href="{{.PageUser.Avatar}}?x-oss-process=image/auto-orient,1/quality,q_70/sharpen,200/resize,limit_0,m_fill,w_200,h_200">
+<style>
+    a.uk-button.uk-button-link {
+    text-transform: none;
+}
+    /* 回答行：左侧「回答」与右侧「标记为已读/标记为未读」按钮等高 */
+    .tb-ans-row .uk-button {
+        height: 40px;
+        line-height: 38px;
+    }
+    .tb-followup-card {
+        border: 1px solid #e7e9ec;
+        border-left: 3px solid #b0b6bd;
+        border-radius: 8px;
+        padding: 12px 14px;
+        background: #fbfbfc;
+    }
+    html[data-theme="dark"] .tb-followup-card {
+        background: #1b1e23;
+        border-color: #2c2f36;
+        border-left-color: #3a4250;
+    }
+    html[data-theme="dark"] .tb-followup-card .uk-button-default {
+        background-color: #2c2f36;
+        color: #e5e9ec;
+        border-color: #3a4250;
+    }
+    html[data-theme="dark"] .tb-followup-card .uk-button-default:hover {
+        background-color: #353941;
+        color: #ffffff;
+    }
+    .tb-img-uploader {
+        width: 100%;
+        background-color: #f8f8f8;
+        display: flex;
+        padding-top: 5px;
+        padding-bottom: 5px;
+        align-items: center;
+        justify-content: flex-start;
+        gap: 5px;
+    }
+    html[data-theme="dark"] .tb-img-uploader {
+        background-color: #1b1e23;
+    }
+</style>
+<div>
+  <div class="uk-card uk-card-default">
+    <div class="uk-card-header">
+      <div class="uk-text-left uk-text-small uk-text-muted">{{Date .Question.CreatedAt "Y-m-d H:i:s"}}</div>
+      <div class="md-body uk-text-break uk-margin-top uk-margin-bottom">{{MarkdownFormat .Question.Content}}</div>
+      {{ if .AskUploadImages }}
+      <ul class="uk-thumbnav" uk-margin>
+        {{ range $index, $elem := .AskUploadImages }}
+        <div uk-lightbox>
+          <a href="https://{{ ImageBucketCDNHost }}/{{ $elem.Key }}">
+            <img class="uk-border-rounded uk-object-fill" src="https://{{ ImageBucketCDNHost }}/{{ $elem.Key }}" width="100" height="100" alt="">
+          </a>
+        </div>
+        {{ end }}
+      </ul>
+      {{ end }}
+    </div>
+
+    {{if ne .Question.Answer ""}}
+    <div class="uk-card-body">
+      <!--<div class="uk-text-left uk-text-small uk-text-muted">{{Date .Question.UpdatedAt "Y-m-d H:i:s"}}</div>-->
+      <div id="answer-display">
+     <div class="md-body uk-text-break">{{MarkdownFormat .Question.Answer}}</div>
+      {{ if .AnswerUploadImages }}
+      <ul class="uk-thumbnav" uk-margin>
+        {{ range $index, $elem := .AnswerUploadImages }}
+        <div uk-lightbox>
+          <a href="https://{{ ImageBucketCDNHost }}/{{ $elem.Key }}">
+            <img class="uk-border-rounded uk-object-fill" src="https://{{ ImageBucketCDNHost }}/{{ $elem.Key }}" width="100" height="100" alt="">
+          </a>
+        </div>
+        {{ end }}
+      </ul>
+      {{ end }}
+      </div>
+      <p class="uk-text-small uk-text-right uk-text-muted">{{t .LangCode "qitem.answeredBy" .PageUser.Name (Date .Question.UpdatedAt "Y-m-d H:i:s")}}</p>
+      <!-- 分享此提问（左）与 更新回答（右）一左一右分开；箱主未登录（无更新回答按钮）时分享按钮居中；编辑区在下方由 tbToggleAnswerEditor 控制 -->
+      <div class="uk-flex uk-flex-middle uk-flex-wrap uk-margin-small-top {{ if not .CanDelete }}uk-flex-center{{ end }}" style="gap: 8px;">
+        {{ if and (not .Question.IsPrivate) (ne .Question.Answer "") }}
+        <a class="uk-button uk-button-default uk-button-small" href="/_/{{ .PageUser.Domain }}/{{ .Question.ID }}/share-card" target="_blank">📤 {{t .LangCode "qitem.shareCard"}}</a>
+        {{ end }}
+        {{ if .CanDelete }}
+        <div id="answer-edit-trigger" style="margin-left: auto;">
+          <button type="button" class="uk-button uk-button-default uk-button-small" onclick="tbToggleAnswerEditor()">{{t .LangCode "qitem.updateAnswer"}}</button>
+        </div>
+        {{ end }}
+      </div>
+      {{ if not .CanDelete }}
+        <div id="waline"></div>
+        <script>
+            document.addEventListener('DOMContentLoaded', function () {
+            const waline = Waline.init({
+                el: '#waline',
+                //后端服务器地址
+                serverURL: 'https://waline.337845818.best/',
+                path: window.location.href,
+                    // 中文默认
+                locale: {
+                  nick: '昵称',
+                  nickError: '昵称不能少于3个字符',
+                  mail: '邮箱',
+                  mailError: '请填写正确的邮件地址',
+                  link: '网址',
+                  optional: '可选',
+                  placeholder: '欢迎评论（需要手工审核，不会立即展现）',
+                  sofa: '来发评论吧~',
+                  submit: '提交',
+                  like: '喜欢',
+                  cancelLike: '取消喜欢',
+                  reply: '回复',
+                  cancelReply: '取消回复',
+                  comment: '评论',
+                  refresh: '刷新',
+                  more: '加载更多...',
+                  preview: '预览',
+                  emoji: '表情',
+                  uploadImage: '上传图片',
+                  seconds: '秒前',
+                  minutes: '分钟前',
+                  hours: '小时前',
+                  days: '天前',
+                  now: '刚刚',
+                  uploading: '正在上传',
+                  login: '登录',
+                  logout: '退出',
+                  admin: '博主',
+                  sticky: '置顶',
+                  word: '字',
+                  wordHint: '评论字数应在 $0 到 $1 字之间！\n当前字数：$2',
+                  anonymous: '无名小狼',
+                  level0: '潜水',
+                  level1: '冒泡',
+                  level2: '吐槽',
+                  level3: '活跃',
+                  level4: '话痨',
+                  level5: '传说',
+                  gif: '表情包',
+                  gifSearchPlaceholder: '搜索表情包',
+                  profile: '个人资料',
+                  approved: '通过',
+                  waiting: '待审核',
+                  spam: '垃圾',
+                  unsticky: '取消置顶',
+                  oldest: '按倒序',
+                  latest: '按正序',
+                  hottest: '按热度',
+                  reactionTitle: '',
+                  reaction0: '哇哦',
+                  reaction1: 'prpr',
+                  reaction2: '流汗',
+                  reaction3: '生气',
+                  reaction4: '流鼻血',
+                  reaction5: 'あべ',
+                },
+                reaction: [
+                 'https://ali-imgs.acfun.cn/kimg/bs2/zt-image-host/ChYwOGQ3OTRhYzRjMTBkZmZhZDVmZTA1EIjM1y8.gif',
+                 'https://ali-imgs.acfun.cn/kimg/bs2/zt-image-host/ChQwOGEyOTlhYzRjMTBmOWFkZjAwYRCIzNcv.gif',
+                 'https://ali-imgs.acfun.cn/kimg/bs2/zt-image-host/ChYwOGRhOTVhYzRjMTBkNmViYTVlNTA2EIjM1y8.gif',
+                 'https://ali-imgs.acfun.cn/kimg/bs2/zt-image-host/ChYwOGU1OTJhYzRjMTBmMzk3ZmVmNTAyEIjM1y8.gif',
+                 'https://ali-imgs.acfun.cn/kimg/bs2/zt-image-host/ChYwOGNkODdhYzRjMTBjYmEwOTFjNjAxEIjM1y8.gif',
+                 'https://ali-imgs.acfun.cn/kimg/bs2/zt-image-host/ChQwODliOGVhYzRjMTBmOGM0ZWY1ZRCIzNcv.gif',
+                ],
+                meta: ['nick','mail'],
+                requiredMeta: ['mail'],
+                pageview: true,
+                search: false,
+                comment: false,
+                login: 'disable',
+                wordLimit: 50,
+                pageSize: 5,
+                avatar: 'monsterid',
+                emoji: [
+                    'https://gcore.jsdelivr.net/gh/tamakyi/emoji-collection@main/acfun-color/60x60',
+                ],
+                //禁止图片上传按钮
+                imageUploader: false,
+                //不显示版权标志
+                copyright: false,
+            });
+            });
+        </script>
+      {{ end }}
+      {{ if .CanDelete }}
+      <div id="answer-editor" style="display:none;">
+        <hr>
+        <form method="post" action="/_/{{ .PageUser.Domain }}/{{ .Question.ID }}/answer" enctype="multipart/form-data">
+          {{ .CSRFTokenHTML }}
+          <div class="uk-margin uk-text-center">
+                <textarea name="answer" class="uk-textarea" rows="5" maxlength="{{ .Limits.AnswerContentLen }}"
+                          placeholder="{{t .LangCode "qitem.answerPlaceholder"}}">{{ .Question.Answer }}</textarea>
+                <div x-data="{ files: null }" class="tb-img-uploader">
+                  <div uk-form-custom>
+                    <a href="#" class="uk-icon-link" uk-icon="image" style="margin-left: 10px"></a>
+                    <span style="font-size: 12px" x-text="files ? files[0].name : '{{t .LangCode "ask.addImage"}}'"></span>
+                    <input id="uploader" name="images" type="file" accept="image/*" x-on:change="files = Object.values($event.target.files)">
+                  </div>
+                  <button x-show="files" type="button" class="uk-icon-link" uk-icon="close" style="margin-left: 10px;"
+                          @click="files = null"></button>
+                </div>
+          </div>
+          {{ if ne .Question.ReceiveReplyEmail "" }}
+          <div class="uk-alert-warning uk-text-small" uk-alert>
+            <p>{{t .LangCode "qitem.emailNotifyHint"}}</p>
+          </div>
+          {{ end }}
+          <div class="uk-margin uk-text-center">
+            <button type="submit" class="uk-button uk-button-primary uk-button-small">{{t .LangCode "qitem.updateAnswer"}}</button>
+            <button type="button" class="uk-button uk-button-default uk-button-small uk-margin-small-left" onclick="tbToggleAnswerEditor()">{{t .LangCode "common.cancel"}}</button>
+          </div>
+        </form>
+      </div>
+      {{ end }}
+    </div>
+    {{ else if .CanDelete }}
+    <div class="uk-card-body uk-padding-remove-top">
+      <hr>
+      <h5 class="uk-text-center">{{t .LangCode "qitem.answerTitle"}}</h5>
+      <form id="tb-answer-form" method="post" action="/_/{{ .PageUser.Domain }}/{{ .Question.ID }}/answer" enctype="multipart/form-data">
+        {{ .CSRFTokenHTML }}
+        <div class="uk-margin uk-text-center">
+              <textarea name="answer" class="uk-textarea" rows="5" maxlength="{{ .Limits.AnswerContentLen }}"
+                        placeholder="{{t .LangCode "qitem.answerPlaceholder"}}">{{ .answer }}</textarea>
+              <div x-data="{ files: null }" style="width: 100%; background-color: #f8f8f8; display: flex; padding-top: 5px; padding-bottom: 5px; align-items: center; justify-content: start;gap: 5px">
+                <div uk-form-custom>
+                  <a href="#" class="uk-icon-link" uk-icon="image" style="margin-left: 10px"></a>
+                  <span style="font-size: 12px" x-text="files ? files[0].name : '{{t .LangCode "ask.addImage"}}'"></span>
+                  <input id="uploader" name="images" type="file" accept="image/*" x-on:change="files = Object.values($event.target.files)">
+                </div>
+                <button x-show="files" type="button" class="uk-icon-link" uk-icon="close" style="margin-left: 10px;"
+                        @click="files = null"></button>
+              </div>
+        </div>
+        {{ if ne .Question.ReceiveReplyEmail "" }}
+        <div class="uk-alert-warning uk-text-small" uk-alert>
+          <p>{{t .LangCode "qitem.emailNotifyHint"}}</p>
+        </div>
+        {{ end }}
+      </form>
+      <!-- 回答（左）+ 阅读状态（右）同一行，压缩空间；tb-ans-row 保证左右按钮等高 -->
+      <div class="uk-flex uk-flex-middle uk-flex-wrap uk-margin-small-top tb-ans-row" style="gap: 12px; justify-content: space-between;">
+        <button type="submit" form="tb-answer-form" class="uk-button uk-button-primary">{{t .LangCode "qitem.submitAnswer"}}</button>
+        <div class="uk-flex uk-flex-middle uk-flex-wrap" style="gap: 8px;">
+          {{ if .Question.IsRead }}
+          <span class="uk-text-small uk-text-muted">✓ {{t .LangCode "qlist.read"}}</span>
+          <form class="uk-display-inline" method="post" action="/_/{{ .PageUser.Domain }}/{{ .Question.ID }}/unread">
+            {{ .CSRFTokenHTML }}
+            <button type="submit" class="uk-button uk-button-default">{{t .LangCode "qitem.markUnread"}}</button>
+          </form>
+          {{ else }}
+          <form method="post" action="/_/{{ .PageUser.Domain }}/{{ .Question.ID }}/read">
+            {{ .CSRFTokenHTML }}
+            <button type="submit" class="uk-button uk-button-default">{{t .LangCode "qitem.markRead"}}</button>
+          </form>
+          {{ end }}
+        </div>
+      </div>
+    </div>
+    {{ end }}
+
+    <!-- 已回答的阅读状态（箱主）：该行仅此一个元素，居中显示 -->
+    {{ if and .CanDelete (ne .Question.Answer "") }}
+    <div class="uk-card-body uk-padding-remove-top">
+      <div class="uk-text-center">
+        <span class="uk-label uk-label-success">✓ {{t .LangCode "qlist.read"}}</span>
+        <span class="uk-text-small uk-text-muted">{{t .LangCode "qitem.readLocked"}}</span>
+      </div>
+    </div>
+    {{ end }}
+
+    {{ if .FollowUps }}
+    <div class="uk-card-body uk-padding-remove-top">
+      {{ range $index, $elem := .FollowUps }}
+      <div class="tb-followup-card uk-margin-small-bottom">
+        <p class="uk-text-small uk-text-break uk-margin-remove-bottom"><strong>{{t $.LangCode "followup.content"}}</strong>{{ $elem.Content }}</p>
+        {{ if ne $elem.Answer "" }}
+          {{ if $.CanDelete }}
+            <div id="fu-display-{{ $index }}" class="uk-text-small uk-text-muted uk-text-break uk-margin-small-top">@{{ $.PageUser.Name }}：{{ MarkdownFormat $elem.Answer }}</div>
+            <div class="uk-margin-small-top uk-text-right">
+              <button type="button" class="uk-button uk-button-default uk-button-small" onclick="tbToggleFollowUpEditor({{ $index }})">{{t $.LangCode "qitem.updateAnswer"}}</button>
+            </div>
+            <div id="fu-editor-{{ $index }}" style="display:none;">
+              <hr>
+              <form method="post" action="/_/{{ $.PageUser.Domain }}/{{ $.Question.ID }}/follow-up/{{ $elem.ID }}/answer" class="uk-margin-small-top">
+                {{ $.CSRFTokenHTML }}
+                <textarea name="answer" class="uk-textarea" rows="3" maxlength="{{ $.Limits.AnswerContentLen }}" placeholder="{{t $.LangCode "followup.answerPlaceholder"}}">{{ $elem.Answer }}</textarea>
+                <div class="uk-margin-small-top uk-text-right">
+                  <button type="submit" class="uk-button uk-button-primary uk-button-small">{{t $.LangCode "qitem.updateAnswer"}}</button>
+                  <button type="button" class="uk-button uk-button-default uk-button-small uk-margin-small-left" onclick="tbToggleFollowUpEditor({{ $index }})">{{t $.LangCode "common.cancel"}}</button>
+                </div>
+              </form>
+            </div>
+          {{ else }}
+            <div class="uk-text-small uk-text-muted uk-text-break uk-margin-small-top">@{{ $.PageUser.Name }}：{{ MarkdownFormat $elem.Answer }}</div>
+          {{ end }}
+        {{ else if $.CanDelete }}
+        <form method="post" action="/_/{{ $.PageUser.Domain }}/{{ $.Question.ID }}/follow-up/{{ $elem.ID }}/answer" class="uk-margin-small-top">
+          {{ $.CSRFTokenHTML }}
+          <textarea name="answer" class="uk-textarea" rows="3" maxlength="{{ $.Limits.AnswerContentLen }}" placeholder="{{t $.LangCode "followup.answerPlaceholder"}}"></textarea>
+          <div class="uk-margin-small-top uk-text-right">
+            <button type="submit" class="uk-button uk-button-primary uk-button-small">{{t $.LangCode "followup.answerBtn"}}</button>
+          </div>
+        </form>
+        {{ else }}
+        <p class="uk-text-small uk-text-muted uk-margin-small-top">{{t $.LangCode "followup.waiting"}}</p>
+        {{ end }}
+      </div>
+      {{ end }}
+    </div>
+    {{ end }}
+
+    {{ if and .CanFollowUp (not .CanDelete) }}
+    <div class="uk-card-body uk-padding-remove-top">
+      <div class="tb-followup-card">
+        <h5 class="uk-margin-remove-bottom">{{t .LangCode "followup.askMore"}}</h5>
+        <p class="uk-text-small uk-text-muted">{{t .LangCode "followup.remaining" .FollowUpRemaining .FollowUpLimit}}</p>
+        <form method="post" action="/_/{{ .PageUser.Domain }}/{{ .Question.ID }}/follow-up">
+          {{ .CSRFTokenHTML }}
+          <input type="hidden" name="token" value="{{ .QuestionToken }}">
+          <textarea name="content" class="uk-textarea" rows="3" maxlength="{{ .Limits.FollowUpContentLen }}" placeholder="{{t .LangCode "followup.contentPlaceholder"}}"></textarea>
+          <div class="uk-margin uk-text-center">
+            <button type="submit" class="uk-button uk-button-primary">{{t .LangCode "followup.submit"}}</button>
+          </div>
+        </form>
+      </div>
+    </div>
+    {{ end }}
+
+    {{ if and .WaitingFollowUpReply (not .CanDelete) }}
+    <div class="uk-card-body uk-padding-remove-top">
+      <div class="tb-followup-card uk-text-small uk-text-muted uk-text-center">{{t .LangCode "followup.waitingReply"}}</div>
+    </div>
+    {{ end }}
+
+    <div class="uk-card-footer">
+      {{template "base/alert" .}}
+
+      {{ if .CanDelete }}      
+
+        {{ if .Question.IsPrivate }}
+          <form class="uk-float-right" method="post" action="/_/{{ .PageUser.Domain }}/{{ .Question.ID }}/set-public">
+            {{ .CSRFTokenHTML }}
+            <button type="submit" class="uk-button uk-button-default uk-button-small">{{t .LangCode "qitem.public"}}</button>
+          </form>
+        {{ else }}
+          <form class="uk-float-right" method="post" action="/_/{{ .PageUser.Domain }}/{{ .Question.ID }}/set-private">
+            {{ .CSRFTokenHTML }}
+            <button type="submit" class="uk-button uk-button-default uk-button-small">{{t .LangCode "qitem.private"}}</button>
+          </form>
+        {{ end }}      
+
+        <a class="uk-button uk-button-danger uk-button-small" href="#">{{t .LangCode "qitem.delete"}}</a>
+        <div class="uk-dropbar uk-dropbar-top" uk-drop="stretch: x; mode: click">
+          <div class="uk-card uk-card-default uk-card-body">
+            <h3 class="uk-card-title">{{t .LangCode "qitem.danger"}}</h3>
+            <p>{{t .LangCode "qitem.deleteConfirm"}}</p>
+            <form class="uk-float-right"
+                  method="post"
+                  action="/_/{{ .PageUser.Domain }}/{{ .Question.ID }}/delete">
+              {{ .CSRFTokenHTML }}
+              <button class="uk-button uk-button-danger">{{t .LangCode "qitem.deleteConfirmBtn"}}</button>
+            </form>
+          </div>
+        </div>
+      {{ end }}
+
+      <div class="uk-margin uk-text-center">
+        {{ $backTo := printf "/_/%s" .PageUser.Domain }}
+        {{ if eq .BackFrom "admin" }}{{ $backTo = .BackTo }}{{ end }}
+        <a class="uk-button uk-button-link" href="{{ $backTo }}">{{t .LangCode "qitem.backToBox" .PageUser.Name}}</a>
+      </div>
+
+      <!-- Box owner can't create new question here. -->
+      {{if not .IsOwnPage }}
+      <h5 class="uk-text-center">{{t .LangCode "qitem.askMore"}}</h5>
+      {{template "question/new-question-template" .}}
+      {{ end }}
+
+      <hr class="uk-divider-icon">
+      <p class="uk-text-left uk-text-muted uk-text-small">{{t .LangCode "ask.history" .PageUser.Name}} ({{ .AnsweredCount }})</p>
+      {{ template "question/history-template" . }}
+    </div>
+  </div>
+</div>
+<script>
+  function tbToggleAnswerEditor() {
+    var disp = document.getElementById('answer-display');
+    var trig = document.getElementById('answer-edit-trigger');
+    var ed = document.getElementById('answer-editor');
+    if (!ed) return;
+    if (ed.style.display === 'none') {
+      ed.style.display = 'block';
+      if (disp) disp.style.display = 'none';
+      if (trig) trig.style.display = 'none';
+    } else {
+      ed.style.display = 'none';
+      if (disp) disp.style.display = 'block';
+      if (trig) trig.style.display = 'block';
+    }
+  }
+
+  function tbToggleFollowUpEditor(idx) {
+    var disp = document.getElementById('fu-display-' + idx);
+    var ed = document.getElementById('fu-editor-' + idx);
+    if (!ed) return;
+    if (ed.style.display === 'none') {
+      ed.style.display = 'block';
+      if (disp) disp.style.display = 'none';
+    } else {
+      ed.style.display = 'none';
+      if (disp) disp.style.display = 'block';
+    }
+  }
+</script>
+{{template "base/footer" .}}
diff --git a/templates/question/list.html b/templates/question/list.html
new file mode 100644
index 0000000..2934952
--- /dev/null
+++ b/templates/question/list.html
@@ -0,0 +1,310 @@
+{{template "base/header" .}}
+<!-- 头像直连 R2：crossorigin 让 favicon 也以 CORS 模式请求，确保浏览器缓存的响应都带 ACAO；
+     ?v=2 击穿历史上被「无 ACAO 响应」污染的缓存条目（R2 对无 Origin 请求的响应无 Vary，可缓存 31 天） -->
+<link rel="shortcut icon" href="{{.PageUser.Avatar}}?v=2" crossorigin="anonymous"/>
+<link rel="apple-touch-icon" href="{{.PageUser.Avatar}}?v=2" crossorigin="anonymous"/>
+<link rel="icon" sizes="192x192" href="{{.PageUser.Avatar}}?v=2" crossorigin="anonymous">
+<style>
+  /* 投票列表：与探索页"全部投票"一致的列表行样式 */
+  .profile-votes-list { display: grid; gap: 0; }
+  .profile-vote-item {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 16px;
+    min-width: 0;
+    padding: 14px 16px;
+    border-bottom: 1px solid var(--tb-border, #e9e9e9);
+    text-decoration: none;
+  }
+  .profile-vote-item:first-child { border-top: 1px solid var(--tb-border, #e9e9e9); }
+  .profile-vote-item:hover { background: var(--tb-surface-hover, #f8fbff); text-decoration: none; }
+  .profile-vote-content { min-width: 0; }
+  .profile-vote-title {
+    display: block;
+    overflow: hidden;
+    color: var(--tb-text, #333);
+    font-size: 0.98rem;
+    font-weight: 600;
+    line-height: 1.45;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+  }
+  .profile-vote-meta {
+    display: flex;
+    flex-wrap: wrap;
+    align-items: center;
+    gap: 7px;
+    margin-top: 8px;
+  }
+  .profile-vote-meta .uk-label { font-size: 0.72rem; line-height: 1.6; }
+  .profile-vote-action {
+    flex: 0 0 auto;
+    color: var(--tb-primary, #1e87f0);
+    font-size: 0.82rem;
+    white-space: nowrap;
+  }
+  html[data-theme="dark"] .profile-vote-item { border-color: var(--tb-border); }
+  html[data-theme="dark"] .profile-vote-title { color: var(--tb-text); }
+  html[data-theme="dark"] .profile-vote-item:hover { background: rgba(78, 168, 245, 0.10); }
+  /* 个人主页 Tab：与探索页一致的胶囊切换样式 */
+  /* 个人主页 Tab：全宽等分，置于主体顶部，作为一级导航（移动端整行可点） */
+  .profile-tabs {
+    display: flex;
+    gap: 4px;
+    padding: 4px;
+    margin-top: 20px;
+    margin-bottom: 18px;
+    border: 1px solid var(--tb-border, #e5e5e5);
+    border-radius: 9px;
+    background: var(--tb-surface-2, #fafafa);
+  }
+  .profile-tab {
+    flex: 1;
+    border: 0;
+    border-radius: 6px;
+    padding: 9px 15px;
+    background: transparent;
+    color: var(--tb-text-muted, #666);
+    cursor: pointer;
+    font-size: 0.9rem;
+    transition: background 0.2s ease, color 0.2s ease;
+  }
+  .profile-tab:hover { color: var(--tb-primary, #1e87f0); }
+  .profile-tab.is-active {
+    background: var(--tb-surface, #fff);
+    box-shadow: 0 1px 3px rgba(0, 0, 0, 0.10);
+    color: var(--tb-primary, #1e87f0);
+    font-weight: 600;
+  }
+  /* 功能关闭时置灰禁用的 Tab（如投票功能关闭） */
+  .profile-tab.is-disabled,
+  .profile-tab:disabled {
+    cursor: not-allowed;
+    color: var(--tb-text-muted, #999);
+    opacity: 0.7;
+  }
+  .profile-tab.is-disabled:hover { color: var(--tb-text-muted, #999); }
+  .profile-panel[hidden] { display: none !important; }
+  html[data-theme="dark"] .profile-tabs {
+    border-color: var(--tb-border);
+    background: var(--tb-surface-2);
+  }
+  html[data-theme="dark"] .profile-tab { color: var(--tb-text-muted); }
+  html[data-theme="dark"] .profile-tab.is-active { background: var(--tb-surface); color: var(--tb-primary); }
+  html[data-theme="dark"] .profile-tab.is-disabled { color: var(--tb-text-muted); opacity: 0.55; }
+</style>
+<div class="uk-card uk-card-default uk-text-center">
+  <div class="uk-flex uk-flex-center uk-flex-middle uk-background-cover uk-light" style="min-height: 260px;" data-src="{{ .PageUser.Background }}" uk-img>
+    <div class="uk-card-body">
+      <img class="uk-border-circle uk-box-shadow-large" src="{{ if .PageUser.Avatar }}{{ .PageUser.Avatar }}?v=2{{ else }}{{ .DefaultAvatar }}{{ end }}" crossorigin="anonymous" style="width: 100px; height: 100px; max-width: 100%; max-height: 100%;">
+      <h3 id="usernamecolor">{{ .PageUser.Name }}</h3>
+      <p id="introcolor">{{ .PageUser.Intro }}</p>
+        <div class="icon-container">
+        {{ if and .PageUser.Acfunlink (ne .PageUser.Acfunlink "none") }}
+         <a href="https://{{.PageUser.Acfunlink}}" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/ailicili.png" alt="acfunlink" class="icon">
+         </a>
+        {{ end }}
+        {{ if and .PageUser.Bililink (ne .PageUser.Bililink "none") }}
+         <a href="https://{{.PageUser.Bililink}}" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/bili.png" alt="bililink" class="icon">
+         </a>
+        {{ end }}
+        {{ if and .PageUser.Weibolink (ne .PageUser.Weibolink "none") }}
+         <a href="https://{{.PageUser.Weibolink}}" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/weibo.png" alt="weibolink" class="icon">
+         </a>
+        {{ end }}
+        {{ if and .PageUser.Xiaohongshulink (ne .PageUser.Xiaohongshulink "none") }}
+         <a href="https://{{.PageUser.Xiaohongshulink}}" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/xiaohongshu.png" alt="xiaohongshulink" class="icon">
+         </a>
+        {{ end }}
+        {{ if and .PageUser.Bloglink (ne .PageUser.Bloglink "none") }}
+          <a href="https://{{.PageUser.Bloglink}}" target="_blank">
+           <img src="https://r2.337845818.best/tamabox/icon/social/blog.png" alt="bloglink" class="icon">
+         </a>
+        {{ end }}
+        </div>
+    </div>
+  </div>
+</div>
+<script>
+document.getElementById("usernamecolor").style.color = "{{.PageUser.Usernamecolor}}";
+document.getElementById("introcolor").style.color = "{{.PageUser.Introcolor}}";
+</script>
+<div>
+  <div class="uk-card uk-card-default uk-card-small uk-card-body">
+    {{ if .CanAsk }}
+    <!-- jQuery 已改为按需加载：defer 按文档顺序先于 easy.qrcode 执行，保证就绪 -->
+    <script defer src="https://cdnjs.snrat.com/ajax/libs/jquery/3.7.1/jquery.min.js"></script>
+    <script defer src='https://r2.337845818.best/tamabox/cdn/js/remake/easy.qrcode.min.js' type="text/javascript"  charset="utf-8"></script>
+    <center><div id="boxqrimg"></div></center>
+    <script type="text/javascript">
+    document.addEventListener('DOMContentLoaded', function () {
+        var options = {
+            text: window.location.href,
+            width: 200,
+            height: 200,
+            // 与 Profile 编辑器保持一致：仅当启用自定义前景色时，才把 Qrcodebackcolor 作为前景色；
+            // 否则强制黑色 #000000，避免未勾选却显示自定义前景色、与 Profile 预览不一致。
+            colorDark: ({{.PageUser.UseCustomQRColor}} ? "{{.PageUser.Qrcodebackcolor}}" : "#000000") || "#000000",
+            colorLight: "{{.PageUser.Qrcodecolor}}" || "#FFFFFF",
+            dotScale: parseFloat("{{.PageUser.Dotscale}}") || 0.4,
+            dotScaleTiming: parseFloat("{{.PageUser.Dotscale}}") || 0.4,
+            dotScaleA: parseFloat("{{.PageUser.Dotscale}}") || 0.4,
+            correctLevel: QRCode.CorrectLevel.H,
+            logo: (function () {
+                // ?v=2：击穿曾被无 ACAO 响应污染的浏览器缓存条目；仅对 http(s) 绝对地址追加
+                var a = "{{.PageUser.Avatar}}" || "{{.DefaultAvatar}}";
+                return a ? (a.indexOf("http") === 0 ? a + "?v=2" : a) : undefined;
+            })(),
+            logoWidth: 60,
+            logoHeight: 60,
+            logoBackgroundTransparent: true,
+            // 直连 R2 等跨域图片须以 CORS 模式加载，canvas 才不被污染、可正常导出
+            crossOrigin: 'anonymous',
+            backgroundImage: ("{{.PageUser.BackgroundImage}}" ? "{{.PageUser.BackgroundImage}}" : undefined),
+            backgroundImageAlpha: parseFloat("{{.PageUser.Backgroundimagealpha}}") || 0.8,
+            autoColor: false,
+            PO: "{{.PageUser.Qrcodepdpcolor}}" || "#000000",
+            PI: "{{.PageUser.Qrcodepdpcolor}}" || "#000000",
+            AO: '',
+            AI: '',
+            timing: "{{.PageUser.Qrcodepdpcolor}}" || "#000000"
+        };
+        // 降级渲染：头像（logo）/ 背景图加载慢/失败时先出基础码，探针成功后再升级带 logo 版
+        window.tbRenderQR(document.getElementById("boxqrimg"), function () { return options; });
+    });
+    </script>
+ 
+    <p class="uk-text-center uk-text-small">{{t .LangCode "ask.scan" .PageUser.Name}}<br>{{ if .RegisterOnlyAsk }}{{t .LangCode "ask.registerOnly"}}{{ else }}{{t .LangCode "ask.anonymous"}}{{ end }}</p>
+
+    <div class="uk-text-center uk-margin-small-top">
+        <a id="share-btn" href="/_/{{ .PageUser.Domain }}/share-card" download class="uk-button uk-button-default uk-button-small">
+            📤 {{t .LangCode "ask.share"}}
+        </a>
+    </div>
+
+    <div id="share-loading-overlay" style="display:none; position: fixed; top:0; left:0; width:100%; height:100%; background: rgba(255,255,255,0.85); z-index:9999;">
+        <div style="display:flex; flex-direction:column; align-items:center; justify-content:center; height:100%;">
+            <div uk-spinner="ratio: 2" class="uk-margin-bottom"></div>
+            <p class="uk-text-large uk-text-muted">{{t .LangCode "ask.generating"}}</p>
+        </div>
+    </div>
+
+    <script>
+    (function() {
+        var btn = document.getElementById('share-btn');
+        var overlay = document.getElementById('share-loading-overlay');
+        if (!btn || !overlay) return;
+        btn.addEventListener('click', function(e) {
+            e.preventDefault();
+            overlay.style.display = 'block';
+            btn.style.pointerEvents = 'none';
+            fetch(btn.href)
+                .then(function(response) {
+                    if (!response.ok) throw new Error('{{t .LangCode "ask.networkError"}}');
+                    return response.blob();
+                })
+                .then(function(blob) {
+                    var url = URL.createObjectURL(blob);
+                    var a = document.createElement('a');
+                    a.href = url;
+                    a.download = '{{t .LangCode "ask.shareFilename"}}';
+                    document.body.appendChild(a);
+                    a.click();
+                    setTimeout(function() {
+                        document.body.removeChild(a);
+                        URL.revokeObjectURL(url);
+                    }, 100);
+                })
+                .catch(function(err) {
+                    alert('{{t .LangCode "ask.genFailed"}}');
+                    console.error(err);
+                })
+                .finally(function() {
+                    overlay.style.display = 'none';
+                    btn.style.pointerEvents = 'auto';
+                });
+        });
+    })();
+    </script>
+    {{ end }}
+    {{template "base/alert" .}}
+
+    <!-- 提问 / 投票 切换：默认显示提问，支持 ?tab=votes 直达（服务端初始态）与 #votes hash 覆盖 -->
+    <div class="profile-tabs" role="tablist">
+      <button type="button" class="profile-tab{{ if eq .ActiveProfileTab "questions" }} is-active{{ end }}" data-profile-tab="questions" role="tab" aria-selected="{{ if eq .ActiveProfileTab "questions" }}true{{ else }}false{{ end }}">{{t .LangCode "explore.questionsTab"}}</button>
+      {{ if .VoteEnabled }}
+      <button type="button" class="profile-tab{{ if eq .ActiveProfileTab "votes" }} is-active{{ end }}" data-profile-tab="votes" role="tab" aria-selected="{{ if eq .ActiveProfileTab "votes" }}true{{ else }}false{{ end }}">{{t .LangCode "explore.votesTab"}}</button>
+      {{ else }}
+      <!-- 投票功能关闭：保留 Tab 展示但置灰禁用，hover 提示原因 -->
+      <button type="button" class="profile-tab is-disabled" disabled aria-disabled="true" uk-tooltip="{{ .VoteClosedMessage }}">{{t .LangCode "explore.votesTab"}} <span uk-icon="icon: lock; ratio: 0.8"></span></button>
+      {{ end }}
+    </div>
+
+    <div class="profile-panel" data-profile-panel="questions"{{ if eq .ActiveProfileTab "votes" }} hidden{{ end }}>
+    {{template "question/new-question-template" .}}
+
+    {{ if ne (len .PageQuestions) 0 }}
+    <p class="uk-text-left uk-text-muted uk-text-small">{{t .LangCode "ask.history" .PageUser.Name}} ({{ .AnsweredCount }})</p>
+    {{ template "question/history-template" . }}
+    {{ end }}
+    </div>
+
+    <div class="profile-panel" data-profile-panel="votes"{{ if ne .ActiveProfileTab "votes" }} hidden{{ end }}>
+    {{ if .PageVotes }}
+    <!-- 匿名投票板块：箱主"进行中"的公开投票（列表行样式，与探索页"全部投票"一致） -->
+    <div class="profile-votes-list">
+      {{ range .PageVotes }}
+      <a href="/vote/{{ .LinkToken }}" class="profile-vote-item">
+        <div class="profile-vote-content">
+          <span class="profile-vote-title" title="{{ .Title }}">{{ .Title }}</span>
+          <span class="profile-vote-meta">
+            {{ if eq .Type "single" }}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeSingle"}}</span>{{ end }}
+            {{ if eq .Type "multiple" }}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeMultiple"}}</span>{{ end }}
+            {{ if eq .Type "rating" }}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeRating"}}</span>{{ end }}
+            {{ if eq .Type "rank" }}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeRank"}}</span>{{ end }}
+            {{ if eq .Type "form" }}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeForm"}}</span>{{ end }}
+            <span class="uk-text-meta">{{ .CreatedAt.Format "2006-01-02" }}</span>
+          </span>
+        </div>
+        <span class="profile-vote-action">{{t $.LangCode "vote.page.goVote"}} <span uk-icon="icon: arrow-right; ratio: .8"></span></span>
+      </a>
+      {{ end }}
+    </div>
+    {{ else }}
+    <div class="uk-alert uk-alert-primary uk-margin-remove-top">{{t .LangCode "explore.noVotes"}}</div>
+    {{ end }}
+    </div>
+  </div>
+</div>
+<script>
+document.addEventListener('DOMContentLoaded', function() {
+  var tabs = document.querySelectorAll('[data-profile-tab]');
+  var panels = document.querySelectorAll('[data-profile-panel]');
+  function showPanel(name) {
+    tabs.forEach(function(tab) {
+      var active = tab.dataset.profileTab === name;
+      tab.classList.toggle('is-active', active);
+      tab.setAttribute('aria-selected', active ? 'true' : 'false');
+    });
+    panels.forEach(function(panel) {
+      panel.hidden = panel.dataset.profilePanel !== name;
+    });
+    if (window.history && window.history.replaceState) {
+      window.history.replaceState({}, document.title, window.location.pathname + window.location.search + (name === 'votes' ? '#votes' : ''));
+    }
+  }
+  tabs.forEach(function(tab) {
+    tab.addEventListener('click', function() { showPanel(tab.dataset.profileTab); });
+  });
+  // 仅当投票 Tab 可点击（功能开启）时才响应 #votes hash，避免投票关闭时切到空面板
+  if (window.location.hash === '#votes' && document.querySelector('[data-profile-tab="votes"]')) {
+    showPanel('votes');
+  }
+});
+</script>
+{{template "base/footer" .}}
\ No newline at end of file
diff --git a/templates/question/new-question-template.html b/templates/question/new-question-template.html
new file mode 100644
index 0000000..ab70a6f
--- /dev/null
+++ b/templates/question/new-question-template.html
@@ -0,0 +1,232 @@
+{{ if .AskClosedMessage }}
+<div>
+  <div uk-alert class="uk-text-center">
+    <p>{{ .AskClosedMessage }}</p>
+    {{ if .AskNextOpenAtStr }}
+    <p class="uk-text-small uk-text-muted">{{t .LangCode "ask.nextOpenAt" .AskNextOpenAtStr}}</p>
+    {{ end }}
+    {{ if .AskLastCloseAtStr }}
+    <p class="uk-text-small uk-text-muted">{{t .LangCode "ask.lastCloseAt" .AskLastCloseAtStr}}</p>
+    {{ end }}
+  </div>
+
+  <!-- 提问功能关闭但私聊开启：保留独立私聊入口（提问与私聊是独立功能） -->
+  {{ if .AllowChat }}
+  <div class="uk-margin-top">
+    {{ if .LoggedUser }}
+    <form method="post" action="/_/{{.PageUser.Domain}}" id="chat-only-form" enctype="multipart/form-data">
+      {{ .CSRFTokenHTML }}
+      {{ if .PageUser.AskPassword }}
+      <input type="hidden" name="ask_password" id="ask_password_input" value="">
+      {{ end }}
+      <input type="hidden" name="start_chat_val" value="true">
+      <input type="hidden" name="g-recaptcha-response" id="chat-g-recaptcha-response" value="">
+      <div class="uk-margin uk-text-center">
+        <textarea name="content" class="uk-textarea" rows="4" placeholder="{{t .LangCode "ask.chatPlaceholder"}}" maxlength="{{ .Limits.ChatMessageLen }}"></textarea>
+      </div>
+      <div class="uk-margin uk-text-center">
+        {{ if eq .CaptchaType "math" }}
+        <button type="button" class="uk-button uk-button-secondary math-captcha-trigger" id="chat-only-submit-btn">{{t .LangCode "ask.chat"}}</button>
+        {{ else }}
+        <button type="submit" class="uk-button uk-button-secondary g-recaptcha"
+                data-sitekey="{{.RecaptchaSiteKey}}" data-callback="onChatOnlySubmit"
+                id="chat-only-submit-btn">{{t .LangCode "ask.chat"}}</button>
+        {{ end }}
+        <div class="uk-text-meta">{{t .LangCode "ask.chatLimit" .PageUser.ChatMaxMessages}}</div>
+      </div>
+    </form>
+    {{ else }}
+    <!-- 未登录：私聊需登录 -->
+    <div class="uk-text-center uk-margin">
+      <p class="uk-text-small uk-text-muted">{{t .LangCode "ask.loginRequiredChat"}}</p>
+      <a class="uk-button uk-button-secondary uk-button-small" href="/login?to={{.CurrentURI}}">{{t .LangCode "ask.goLogin"}}</a>
+    </div>
+    {{ end }}
+  </div>
+  {{ end }}
+
+  {{ if and .AllowChat .LoggedUser }}
+  {{ if ne .CaptchaType "math" }}
+  <!-- 独立私聊表单的验证码回调（提问表单的 onSubmit 只提交 #form） -->
+  <script>
+  function onChatOnlySubmit(token) {
+    var form = document.getElementById('chat-only-form');
+    if (!form) return;
+    var btn = document.getElementById('chat-only-submit-btn');
+    if (btn) { btn.disabled = true; btn.innerText = '{{t .LangCode "common.verifying"}}'; }
+    var needPassword = {{ if .PageUser.AskPassword }}true{{ else }}false{{ end }};
+    if (needPassword) {
+      UIkit.modal.prompt('{{t .LangCode "ask.needPassword"}}', '', 'password')
+        .then(function(password) {
+          if (password) {
+            var pw = form.querySelector('#ask_password_input');
+            if (pw) pw.value = password;
+            form.submit();
+          } else {
+            if (btn) { btn.disabled = false; btn.innerText = '{{t .LangCode "ask.chat"}}'; }
+          }
+        });
+    } else {
+      form.submit();
+    }
+  }
+  </script>
+  {{ end }}
+  {{ end }}
+</div>
+{{ else if not .CanAsk }}
+<div>
+  <div uk-alert class="uk-text-center">
+    <p>{{t .LangCode "ask.needLogin"}}</p>
+  </div>
+  <div class="uk-margin uk-text-center">
+    <a class="uk-button uk-button-primary" href="/login?to={{.CurrentURI}}">{{t .LangCode "ask.goLogin"}}</a>
+  </div>
+</div>
+{{ else }}
+<form method="post" action="/_/{{.PageUser.Domain}}" enctype="multipart/form-data" id="form">
+  {{ .CSRFTokenHTML }}
+
+  {{if .PageUser.AskPassword}}
+  <input type="hidden" name="ask_password" id="ask_password_input" value="">
+  {{end}}
+
+  <input type="hidden" name="start_chat_val" id="start_chat_val" value="false">
+  <input type="hidden" name="g-recaptcha-response" id="g-recaptcha-response" value="">
+
+  <div class="uk-margin uk-text-center">
+    <textarea name="content" class="uk-textarea" rows="5" placeholder="{{t .LangCode "ask.placeholder"}}"
+              maxlength="{{ .Limits.QuestionContentLen }}">{{.content}}</textarea>
+    <div x-data="{ files: null }" style="width: 100%; background-color: #f8f8f8; display: flex; padding-top: 5px; padding-bottom: 5px; align-items: center; justify-content: start;gap: 5px">
+      <div uk-form-custom>
+        <a href="#" class="uk-icon-link" uk-icon="image" style="margin-left: 10px"></a>
+        <span style="font-size: 12px" x-text="files ? files[0].name : '{{t .LangCode "ask.addImage"}}'"></span>
+        <input id="uploader" name="images" type="file" accept="image/*" x-on:change="files = Object.values($event.target.files)">
+      </div>
+      <button x-show="files" type="button" class="uk-icon-link" uk-icon="close" style="margin-left: 10px;"
+              @click="files = null"></button>
+    </div>
+  </div>
+
+  <div class="uk-margin uk-grid-small">
+    <label class="uk-text-small">
+      <input name="private" class="uk-checkbox" type="checkbox"> {{t .LangCode "ask.private"}}
+    </label>
+    <label class="uk-text-small">
+      <input name="receive_reply_via_email" id="notify-checkbox" class="uk-checkbox" type="checkbox"> {{t .LangCode "ask.notify"}}
+    </label>
+    <div id="email-container" style="width: 100%; display: none;" class="uk-margin-small-top">
+      <input class="uk-input uk-form-small" type="email" name="receive_reply_email" id="email-input" placeholder="{{t .LangCode "ask.emailPlaceholder"}}">
+    </div>
+  </div>
+
+  <div class="uk-margin uk-text-center">
+    <div class="uk-grid-small uk-flex-center" uk-grid>
+      <div>
+        {{ if eq .CaptchaType "math" }}
+        <button type="button" class="uk-button uk-button-primary math-captcha-trigger" id="normal-submit-btn">{{t .LangCode "ask.submit"}}</button>
+        {{ else }}
+        <button type="submit" class="uk-button uk-button-primary g-recaptcha" 
+                data-sitekey="{{.RecaptchaSiteKey}}" data-callback="onSubmit"
+                id="normal-submit-btn">{{t .LangCode "ask.submit"}}</button>
+        {{ end }}
+      </div>
+      {{ if not .AllowChat }}
+      <div>
+          <button type="button" class="uk-button uk-button-secondary" disabled
+                  uk-tooltip="{{t .LangCode "ask.chatDisabled"}}">{{t .LangCode "ask.chat"}}</button>
+      </div>
+      {{ else if .LoggedUser }}
+      <div>
+          <button type="button" class="uk-button uk-button-secondary" id="chat-submit-btn">{{t .LangCode "ask.chat"}}</button>
+          <div class="uk-text-meta">{{t .LangCode "ask.chatLimit" .PageUser.ChatMaxMessages}}</div>
+      </div>
+      {{ else }}
+      <div>
+          <button type="button" class="uk-button uk-button-secondary" id="chat-submit-btn">{{t .LangCode "ask.chat"}}</button>
+      </div>
+      {{ end }}
+    </div>
+  </div>
+</form>
+
+<script>
+  // 邮箱显隐与验证逻辑
+  var notifyCheckbox = document.getElementById('notify-checkbox');
+  var emailContainer = document.getElementById('email-container');
+  var emailInput = document.getElementById('email-input');
+
+  if (notifyCheckbox && emailContainer && emailInput) {
+    notifyCheckbox.addEventListener('change', function() {
+      if (this.checked) {
+        emailContainer.style.display = 'block';
+        emailInput.setAttribute('required', 'required');
+      } else {
+        emailContainer.style.display = 'none';
+        emailInput.removeAttribute('required');
+        emailInput.value = '';
+      }
+    });
+  }
+
+  // 私聊按钮：设置标识后触发验证弹窗
+  var chatBtn = document.getElementById('chat-submit-btn');
+  if (chatBtn) {
+    chatBtn.addEventListener('click', function() {
+      var isLogged = {{ if .LoggedUser }}true{{ else }}false{{ end }};
+      if (!isLogged) {
+        var currentURI = '{{.CurrentURI}}';
+        UIkit.modal.dialog(
+            '<div class="uk-text-center uk-padding" style="min-height: 150px; display: flex; flex-direction: column; justify-content: center;">' +
+            '<h3 class="uk-modal-title uk-margin-small-bottom">{{t .LangCode "ask.loginRequired"}}</h3>' +
+            '<p class="uk-text-muted uk-margin-small-bottom">{{t .LangCode "ask.loginRequiredChat"}}</p>' +
+            '<a href="/login?to=' + encodeURIComponent(currentURI) + '" class="uk-button uk-button-primary">{{t .LangCode "ask.goLogin"}}</a>' +
+            '</div>',
+            {width: '400px'}
+        );
+        return;
+      }
+      document.getElementById('start_chat_val').value = 'true';
+      {{ if eq .CaptchaType "math" }}
+      var submitBtn = document.getElementById('normal-submit-btn');
+      if (submitBtn) submitBtn.click();
+      {{ else }}
+      document.getElementById('normal-submit-btn').click();
+      {{ end }}
+    });
+  }
+
+  {{ if ne .CaptchaType "math" }}
+  function onSubmit(token) {
+    var btn = document.querySelector('.g-recaptcha');
+    var originalText = btn.innerText;
+
+    if (notifyCheckbox && notifyCheckbox.checked && emailInput && emailInput.value.trim() === '') {
+      alert(CAPTCHA_I18N.needEmail);
+      grecaptcha.reset();
+      return;
+    }
+
+    btn.disabled = true;
+    btn.innerText = '{{t .LangCode "common.verifying"}}';
+
+    var needPassword = {{if .PageUser.AskPassword}}true{{else}}false{{end}};
+    if (needPassword) {
+      UIkit.modal.prompt(CAPTCHA_I18N.needPassword, '', 'password')
+        .then(function(password) {
+          if (password) {
+            document.getElementById('ask_password_input').value = password;
+            document.getElementById('form').submit();
+          } else {
+            btn.disabled = false;
+            btn.innerText = originalText;
+            grecaptcha.reset();
+          }
+        });
+    } else {
+      document.getElementById('form').submit();
+    }
+  }
+  {{ end }}
+</script>
+{{ end }}
diff --git a/templates/question/new-question-template.html.bak b/templates/question/new-question-template.html.bak
new file mode 100644
index 0000000..f1ad848
--- /dev/null
+++ b/templates/question/new-question-template.html.bak
@@ -0,0 +1,145 @@
+{{ if not .CanAsk }}
+<div>
+  <div uk-alert class="uk-text-center">
+    <p>提问箱的主人设置了仅注册用户才能提问，你需要先登录才能向他提问。</p>
+  </div>
+  <div class="uk-margin uk-text-center">
+    <a class="uk-button uk-button-primary" href="/login?to={{.CurrentURI}}">前往登录</a>
+  </div>
+</div>
+{{ else }}
+<form method="post" action="/_/{{.PageUser.Domain}}" enctype="multipart/form-data" id="form">
+  {{ .CSRFTokenHTML }}
+
+  {{if .PageUser.AskPassword}}
+  <input type="hidden" name="ask_password" id="ask_password_input" value="">
+  {{end}}
+
+  <input type="hidden" name="start_chat_val" id="start_chat_val" value="false">
+
+  <div class="uk-margin uk-text-center">
+    <textarea name="content" class="uk-textarea" rows="5" placeholder="在此处撰写你的问题..."
+              maxlength="1000">{{.content}}</textarea>
+    <div x-data="{ files: null }" style="width: 100%; background-color: #f8f8f8; display: flex; padding-top: 5px; padding-bottom: 5px; align-items: center; justify-content: start;gap: 5px">
+      <div uk-form-custom>
+        <a href="#" class="uk-icon-link" uk-icon="image" style="margin-left: 10px"></a>
+        <span style="font-size: 12px" x-text="files ? files[0].name : '添加图片'"></span>
+        <input id="uploader" name="images" type="file" accept="image/*" x-on:change="files = Object.values($event.target.files)">
+      </div>
+      <button x-show="files" type="button" class="uk-icon-link" uk-icon="close" style="margin-left: 10px;"
+              @click="files = null"></button>
+    </div>
+  </div>
+
+  <div class="uk-margin uk-grid-small">
+    <label class="uk-text-small">
+      <input name="private" class="uk-checkbox" type="checkbox"> 回复后不公开
+    </label>
+    <label class="uk-text-small">
+      <input name="receive_reply_via_email" id="notify-checkbox" class="uk-checkbox" type="checkbox"> 接收通知
+    </label>
+    <div id="email-container" style="width: 100%; display: none;" class="uk-margin-small-top">
+      <input class="uk-input uk-form-small" type="email" name="receive_reply_email" id="email-input" placeholder="请输入你的邮箱地址">
+    </div>
+  </div>
+
+  <div class="uk-margin uk-text-center">
+    <div class="uk-grid-small uk-flex-center" uk-grid>
+      <div>
+        <button type="submit" class="uk-button uk-button-primary g-recaptcha" 
+                data-sitekey="{{.RecaptchaSiteKey}}" data-callback="onSubmit"
+                id="normal-submit-btn">发送提问</button>
+      </div>
+      {{ if and .LoggedUser .PageUser.AllowChat }}
+      <div>
+        <button type="button" class="uk-button uk-button-secondary" id="chat-submit-btn">发起私聊</button>
+        <div class="uk-text-meta">消息上限：{{.PageUser.ChatMaxMessages}}条</div>
+      </div>
+      {{ else if not .LoggedUser }}
+      <div>
+        <button type="button" class="uk-button uk-button-secondary" id="chat-submit-btn">发起私聊</button>
+      </div>
+      {{ else }}
+      <div>
+        <button type="button" class="uk-button uk-button-secondary" disabled uk-tooltip="该提问箱未开启私聊">发起私聊</button>
+      </div>
+      {{ end }}
+    </div>
+  </div>
+</form>
+
+<script>
+  // 邮箱显隐与验证逻辑
+  var notifyCheckbox = document.getElementById('notify-checkbox');
+  var emailContainer = document.getElementById('email-container');
+  var emailInput = document.getElementById('email-input');
+
+  if (notifyCheckbox && emailContainer && emailInput) {
+    notifyCheckbox.addEventListener('change', function() {
+      if (this.checked) {
+        emailContainer.style.display = 'block';
+        emailInput.setAttribute('required', 'required');
+      } else {
+        emailContainer.style.display = 'none';
+        emailInput.removeAttribute('required');
+        emailInput.value = ''; // 清空已填内容
+      }
+    });
+  }
+
+  // 私聊按钮点击处理
+  var chatBtn = document.getElementById('chat-submit-btn');
+  if (chatBtn) {
+    chatBtn.addEventListener('click', function() {
+      var isLogged = {{ if .LoggedUser }}true{{ else }}false{{ end }};
+      if (!isLogged) {
+        var currentURI = '{{.CurrentURI}}';
+        UIkit.modal.dialog(
+            '<div class="uk-text-center uk-padding" style="min-height: 150px; display: flex; flex-direction: column; justify-content: center;">' +
+            '<h3 class="uk-modal-title uk-margin-small-bottom">需要登录</h3>' +
+            '<p class="uk-text-muted uk-margin-small-bottom">发起私聊需要登录账号</p>' +
+            '<a href="/login?to=' + encodeURIComponent(currentURI) + '" class="uk-button uk-button-primary">去登录</a>' +
+            '</div>',
+            {width: '400px'}
+        );
+        return;
+      }
+      // 已登录，设置私聊标识并触发提交
+      document.getElementById('start_chat_val').value = 'true';
+      document.getElementById('normal-submit-btn').click();
+    });
+  }
+
+  function onSubmit(token) {
+    var btn = document.querySelector('.g-recaptcha');
+    var originalText = btn.innerText;
+
+    // 手动验证邮箱（字段名已修正为 receive_reply_email）
+    if (notifyCheckbox && notifyCheckbox.checked && emailInput && emailInput.value.trim() === '') {
+      alert('请填写接收通知的邮箱地址');
+      grecaptcha.reset(); // 重置验证码
+      return;
+    }
+
+    btn.disabled = true;
+    btn.innerText = '验证中...';
+
+    var needPassword = {{if .PageUser.AskPassword}}true{{else}}false{{end}};
+    if (needPassword) {
+      UIkit.modal.prompt('此提问箱需要密码', '', 'password')
+        .then(function(password) {
+          if (password) {
+            document.getElementById('ask_password_input').value = password;
+            document.getElementById('form').submit();
+          } else {
+            btn.disabled = false;
+            btn.innerText = originalText;
+            grecaptcha.reset();
+          }
+        });
+    } else {
+      document.getElementById('form').submit();
+    }
+  }
+</script>
+{{ end }}
\ No newline at end of file
diff --git a/templates/question/password.html b/templates/question/password.html
new file mode 100644
index 0000000..92f8f2b
--- /dev/null
+++ b/templates/question/password.html
@@ -0,0 +1,62 @@
+{{template "base/header" .}}
+<!-- 头像直连 R2：crossorigin 让 favicon 也以 CORS 模式请求，确保浏览器缓存的响应都带 ACAO；
+     ?v=2 击穿历史上被「无 ACAO 响应」污染的缓存条目 -->
+<link rel="shortcut icon"
+      href="{{.PageUser.Avatar}}?v=2" crossorigin="anonymous"/>
+<link rel="apple-touch-icon"
+      href="{{.PageUser.Avatar}}?v=2" crossorigin="anonymous"/>
+<link rel="icon" sizes="192x192"
+      href="{{.PageUser.Avatar}}?v=2" crossorigin="anonymous">
+
+<style>
+  .password-card {
+      max-width: 450px;
+      margin: 0 auto;
+      margin-top: 50px;
+  }
+  .password-icon {
+      text-align: center;
+      font-size: 3em;
+      color: #faa05a;
+      margin-bottom: 15px;
+  }
+  .password-desc {
+      text-align: center;
+      color: #666;
+      margin-bottom: 25px;
+  }
+</style>
+
+<div class="uk-container uk-container-xsmall">
+  <div class="uk-card uk-card-default uk-card-body password-card uk-box-shadow-medium">
+    <div class="password-icon">
+      <span uk-icon="icon: lock; ratio: 3"></span>
+    </div>
+    <h3 class="uk-text-center uk-margin-small-top">{{ .PageUser.Name }}{{t .LangCode "site.logoSuffix"}}</h3>
+    <p class="password-desc">{{t .LangCode "password.desc"}}</p>
+
+    {{template "base/alert" .}}
+    
+    <form method="post" action="/_/{{.PageUser.Domain}}/password" class="uk-form-stacked">
+      {{ .CSRFTokenHTML }}
+      <input type="hidden" name="next" value="{{.Next}}">
+      <div class="uk-margin">
+        <div class="uk-inline uk-width-1-1">
+          <span class="uk-form-icon uk-form-icon" uk-icon="icon: lock"></span>
+          <input name="password" class="uk-input uk-form-large" type="password" placeholder="{{t .LangCode "password.input"}}" autofocus>
+        </div>
+      </div>
+      <div class="uk-margin">
+        <button type="submit" class="uk-button uk-button-primary uk-width-1-1 uk-button-large">
+          <span uk-icon="icon: sign-in"></span> {{t .LangCode "password.enter"}}
+        </button>
+      </div>
+    </form>
+
+    <div class="uk-text-center uk-margin-small-top">
+      <a href="/" class="uk-text-muted uk-text-small">← {{t .LangCode "common.backHome"}}</a>
+    </div>
+  </div>
+</div>
+
+{{template "base/footer" .}}
\ No newline at end of file
diff --git a/templates/question/question-not-found.html b/templates/question/question-not-found.html
new file mode 100644
index 0000000..beec2fc
--- /dev/null
+++ b/templates/question/question-not-found.html
@@ -0,0 +1,106 @@
+{{template "base/header" .}}
+<!--<link rel="stylesheet" href="https://lf6-cdn-tos.bytecdntp.com/cdn/expire-1-y/uikit/3.3.3/css/uikit.min.css">-->
+<!-- 头像直连 R2：crossorigin 让 favicon 也以 CORS 模式请求，确保浏览器缓存的响应都带 ACAO；
+     ?v=2 击穿历史上被「无 ACAO 响应」污染的缓存条目 -->
+<link rel="shortcut icon"
+      href="{{.PageUser.Avatar}}?v=2" crossorigin="anonymous"/>
+<link rel="apple-touch-icon"
+      href="{{.PageUser.Avatar}}?v=2" crossorigin="anonymous"/>
+<link rel="icon" sizes="192x192"
+      href="{{.PageUser.Avatar}}?v=2" crossorigin="anonymous">
+<div class="uk-card uk-card-default uk-text-center">
+  <div class="uk-flex uk-flex-center uk-flex-middle uk-background-cover uk-light" style="min-height: 260px;" data-src="{{ .PageUser.Background }}" uk-img>
+    <div class="uk-card-body">
+      <img class="uk-border-circle uk-box-shadow-large" src="{{ if .PageUser.Avatar }}{{ .PageUser.Avatar }}?v=2{{ else }}{{ .DefaultAvatar }}{{ end }}" crossorigin="anonymous" style="width: 100px; height: 100px; max-width: 100%; max-height: 100%;">
+      <h3 id="usernamecolor">{{ .PageUser.Name }}</h3>
+      <p id="introcolor">{{ .PageUser.Intro }}</p>
+        <div class="icon-container">
+        {{ if and .PageUser.Acfunlink (ne .PageUser.Acfunlink "none") }}
+         <a href="https://{{.PageUser.Acfunlink}}" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/ailicili.png" alt="acfunlink" class="icon">
+         </a>
+        {{ end }}
+        {{ if and .PageUser.Bililink (ne .PageUser.Bililink "none") }}
+         <a href="https://{{.PageUser.Bililink}}" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/bili.png" alt="bililink" class="icon">
+         </a>
+        {{ end }}
+        {{ if and .PageUser.Weibolink (ne .PageUser.Weibolink "none") }}
+         <a href="https://{{.PageUser.Weibolink}}" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/weibo.png" alt="weibolink" class="icon">
+         </a>
+        {{ end }}
+        {{ if and .PageUser.Xiaohongshulink (ne .PageUser.Xiaohongshulink "none") }}
+         <a href="https://{{.PageUser.Xiaohongshulink}}" target="_blank">
+          <img src="https://r2.337845818.best/tamabox/icon/social/xiaohongshu.png" alt="xiaohongshulink" class="icon">
+         </a>
+        {{ end }}
+        {{ if and .PageUser.Bloglink (ne .PageUser.Bloglink "none") }}
+          <a href="https://{{.PageUser.Bloglink}}" target="_blank">
+           <img src="https://r2.337845818.best/tamabox/icon/social/blog.png" alt="bloglink" class="icon">
+         </a>
+        {{ end }}
+        </div>
+    </div>
+  </div>
+</div>
+<script>
+document.getElementById("usernamecolor").style.color = {{.PageUser.Usernamecolor}};
+document.getElementById("introcolor").style.color = {{.PageUser.Introcolor}};
+</script>
+<div>
+  <div class="uk-card uk-card-default uk-card-small uk-card-body">
+    {{ if .CanAsk }}
+    <!-- jQuery 按需加载（同步，保证下方内联二维码初始化就绪） -->
+    <script src="https://cdnjs.snrat.com/ajax/libs/jquery/3.7.1/jquery.min.js"></script>
+    <script src='https://r2.337845818.best/tamabox/cdn/js/remake/easy.qrcode.min.js' type="text/javascript"  charset="utf-8"></script>
+    <center><div id="boxqrimg"></div></center>
+    <script type="text/javascript">
+        var options = {
+            text: window.location.href,
+            width: 200,
+            height: 200,
+            // 与 Profile 编辑器保持一致：仅当启用自定义前景色时，才把 Qrcodebackcolor 作为前景色；
+            // 否则强制黑色 #000000，避免未勾选却显示自定义前景色、与 Profile 预览不一致。
+            colorDark: ({{.PageUser.UseCustomQRColor}} ? "{{.PageUser.Qrcodebackcolor}}" : "#000000") || "#000000",
+            colorLight: "{{.PageUser.Qrcodecolor}}" || "#FFFFFF",
+            dotScale: parseFloat("{{.PageUser.Dotscale}}") || 0.4,
+            dotScaleTiming: parseFloat("{{.PageUser.Dotscale}}") || 0.4,
+            dotScaleA: parseFloat("{{.PageUser.Dotscale}}") || 0.4,
+            correctLevel: QRCode.CorrectLevel.H,
+            logo: (function () {
+                // ?v=2：击穿曾被无 ACAO 响应污染的浏览器缓存条目；仅对 http(s) 绝对地址追加
+                var a = "{{.PageUser.Avatar}}" || "{{.DefaultAvatar}}";
+                return a ? (a.indexOf("http") === 0 ? a + "?v=2" : a) : undefined;
+            })(),
+            logoWidth: 60,
+            logoHeight: 60,
+            logoBackgroundTransparent: true,
+            // 直连 R2 等跨域图片须以 CORS 模式加载，canvas 才不被污染、可正常导出
+            crossOrigin: 'anonymous',
+            backgroundImage: ("{{.PageUser.BackgroundImage}}" ? "{{.PageUser.BackgroundImage}}" : undefined),
+            backgroundImageAlpha: parseFloat("{{.PageUser.Backgroundimagealpha}}") || 0.8,
+            autoColor: false,
+            PO: "{{.PageUser.Qrcodepdpcolor}}" || "#000000",
+            PI: "{{.PageUser.Qrcodepdpcolor}}" || "#000000",
+            AO: '',
+            AI: '',
+            timing: "{{.PageUser.Qrcodepdpcolor}}" || "#000000"
+        };
+        // 降级渲染：头像（logo）/ 背景图加载慢/失败时先出基础码，探针成功后再升级带 logo 版
+        window.tbRenderQR(document.getElementById("boxqrimg"), function () { return options; });
+    </script>
+ 
+    <p class="uk-text-center uk-text-small">扫码向@{{ .PageUser.Name }}提问<br>{{ if .RegisterOnlyAsk }}{{t .LangCode "ask.registerOnly"}}{{ else }}{{t .LangCode "ask.anonymous"}}{{ end }}</p>
+    {{ end }}
+    {{template "base/alert" .}}
+    {{template "question/new-question-template" .}}
+
+    <hr class="uk-divider-icon">
+    {{ if ne (len .PageQuestions) 0 }}
+    <p class="uk-text-left uk-text-muted uk-text-small">@{{ .PageUser.Name }} 以前回答过的问题 ({{ .AnsweredCount }})</p>
+    {{ template "question/history-template" . }}
+    {{ end }}
+  </div>
+</div>
+{{template "base/footer" .}}
\ No newline at end of file
diff --git a/templates/question/success.html b/templates/question/success.html
new file mode 100644
index 0000000..ae3a840
--- /dev/null
+++ b/templates/question/success.html
@@ -0,0 +1,54 @@
+{{template "base/header" .}}
+<div class="uk-card uk-card-default uk-card-body">
+  <div class="uk-text-center uk-margin-bottom">
+    <span uk-icon="icon: check; ratio: 2" class="uk-text-success"></span>
+    <h3 class="uk-margin-remove">{{t .LangCode "success.title"}}</h3>
+  </div>
+
+  <p class="uk-text-small uk-text-muted">{{t .LangCode "success.yourQuestion"}}</p>
+  <div class="md-body uk-text-break">{{MarkdownFormat .Question.Content}}</div>
+
+  {{ if .HasReceiveEmail }}
+  <div class="uk-alert-success" uk-alert>
+    <p>{{t .LangCode "success.emailSent"}}</p>
+  </div>
+  {{ else }}
+  <div class="uk-alert-danger" uk-alert>
+    <p>{{t .LangCode "success.saveLink" | safe}}</p>
+  </div>
+  {{ end }}
+
+  <div class="uk-margin">
+    <label class="uk-form-label uk-text-small">{{t .LangCode "success.privateLink"}}</label>
+    <div class="uk-flex uk-flex-middle">
+      <input id="private-url-input" class="uk-input uk-form-small uk-width-expand" type="text" value="{{.PrivateAbsURL}}" readonly>
+      <button id="copy-btn" class="uk-button uk-button-primary uk-button-small uk-margin-small-left uk-flex-none" type="button">{{t .LangCode "success.copy"}}</button>
+    </div>
+    <p class="uk-text-small uk-text-muted">{{t .LangCode "success.token" .Question.Token}}</p>
+  </div>
+
+  <div class="uk-text-center uk-margin-top">
+    <a class="uk-button uk-button-default uk-button-small" href="{{.PrivateURL}}">{{t .LangCode "success.viewQuestion"}}</a>
+    <a class="uk-button uk-button-default uk-button-small uk-margin-small-left" href="/_/{{.PageUser.Domain}}">{{t .LangCode "success.backToBox" .PageUser.Name}}</a>
+  </div>
+</div>
+
+<script>
+document.addEventListener('DOMContentLoaded', function () {
+  var input = document.getElementById('private-url-input');
+  var btn = document.getElementById('copy-btn');
+  if (!input || !btn) return;
+  btn.addEventListener('click', function () {
+    input.select();
+    input.setSelectionRange(0, 99999);
+    var ok = false;
+    try { ok = document.execCommand('copy'); } catch (e) {}
+    if (navigator.clipboard && navigator.clipboard.writeText) {
+      navigator.clipboard.writeText(input.value).then(function () { ok = true; }, function () {});
+    }
+    btn.textContent = ok ? '{{t .LangCode "success.copied"}}' : '{{t .LangCode "success.copyFailed"}}';
+    setTimeout(function () { btn.textContent = '{{t .LangCode "success.copy"}}'; }, 2000);
+  });
+});
+</script>
+{{template "base/footer" .}}
diff --git a/templates/render_public_test.go b/templates/render_public_test.go
new file mode 100644
index 0000000..12eb2b8
--- /dev/null
+++ b/templates/render_public_test.go
@@ -0,0 +1,271 @@
+package templates
+
+import (
+	gotemplate "html/template"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+)
+
+type mockPageQuestion struct {
+	ID        uint
+	Content   string
+	CreatedAt time.Time
+	IsPinned  bool
+	Answer    string
+}
+
+func publicBaseData() map[string]interface{} {
+	pageUser := map[string]interface{}{
+		"Domain": "tester", "Name": "测试箱主", "Avatar": "", "Background": "",
+		"Intro": "欢迎提问", "Usernamecolor": "#000", "Introcolor": "#666",
+		"Acfunlink": "none", "Bililink": "none", "Weibolink": "none",
+		"Xiaohongshulink": "none", "Bloglink": "none",
+		"Qrcodebackcolor": "#fff", "Qrcodecolor": "#000", "Dotscale": "0.35",
+		"BackgroundImage": "", "Backgroundimagealpha": "0.8", "Qrcodepdpcolor": "#000",
+		"HarassmentSetting": "disabled", "AllowChat": true, "ChatMaxMessages": 10,
+	}
+	return map[string]interface{}{
+		"LangCode":         "zh-CN",
+		"SupportedLangs":   []map[string]string{{"Code": "zh-CN", "Name": "简体中文"}},
+		"IsLogged":         false,
+		"IsUserPage":       true,
+		"IsOwnPage":        false,
+		"IsPixel":          false,
+		"VConsole":         false,
+		"CSRFTokenHTML":    gotemplate.HTML(`<input type="hidden" name="_csrf" value="x">`),
+		"RecaptchaSiteKey": "",
+		"CaptchaType":      "recaptcha",
+		"PageUser":         pageUser,
+		"PageUserRaw":      pageUser,
+		"PageQuestions": []mockPageQuestion{
+			{ID: 1, Content: "置顶的问题", CreatedAt: time.Now(), IsPinned: true, Answer: "答1"},
+			{ID: 2, Content: "普通问题", CreatedAt: time.Now().Add(-time.Hour), IsPinned: false, Answer: "答2"},
+		},
+		"PageQuestionCursor": "2",
+		"CanAsk":             true,
+		"AnsweredCount":      2,
+		"ICP":                "",
+		// [limits] 全站上限（生产由 Contexter 全局注入 conf.Limits），供提问/回答/追问
+		// 输入框 maxlength 与私聊发起框同源
+		"Limits": conf.Limits,
+	}
+}
+
+// TestRenderPublicQuestionList 渲染提问箱主页（含置顶条目），复现公开页 500。
+func TestRenderPublicQuestionList(t *testing.T) {
+	if err := renderWithData(t, "question/list", publicBaseData()); err != nil {
+		t.Fatalf("render question/list failed: %v", err)
+	}
+}
+
+// TestRenderQuestionListClosed 提问功能关闭时：展示关闭原因 + 下次开放/上次关闭时间（问题 3 的模板路径）。
+func TestRenderQuestionListClosed(t *testing.T) {
+	base := publicBaseData()
+	base["CanAsk"] = false
+	base["AskState"] = map[string]interface{}{"Open": false, "Reason": "not_started"}
+	base["AskClosedMessage"] = "提问功能尚未开放"
+	base["AskNextOpenAtStr"] = "2026-09-02 10:00"
+	base["AskLastCloseAtStr"] = "2026-09-01 18:00"
+
+	out, err := renderToString(t, "question/list", base)
+	if err != nil {
+		t.Fatalf("render question/list (closed) failed: %v", err)
+	}
+	if !strings.Contains(out, "提问功能尚未开放") {
+		t.Fatal("closed reason not rendered")
+	}
+	if !strings.Contains(out, "下次开放时间：2026-09-02 10:00") {
+		t.Fatal("next open time not rendered")
+	}
+	if !strings.Contains(out, "上次关闭时间：2026-09-01 18:00") {
+		t.Fatal("last close time not rendered")
+	}
+}
+
+// TestRenderQuestionListClosedPermanent 一次性窗口结束后（无循环定时）：只展示上次关闭时间，不展示下次开放。
+func TestRenderQuestionListClosedPermanent(t *testing.T) {
+	base := publicBaseData()
+	base["CanAsk"] = false
+	base["AskState"] = map[string]interface{}{"Open": false, "Reason": "ended"}
+	base["AskClosedMessage"] = "提问功能已结束收集"
+	base["AskNextOpenAtStr"] = ""
+	base["AskLastCloseAtStr"] = "2026-08-31 18:00"
+
+	out, err := renderToString(t, "question/list", base)
+	if err != nil {
+		t.Fatalf("render question/list (ended) failed: %v", err)
+	}
+	if strings.Contains(out, "下次开放时间") {
+		t.Fatal("next open time should NOT be rendered when permanently closed")
+	}
+	if !strings.Contains(out, "上次关闭时间：2026-08-31 18:00") {
+		t.Fatal("last close time not rendered")
+	}
+}
+
+// TestRenderQuestionListRegisterOnlyCaption 未开启「仅允许注册用户」时，二维码文案保持原样。
+func TestRenderQuestionListRegisterOnlyCaption(t *testing.T) {
+	base := publicBaseData()
+	base["RegisterOnlyAsk"] = false
+	out, err := renderToString(t, "question/list", base)
+	if err != nil {
+		t.Fatalf("render question/list failed: %v", err)
+	}
+	if !strings.Contains(out, "谁都可以以匿名的形式提问") {
+		t.Fatal("anonymous caption should be rendered when not register-only")
+	}
+	if strings.Contains(out, "仅允许注册用户向TA提问") {
+		t.Fatal("register-only caption should NOT be rendered when not register-only")
+	}
+}
+
+// TestRenderQuestionListRegisterOnlyOn 开启「仅允许注册用户」（箱主登录态可提问）时，二维码文案联动（问题 2）。
+func TestRenderQuestionListRegisterOnlyOn(t *testing.T) {
+	base := publicBaseData()
+	base["CanAsk"] = true
+	base["RegisterOnlyAsk"] = true
+	out, err := renderToString(t, "question/list", base)
+	if err != nil {
+		t.Fatalf("render question/list failed: %v", err)
+	}
+	if !strings.Contains(out, "仅允许注册用户向TA提问") {
+		t.Fatal("register-only caption should be rendered when register-only enabled")
+	}
+	if strings.Contains(out, "谁都可以以匿名的形式提问") {
+		t.Fatal("anonymous caption should NOT be rendered when register-only enabled")
+	}
+}
+
+// TestRenderQuestionListVoteDisabled 投票功能关闭时：投票 Tab 保留显示但置灰禁用，并带原因 tooltip。
+func TestRenderQuestionListVoteDisabled(t *testing.T) {
+	base := publicBaseData()
+	base["VoteEnabled"] = false
+	base["VoteClosedMessage"] = "该提问箱已关闭投票功能"
+	out, err := renderToString(t, "question/list", base)
+	if err != nil {
+		t.Fatalf("render question/list (vote disabled) failed: %v", err)
+	}
+	if !strings.Contains(out, "profile-tab is-disabled") {
+		t.Fatal("vote tab should stay visible but disabled")
+	}
+	if !strings.Contains(out, "disabled") {
+		t.Fatal("vote tab should carry disabled attribute")
+	}
+	if !strings.Contains(out, "该提问箱已关闭投票功能") {
+		t.Fatal("vote tab should carry the close reason tooltip")
+	}
+	// 注意：JS 守卫代码里也有 [data-profile-tab="votes"] 选择器，须按按钮元素精确断言
+	if strings.Contains(out, `data-profile-tab="votes" role="tab"`) {
+		t.Fatal("disabled vote tab must NOT be switchable")
+	}
+}
+
+// TestRenderQuestionListVoteEnabled 投票功能正常时：投票 Tab 可点击切换。
+func TestRenderQuestionListVoteEnabled(t *testing.T) {
+	base := publicBaseData()
+	base["VoteEnabled"] = true
+	out, err := renderToString(t, "question/list", base)
+	if err != nil {
+		t.Fatalf("render question/list (vote enabled) failed: %v", err)
+	}
+	if !strings.Contains(out, `data-profile-tab="votes"`) {
+		t.Fatal("vote tab should be switchable when enabled")
+	}
+	if strings.Contains(out, "profile-tab is-disabled") {
+		t.Fatal("vote tab must not be disabled when enabled")
+	}
+}
+
+// TestRenderQuestionListChatOnly 提问功能关闭但私聊开启时：保留独立私聊入口（含已登录/未登录两种形态）。
+func TestRenderQuestionListChatOnly(t *testing.T) {
+	base := publicBaseData()
+	base["CanAsk"] = false
+	base["AskState"] = map[string]interface{}{"Open": false, "Reason": "disabled"}
+	base["AskClosedMessage"] = "提问箱主人已关闭提问功能"
+	base["AskNextOpenAtStr"] = ""
+	base["AskLastCloseAtStr"] = ""
+	base["AllowChat"] = true
+	base["ChatMaxMessages"] = 20
+	base["LoggedUser"] = map[string]interface{}{"Domain": "tester", "Name": "测试箱主"}
+
+	// 已登录：渲染独立私聊表单
+	out, err := renderToString(t, "question/list", base)
+	if err != nil {
+		t.Fatalf("render question/list (chat only, logged in) failed: %v", err)
+	}
+	if !strings.Contains(out, "提问箱主人已关闭提问功能") {
+		t.Fatal("ask closed reason should still be shown")
+	}
+	if !strings.Contains(out, `id="chat-only-form"`) {
+		t.Fatal("chat-only form should be rendered when chat enabled and logged in")
+	}
+	if !strings.Contains(out, `id="chat-only-form" enctype="multipart/form-data"`) {
+		t.Fatal("chat-only form must be multipart, otherwise form.Bind panics on the Images field")
+	}
+	if !strings.Contains(out, `name="start_chat_val" value="true"`) {
+		t.Fatal("chat-only form must submit as a chat request")
+	}
+	if !strings.Contains(out, "在此处撰写你的私聊消息...") {
+		t.Fatal("chat placeholder should be rendered")
+	}
+	if !strings.Contains(out, "onChatOnlySubmit") {
+		t.Fatal("chat-only captcha callback should be defined for non-math captcha")
+	}
+
+	// 未登录：渲染登录引导而非表单
+	base["LoggedUser"] = nil
+	out, err = renderToString(t, "question/list", base)
+	if err != nil {
+		t.Fatalf("render question/list (chat only, anonymous) failed: %v", err)
+	}
+	if strings.Contains(out, `id="chat-only-form"`) {
+		t.Fatal("chat-only form must not be rendered for anonymous visitors")
+	}
+	if !strings.Contains(out, "/login?to=") {
+		t.Fatal("anonymous visitors should get a login link to start chats")
+	}
+}
+
+// TestRenderQuestionListChatOnlyNoChat 提问关闭且私聊也关闭：不渲染私聊入口。
+func TestRenderQuestionListChatOnlyNoChat(t *testing.T) {
+	base := publicBaseData()
+	base["CanAsk"] = false
+	base["AskClosedMessage"] = "提问箱主人已关闭提问功能"
+	base["AllowChat"] = false
+	base["LoggedUser"] = map[string]interface{}{"Domain": "tester", "Name": "测试箱主"}
+	out, err := renderToString(t, "question/list", base)
+	if err != nil {
+		t.Fatalf("render question/list (all closed) failed: %v", err)
+	}
+	if strings.Contains(out, `id="chat-only-form"`) {
+		t.Fatal("chat-only form must not be rendered when chat is disabled")
+	}
+}
+
+// TestRenderPublicQuestionItem 渲染单题页（含历史列表），复现公开页 500。
+func TestRenderPublicQuestionItem(t *testing.T) {
+	data := publicBaseData()
+	data["Question"] = map[string]interface{}{
+		"ID": 1, "Content": "置顶的问题", "Answer": "答1", "CreatedAt": time.Now(),
+		"UpdatedAt": time.Now(), "IsPrivate": false, "IsPinned": true,
+		"Token": "abc123", "ReceiveReplyEmail": "",
+	}
+	data["QuestionToken"] = "abc123"
+	data["AskUploadImages"] = []interface{}{}
+	data["AnswerUploadImages"] = []interface{}{}
+	data["FollowUps"] = []interface{}{}
+	data["CanFollowUp"] = false
+	data["FollowUpRemaining"] = 0
+	data["FollowUpLimit"] = 3
+	data["IsOwnPage"] = true
+	data["IsQuestioner"] = false
+	data["IsBlocked"] = false
+	data["AllowChat"] = true
+
+	if err := renderWithData(t, "question/item", data); err != nil {
+		t.Fatalf("render question/item failed: %v", err)
+	}
+}
diff --git a/templates/render_test.go b/templates/render_test.go
new file mode 100644
index 0000000..a7ddb8f
--- /dev/null
+++ b/templates/render_test.go
@@ -0,0 +1,313 @@
+package templates
+
+import (
+	"bytes"
+	"fmt"
+	gotemplate "html/template"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/flamego/template"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/db"
+	templatepkg "github.com/tamakyi/TamaBox/internal/template"
+)
+
+// renderWithData 用给定数据渲染模板（复刻生产环境 Templater + FuncMap）。
+func renderWithData(t *testing.T, name string, data map[string]interface{}) error {
+	t.Helper()
+	_, err := renderToString(t, name, data)
+	return err
+}
+
+// renderToString 渲染模板并返回输出，供需要断言渲染结果的用例使用。
+func renderToString(t *testing.T, name string, data map[string]interface{}) (string, error) {
+	t.Helper()
+	fs, err := template.EmbedFS(FS, ".", []string{".html"})
+	if err != nil {
+		t.Fatalf("EmbedFS: %v", err)
+	}
+
+	tpl := gotemplate.New("Flamego.Template")
+	for _, f := range fs.Files() {
+		tt := tpl.New(f.Name())
+		for _, funcMap := range templatepkg.FuncMap() {
+			tt.Funcs(funcMap)
+		}
+		dataBytes, err := f.Data()
+		if err != nil {
+			t.Fatalf("get data of %q: %v", f.Name(), err)
+		}
+		if _, err := tt.Parse(string(dataBytes)); err != nil {
+			t.Fatalf("parse %q: %v", f.Name(), err)
+		}
+	}
+
+	var buf bytes.Buffer
+	if err := tpl.ExecuteTemplate(&buf, name, data); err != nil {
+		return "", err
+	}
+	return buf.String(), nil
+}
+
+// mockLoggedUser 覆盖 templates/user/profile.html 引用到的 LoggedUser 字段。
+type mockLoggedUser struct {
+	Domain               string
+	Name                 string
+	Email                string
+	Avatar               string
+	Background           string
+	BackgroundImage      string
+	Backgroundimagealpha string
+	Intro                string
+	Introcolor           string
+	Usernamecolor        string
+	Qrcodebackcolor      string
+	Qrcodecolor          string
+	Qrcodepdpcolor       string
+	Dotscale             string
+	UseCustomQRColor     bool
+	Notify               string
+	Language             string
+	HarassmentSetting    string
+	BlockWords           string
+	Tags                 string
+	ShowInHome           bool
+	Acfunlink            string
+	Bililink             string
+	Weibolink            string
+	Xiaohongshulink      string
+	Bloglink             string
+	ChatMaxMessages      int
+	DailyMessageLimit    int
+}
+
+// profileBaseData 构造 /user/profile 渲染所需的基础数据。
+func profileBaseData() map[string]interface{} {
+	return map[string]interface{}{
+		"Title":          "设置",
+		"LangCode":       "zh-CN",
+		"SupportedLangs": []map[string]string{{"Code": "zh-CN", "Name": "简体中文"}},
+		"IsLogged":       true,
+		"LoggedUser": &mockLoggedUser{
+			Domain: "tester", Name: "测试箱主", Email: "t@example.com",
+			Usernamecolor: "#000", Introcolor: "#666", Qrcodecolor: "#000",
+			Qrcodepdpcolor: "#000", Qrcodebackcolor: "#fff", Dotscale: "0.35",
+			Backgroundimagealpha: "0.8", Notify: "email", Language: "zh-CN",
+			HarassmentSetting: "none", BlockWords: "广告,spam", Tags: "杂谈",
+			ChatMaxMessages: 20, DailyMessageLimit: 0,
+		},
+		"CSRFTokenHTML":    gotemplate.HTML(`<input type="hidden" name="_csrf" value="x">`),
+		"IsUserPage":       false,
+		"IsPixel":          false,
+		"VConsole":         false,
+		"HasPagePassword":  false,
+		"HasAskPassword":   true,
+		"ActiveProfileTab": "account",
+		"ICP":              "",
+		// 标签 / 屏蔽词上限，供标签块输入组件做实时提示（生产由 route/user.Profile 注入，
+		// 值来自 conf.Limits）
+		"TagLimits": map[string]int{
+			"MaxTags":         conf.Limits.MaxTags,
+			"MaxTagLen":       conf.Limits.MaxTagLen,
+			"MaxBlockWords":   conf.Limits.MaxBlockWords,
+			"MaxBlockWordLen": conf.Limits.MaxBlockWordLen,
+		},
+		// 私聊面板数值上下界（同样来自 conf.Limits）
+		"ChatLimits": map[string]int{
+			"MaxChatMessages":      conf.Limits.ChatMaxMessages,
+			"DailyMessageLimitMax": conf.Limits.DailyMessageLimitMax,
+		},
+	}
+}
+
+// TestRenderUserProfileTabs 渲染整合后的账号设置页：用户设置 + 提问/私聊/投票 三个功能面板，
+// 覆盖"开启 / 手动关闭 / 已达定量上限"三种功能状态。
+func TestRenderUserProfileTabs(t *testing.T) {
+	type mockControl struct {
+		Enabled      bool
+		OpenAt       *time.Time
+		CloseAt      *time.Time
+		QuotaLimit   int64
+		QuotaCount   int64
+		QuotaResetAt *time.Time
+	}
+	type mockState struct {
+		Enabled    bool
+		Open       bool
+		Reason     string
+		QuotaLimit int64
+		QuotaCount int64
+	}
+	type mockFeature struct {
+		Key             string
+		LangCode        string
+		NameText        string
+		StatusText      string
+		CSRFTokenHTML   interface{}
+		Control         *mockControl
+		State           *mockState
+		OpenAtStr       string
+		CloseAtStr      string
+		QuotaResetAtStr string
+		ScheduleDays    string
+		ScheduleStart   string
+		ScheduleEnd     string
+		Mode            string
+	}
+
+	resetAt := time.Now().Add(-24 * time.Hour)
+	csrf := gotemplate.HTML(`<input type="hidden" name="_csrf" value="x">`)
+
+	base := profileBaseData()
+	base["QuotaLimitMax"] = db.QuotaLimitMax
+	base["CSRFTokenHTML"] = csrf
+	base["FeatureQuestion"] = &mockFeature{
+		Key: "question", LangCode: "zh-CN", NameText: "提问", StatusText: "进行中", CSRFTokenHTML: csrf,
+		Control: &mockControl{Enabled: true},
+		State:   &mockState{Enabled: true, Open: true},
+		Mode:    "always",
+	}
+	// 手动关闭
+	base["FeatureChat"] = &mockFeature{
+		Key: "chat", LangCode: "zh-CN", NameText: "私聊", StatusText: "已关闭", CSRFTokenHTML: csrf,
+		Control: &mockControl{Enabled: false},
+		State:   &mockState{Enabled: false, Reason: "disabled"},
+		Mode:    "always",
+	}
+	// 定时 + 定量：已达上限（历史数据存在循环定时，模式推断为 recurring）
+	base["FeatureVote"] = &mockFeature{
+		Key: "vote", LangCode: "zh-CN", NameText: "投票", StatusText: "已达上限", CSRFTokenHTML: csrf,
+		Control:   &mockControl{Enabled: true, QuotaLimit: 100, QuotaCount: 100, QuotaResetAt: &resetAt},
+		State:     &mockState{Enabled: true, Reason: "quota_reached", QuotaLimit: 100, QuotaCount: 100},
+		OpenAtStr: "2026-09-01T09:00", CloseAtStr: "2026-09-30T18:00",
+		QuotaResetAtStr: resetAt.Format("2006-01-02 15:04"),
+		ScheduleDays:    "1,3,5", ScheduleStart: "09:00", ScheduleEnd: "18:00",
+		Mode: "recurring",
+	}
+
+	// 逐个面板渲染：模板能正常执行，且只有目标面板可见、其余面板带 hidden
+	all := []string{"account", "question", "chat", "vote"}
+	for _, tab := range all {
+		base["ActiveProfileTab"] = tab
+		out, err := renderToString(t, "user/profile", base)
+		if err != nil {
+			t.Fatalf("render user/profile (tab=%s) failed: %v", tab, err)
+		}
+		if tab == "account" {
+			// 标签块组件的上限常量已注入（缺注入时 with 会静默跳过，页面失去计数/锁定能力）
+			wantMax := fmt.Sprintf(`data-tb-max="%d" data-tb-max-len="%d"`, conf.Limits.MaxTags, conf.Limits.MaxTagLen)
+			if !strings.Contains(out, wantMax) {
+				t.Fatalf("account: 标签输入缺 data-tb-max 注入，want %q", wantMax)
+			}
+			wantBlock := fmt.Sprintf(`data-tb-max="%d" data-tb-max-len="%d"`, conf.Limits.MaxBlockWords, conf.Limits.MaxBlockWordLen)
+			if !strings.Contains(out, wantBlock) {
+				t.Fatalf("account: 屏蔽词输入缺 data-tb-max 注入，want %q", wantBlock)
+			}
+		}
+		if tab == "chat" {
+			// 私聊面板的 number 输入框 min/max 与 conf.Limits 同源
+			wantChat := fmt.Sprintf(`name="chat_max_messages" class="uk-input uk-width-small" type="number" min="1" max="%d"`, conf.Limits.ChatMaxMessages)
+			if !strings.Contains(out, wantChat) {
+				t.Fatalf("chat: 会话条数输入缺 conf 上限，want %q", wantChat)
+			}
+			wantDaily := fmt.Sprintf(`name="chat_daily_limit" class="uk-input uk-width-small" type="number" min="0" max="%d"`, conf.Limits.DailyMessageLimitMax)
+			if !strings.Contains(out, wantDaily) {
+				t.Fatalf("chat: 每日条数输入缺 conf 上限，want %q", wantDaily)
+			}
+		}
+		for _, other := range all {
+			want := fmt.Sprintf(`data-profile-panel="%s"`, other)
+			visible := strings.Contains(out, want+">")
+			hidden := strings.Contains(out, want+" hidden>")
+			if other == tab && !visible {
+				t.Fatalf("tab=%s: 面板 %s 未渲染为可见", tab, other)
+			}
+			if other != tab && !hidden {
+				t.Fatalf("tab=%s: 面板 %s 未隐藏", tab, other)
+			}
+		}
+	}
+}
+
+// TestRenderUserQuestionList 模拟 /user/questions 的数据渲染，复现 500 错误。
+func TestRenderUserQuestionList(t *testing.T) {
+	type mockItem struct {
+		Type       string
+		CreatedAt  time.Time
+		Content    string
+		Link       string
+		IsAnswered bool
+		IsRead     bool
+		IsPrivate  bool
+		IsBlocked  bool
+		QuestionID uint
+		IsPinned   bool
+		PinLink    string
+	}
+	type mockConv struct {
+		Token     string
+		CreatedAt time.Time
+	}
+	type mockConvDetail struct {
+		Conversation *mockConv
+		OwnerDomain  string
+		OwnerName    string
+		FirstMessage string
+		IsBlocked    bool
+	}
+
+	base := map[string]interface{}{
+		"Title":            "我的提问",
+		"LangCode":         "zh-CN",
+		"SupportedLangs":   []map[string]string{{"Code": "zh-CN", "Name": "简体中文"}},
+		"IsLogged":         true,
+		"LoggedUser":       map[string]interface{}{"Domain": "test", "Name": "tester"},
+		"LoggedUserName":   "tester",
+		"CurrentURI":       "/user/questions",
+		"IsUserPage":       true,
+		"IsPixel":          false,
+		"VConsole":         false,
+		"CSRFTokenHTML":    gotemplate.HTML(`<input type="hidden" name="_csrf" value="x">`),
+		"RecaptchaSiteKey": "",
+		"CaptchaType":      "recaptcha",
+		"PageUser":         map[string]interface{}{"Domain": "test", "Name": "tester", "Avatar": ""},
+		"ICP":              "",
+		"Stats": map[string]int64{
+			"total": 3, "answered": 2, "unanswered": 1, "read": 2, "unread": 1, "private": 1, "pinned": 1,
+		},
+		"ChatStats": map[string]int64{
+			"total": 2, "received": 1, "initiated": 1, "closed": 0,
+		},
+		"Keyword":        "",
+		"SelectedSort":   "latest",
+		"SelectedStatus": "all",
+		"SelectedRead":   "all",
+		"SelectedType":   "all",
+		"ReceivedItems": []interface{}{
+			mockItem{Type: "question_public", CreatedAt: time.Now(), Content: "你好吗？", Link: "/_/test/1",
+				IsAnswered: true, IsRead: true, QuestionID: 1, IsPinned: true, PinLink: "/_/test/1/pin"},
+			mockItem{Type: "question_private", CreatedAt: time.Now(), Content: "悄悄话", Link: "/_/test/2",
+				IsAnswered: false, IsPrivate: true, QuestionID: 2, PinLink: "/_/test/2/pin"},
+		},
+		"ReceivedChats": []interface{}{
+			mockItem{Type: "chat", CreatedAt: time.Now(), Content: "你好", Link: "/_/test/chat/abc", IsBlocked: false},
+		},
+		"ConversationDetails": []interface{}{
+			mockConvDetail{Conversation: &mockConv{Token: "abc", CreatedAt: time.Now()},
+				OwnerDomain: "other", OwnerName: "别人", FirstMessage: "hi", IsBlocked: false},
+		},
+	}
+
+	if err := renderWithData(t, "user/question-list", base); err != nil {
+		t.Fatalf("render user/question-list failed: %v", err)
+	}
+
+	// 带搜索关键词的场景
+	base["Keyword"] = "hello"
+	if err := renderWithData(t, "user/question-list", base); err != nil {
+		t.Fatalf("render user/question-list (keyword) failed: %v", err)
+	}
+}
diff --git a/templates/sponsor.html b/templates/sponsor.html
new file mode 100644
index 0000000..ae8c551
--- /dev/null
+++ b/templates/sponsor.html
@@ -0,0 +1,108 @@
+{{template "base/header" .}}
+<style>
+    .sponsor {
+        position: relative;
+    }
+
+    .sponsor > .popup {
+        width: 280px;
+        background: #eee;
+        color: #fff;
+        box-shadow: 0 0 5px 0 #ccc;
+        border-radius: 5px;
+        line-height: 0;
+    }
+
+    .sponsor > .alipay {
+        background: #00a2ea;
+    }
+
+    .sponsor > .popup > .head {
+        text-align: center;
+        padding-top: 30px;
+    }
+
+    .sponsor .qrcode {
+        text-align: center;
+    }
+
+    .sponsor .qrcode img {
+        margin: 30px auto;
+        width: 80%;
+    }
+
+    .sponsor ul.platform {
+        padding: 0 !important;
+        margin: 0 !important;
+        text-align: center;
+        background: #FFF;
+        border-bottom-left-radius: 5px;
+        border-bottom-right-radius: 5px;
+    }
+
+    .sponsor ul.platform li {
+        display: inline-block;
+        cursor: pointer;
+        margin: 5px;
+        filter: grayscale(100%);
+    }
+
+    .sponsor ul.platform li.active {
+        font-weight: 600;
+        filter: grayscale(0%);
+    }
+
+    .sponsor ul.platform li.icon-alipay {
+        background: url(https://cdn.github.red/wp-content/plugins/you-shang/image/alipay.svg) no-repeat center center;
+        width: 24px;
+        height: 24px;
+        background-size: cover;
+    }
+</style>
+<div class="uk-card uk-card-default uk-card-body">
+  <div class="uk-child-width-expand@s" uk-grid>
+    <div>
+      <h2>给 NekoBox 打钱</h2>
+      <p>NekoBox 创立于 2020 年疫情初期，一开始是我疫情在家花了三天时间随手写得一个匿名留言箱。</p>
+      <p>目前 NekoBox 的服务器、CDN 开销还是我一个人承担，如果你也想为我分担一些，欢迎给 NekoBox 打钱！👏🏻</p>
+    </div>
+    <div>
+      <div class="sponsor">
+        <div class="alipay popup" style="">
+          <div class="head">谢谢老板 Thanks♪(･ω･)ﾉ</div>
+          <div class="qrcode">
+            <div class="qrcode-li alipay"><img
+                    src="https://cdn.github.red/wp-content/uploads/2021/02/alipay_qrcode.jpg">
+              <noscript><img src="https://cdn.github.red/wp-content/uploads/2021/02/alipay_qrcode.jpg"/></noscript>
+            </div>
+          </div>
+          <ul class="platform">
+            <li class="icon-alipay active" data-bg-color="#00a2ea" data-thanks="谢谢老板 Thanks♪(･ω･)ﾉ"></li>
+          </ul>
+        </div>
+      </div>
+    </div>
+  </div>
+  <div uk-alert class="uk-text-small">感谢以下小伙伴对 NekoBox 的支持！</div>
+  <table class="uk-table uk-table-small uk-table-divider">
+    <thead>
+    <tr>
+      <th>日期</th>
+      <th>附言</th>
+      <th>金额</th>
+    </tr>
+    </thead>
+    <tbody x-data="{ s: '' }" x-init="
+    s = await (async () => {
+      let html = '';
+      let items = (await(await fetch('https://pb.app.apicon.cn/api/collections/nekobox_sponsors/records?perPage=500&sort=-date')).json()).items;
+      items.forEach(item => {
+        html += `<tr class=uk-text-meta><td>${item.date.slice(0,10)}</td><td>${item.desc}</td><td>¥ ${item.price.toFixed(2)}</td></tr>`;
+      })
+      return html;
+    })()
+  " x-html="s">
+    </tbody>
+  </table>
+</div>
+{{template "base/footer" .}}
diff --git a/templates/templates_test.go b/templates/templates_test.go
new file mode 100644
index 0000000..5e83e39
--- /dev/null
+++ b/templates/templates_test.go
@@ -0,0 +1,85 @@
+// Copyright 2022 E99p1ant. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package templates
+
+import (
+	gotemplate "html/template"
+	"regexp"
+	"testing"
+
+	"github.com/flamego/template"
+
+	templatepkg "github.com/tamakyi/TamaBox/internal/template"
+)
+
+// TestTemplatesParse 复刻生产环境（internal/route/route.go 中
+// template.Templater + templatepkg.FuncMap()）的模板加载逻辑：
+// 逐个模板注册 FuncMap 并解析，任一文件解析失败即报错。
+func TestTemplatesParse(t *testing.T) {
+	fs, err := template.EmbedFS(FS, ".", []string{".html"})
+	if err != nil {
+		t.Fatalf("EmbedFS: %v", err)
+	}
+
+	tpl := gotemplate.New("Flamego.Template")
+	for _, f := range fs.Files() {
+		tt := tpl.New(f.Name())
+		for _, funcMap := range templatepkg.FuncMap() {
+			tt.Funcs(funcMap)
+		}
+
+		data, err := f.Data()
+		if err != nil {
+			t.Fatalf("get data of %q: %v", f.Name(), err)
+		}
+
+		if _, err := tt.Parse(string(data)); err != nil {
+			t.Errorf("parse %q: %v", f.Name(), err)
+		}
+	}
+}
+
+var (
+	// definePattern 匹配 {{define "x"}} / {{block "x" ...}}：定义模板。
+	definePattern = regexp.MustCompile(`\{\{\s*(?:define|block)\s+"([^"]+)"`)
+	// refPattern 匹配 {{template "x" ...}}：引用模板。
+	refPattern = regexp.MustCompile(`\{\{\s*template\s+"([^"]+)"`)
+)
+
+// TestTemplateCrossReferences 检查所有 {{template "x"}} 引用的目标模板
+// 是否真实存在（文件名或 define/block 定义），避免运行时 "no such template"。
+func TestTemplateCrossReferences(t *testing.T) {
+	fs, err := template.EmbedFS(FS, ".", []string{".html"})
+	if err != nil {
+		t.Fatalf("EmbedFS: %v", err)
+	}
+
+	// 集合 = 所有模板文件名 + 文件内 define/block 定义的名称
+	names := make(map[string]bool)
+	fileData := make(map[string][]byte)
+	for _, f := range fs.Files() {
+		names[f.Name()] = true
+		data, err := f.Data()
+		if err != nil {
+			t.Fatalf("get data of %q: %v", f.Name(), err)
+		}
+		fileData[f.Name()] = data
+	}
+
+	for _, data := range fileData {
+		for _, m := range definePattern.FindAllStringSubmatch(string(data), -1) {
+			names[m[1]] = true
+		}
+	}
+
+	// 检查所有引用是否落在集合内
+	for name, data := range fileData {
+		for _, m := range refPattern.FindAllStringSubmatch(string(data), -1) {
+			if !names[m[1]] {
+				t.Errorf("%s: 引用了未定义的模板 %q", name, m[1])
+			}
+		}
+	}
+}
diff --git a/templates/user/deactivate.html b/templates/user/deactivate.html
new file mode 100644
index 0000000..3e71042
--- /dev/null
+++ b/templates/user/deactivate.html
@@ -0,0 +1,17 @@
+{{template "base/header" .}}
+<form method="post" id="form">
+  <fieldset class="uk-fieldset">
+    {{ .CSRFTokenHTML }}
+    <legend class="uk-legend">{{t .LangCode "deactivate.title"}}</legend>
+    {{template "base/alert" .}}
+    <div class="uk-margin">
+      {{t .LangCode "deactivate.desc"}}
+      <br>
+      <br>
+      <button type="submit" class="uk-button uk-button-danger g-recaptcha" data-sitekey="{{.RecaptchaSiteKey}}"
+              data-callback="onSubmit">{{t .LangCode "deactivate.confirm"}}
+      </button>
+    </div>
+  </fieldset>
+</form>
+{{template "base/footer" .}}
diff --git a/templates/user/explore.html b/templates/user/explore.html
new file mode 100644
index 0000000..f50de58
--- /dev/null
+++ b/templates/user/explore.html
@@ -0,0 +1,621 @@
+{{template "base/header" .}}
+<style>
+  .truncate {
+    white-space: nowrap;
+    overflow: hidden;
+    text-overflow: ellipsis;
+  }
+  .line-clamp-2 {
+    display: -webkit-box;
+    -webkit-line-clamp: 2;
+    -webkit-box-orient: vertical;
+    overflow: hidden;
+    word-break: break-word;
+  }
+  .explore-avatar {
+    width: 60px;
+    height: 60px;
+    border-radius: 50%;
+    object-fit: cover;
+    margin-right: 15px;
+  }
+  .explore-info {
+    flex: 1;
+    min-width: 0;
+  }
+  .explore-name {
+    font-size: 1.2rem;
+    font-weight: bold;
+    margin-bottom: 5px;
+  }
+  .explore-name a {
+    text-decoration: none;
+    color: #333;
+  }
+  .explore-name a:hover {
+    color: #1e87f0;
+  }
+  .explore-intro {
+    color: #666;
+    margin-bottom: 10px;
+    font-size: 0.9rem;
+    display: -webkit-box;
+    -webkit-line-clamp: 2;
+    -webkit-box-orient: vertical;
+    overflow: hidden;
+    min-height: 2.6em;
+  }
+  .explore-tags {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 5px;
+  }
+  .explore-tags .uk-label {
+    max-width: 100%;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+  }
+  .recommend-card {
+    display: flex;
+    align-items: center;
+    padding: 10px;
+    background: #f8f8f8;
+    border-radius: 8px;
+    transition: background 0.2s;
+  }
+  .recommend-card:hover {
+    background: #f0f0f0;
+  }
+  .recommend-avatar {
+    width: 40px;
+    height: 40px;
+    border-radius: 50%;
+    margin-right: 10px;
+  }
+  .recommend-info {
+    flex: 1;
+    min-width: 0;
+  }
+  .recommend-name {
+    font-weight: bold;
+    font-size: 1rem;
+  }
+  .recommend-name a {
+    text-decoration: none;
+    color: #333;
+  }
+  .recommend-tags {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 3px;
+    margin-top: 3px;
+  }
+  .recommend-tags .uk-label {
+    font-size: 0.7rem;
+    padding: 0 5px;
+  }
+  .hot-votes-list {
+    display: grid;
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+    gap: 12px;
+    margin-top: 16px;
+  }
+  .hot-vote-item {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 16px;
+    min-width: 0;
+    padding: 16px 18px;
+    border: 1px solid #e5e5e5;
+    border-radius: 8px;
+    background: #fafafa;
+    text-decoration: none;
+    transition: border-color 0.2s ease, background 0.2s ease, transform 0.2s ease;
+  }
+  .hot-vote-item:hover {
+    border-color: #1e87f0;
+    background: #f5faff;
+    text-decoration: none;
+    transform: translateY(-1px);
+  }
+  .hot-vote-content {
+    min-width: 0;
+  }
+  .hot-vote-title {
+    display: block;
+    overflow: hidden;
+    color: #333;
+    font-size: 0.98rem;
+    font-weight: 600;
+    line-height: 1.45;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+  }
+  .hot-vote-meta {
+    display: flex;
+    flex-wrap: wrap;
+    align-items: center;
+    gap: 7px;
+    margin-top: 8px;
+  }
+  .hot-vote-meta .uk-label {
+    font-size: 0.72rem;
+    line-height: 1.6;
+  }
+  .hot-vote-action {
+    flex: 0 0 auto;
+    color: #1e87f0;
+    font-size: 0.82rem;
+    white-space: nowrap;
+  }
+  html[data-theme="dark"] .hot-vote-item {
+    border-color: var(--tb-border);
+    background: var(--tb-surface-2);
+  }
+  html[data-theme="dark"] .hot-vote-item:hover {
+    border-color: var(--tb-primary);
+    background: rgba(78, 168, 245, 0.10);
+  }
+  html[data-theme="dark"] .hot-vote-title {
+    color: var(--tb-text);
+  }
+  @media (max-width: 640px) {
+    .hot-votes-list {
+      grid-template-columns: 1fr;
+    }
+    .hot-vote-item {
+      padding: 14px;
+    }
+  }
+  .explore-tabs {
+    display: flex;
+    justify-content: center;
+    gap: 4px;
+    padding: 4px;
+    margin: 2px auto 20px;
+    max-width: 320px;
+    border: 1px solid #e5e5e5;
+    border-radius: 9px;
+    background: #fafafa;
+  }
+  .explore-tab {
+    border: 0;
+    border-radius: 6px;
+    padding: 8px 15px;
+    background: transparent;
+    color: #666;
+    cursor: pointer;
+    font-size: 0.9rem;
+    transition: background 0.2s ease, color 0.2s ease;
+  }
+  .explore-tab:hover { color: #1e87f0; }
+  .explore-tab.is-active {
+    background: #fff;
+    box-shadow: 0 1px 3px rgba(0, 0, 0, 0.10);
+    color: #1e87f0;
+    font-weight: 600;
+  }
+  .explore-panel[hidden] { display: none !important; }
+  .explore-vote-toolbar {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 12px;
+    margin-bottom: 16px;
+  }
+  .explore-vote-toolbar p { margin: 4px 0 0; }
+  .vote-random-btn {
+    flex: 0 0 auto;
+    border: 1px solid #dce9ff;
+    border-radius: 7px;
+    padding: 7px 11px;
+    color: #1e87f0;
+    background: #f5faff;
+    cursor: pointer;
+    font-size: 0.84rem;
+  }
+  .vote-random-btn:hover { border-color: #1e87f0; background: #edf6ff; }
+  .all-votes-list { display: grid; gap: 10px; }
+  .all-vote-item {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 16px;
+    padding: 14px 16px;
+    border-bottom: 1px solid #e9e9e9;
+    text-decoration: none;
+  }
+  .all-vote-item:first-child { border-top: 1px solid #e9e9e9; }
+  .all-vote-item:hover { background: #f8fbff; text-decoration: none; }
+  .all-vote-item .hot-vote-title { max-width: 100%; }
+  html[data-theme="dark"] .explore-tabs {
+    border-color: var(--tb-border);
+    background: var(--tb-surface-2);
+  }
+  html[data-theme="dark"] .explore-tab { color: var(--tb-text-muted); }
+  html[data-theme="dark"] .explore-tab.is-active { background: var(--tb-surface); color: var(--tb-primary); }
+  html[data-theme="dark"] .vote-random-btn { border-color: var(--tb-border); background: var(--tb-surface-2); color: var(--tb-primary); }
+  html[data-theme="dark"] .all-vote-item { border-color: var(--tb-border); }
+  html[data-theme="dark"] .all-vote-item:hover { background: rgba(78, 168, 245, 0.10); }
+  .explore-notice {
+    background: #f0f7ff;
+    border-left: 4px solid #1e87f0;
+    padding: 15px 20px;
+    margin-bottom: 20px;
+    border-radius: 4px;
+    color: #333;
+    font-size: 0.9rem;
+    line-height: 1.6;
+  }
+  .explore-notice strong {
+    color: #1e87f0;
+  }
+  /* 极简「换一批」按钮：描边胶囊 + 悬停浅蓝底色 + 点击旋转反馈 */
+  .tb-shuffle-btn {
+    display: inline-flex;
+    align-items: center;
+    gap: 6px;
+    padding: 5px 14px;
+    font-size: 0.85rem;
+    line-height: 1.4;
+    color: #1e87f0;
+    background: transparent;
+    border: 1px solid #e3e3e3;
+    border-radius: 999px;
+    cursor: pointer;
+    transition: background 0.2s ease, border-color 0.2s ease, color 0.2s ease;
+  }
+  .tb-shuffle-btn:hover {
+    background: #f0f7ff;
+    border-color: #1e87f0;
+  }
+  .tb-shuffle-btn:active {
+    transform: scale(0.96);
+  }
+  .tb-shuffle-btn .uk-icon {
+    transition: transform 0.5s ease;
+  }
+  .tb-shuffle-btn.is-spinning .uk-icon {
+    transform: rotate(360deg);
+  }
+  html[data-theme="dark"] .tb-shuffle-btn {
+    color: #4ea8f5;
+    border-color: #3a3f45;
+  }
+  html[data-theme="dark"] .tb-shuffle-btn:hover {
+    background: rgba(78, 168, 245, 0.12);
+    border-color: #4ea8f5;
+  }
+</style>
+
+<div class="uk-container uk-container-small">
+  <h2>{{t .LangCode "explore.title"}}</h2>
+
+  <div class="explore-notice">
+    <p>{{t .LangCode "explore.notice" | safe}}</p>
+  </div>
+
+  <div class="explore-tabs" role="tablist" aria-label="{{t .LangCode "explore.title"}}">
+    <button type="button" class="explore-tab is-active" data-explore-tab="questions" role="tab" aria-selected="true">{{t .LangCode "explore.questionsTab"}}</button>
+    <button type="button" class="explore-tab" data-explore-tab="votes" role="tab" aria-selected="false">{{t .LangCode "explore.votesTab"}}</button>
+  </div>
+
+  <div class="explore-panel" data-explore-panel="questions">
+  <div class="uk-card uk-card-default uk-card-body uk-margin-bottom">
+    <div class="uk-flex uk-flex-between uk-flex-middle">
+      <h3 class="uk-card-title uk-margin-remove">{{t .LangCode "explore.recommend"}}</h3>
+      <button class="tb-shuffle-btn" id="refresh-recommend" type="button">
+        <span uk-icon="icon: refresh"></span> {{t .LangCode "explore.shuffle"}}
+      </button>
+    </div>
+    <div id="recommend-list" class="uk-grid-small uk-child-width-1-2@s uk-child-width-1-3@m uk-grid-match" uk-grid>
+      {{if .RecommendUsers}}
+      {{range $user := .RecommendUsers}}
+      <div>
+        <a href="/_/{{$user.Domain}}" class="recommend-card">
+          <img class="recommend-avatar" src="{{$user.Avatar}}" alt="avatar">
+          <div class="recommend-info">
+            <div class="recommend-name truncate">{{$user.Name}}</div>
+            <div class="recommend-tags">
+              {{if $user.TagList}}
+                {{range $index, $tag := $user.TagList}}
+                <span class="uk-label {{index $user.TagColors $index}}">{{$tag}}</span>
+                {{end}}
+              {{else}}
+                <span class="uk-text-muted">{{t $.LangCode "explore.noTags"}}</span>
+              {{end}}
+            </div>
+          </div>
+        </a>
+      </div>
+      {{end}}
+      {{else}}
+      <div class="uk-text-center uk-padding">{{t .LangCode "explore.noRecommend"}}</div>
+      {{end}}
+    </div>
+  </div>
+
+  <!-- 热门标签榜 -->
+  {{if .HotTags}}
+  <div class="uk-card uk-card-default uk-card-body uk-margin-bottom">
+    <h4 class="uk-card-title uk-margin-remove-bottom">{{t .LangCode "explore.hotTags"}}</h4>
+    <div class="uk-margin-small-top uk-flex uk-flex-wrap uk-flex-middle" style="gap: 6px;">
+      {{range $i, $tag := .HotTags}}
+      <a class="uk-label {{if eq (mod $i 5) 0}}uk-label-success{{else if eq (mod $i 5) 1}}uk-label-warning{{else if eq (mod $i 5) 2}}uk-label-danger{{else if eq (mod $i 5) 3}}uk-label-primary{{else}}uk-label-secondary{{end}}"
+         href="/explore?q={{urlquery $tag}}" style="text-decoration:none;">#{{$tag}}</a>
+      {{end}}
+    </div>
+  </div>
+  {{end}}
+
+  <form method="get" action="/explore" class="uk-margin uk-margin-bottom">
+    <div class="uk-grid-small" uk-grid>
+      <div class="uk-width-expand">
+        <div class="uk-inline uk-width-1-1">
+          <button class="uk-form-icon uk-form-icon-flip" uk-icon="icon: search" type="submit"></button>
+          <input class="uk-input" type="text" name="q" placeholder="{{t .LangCode "explore.search"}}" value="{{.Keyword}}">
+        </div>
+      </div>
+      <div class="uk-width-auto">
+        <select name="sort" class="uk-select" onchange="this.form.submit()">
+          <option value="latest" {{if eq .Sort "latest"}}selected{{end}}>{{t .LangCode "explore.sortLatest"}}</option>
+          <option value="oldest" {{if eq .Sort "oldest"}}selected{{end}}>{{t .LangCode "explore.sortOldest"}}</option>
+        </select>
+      </div>
+    </div>
+  </form>
+
+  {{if .Users}}
+  <div class="uk-child-width-1-1 uk-child-width-1-2@s uk-grid-match" uk-grid>
+    {{range .Users}}
+    {{$user := .}}
+    <div>
+      <div class="uk-card uk-card-default uk-card-hover uk-card-body">
+        <div class="uk-flex uk-flex-top">
+          <div>
+            <img class="explore-avatar" src="{{$user.Avatar}}" alt="avatar">
+          </div>
+          <div class="explore-info">
+            <div class="explore-name truncate">
+              <a href="/_/{{$user.Domain}}" title="{{$user.Name}}">{{$user.Name}}</a>
+            </div>
+            <div class="explore-intro" title="{{$user.Intro}}">
+              {{if $user.Intro}}{{$user.Intro}}{{else}}{{t $.LangCode "explore.lazy"}}{{end}}
+            </div>
+            <div class="explore-tags">
+              {{if $user.TagList}}
+                {{range $index, $tag := $user.TagList}}
+                  <span class="uk-label {{index $user.TagColors $index}}" title="{{$tag}}">{{$tag}}</span>
+                {{end}}
+              {{else}}
+                <span class="uk-text-muted">{{t $.LangCode "explore.noTags"}}</span>
+              {{end}}
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+    {{end}}
+  </div>
+
+  <ul class="uk-pagination uk-flex-center uk-margin-top" uk-margin>
+    {{if gt .Page 1}}
+    <li><a href="?{{if .Keyword}}q={{.Keyword}}&{{end}}sort={{.Sort}}&page={{.PrevPage}}"><span uk-pagination-previous></span> {{t .LangCode "explore.prevPage"}}</a></li>
+    {{else}}
+    <li class="uk-disabled"><span><span uk-pagination-previous></span> {{t .LangCode "explore.prevPage"}}</span></li>
+    {{end}}
+    <li class="uk-active"><span>{{.Page}} / {{.TotalPages}}</span></li>
+    {{if lt .Page .TotalPages}}
+    <li><a href="?{{if .Keyword}}q={{.Keyword}}&{{end}}sort={{.Sort}}&page={{.NextPage}}">{{t .LangCode "explore.nextPage"}} <span uk-pagination-next></span></a></li>
+    {{else}}
+    <li class="uk-disabled"><span>{{t .LangCode "explore.nextPage"}} <span uk-pagination-next></span></span></li>
+    {{end}}
+  </ul>
+  {{else}}
+  <div class="uk-alert uk-alert-warning">{{t .LangCode "explore.noResult"}}</div>
+  {{end}}
+  </div>
+
+  <div class="explore-panel" data-explore-panel="votes" hidden>
+    <div class="uk-card uk-card-default uk-card-body uk-margin-bottom">
+      <div class="explore-vote-toolbar">
+        <div>
+          <h3 class="uk-card-title uk-margin-remove">{{t .LangCode "explore.votesTitle"}}</h3>
+          <p class="uk-text-meta uk-text-small">{{t .LangCode "explore.votesDesc"}}</p>
+        </div>
+        <button type="button" class="vote-random-btn" id="random-vote-btn"><span uk-icon="icon: refresh; ratio: .8"></span> {{t .LangCode "explore.randomVote"}}</button>
+      </div>
+
+      {{if .HotVotes}}
+      <h4 class="uk-heading-bullet uk-margin-small-bottom">{{t .LangCode "explore.hotVotes"}}</h4>
+      <div class="hot-votes-list uk-margin-small-bottom">
+        {{range $vote := .HotVotes}}
+        <a href="/vote/{{$vote.LinkToken}}" class="hot-vote-item">
+          <div class="hot-vote-content">
+            <span class="hot-vote-title" title="{{$vote.Title}}">{{$vote.Title}}</span>
+            <span class="hot-vote-meta">
+              {{if eq $vote.Type "single"}}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeSingle"}}</span>{{end}}
+              {{if eq $vote.Type "multiple"}}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeMultiple"}}</span>{{end}}
+              {{if eq $vote.Type "rating"}}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeRating"}}</span>{{end}}
+              {{if eq $vote.Type "rank"}}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeRank"}}</span>{{end}}
+              {{if eq $vote.Type "form"}}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeForm"}}</span>{{end}}
+            </span>
+          </div>
+          <span class="hot-vote-action">{{t $.LangCode "vote.page.goVote"}} <span uk-icon="icon: arrow-right; ratio: .8"></span></span>
+        </a>
+        {{end}}
+      </div>
+      {{end}}
+
+      <h4 class="uk-heading-bullet uk-margin-medium-top uk-margin-small-bottom">{{t .LangCode "explore.allVotes"}}</h4>
+      {{if .AllVotes}}
+      <div class="all-votes-list" id="all-votes-list">
+        {{range $vote := .AllVotes}}
+        <a href="/vote/{{$vote.LinkToken}}" class="all-vote-item">
+          <div class="hot-vote-content">
+            <span class="hot-vote-title" title="{{$vote.Title}}">{{$vote.Title}}</span>
+            <span class="hot-vote-meta">
+              {{if eq $vote.Type "single"}}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeSingle"}}</span>{{end}}
+              {{if eq $vote.Type "multiple"}}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeMultiple"}}</span>{{end}}
+              {{if eq $vote.Type "rating"}}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeRating"}}</span>{{end}}
+              {{if eq $vote.Type "rank"}}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeRank"}}</span>{{end}}
+              {{if eq $vote.Type "form"}}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeForm"}}</span>{{end}}
+              <span class="uk-text-meta">{{$vote.CreatedAt.Format "2006-01-02"}}</span>
+            </span>
+          </div>
+          <span class="hot-vote-action">{{t $.LangCode "vote.page.goVote"}} <span uk-icon="icon: arrow-right; ratio: .8"></span></span>
+        </a>
+        {{end}}
+      </div>
+      {{else}}
+      <div class="uk-alert uk-alert-primary uk-margin-remove">{{t .LangCode "explore.noVotes"}}</div>
+      {{end}}
+    </div>
+  </div>
+</div>
+
+<script>
+document.addEventListener('DOMContentLoaded', function() {
+  const recommendContainer = document.getElementById('recommend-list');
+  const refreshBtn = document.getElementById('refresh-recommend');
+  const tabs = document.querySelectorAll('[data-explore-tab]');
+  const panels = document.querySelectorAll('[data-explore-panel]');
+
+  function showExplorePanel(name) {
+    tabs.forEach(function(tab) {
+      const active = tab.dataset.exploreTab === name;
+      tab.classList.toggle('is-active', active);
+      tab.setAttribute('aria-selected', active ? 'true' : 'false');
+    });
+    panels.forEach(function(panel) {
+      panel.hidden = panel.dataset.explorePanel !== name;
+    });
+    if (window.history && window.history.replaceState) {
+      window.history.replaceState({}, document.title, window.location.pathname + (name === 'votes' ? '#votes' : ''));
+    }
+  }
+
+  tabs.forEach(function(tab) {
+    tab.addEventListener('click', function() { showExplorePanel(tab.dataset.exploreTab); });
+  });
+  if (window.location.hash === '#votes') showExplorePanel('votes');
+
+  const randomVoteBtn = document.getElementById('random-vote-btn');
+  if (randomVoteBtn) {
+    randomVoteBtn.addEventListener('click', function() {
+      const votes = Array.from(document.querySelectorAll('#all-votes-list .all-vote-item'));
+      if (!votes.length) return;
+      const target = votes[Math.floor(Math.random() * votes.length)];
+      randomVoteBtn.classList.add('is-spinning');
+      target.style.outline = '2px solid #1e87f0';
+      target.style.outlineOffset = '2px';
+      window.setTimeout(function() {
+        window.location.href = target.href;
+      }, 350);
+    });
+  }
+
+  // 递归提取用户数组，无视包裹层数
+  function extractUsers(obj) {
+    if (Array.isArray(obj)) return obj;
+    if (!obj || typeof obj !== 'object') return [];
+    // 单个用户对象
+    if (obj.domain || obj.id) {
+      return [obj];
+    }
+    // 尝试从 data 中递归
+    if (obj.data) {
+      return extractUsers(obj.data);
+    }
+    // 遍历所有值
+    for (const key in obj) {
+      if (obj.hasOwnProperty(key)) {
+        const val = obj[key];
+        if (Array.isArray(val)) {
+          return val;
+        } else if (val && typeof val === 'object') {
+          const result = extractUsers(val);
+          if (result.length > 0) return result;
+        }
+      }
+    }
+    return [];
+  }
+
+  function escapeHTML(str) {
+    if (str == null) return '';
+    return String(str)
+      .replace(/&/g, '&amp;')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;')
+      .replace(/"/g, '&quot;')
+      .replace(/'/g, '&#39;');
+  }
+
+  // 仅允许 http(s) 头像地址，阻断 javascript: 等伪协议。
+  function safeAvatarURL(url) {
+    if (typeof url !== 'string') return '';
+    if (/^https?:\/\//i.test(url)) return url;
+    return '';
+  }
+
+  function loadRandomRecommend() {
+    recommendContainer.innerHTML = '<div class="uk-text-center uk-padding"><div uk-spinner></div> {{t .LangCode "explore.loading"}}</div>';
+    fetch('/api/v1/explore/random')
+      .then(response => {
+        if (!response.ok) throw new Error(`HTTP {{t .LangCode "explore.loadFailed"}} ${response.status}`);
+        return response.json();
+      })
+      .then(resp => {
+        const users = extractUsers(resp);
+        if (users.length === 0) {
+          recommendContainer.innerHTML = '<div class="uk-text-center uk-padding">{{t .LangCode "explore.noRecommend"}}</div>';
+          return;
+        }
+        let html = '';
+        users.forEach(user => {
+          let tagsHtml = '';
+          if (user.tag_list && user.tag_list.length) {
+            user.tag_list.forEach((tag, idx) => {
+              const colorClass = (user.tag_color && user.tag_color[idx]) || 'uk-label-default';
+              tagsHtml += `<span class="uk-label ${escapeHTML(colorClass)}" title="${escapeHTML(tag)}">${escapeHTML(tag)}</span>`;
+            });
+          } else {
+            tagsHtml = '<span class="uk-text-muted">{{t .LangCode "explore.noTags"}}</span>';
+          }
+          html += `
+            <div>
+              <a href="/_/${escapeHTML(user.domain)}" class="recommend-card">
+                <img class="recommend-avatar" src="${safeAvatarURL(user.avatar)}" alt="avatar">
+                <div class="recommend-info">
+                  <div class="recommend-name truncate">${escapeHTML(user.name)}</div>
+                  <div class="recommend-tags">${tagsHtml}</div>
+                </div>
+              </a>
+            </div>
+          `;
+        });
+        recommendContainer.innerHTML = html;
+        if (window.UIkit && UIkit.grid) {
+          UIkit.grid(recommendContainer);
+        }
+      })
+      .catch(error => {
+        console.error('Failed to load random recommends:', error);
+        recommendContainer.innerHTML = '<div class="uk-alert uk-alert-danger">加载失败：' + escapeHTML(error.message) + '</div>';
+      });
+  }
+
+  // 初始推荐已由服务端渲染，只有"换一批"按钮触发 AJAX
+  refreshBtn.addEventListener('click', function() {
+    // 重启旋转动画（先移再触发 reflow 再加，确保每次点击都播放）
+    refreshBtn.classList.remove('is-spinning');
+    void refreshBtn.offsetWidth;
+    refreshBtn.classList.add('is-spinning');
+    loadRandomRecommend();
+  });
+});
+</script>
+{{template "base/footer" .}}
diff --git a/templates/user/feature-control-form.html b/templates/user/feature-control-form.html
new file mode 100644
index 0000000..0345d3a
--- /dev/null
+++ b/templates/user/feature-control-form.html
@@ -0,0 +1,135 @@
+<!--
+  功能控制表单部分模板：提问 / 私聊 / 投票 三个功能面板共用。
+  渲染时「点」为单个功能视图（Key / Control / State / Mode / CSRFTokenHTML ...），
+  因此所有文案与令牌都可自取，无需访问根数据。
+
+  收集模式（mode）三选一，保存时互斥、后端同步清理未选模式的字段：
+    - always    长期开放：不限时间，保持开放直到手动关闭（仍受收集上限约束）；
+    - window    定时收集：一次性开放 / 关闭时间窗口；
+    - recurring 循环定时：每周固定开放日 + 每日时间段循环。
+  私聊（chat）不提供收集上限：配额字段与重置计数按钮按 Key 条件隐藏，后端强制清零。
+  「保存」与「重置计数」同行：重置按钮通过 HTML5 form 属性指向独立的 reset 表单。
+-->
+<div class="feat-card">
+  <div class="feat-card-head">
+    <h3 class="uk-margin-remove">{{ .NameText }}</h3>
+    <span class="feat-status {{ if .State.Open }}is-open{{ else }}is-closed{{ end }}">{{ .StatusText }}</span>
+  </div>
+  <span class="feat-hint">{{t .LangCode (print "admin.featureHint." .Key)}}</span>
+
+  <form method="post" action="/user/profile/features/update">
+    {{ .CSRFTokenHTML }}
+    <input type="hidden" name="feature" value="{{ .Key }}">
+    <div class="uk-margin-small">
+      <label>
+        <input name="enabled" class="uk-checkbox" type="checkbox" {{ if .Control.Enabled }}checked{{ end }}>
+        <span class="uk-text-small">{{t .LangCode "admin.featureEnabled"}}</span>
+      </label>
+    </div>
+    <div class="uk-margin-small feat-field">
+      <span class="feat-field-label">{{t .LangCode "admin.featureMode"}}</span>
+      <div class="feat-modes">
+        <label class="feat-day{{ if eq .Mode "always" }} is-on{{ end }}">
+          <input name="mode" type="radio" value="always" {{ if eq .Mode "always" }}checked{{ end }}>
+          <span>{{t .LangCode "admin.featureModeAlways"}}</span>
+        </label>
+        <label class="feat-day{{ if eq .Mode "window" }} is-on{{ end }}">
+          <input name="mode" type="radio" value="window" {{ if eq .Mode "window" }}checked{{ end }}>
+          <span>{{t .LangCode "admin.featureModeWindow"}}</span>
+        </label>
+        <label class="feat-day{{ if eq .Mode "recurring" }} is-on{{ end }}">
+          <input name="mode" type="radio" value="recurring" {{ if eq .Mode "recurring" }}checked{{ end }}>
+          <span>{{t .LangCode "admin.featureModeRecurring"}}</span>
+        </label>
+      </div>
+      <span class="feat-hint">{{t .LangCode "admin.featureModeHint"}}</span>
+    </div>
+    <div class="uk-margin-small feat-field feat-window-fields">
+      <label>
+        <span>{{t .LangCode "admin.featureOpenAt"}}</span>
+        <input name="open_at" class="uk-input" type="datetime-local" value="{{ .OpenAtStr }}">
+      </label>
+      <label>
+        <span>{{t .LangCode "admin.featureCloseAt"}}</span>
+        <input name="close_at" class="uk-input" type="datetime-local" value="{{ .CloseAtStr }}">
+      </label>
+      <span class="feat-hint">{{t .LangCode "admin.featureTimeHint"}}</span>
+    </div>
+    <div class="uk-margin-small feat-field feat-recurring-fields">
+      <label>
+        <span>{{t .LangCode "admin.featureSchedule"}}</span>
+      </label>
+      <div class="feat-schedule">
+        <div class="feat-schedule-days">
+          {{ range $i := loop 7 }}
+          <label class="feat-day{{ if hasDay $.ScheduleDays (sub $i 1) }} is-on{{ end }}">
+            <input name="schedule_days" class="uk-checkbox" type="checkbox" value="{{ sub $i 1 }}" {{ if hasDay $.ScheduleDays (sub $i 1) }}checked{{ end }}>
+            <span>{{t $.LangCode (printf "weekday.%d" (sub $i 1))}}</span>
+          </label>
+          {{ end }}
+        </div>
+        <div class="feat-schedule-times">
+          <label>
+            <span>{{t .LangCode "admin.featureScheduleStart"}}</span>
+            <input name="schedule_start" class="uk-input" type="time" value="{{ .ScheduleStart }}">
+          </label>
+          <label>
+            <span>{{t .LangCode "admin.featureScheduleEnd"}}</span>
+            <input name="schedule_end" class="uk-input" type="time" value="{{ .ScheduleEnd }}">
+          </label>
+        </div>
+        <span class="feat-hint">{{t .LangCode "admin.featureScheduleHint"}}</span>
+      </div>
+    </div>
+    {{ if ne .Key "chat" }}
+    <div class="uk-margin-small feat-field">
+      <label>
+        <span>{{t .LangCode "admin.featureQuotaLimit"}}</span>
+        <input name="quota_limit" class="uk-input" type="number" min="0" max="1000000" value="{{ .Control.QuotaLimit }}">
+      </label>
+      <span class="feat-hint">{{t .LangCode "admin.featureQuotaHint"}}</span>
+    </div>
+    <div class="feat-quota-line">
+      {{t .LangCode "admin.featureQuotaCount"}}：{{ .State.QuotaCount }}
+      {{ if .Control.QuotaLimit }}/ {{ .Control.QuotaLimit }}{{ else }}<span class="uk-text-muted">（{{t .LangCode "admin.featureQuotaUnlimited"}}）</span>{{ end }}
+      {{ if .Control.QuotaResetAt }}<br>{{t .LangCode "admin.featureQuotaResetAt"}} {{ .QuotaResetAtStr }}{{ end }}
+    </div>
+    {{ end }}
+    <div class="feat-actions">
+      {{ if ne .Key "chat" }}
+      <button type="submit" class="uk-button uk-button-default" form="feat-reset-{{ .Key }}">{{t .LangCode "admin.featureResetQuota"}}</button>
+      {{ end }}
+      <button type="submit" class="uk-button uk-button-primary">{{t .LangCode "admin.featureSave"}}</button>
+    </div>
+  </form>
+
+  {{ if ne .Key "chat" }}
+  <form id="feat-reset-{{ .Key }}" method="post" action="/user/profile/features/reset-quota">
+    {{ .CSRFTokenHTML }}
+    <input type="hidden" name="feature" value="{{ .Key }}">
+  </form>
+  {{ end }}
+
+  <script>
+  (function () {
+    var card = document.currentScript && document.currentScript.closest('.feat-card');
+    if (!card) return;
+    var radios = card.querySelectorAll('input[name="mode"]');
+    var windowFields = card.querySelector('.feat-window-fields');
+    var recurringFields = card.querySelector('.feat-recurring-fields');
+    if (!radios.length) return;
+    function sync() {
+      var mode = '';
+      radios.forEach(function (r) {
+        var pill = r.closest('.feat-day');
+        if (pill) pill.classList.toggle('is-on', r.checked);
+        if (r.checked) mode = r.value;
+      });
+      if (windowFields) windowFields.classList.toggle('is-hidden', mode !== 'window');
+      if (recurringFields) recurringFields.classList.toggle('is-hidden', mode !== 'recurring');
+    }
+    radios.forEach(function (r) { r.addEventListener('change', sync); });
+    sync();
+  })();
+  </script>
+</div>
diff --git a/templates/user/global-blockwords.html b/templates/user/global-blockwords.html
new file mode 100644
index 0000000..a59668e
--- /dev/null
+++ b/templates/user/global-blockwords.html
@@ -0,0 +1,29 @@
+<!--
+  全局屏蔽词表单部分模板：提问 / 私聊 / 投票 三个功能面板共用同一份词表设置。
+  渲染时「点」为 dict{ Root: 根数据, Action: 表单提交地址 }：
+    Root   —— profile 页面根数据（LoggedUser / TagLimits / LangCode / CSRFTokenHTML …）；
+    Action —— 表单 action，携带 ?tab= 来源面板参数，保存后回跳原面板。
+  三处展示同一份数据（users.block_words），任意一处修改保存后全部同步生效；
+  词表按 conf.Limits.MaxBlockWords / MaxBlockWordLen 上限校验（后端同一份配置）。
+-->
+{{ $root := .Root }}
+<div class="uk-margin">
+  <form method="post" action="{{ .Action }}">
+    {{ $root.CSRFTokenHTML }}
+    <legend class="uk-legend">{{t $root.LangCode "admin.globalBlockWords"}}</legend>
+    <div class="uk-margin">
+      <p class="uk-text-meta uk-text-small">{{t $root.LangCode "admin.globalBlockWordsHint"}}</p>
+      <label class="uk-form-label">{{t $root.LangCode "admin.blockWords" | safe}}</label>
+      <input name="block_words" class="uk-input" type="text" value="{{$root.LoggedUser.BlockWords}}"
+             data-tb-tag-input
+             {{ with $root.TagLimits }}data-tb-max="{{ .MaxBlockWords }}" data-tb-max-len="{{ .MaxBlockWordLen }}"{{ end }}
+             data-tb-msg-too-many="{{t $root.LangCode "admin.flash.blockWordsTooMany"}}"
+             data-tb-msg-too-long="{{t $root.LangCode "admin.flash.blockWordTooLong"}}"
+             data-tb-msg-duplicate="{{t $root.LangCode "admin.tagInputDuplicate"}}"
+             data-tb-msg-hint="{{t $root.LangCode "admin.tagInputHint"}}">
+    </div>
+    <div class="tb-card-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t $root.LangCode "admin.updateBlockWords"}}</button>
+    </div>
+  </form>
+</div>
diff --git a/templates/user/profile.html b/templates/user/profile.html
new file mode 100644
index 0000000..739e561
--- /dev/null
+++ b/templates/user/profile.html
@@ -0,0 +1,1528 @@
+{{template "base/header" .}}
+
+<!-- 二维码预览依赖 jQuery（同步加载，保证下方 easy.qrcode 初始化就绪）；jQuery 统一使用 3.7.1 -->
+<script src="https://cdnjs.snrat.com/ajax/libs/jquery/3.7.1/jquery.min.js"></script>
+<script src='https://r2.337845818.best/tamabox/cdn/js/remake/easy.qrcode.min.js' type="text/javascript" charset="utf-8"></script>
+
+<!-- Pickr 颜色选择器 -->
+<link rel="stylesheet" href="https://r2.337845818.best/tamabox/cdn/lib/pickr/1.10.1/nano.min.css"/>
+<script src="https://r2.337845818.best/tamabox/cdn/lib/pickr/1.10.1/pickr.min.js"></script>
+
+<!-- Cropper.js 头像/背景裁剪（迁 cdnjs.snrat.com，sha256 与官方一致；R2 原存非 min 版，snrat 为 min 版语义等价） -->
+<link rel="stylesheet" href="https://cdnjs.snrat.com/ajax/libs/cropperjs/1.6.2/cropper.min.css"/>
+<script src="https://cdnjs.snrat.com/ajax/libs/cropperjs/1.6.2/cropper.min.js"></script>
+
+<style>
+  .range-input-group {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+  }
+  .range-input-group input[type="range"] {
+    flex: 1;
+  }
+  .range-input-group input[type="number"] {
+    width: 70px;
+  }
+  .range-input-group .range-value {
+    min-width: 40px;
+    text-align: right;
+  }
+  .color-picker {
+    display: inline-block;
+    vertical-align: middle;
+  }
+  .preview-card {
+    background: #fff;
+    padding: 20px;
+    border: 1px solid #e5e5e5;
+    border-radius: 8px;
+    text-align: center;
+  }
+  .preview-card .qrcode-wrapper {
+    width: 100%;
+    max-width: 220px;
+    margin: 0 auto;
+  }
+  .theme-btn {
+    margin: 2px;
+    font-size: 0.8rem;
+  }
+  .social-item {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    flex-wrap: wrap;
+  }
+  .social-item label.checkbox-label {
+    margin: 0;
+    white-space: nowrap;
+  }
+  .social-item input[type="text"] {
+    flex: 1;
+  }
+  .social-item input[type="text"]:invalid {
+    border-color: #f0506e;
+  }
+  @media (max-width: 640px) {
+    .preview-card {
+      margin-top: 20px;
+    }
+  }
+
+  /* 面板切换：与提问箱主页一致的胶囊样式（用户设置 / 提问 / 私聊 / 投票） */
+  .profile-tabs {
+    display: flex;
+    gap: 4px;
+    padding: 4px;
+    margin-bottom: 18px;
+    border: 1px solid var(--tb-border, #e5e5e5);
+    border-radius: 9px;
+    background: var(--tb-surface-2, #fafafa);
+  }
+  .profile-tab {
+    flex: 1;
+    border: 0;
+    border-radius: 6px;
+    padding: 9px 8px;
+    background: transparent;
+    color: var(--tb-text-muted, #666);
+    cursor: pointer;
+    font-size: 0.9rem;
+    white-space: nowrap;
+    transition: background 0.2s ease, color 0.2s ease;
+  }
+  .profile-tab:hover { color: var(--tb-primary, #1e87f0); }
+  .profile-tab.is-active {
+    background: var(--tb-surface, #fff);
+    box-shadow: 0 1px 3px rgba(0, 0, 0, 0.10);
+    color: var(--tb-primary, #1e87f0);
+    font-weight: 600;
+  }
+  .profile-panel[hidden] { display: none !important; }
+  html[data-theme="dark"] .profile-tabs {
+    border-color: var(--tb-border);
+    background: var(--tb-surface-2);
+  }
+  html[data-theme="dark"] .profile-tab { color: var(--tb-text-muted); }
+  html[data-theme="dark"] .profile-tab.is-active { background: var(--tb-surface); color: var(--tb-primary); }
+
+  /* 功能控制卡片（部分模板 user/feature-control-form 使用） */
+  .feat-card {
+    display: flex;
+    flex-direction: column;
+    gap: 12px;
+    padding: 16px;
+    border: 1px solid #e5e5e5;
+    border-radius: 8px;
+    background: #fff;
+  }
+  .feat-card-head {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 8px;
+  }
+  .feat-card-head h3 { font-size: 1.05rem; }
+  .feat-status {
+    flex: 0 0 auto;
+    font-size: 0.72rem;
+    line-height: 1.6;
+    padding: 0 8px;
+    border-radius: 2px;
+  }
+  .feat-status.is-open { background: #32d296; color: #fff; }
+  .feat-status.is-closed { background: #f0506e; color: #fff; }
+  .feat-hint {
+    display: block;
+    font-size: 0.78rem;
+    line-height: 1.5;
+    color: #999;
+  }
+  .feat-field { display: block; }
+  .feat-field > label > span {
+    display: block;
+    margin-bottom: 4px;
+    font-size: 0.875rem;
+  }
+  .feat-field-label {
+    display: block;
+    margin-bottom: 4px;
+    font-size: 0.875rem;
+  }
+  /* 收集模式三选一（长期开放 / 定时收集 / 循环定时），胶囊样式复用 .feat-day */
+  .feat-modes {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 6px;
+    margin-bottom: 4px;
+  }
+  .is-hidden { display: none !important; }
+  .feat-field input[type="datetime-local"],
+  .feat-field input[type="number"] { width: 100%; }
+  /* 循环定时（每周开放日 + 每日时间段） */
+  .feat-schedule { display: flex; flex-direction: column; gap: 8px; }
+  .feat-schedule-days {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 6px;
+  }
+  .feat-day {
+    display: inline-flex;
+    align-items: center;
+    gap: 3px;
+    padding: 3px 8px;
+    border: 1px solid #e5e5e5;
+    border-radius: 999px;
+    font-size: 0.78rem;
+    color: #666;
+    cursor: pointer;
+    user-select: none;
+  }
+  .feat-day input { margin: 0; }
+  .feat-day.is-on {
+    border-color: #1e87f0;
+    background: rgba(30, 135, 240, 0.08);
+    color: #1e87f0;
+  }
+  .feat-schedule-times {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 12px;
+  }
+  .feat-schedule-times label {
+    display: flex;
+    align-items: center;
+    gap: 6px;
+    font-size: 0.82rem;
+    color: #666;
+  }
+  .feat-schedule-times input[type="time"] {
+    width: 130px;
+    padding: 4px 8px;
+    border: 1px solid #e5e5e5;
+    border-radius: 4px;
+  }
+  html[data-theme="dark"] .feat-day {
+    border-color: var(--tb-border);
+    color: var(--tb-text-muted);
+  }
+  html[data-theme="dark"] .feat-day.is-on {
+    border-color: #1e87f0;
+    background: rgba(30, 135, 240, 0.14);
+    color: #1e87f0;
+  }
+  html[data-theme="dark"] .feat-schedule-times input[type="time"] {
+    border-color: var(--tb-border);
+    background: var(--tb-surface);
+    color: var(--tb-text);
+  }
+  .feat-quota-line {
+    font-size: 0.82rem;
+    color: #666;
+    text-align: center;
+  }
+  .feat-actions {
+    display: flex;
+    flex-wrap: wrap;
+    justify-content: center;
+    gap: 8px;
+    align-items: center;
+    margin-top: auto;
+  }
+  .feat-actions form { margin: 0; }
+  html[data-theme="dark"] .feat-card {
+    border-color: var(--tb-border);
+    background: var(--tb-surface);
+  }
+  html[data-theme="dark"] .feat-card-head h3 { color: var(--tb-text); }
+  html[data-theme="dark"] .feat-hint,
+  html[data-theme="dark"] .feat-quota-line { color: var(--tb-text-muted); }
+
+  /* 私聊面板聚合卡：chat 专属（功能开关/收集窗口 + 消息上限设置）同卡呈现，
+     feat 卡去掉自身边框避免嵌套；第二区 legend 降级为小节标题 */
+  .chat-zone .feat-card {
+    padding: 0;
+    border: 0;
+    background: transparent;
+  }
+  .chat-zone hr { margin: 14px 0; }
+  .chat-zone .uk-legend {
+    font-size: 1.05rem;
+    margin: 0 0 10px;
+  }
+
+  /* 标签块输入：回车或逗号成词，每个词可独立删除；原 input 隐藏后作为提交载体 */
+  .tb-tag-box {
+    display: flex;
+    flex-wrap: wrap;
+    align-items: center;
+    gap: 6px;
+    padding: 6px 8px;
+    border: 1px solid #e5e5e5;
+    border-radius: 4px;
+    background: #fff;
+    cursor: text;
+  }
+  .tb-tag-box:focus-within { border-color: #1e87f0; }
+  .tb-tag-chip {
+    display: inline-flex;
+    align-items: center;
+    gap: 6px;
+    padding: 2px 8px;
+    border-radius: 3px;
+    background: #1e87f0;
+    color: #fff;
+    font-size: 0.875rem;
+    line-height: 1.8;
+  }
+  .tb-tag-chip button {
+    padding: 0;
+    border: 0;
+    background: transparent;
+    color: inherit;
+    font-size: 1rem;
+    line-height: 1;
+    cursor: pointer;
+    opacity: 0.75;
+  }
+  .tb-tag-chip button:hover { opacity: 1; }
+  .tb-tag-entry {
+    flex: 1;
+    min-width: 120px;
+    border: 0;
+    outline: 0;
+    background: transparent;
+    color: inherit;
+    font-size: 0.875rem;
+  }
+  .tb-tag-meta {
+    display: flex;
+    justify-content: space-between;
+    gap: 8px;
+    margin-top: 4px;
+    font-size: 0.75rem;
+    color: #999;
+  }
+  .tb-tag-error { color: #f0506e; }
+  html[data-theme="dark"] .tb-tag-box {
+    border-color: var(--tb-border);
+    background: var(--tb-surface);
+    color: var(--tb-text);
+  }
+  html[data-theme="dark"] .tb-tag-entry { color: var(--tb-text); }
+  html[data-theme="dark"] .tb-tag-meta { color: var(--tb-text-muted); }
+
+  /* ===== profile account 面板卡片化（复用 UIkit 变量体系，暗色自动跟随） ===== */
+  .tb-pcard {
+    background: #fff;
+    border: 1px solid #e5e5e5;
+    border-radius: 10px;
+    padding: 13px 14px 8px;
+    margin-bottom: 12px;
+  }
+  .tb-pcard-title {
+    margin: 0 0 10px;
+    font-size: 1.02rem;
+    font-weight: 600;
+  }
+  /* 全页纵向压缩：面板内表单字段间距由 UIkit 默认 20px 收紧到 12px */
+  .profile-panel .uk-margin { margin-bottom: 12px; }
+  .tb-pcard-title .tb-pcard-extra {
+    float: right;
+    font-size: 0.76rem;
+    font-weight: 400;
+    color: #999;
+    line-height: 1.6;
+  }
+  /* 头像与背景预览：两项同行、整体居中；头像框与背景框“显示高度”一致（150px） */
+  .tb-media-row {
+    display: flex;
+    flex-wrap: wrap;
+    justify-content: center;
+    align-items: flex-start;
+    gap: 14px 32px;
+  }
+  .tb-media-item {
+    /* 头像列与背景列等宽（280px），内部各自居中 → 两个“更换 xx”组件观感一致 */
+    flex: 0 0 280px;
+    max-width: 100%;
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    text-align: center;
+  }
+  .tb-media-frame {
+    display: block;
+    flex: none;
+    border: 1px solid #e5e5e5;
+    background: #f7f7f7;
+    overflow: hidden;
+  }
+  .tb-media-frame.tb-frame-avatar {
+    width: 150px;
+    height: 150px;
+    border-radius: 50%;
+  }
+  .tb-media-frame.tb-frame-bg {
+    /* 16:9 且高 150 ≈ 头像框直径 150：两框视觉等高 */
+    width: 267px;
+    max-width: 100%;
+    aspect-ratio: 16 / 9;
+    border-radius: 8px;
+  }
+  .tb-media-frame img {
+    width: 100%;
+    height: 100%;
+    object-fit: cover;
+    display: block;
+  }
+  .tb-ratio-tag {
+    display: inline-block;
+    margin: 8px 0 0;
+    font-size: 0.72rem;
+    line-height: 1;
+    color: #666;
+    background: #f4f4f4;
+    border: 1px solid #e5e5e5;
+    border-radius: 999px;
+    padding: 4px 9px;
+  }
+  .tb-file-hint {
+    display: block;
+    font-size: 0.78rem;
+    line-height: 1.5;
+    color: #999;
+    margin-top: 6px;
+  }
+  .tb-media-actions { margin-top: 10px; }
+  /* 更换头像 / 更换背景两个按钮同宽 */
+  .tb-media-actions .uk-button { min-width: 150px; }
+  /* 卡片级保存按钮行（居中）：头像背景、基础资料、二维码、社交、改密各块共用 */
+  .tb-card-save,
+  .tb-media-save {
+    margin-top: 6px;
+    text-align: center;
+  }
+  /* 账号操作：导出两按钮同行、退出登录与停用同行；按钮组居中、说明行小字居中 */
+  .tb-account-actions { margin-top: 0; }
+  .tb-account-pair {
+    display: flex;
+    flex-wrap: wrap;
+    justify-content: center;
+    align-items: center;
+    gap: 10px 14px;
+    padding: 8px 0;
+  }
+  .tb-account-pair form { margin: 0; }
+  .tb-account-note {
+    display: block;
+    margin: 0 0 10px;
+    text-align: center;
+    font-size: 0.78rem;
+    line-height: 1.6;
+    color: #999;
+  }
+  .tb-account-note:last-child { margin-bottom: 0; }
+  /* 裁剪弹窗：图片区域限制在视口内，移动端可用 */
+  .tb-crop-stage {
+    max-width: 100%;
+    text-align: center;
+  }
+  .tb-crop-stage img {
+    display: inline-block;
+    max-width: 100%;
+    max-height: 58vh;
+  }
+  #media-crop-modal .uk-modal-dialog { width: 640px; }
+  .tb-crop-hint { margin-top: 12px; }
+  html[data-theme="dark"] .tb-pcard {
+    border-color: var(--tb-border);
+    background: var(--tb-surface);
+  }
+  html[data-theme="dark"] .tb-pcard-title { color: var(--tb-text); }
+  html[data-theme="dark"] .tb-pcard-extra,
+  html[data-theme="dark"] .tb-file-hint { color: var(--tb-text-muted); }
+  html[data-theme="dark"] .tb-media-frame {
+    border-color: var(--tb-border);
+    background: var(--tb-surface-2);
+  }
+  html[data-theme="dark"] .tb-ratio-tag {
+    color: var(--tb-text-muted);
+    border-color: var(--tb-border);
+    background: var(--tb-surface-2);
+  }
+  html[data-theme="dark"] .tb-account-note { color: var(--tb-text-muted); }
+  html[data-theme="dark"] .tb-pcard .uk-accordion-title {
+    color: var(--tb-text);
+  }
+  html[data-theme="dark"] .tb-pcard .uk-accordion-title:hover {
+    color: var(--tb-primary);
+  }
+  /* 移动端：更紧凑的留白与全宽操作区 */
+  @media (max-width: 640px) {
+    .tb-pcard { padding: 13px 12px 8px; }
+    .tb-media-row { gap: 14px; }
+    .tb-media-item { flex-basis: 100%; width: auto; max-width: none; }
+    .tb-media-frame.tb-frame-avatar { width: 120px; height: 120px; }
+    .tb-media-frame.tb-frame-bg { width: 100%; max-width: none; }
+    .tb-media-actions .uk-button,
+    .tb-media-save .uk-button,
+    .tb-card-save .uk-button { width: 100%; }
+  }
+</style>
+
+<!-- 提示条置于面板之外：任何面板保存后的 flash 都可见（面板会被 hidden 隐藏） -->
+{{template "base/alert" .}}
+
+<!-- 头像/背景裁剪弹窗（Cropper.js）：确认后把裁剪结果写回对应的文件域，随主表单一并提交 -->
+<div id="media-crop-modal" uk-modal>
+  <div class="uk-modal-dialog">
+    <button class="uk-modal-close-default" type="button" uk-close></button>
+    <div class="uk-modal-header">
+      <h2 class="uk-modal-title">{{t .LangCode "profile.cropTitle"}}</h2>
+    </div>
+    <div class="uk-modal-body">
+      <div class="tb-crop-stage">
+        <img id="media-crop-image" alt="">
+      </div>
+      <p class="uk-text-meta tb-crop-hint" id="media-crop-hint"></p>
+    </div>
+    <div class="uk-modal-footer uk-text-right">
+      <button type="button" class="uk-button uk-button-default uk-modal-close">{{t .LangCode "common.cancel"}}</button>
+      <button type="button" class="uk-button uk-button-primary" id="media-crop-confirm">{{t .LangCode "profile.cropConfirm"}}</button>
+    </div>
+  </div>
+</div>
+
+<!-- 面板切换：用户设置 与 提问/私聊/投票 的功能管理分开 -->
+<div class="profile-tabs" role="tablist">
+  <button type="button" class="profile-tab{{ if eq .ActiveProfileTab "account" }} is-active{{ end }}" data-profile-tab="account" role="tab" aria-selected="{{ if eq .ActiveProfileTab "account" }}true{{ else }}false{{ end }}">{{t .LangCode "admin.tabAccount"}}</button>
+  <button type="button" class="profile-tab{{ if eq .ActiveProfileTab "question" }} is-active{{ end }}" data-profile-tab="question" role="tab" aria-selected="{{ if eq .ActiveProfileTab "question" }}true{{ else }}false{{ end }}">{{t .LangCode "explore.questionsTab"}}</button>
+  <button type="button" class="profile-tab{{ if eq .ActiveProfileTab "chat" }} is-active{{ end }}" data-profile-tab="chat" role="tab" aria-selected="{{ if eq .ActiveProfileTab "chat" }}true{{ else }}false{{ end }}">{{t .LangCode "qlist.chatsTab"}}</button>
+  <button type="button" class="profile-tab{{ if eq .ActiveProfileTab "vote" }} is-active{{ end }}" data-profile-tab="vote" role="tab" aria-selected="{{ if eq .ActiveProfileTab "vote" }}true{{ else }}false{{ end }}">{{t .LangCode "explore.votesTab"}}</button>
+</div>
+
+<!-- ===================== 用户设置面板 ===================== -->
+<div class="profile-panel" data-profile-panel="account"{{ if ne .ActiveProfileTab "account" }} hidden{{ end }}>
+<form id="profile-form" method="post" enctype="multipart/form-data" action="/user/profile/update">
+  {{ .CSRFTokenHTML }}
+
+  <!-- 1 基础资料：账号与展示基础信息 -->
+  <section class="tb-pcard">
+    <h3 class="tb-pcard-title">{{t .LangCode "profile.card.basic"}}</h3>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.email"}}</label>
+      <input class="uk-input" type="text" disabled value="{{.LoggedUser.Email}}">
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.name"}}</label>
+      <input name="name" class="uk-input" type="text" value="{{.LoggedUser.Name}}">
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.nameColor"}}</label>
+      <div class="color-picker" data-default="{{.LoggedUser.Usernamecolor}}"></div>
+      <input type="hidden" name="usernamecolor" value="{{.LoggedUser.Usernamecolor}}">
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.intro"}}</label>
+      <input name="intro" class="uk-input" type="text" value="{{.LoggedUser.Intro}}">
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.introColor"}}</label>
+      <div class="color-picker" data-default="{{.LoggedUser.Introcolor}}"></div>
+      <input type="hidden" name="introcolor" value="{{.LoggedUser.Introcolor}}">
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.lang"}}</label>
+      <select name="language" class="uk-select">
+        {{ range .SupportedLangs }}
+        <option value="{{.Code}}" {{ if eq $.LoggedUser.Language .Code }}selected{{ end }}>{{.Name}}</option>
+        {{ end }}
+      </select>
+      <span class="uk-text-small uk-text-muted">{{t .LangCode "admin.langHint"}}</span>
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.notify"}}</label>
+      <label>
+        <input name="notify_email" class="uk-checkbox" type="checkbox"
+               {{ if eq .LoggedUser.Notify "email"}}checked{{end}}>
+        <span class="uk-text-small"> {{t .LangCode "admin.notifyEmail"}}</span>
+      </label>
+    </div>
+    <div class="tb-card-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t .LangCode "profile.saveBasic"}}</button>
+    </div>
+  </section>
+
+  <!-- 2 头像与背景：选择文件即弹裁剪框，预览实时更新；头像 1:1、背景 16:9 -->
+  <section class="tb-pcard">
+    <h3 class="tb-pcard-title">{{t .LangCode "profile.card.avatarBg"}}</h3>
+    <div class="tb-media-row">
+      <div class="tb-media-item">
+        <span class="tb-media-frame tb-frame-avatar">
+          <img id="avatar-prev" alt="" src="{{ if .LoggedUser.Avatar }}{{.LoggedUser.Avatar}}{{ else }}{{.DefaultAvatar}}{{ end }}">
+        </span>
+        <span class="tb-ratio-tag">1:1</span>
+        <div class="tb-media-actions">
+          <input type="file" name="avatar" id="avatar-input" accept="image/*" class="uk-hidden">
+          <button type="button" class="uk-button uk-button-default uk-button-small" data-pick-image="avatar">{{t .LangCode "profile.pickAvatar"}}</button>
+        </div>
+        <span class="tb-file-hint">{{t .LangCode "profile.avatarCropHint"}}</span>
+      </div>
+      <div class="tb-media-item">
+        <span class="tb-media-frame tb-frame-bg">
+          <img id="bg-prev" alt=""{{ if .LoggedUser.Background }} src="{{.LoggedUser.Background}}"{{ end }}>
+        </span>
+        <span class="tb-ratio-tag">16:9</span>
+        <div class="tb-media-actions">
+          <input type="file" name="background" id="background-input" accept="image/*" class="uk-hidden">
+          <button type="button" class="uk-button uk-button-default uk-button-small" data-pick-image="background">{{t .LangCode "profile.pickBackground"}}</button>
+        </div>
+        <span class="tb-file-hint">{{t .LangCode "profile.backgroundCropHint"}}</span>
+      </div>
+    </div>
+    <!-- 图片更换后在此即时保存（与主表单共用提交，裁剪结果随文件域一并上传） -->
+    <div class="tb-media-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t .LangCode "profile.saveMedia"}}</button>
+    </div>
+  </section>
+
+  <!-- 3 二维码样式：默认展开（可折叠），独立保存 -->
+  <section class="tb-pcard">
+    <ul class="uk-accordion" uk-accordion="multiple: true">
+      <li class="uk-open">
+        <a class="uk-accordion-title" href="#">{{t .LangCode "profile.card.qr"}}</a>
+        <div class="uk-accordion-content">
+          <div class="uk-grid" uk-grid>
+            <div class="uk-width-2-3@m uk-width-1-1">
+              <div class="uk-margin">
+                <label class="uk-form-label">{{t .LangCode "admin.qrBgColor"}}</label>
+                <div class="color-picker" data-default="{{.LoggedUser.Qrcodecolor}}"></div>
+                <input type="hidden" name="qrcodecolor" value="{{.LoggedUser.Qrcodecolor}}">
+              </div>
+              <div class="uk-margin">
+                <label class="uk-form-label">{{t .LangCode "admin.qrPdColor"}}</label>
+                <div class="color-picker" data-default="{{.LoggedUser.Qrcodepdpcolor}}"></div>
+                <input type="hidden" name="qrcodepdpcolor" value="{{.LoggedUser.Qrcodepdpcolor}}">
+              </div>
+              <div class="uk-margin">
+                <label class="uk-form-label">{{t .LangCode "admin.qrFgColor"}}</label>
+                <div class="uk-margin-small">
+                  <label>
+                      <input type="checkbox" id="use-custom-fg" name="use_custom_qr_color"
+                             {{ if .LoggedUser.UseCustomQRColor }}checked{{ end }}>
+                      {{t .LangCode "admin.useCustomFg"}}
+                  </label>
+                </div>
+                <div class="color-picker" data-default="{{.LoggedUser.Qrcodebackcolor}}"></div>
+                <input type="hidden" name="qrcodebackcolor" value="{{.LoggedUser.Qrcodebackcolor}}">
+                <span class="uk-text-small uk-text-muted">{{t .LangCode "admin.customFgHint"}}</span>
+              </div>
+              <div class="uk-margin">
+                <label class="uk-form-label">{{t .LangCode "admin.qrDotSize"}}</label>
+                <div class="range-input-group">
+                  <input name="dotscale" class="uk-range" type="range" step="0.01" min="0" max="1" value="{{.LoggedUser.Dotscale}}">
+                  <span class="range-value" id="dotscale-val">{{.LoggedUser.Dotscale}}</span>
+                  <input class="uk-input uk-form-width-xsmall" type="number" step="0.01" min="0" max="1" id="dotscale-num" value="{{.LoggedUser.Dotscale}}">
+                </div>
+              </div>
+              <div class="uk-margin">
+                <label class="uk-form-label">{{t .LangCode "admin.qrBgAlpha"}}</label>
+                <div class="range-input-group">
+                  <input name="backgroundimagealpha" class="uk-range" type="range" step="0.01" min="0" max="1" value="{{.LoggedUser.Backgroundimagealpha}}">
+                  <span class="range-value" id="bgalpha-val">{{.LoggedUser.Backgroundimagealpha}}</span>
+                  <input class="uk-input uk-form-width-xsmall" type="number" step="0.01" min="0" max="1" id="bgalpha-num" value="{{.LoggedUser.Backgroundimagealpha}}">
+                </div>
+              </div>
+              <div class="uk-margin">
+                <label class="uk-form-label">{{t .LangCode "admin.qrBackground"}}</label>
+                <div uk-form-custom="target: true">
+                  <input type="file" name="backgroundimage" accept="image/*" id="backgroundimage-file">
+                  <input class="uk-input uk-form-width-large" type="text" placeholder="{{t .LangCode "admin.qrBackgroundPlaceholder"}}" disabled>
+                </div>
+                <span class="uk-text-small uk-text-muted">{{t .LangCode "admin.qrPreviewHint"}}</span>
+              </div>
+            </div>
+            <div class="uk-width-1-3@m uk-width-1-1">
+              <div class="preview-card">
+                <h4 class="uk-text-center">{{t .LangCode "admin.preview"}}</h4>
+                <div class="qrcode-wrapper" id="qrcode-preview"></div>
+                <hr class="uk-margin-small">
+                <div class="uk-text-small">
+                  <strong>{{t .LangCode "admin.themePreset"}}</strong>
+                  <div class="uk-flex uk-flex-wrap uk-flex-center">
+                    <button type="button" class="uk-button uk-button-default uk-button-small theme-btn" data-theme="default">{{t .LangCode "admin.themeDefault"}}</button>
+                    <button type="button" class="uk-button uk-button-default uk-button-small theme-btn" data-theme="dark">{{t .LangCode "admin.themeDark"}}</button>
+                    <button type="button" class="uk-button uk-button-default uk-button-small theme-btn" data-theme="ocean">{{t .LangCode "admin.themeOcean"}}</button>
+                    <button type="button" class="uk-button uk-button-default uk-button-small theme-btn" data-theme="sunset">{{t .LangCode "admin.themeSunset"}}</button>
+                  </div>
+                </div>
+                <div class="uk-margin-small-top">
+                  <button type="button" id="reset-qr-defaults" class="uk-button uk-button-default uk-button-small uk-width-1-1">{{t .LangCode "admin.resetDefaults"}}</button>
+                </div>
+                <p class="uk-text-meta uk-margin-small-top">{{t .LangCode "admin.previewHint"}}</p>
+              </div>
+            </div>
+          </div>
+        </div>
+      </li>
+    </ul>
+    <div class="tb-card-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t .LangCode "profile.saveQR"}}</button>
+    </div>
+  </section>
+
+  <!-- 4 社交主页：默认展开（可折叠），独立保存 -->
+  <section class="tb-pcard">
+    <ul class="uk-accordion" uk-accordion="multiple: true">
+      <li class="uk-open">
+        <a class="uk-accordion-title" href="#">{{t .LangCode "admin.social"}}</a>
+        <div class="uk-accordion-content">
+          <span class="uk-text-muted">{{t .LangCode "admin.socialHint"}}</span>
+          <div class="uk-margin social-item">
+            <label class="checkbox-label">
+              <input type="checkbox" class="social-enable" data-target="acfunlink"> {{t .LangCode "admin.enableAcfun"}}
+            </label>
+            <input name="acfunlink" class="uk-input social-input" type="text" placeholder="acfun.cn/xxx" value="{{.LoggedUser.Acfunlink}}">
+          </div>
+          <div class="uk-margin social-item">
+            <label class="checkbox-label">
+              <input type="checkbox" class="social-enable" data-target="bililink"> {{t .LangCode "admin.enableBili"}}
+            </label>
+            <input name="bililink" class="uk-input social-input" type="text" placeholder="bilibili.com/xxx" value="{{.LoggedUser.Bililink}}">
+          </div>
+          <div class="uk-margin social-item">
+            <label class="checkbox-label">
+              <input type="checkbox" class="social-enable" data-target="weibolink"> {{t .LangCode "admin.enableWeibo"}}
+            </label>
+            <input name="weibolink" class="uk-input social-input" type="text" placeholder="weibo.com/xxx" value="{{.LoggedUser.Weibolink}}">
+          </div>
+          <div class="uk-margin social-item">
+            <label class="checkbox-label">
+              <input type="checkbox" class="social-enable" data-target="xiaohongshulink"> {{t .LangCode "admin.enableXiaohongshu"}}
+            </label>
+            <input name="xiaohongshulink" class="uk-input social-input" type="text" placeholder="xiaohongshu.com/xxx" value="{{.LoggedUser.Xiaohongshulink}}">
+          </div>
+          <div class="uk-margin social-item">
+            <label class="checkbox-label">
+              <input type="checkbox" class="social-enable" data-target="bloglink"> {{t .LangCode "admin.enableBlog"}}
+            </label>
+            <input name="bloglink" class="uk-input social-input" type="text" placeholder="example.com" value="{{.LoggedUser.Bloglink}}">
+          </div>
+        </div>
+      </li>
+    </ul>
+    <div class="tb-card-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t .LangCode "profile.saveSocial"}}</button>
+    </div>
+  </section>
+
+  <!-- 5 修改密码：保存成功后强制登出，需重新登录 -->
+  <section class="tb-pcard">
+    <h3 class="tb-pcard-title">{{t .LangCode "profile.card.password"}}</h3>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.oldPassword"}}</label>
+      <input name="old_password" class="uk-input" type="password" placeholder="{{t .LangCode "admin.oldPasswordHint"}}" autocomplete="current-password">
+    </div>
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.newPassword"}}</label>
+      <input name="new_password" class="uk-input" type="password" placeholder="{{t .LangCode "admin.newPasswordHint"}}" autocomplete="new-password">
+    </div>
+    <p class="uk-text-small uk-text-muted">{{t .LangCode "profile.pwdNote"}}</p>
+    <hr class="uk-margin-small">
+    <div class="tb-card-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t .LangCode "profile.savePassword"}}</button>
+    </div>
+  </section>
+</form>
+
+<!-- 6 标签与展示：独立表单，保存即生效 -->
+<section class="tb-pcard">
+  <h3 class="tb-pcard-title">{{t .LangCode "admin.tags"}}</h3>
+  <form method="post" action="/user/tags/update">
+    {{ .CSRFTokenHTML }}
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.tagsHint"}}</label>
+      <input name="tags" class="uk-input" type="text" value="{{.LoggedUser.Tags}}" placeholder="{{t .LangCode "admin.tagsPlaceholder"}}"
+             data-tb-tag-input
+             {{ with $.TagLimits }}data-tb-max="{{ .MaxTags }}" data-tb-max-len="{{ .MaxTagLen }}"{{ end }}
+             data-tb-msg-too-many="{{t .LangCode "admin.flash.tagsTooMany"}}"
+             data-tb-msg-too-long="{{t .LangCode "admin.flash.tagTooLong"}}"
+             data-tb-msg-duplicate="{{t .LangCode "admin.tagInputDuplicate"}}"
+             data-tb-msg-hint="{{t .LangCode "admin.tagInputHint"}}">
+    </div>
+    <div class="uk-margin">
+      <label>
+        <input name="show_in_home" class="uk-checkbox" type="checkbox" {{ if .LoggedUser.ShowInHome }}checked{{end}}>
+        <span class="uk-text-small"> {{t .LangCode "admin.showInHome"}}</span>
+      </label>
+    </div>
+    <div class="tb-card-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t .LangCode "admin.updateTags"}}</button>
+    </div>
+  </form>
+</section>
+
+<!-- 7 页面访问密码：独立表单 -->
+<section class="tb-pcard">
+  <h3 class="tb-pcard-title">{{t .LangCode "admin.pagePassword"}}</h3>
+  <form method="post" action="/user/profile/update-page-password">
+    {{ .CSRFTokenHTML }}
+    <div class="uk-margin">
+      <label class="uk-form-label">{{t .LangCode "admin.pagePasswordHint"}}</label>
+      <input name="password" class="uk-input" type="password" placeholder="{{t .LangCode "admin.pagePasswordPlaceholder"}}">
+    </div>
+    <div class="tb-card-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t .LangCode "admin.updatePagePassword"}}</button>
+    </div>
+  </form>
+</section>
+
+<!-- 8 账号操作：导出两按钮同行；退出登录与停用我的账号同行 -->
+<section class="tb-pcard">
+  <h3 class="tb-pcard-title">{{t .LangCode "admin.account"}}</h3>
+  <div class="tb-account-actions">
+    <div class="tb-account-pair">
+      <form action="/user/profile/export" method="post" target="_blank" data-tb-skip-submit-feedback="1">
+        {{ .CSRFTokenHTML }}
+        <button class="uk-button uk-button-default">{{t .LangCode "admin.export"}}</button>
+      </form>
+      <form action="/user/profile/export-json" method="post" target="_blank" data-tb-skip-submit-feedback="1">
+        {{ .CSRFTokenHTML }}
+        <button class="uk-button uk-button-default">{{t .LangCode "admin.exportJSON"}}</button>
+      </form>
+    </div>
+    <span class="tb-account-note">{{t .LangCode "admin.exportHint" (t .LangCode "site.title")}} {{t .LangCode "admin.exportJSONHint"}}</span>
+    <div class="tb-account-pair">
+      <!-- Logout 使用独立 POST 表单（携带 CSRF token），GET 链接会留下 CSRF 风险 -->
+      <form method="post" action="/user/logout">
+        {{ .CSRFTokenHTML }}
+        <button type="submit" class="uk-button uk-button-danger">{{t .LangCode "admin.logout"}}</button>
+      </form>
+      <a class="uk-button uk-button-danger" href="/user/profile/deactivate">{{t .LangCode "admin.deactivate"}}</a>
+    </div>
+    <span class="tb-account-note">{{t .LangCode "admin.deactivateHint" | safe}}</span>
+  </div>
+</section>
+</div><!-- /用户设置面板 -->
+
+
+<!-- ===================== 提问功能管理面板 ===================== -->
+<div class="profile-panel" data-profile-panel="question"{{ if ne .ActiveProfileTab "question" }} hidden{{ end }}>
+  {{ with .FeatureQuestion }}{{template "user/feature-control-form" .}}{{ end }}
+
+  <hr>
+  <div class="uk-margin">
+    <form method="post" action="/user/harassment/update?tab=question">
+      {{ $.CSRFTokenHTML }}
+      <legend class="uk-legend">{{t $.LangCode "admin.harassment"}}</legend>
+      <div class="uk-margin">
+        <label class="uk-form-label">{{t $.LangCode "admin.askLimit"}}</label><br>
+        <label>
+          <input name="register_only" class="uk-checkbox" type="checkbox"
+                 {{ if eq $.LoggedUser.HarassmentSetting "register_only"}}checked{{end}} >
+          <span class="uk-text-small"> {{t $.LangCode "admin.registerOnly"}}</span>
+        </label>
+      </div>
+    <div class="tb-card-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t $.LangCode "admin.updateHarassment"}}</button>
+    </div>
+    </form>
+  </div>
+
+  <!-- 全局屏蔽词：三个功能面板共用同一份（见 user/global-blockwords 部分模板） -->
+  {{ template "user/global-blockwords" (dict "Root" $ "Action" "/user/blockwords/update?tab=question") }}
+
+  <hr>
+  <div class="uk-margin">
+    <form method="post" action="/user/profile/update-ask-password">
+      {{ $.CSRFTokenHTML }}
+      <legend class="uk-legend">{{t $.LangCode "admin.askPassword"}}</legend>
+      <div class="uk-margin">
+        <label class="uk-form-label">{{t $.LangCode "admin.askPasswordHint"}}</label>
+        <input name="password" class="uk-input" type="password" placeholder="{{t $.LangCode "admin.askPasswordPlaceholder"}}">
+      </div>
+    <div class="tb-card-save">
+      <button type="submit" class="uk-button uk-button-primary">{{t $.LangCode "admin.updateAskPassword"}}</button>
+    </div>
+    </form>
+  </div>
+</div><!-- /提问功能管理面板 -->
+
+<!-- ===================== 私聊功能管理面板 ===================== -->
+<div class="profile-panel" data-profile-panel="chat"{{ if ne .ActiveProfileTab "chat" }} hidden{{ end }}>
+  <!-- 私聊专属聚合卡：功能开关/收集窗口 + 私聊设置（消息上限）同属私聊，归入一张卡片 -->
+  <section class="tb-pcard chat-zone">
+    {{ with .FeatureChat }}{{template "user/feature-control-form" .}}{{ end }}
+
+    <hr>
+    <form method="post" action="/user/profile/update-chat-settings">
+      {{ $.CSRFTokenHTML }}
+      <legend class="uk-legend">{{t $.LangCode "admin.chat"}}</legend>
+      <div class="uk-margin">
+        <label class="uk-form-label">{{t $.LangCode "admin.chatMaxMessages"}}</label>
+        {{ with $.ChatLimits }}
+        <input name="chat_max_messages" class="uk-input uk-width-small" type="number" min="1" max="{{ .MaxChatMessages }}" value="{{ $.LoggedUser.ChatMaxMessages }}">
+        {{ end }}
+      </div>
+      <div class="uk-margin">
+        <label class="uk-form-label">{{t $.LangCode "admin.chatDailyLimit"}}</label>
+        {{ with $.ChatLimits }}
+        <input name="chat_daily_limit" class="uk-input uk-width-small" type="number" min="0" max="{{ .DailyMessageLimitMax }}" value="{{ $.LoggedUser.DailyMessageLimit }}">
+        {{ end }}
+        <span class="uk-text-muted uk-text-small">{{t $.LangCode "admin.dailyLimitHint"}}</span>
+      </div>
+      <div class="tb-card-save">
+        <button type="submit" class="uk-button uk-button-primary">{{t $.LangCode "admin.updateChat"}}</button>
+      </div>
+    </form>
+  </section>
+
+  <hr>
+  <!-- 全局屏蔽词：提问/私聊/投票三面板共用同一份（见 user/global-blockwords 部分模板） -->
+  {{ template "user/global-blockwords" (dict "Root" $ "Action" "/user/blockwords/update?tab=chat") }}
+</div><!-- /私聊功能管理面板 -->
+
+<!-- ===================== 投票功能管理面板 ===================== -->
+<div class="profile-panel" data-profile-panel="vote"{{ if ne .ActiveProfileTab "vote" }} hidden{{ end }}>
+  {{ with .FeatureVote }}{{template "user/feature-control-form" .}}{{ end }}
+
+  <hr>
+  <!-- 全局屏蔽词：三个功能面板共用同一份（见 user/global-blockwords 部分模板） -->
+  {{ template "user/global-blockwords" (dict "Root" $ "Action" "/user/blockwords/update?tab=vote") }}
+</div><!-- /投票功能管理面板 -->
+
+<script>
+(function() {
+    // ========== 社交信息复选框交互 + 非空验证 ==========
+    function initSocialCheckboxes() {
+        document.querySelectorAll('.social-item').forEach(function(item) {
+            var checkbox = item.querySelector('.social-enable');
+            var input = item.querySelector('.social-input');
+            if (!checkbox || !input) return;
+
+            // 初始化状态
+            var currentVal = input.value.trim();
+            if (currentVal === 'none' || currentVal === '') {
+                checkbox.checked = false;
+                input.value = 'none';
+                input.disabled = true;
+                input.removeAttribute('required');
+            } else {
+                checkbox.checked = true;
+                input.disabled = false;
+                input.setAttribute('required', 'required');
+            }
+
+            // 复选框切换
+            checkbox.addEventListener('change', function() {
+                if (checkbox.checked) {
+                    input.disabled = false;
+                    if (input.value === 'none') input.value = '';
+                    input.setAttribute('required', 'required');
+                    input.focus();
+                } else {
+                    input.value = 'none';
+                    input.disabled = true;
+                    input.removeAttribute('required');
+                    // 清除可能出现的自定义验证消息
+                    input.setCustomValidity('');
+                }
+            });
+
+            // 输入时清除自定义验证消息
+            input.addEventListener('input', function() {
+                if (input.validity.customError) {
+                    input.setCustomValidity('');
+                }
+            });
+        });
+    }
+
+    // 主表单提交验证
+    var profileForm = document.getElementById('profile-form');
+    profileForm.addEventListener('submit', function(e) {
+        var valid = true;
+        document.querySelectorAll('.social-item').forEach(function(item) {
+            var checkbox = item.querySelector('.social-enable');
+            var input = item.querySelector('.social-input');
+            if (checkbox.checked && input.value.trim() === '') {
+                input.setCustomValidity('{{t .LangCode "admin.socialRequired"}}');
+                valid = false;
+            } else {
+                input.setCustomValidity('');
+            }
+        });
+
+        if (!valid) {
+            e.preventDefault();
+            // 触发第一个无效输入框的报告
+            profileForm.reportValidity();
+        } else {
+            // 提交前确保未启用的项值为 "none"
+            document.querySelectorAll('.social-item').forEach(function(item) {
+                var checkbox = item.querySelector('.social-enable');
+                var input = item.querySelector('.social-input');
+                if (!checkbox.checked) {
+                    input.value = 'none';
+                }
+            });
+        }
+    });
+
+    initSocialCheckboxes();
+
+    // ========== 其余脚本（颜色选择器、预览等） ==========
+    function debounce(func, wait) {
+        var timeout;
+        return function() {
+            var context = this, args = arguments;
+            clearTimeout(timeout);
+            timeout = setTimeout(function() { func.apply(context, args); }, wait);
+        };
+    }
+
+    // Pickr 初始化
+    document.querySelectorAll('.color-picker').forEach(function(el) {
+        var hiddenInput = el.nextElementSibling;
+        if (!hiddenInput || hiddenInput.type !== 'hidden') return;
+        var pickr = Pickr.create({
+            el: el,
+            theme: 'nano',
+            default: hiddenInput.value || '#000000',
+            defaultRepresentation: 'HEX',
+            components: {
+                preview: true,
+                opacity: false,
+                hue: true,
+                interaction: {
+                    hex: true,
+                    input: true,
+                    clear: true,
+                    save: true
+                }
+            }
+        });
+        pickr.on('save', function(color) {
+            var hex = color.toHEXA().toString();
+            hiddenInput.value = hex;
+            hiddenInput.dispatchEvent(new Event('input'));
+        });
+    });
+
+    // 滑块联动
+    function bindRangeNumber(range, num, span) {
+        if (!range || !num) return;
+        var update = function() {
+            num.value = range.value;
+            if (span) span.textContent = parseFloat(range.value).toFixed(2);
+            debouncedUpdatePreview();
+        };
+        range.addEventListener('input', update);
+        num.addEventListener('change', function() {
+            var val = parseFloat(num.value);
+            if (isNaN(val)) return;
+            range.value = val;
+            if (span) span.textContent = val.toFixed(2);
+            debouncedUpdatePreview();
+        });
+        if (span) span.textContent = parseFloat(range.value).toFixed(2);
+    }
+
+    var dotScaleRange = document.querySelector('input[name="dotscale"]');
+    var dotScaleNum = document.getElementById('dotscale-num');
+    var dotScaleSpan = document.getElementById('dotscale-val');
+    var bgAlphaRange = document.querySelector('input[name="backgroundimagealpha"]');
+    var bgAlphaNum = document.getElementById('bgalpha-num');
+    var bgAlphaSpan = document.getElementById('bgalpha-val');
+    bindRangeNumber(dotScaleRange, dotScaleNum, dotScaleSpan);
+    bindRangeNumber(bgAlphaRange, bgAlphaNum, bgAlphaSpan);
+
+    // 背景图即时预览
+    var bgImageFile = document.getElementById('backgroundimage-file');
+    window._bgImageDataURL = null;
+    if (bgImageFile) {
+        bgImageFile.addEventListener('change', function(e) {
+            var file = e.target.files[0];
+            if (!file) return;
+            var reader = new FileReader();
+            reader.onload = function(ev) {
+                window._bgImageDataURL = ev.target.result;
+                debouncedUpdatePreview();
+            };
+            reader.readAsDataURL(file);
+        });
+    }
+
+    // 二维码预览核心
+    var boxURL = window.location.origin + '/_/' + '{{.LoggedUser.Domain}}';
+    var previewEl = document.getElementById('qrcode-preview');
+    var useCustomFg = document.getElementById('use-custom-fg');
+    updatePreview();
+
+    function getInputVal(name, fallback) {
+        var input = document.querySelector('input[name="' + name + '"]');
+        var v = input ? (input.value || '').trim() : '';
+        return v || (fallback || '#000000');
+    }
+
+    function updatePreview() {
+        var useFg = useCustomFg.checked;
+        var containerWidth = previewEl.clientWidth || 220;
+        var size = Math.min(containerWidth, 220);
+        // 关键修复：禁止 autoColor。新用户未设颜色时 easy.qrcode 的 autoColor 会自动取一个
+        // ≈背景色的前景，导致整张二维码变成背景色方块、无法扫描。改为始终传入明确的
+        // colorDark / colorLight 兜底值（空字段时回退到标准黑白）。
+        var dotScaleVal = parseFloat(dotScaleRange.value) || 0.4;
+        var bgAlphaVal = parseFloat(bgAlphaRange.value) || 0.8;
+        var options = {
+            text: boxURL,
+            width: size,
+            height: size,
+            colorDark: useFg ? getInputVal('qrcodebackcolor', '#000000') : '#000000',
+            colorLight: getInputVal('qrcodecolor', '#FFFFFF'),
+            dotScale: dotScaleVal,
+            dotScaleTiming: dotScaleVal,
+            dotScaleA: dotScaleVal,
+            correctLevel: QRCode.CorrectLevel.H,
+            logo: (function () {
+                // ?v=2：击穿曾被无 ACAO 响应污染的浏览器缓存条目；仅对 http(s) 绝对地址追加
+                var a = "{{.LoggedUser.Avatar}}" || "{{.DefaultAvatar}}";
+                return a ? (a.indexOf("http") === 0 ? a + "?v=2" : a) : undefined;
+            })(),
+            logoWidth: Math.floor(size * 0.25),
+            logoHeight: Math.floor(size * 0.25),
+            logoBackgroundTransparent: true,
+            // 直连 R2 等跨域图片须以 CORS 模式加载，画布才不会被污染、可正常导出；
+            // 前提是图片所在桶/域名已配 Access-Control-Allow-Origin（如 R2 CORS Policy）。
+            crossOrigin: 'anonymous',
+            // 默认不注入任何二维码背景图：仅在用户自己上传/设置了 BackgroundImage 时才使用，
+            // 或本次会话通过本地文件选择器临时预览（window._bgImageDataURL）。
+            // 没有背景图时（autoColor:false + 显式 colorDark/colorLight）才能稳定输出可扫描的黑白二维码，
+            // 否则在「无背景图却勾选自定义前景色」时容易糊成一坨。
+            backgroundImage: window._bgImageDataURL || ("{{.LoggedUser.BackgroundImage}}" ? "{{.LoggedUser.BackgroundImage}}" : undefined),
+            backgroundImageAlpha: bgAlphaVal,
+            autoColor: false,
+            PO: getInputVal('qrcodepdpcolor', '#000000'),
+            PI: getInputVal('qrcodepdpcolor', '#000000'),
+            AO: '',
+            AI: '',
+            timing: getInputVal('qrcodepdpcolor', '#000000')
+        };
+        // 降级渲染（P0-②）：头像 logo / 背景图慢或失败时先出基础码，探针成功自动升级带 logo；
+        // 结果按 URL 同会话记忆，拖动滑块高频重绘时 logo 已知可用 → 一次成型、不闪降级。
+        window.tbRenderQR(previewEl, function () { return options; });
+    }
+
+    var debouncedUpdatePreview = debounce(updatePreview, 150);
+    // 二维码卡默认展开后：若初始不在 account 面板（?tab=question 等），容器曾 hidden 导致
+    // 预览按回退 220px 绘制；面板切回时由 tab 脚本调用本函数按真实宽度重绘。
+    window.__tbRefreshAccountPreview = debouncedUpdatePreview;
+
+    var colorInputs = document.querySelectorAll('input[type="hidden"][name="qrcodebackcolor"], input[type="hidden"][name="qrcodecolor"], input[type="hidden"][name="qrcodepdpcolor"]');
+    colorInputs.forEach(function(input) {
+        input.addEventListener('input', debouncedUpdatePreview);
+    });
+    useCustomFg.addEventListener('change', debouncedUpdatePreview);
+    window.addEventListener('resize', debouncedUpdatePreview);
+    // uk-accordion 展开/收起时按真实宽度重绘（初始默认展开；从其它面板切回见下方 tab 钩子）
+    document.addEventListener('shown', function(e) {
+      if (e.target && e.target.closest && e.target.closest('.uk-accordion')) {
+        debouncedUpdatePreview();
+      }
+    });
+    updatePreview();
+
+    // 预设主题
+    var themes = {
+        'default': {
+            qrcodecolor: '#FFFFFF',
+            qrcodebackcolor: '#000000',
+            qrcodepdpcolor: '#000000',
+            dotscale: 0.35,
+            bgalpha: 0.8
+        },
+        'dark': {
+            qrcodecolor: '#1a1a1a',
+            qrcodebackcolor: '#FFFFFF',
+            qrcodepdpcolor: '#FFFFFF',
+            dotscale: 0.5,
+            bgalpha: 0.9
+        },
+        'ocean': {
+            qrcodecolor: '#E0F7FA',
+            qrcodebackcolor: '#006064',
+            qrcodepdpcolor: '#004D40',
+            dotscale: 0.4,
+            bgalpha: 0.7
+        },
+        'sunset': {
+            qrcodecolor: '#FFF3E0',
+            qrcodebackcolor: '#BF360C',
+            qrcodepdpcolor: '#870000',
+            dotscale: 0.45,
+            bgalpha: 0.75
+        }
+    };
+
+    function applyTheme(theme) {
+        var t = themes[theme];
+        if (!t) return;
+        document.querySelector('input[name="qrcodecolor"]').value = t.qrcodecolor;
+        document.querySelector('input[name="qrcodebackcolor"]').value = t.qrcodebackcolor;
+        document.querySelector('input[name="qrcodepdpcolor"]').value = t.qrcodepdpcolor;
+        dotScaleRange.value = t.dotscale;
+        dotScaleNum.value = t.dotscale;
+        dotScaleSpan.textContent = parseFloat(t.dotscale).toFixed(2);
+        bgAlphaRange.value = t.bgalpha;
+        bgAlphaNum.value = t.bgalpha;
+        bgAlphaSpan.textContent = parseFloat(t.bgalpha).toFixed(2);
+
+        document.querySelector('input[name="qrcodecolor"]').dispatchEvent(new Event('input'));
+        document.querySelector('input[name="qrcodebackcolor"]').dispatchEvent(new Event('input'));
+        document.querySelector('input[name="qrcodepdpcolor"]').dispatchEvent(new Event('input'));
+        debouncedUpdatePreview();
+    }
+
+    document.querySelectorAll('.theme-btn').forEach(function(btn) {
+        btn.addEventListener('click', function() {
+            applyTheme(this.getAttribute('data-theme'));
+        });
+    });
+
+    document.getElementById('reset-qr-defaults').addEventListener('click', function() {
+        applyTheme('default');
+        useCustomFg.checked = false;
+        debouncedUpdatePreview();
+    });
+
+})();
+</script>
+
+<script>
+// 面板切换：用户设置 / 提问 / 私聊 / 投票。
+// 服务端已按 ?tab= 渲染初始面板，此处仅在前端切换，并用 hash 保持可分享。
+document.addEventListener('DOMContentLoaded', function() {
+  var tabs = document.querySelectorAll('[data-profile-tab]');
+  var panels = document.querySelectorAll('[data-profile-panel]');
+  function showPanel(name, pushToURL) {
+    tabs.forEach(function(tab) {
+      var active = tab.dataset.profileTab === name;
+      tab.classList.toggle('is-active', active);
+      tab.setAttribute('aria-selected', active ? 'true' : 'false');
+    });
+    panels.forEach(function(panel) {
+      panel.hidden = panel.dataset.profilePanel !== name;
+    });
+    // 切回用户设置面板时按真实宽度重绘二维码预览（展开状态不会再触发 accordion 'shown'）
+    if (name === 'account' && window.__tbRefreshAccountPreview) {
+      window.__tbRefreshAccountPreview();
+    }
+    if (pushToURL && window.history && window.history.replaceState) {
+      window.history.replaceState({}, document.title, '/user/profile?tab=' + name);
+    }
+  }
+  tabs.forEach(function(tab) {
+    tab.addEventListener('click', function() { showPanel(tab.dataset.profileTab, true); });
+  });
+  var hash = (window.location.hash || '').replace('#', '');
+  if (hash && document.querySelector('[data-profile-tab="' + hash + '"]')) {
+    showPanel(hash, false);
+  }
+});
+</script>
+
+<script>
+// 标签 / 屏蔽词的标签块输入：把原本的逗号分隔文本框升级为"回车或逗号成词 + 逐条删除"。
+// 渐进增强：接管前原 input 就是可用的普通文本框；接管后原 input 转为隐藏的提交载体，
+// 提交前把标签块拼回逗号串写回它，后端解析逻辑完全不变（仍按逗号分隔）。
+(function () {
+  // 后端兼容中文逗号，前端切分口径保持一致
+  function parseList(value) {
+    return String(value || '').split(/[,，]/).map(function (s) {
+      return s.trim();
+    }).filter(function (s) { return s !== ''; });
+  }
+
+  function initTagInput(input) {
+    var max = parseInt(input.getAttribute('data-tb-max'), 10);
+    var maxLen = parseInt(input.getAttribute('data-tb-max-len'), 10);
+    // data 属性缺失（如错误分支重渲染）时回落到与 db 常量一致的宽松值，后端仍是唯一权威
+    if (!max || max < 1) { max = 10; }
+    if (!maxLen || maxLen < 1) { maxLen = 10; }
+    var msgTooMany = input.getAttribute('data-tb-msg-too-many') || '';
+    var msgTooLong = input.getAttribute('data-tb-msg-too-long') || '';
+    var msgDuplicate = input.getAttribute('data-tb-msg-duplicate') || '';
+    var hint = input.getAttribute('data-tb-msg-hint') || '';
+
+    var items = parseList(input.value);
+
+    var box = document.createElement('div');
+    box.className = 'tb-tag-box';
+    var entry = document.createElement('input');
+    entry.type = 'text';
+    entry.className = 'tb-tag-entry';
+    box.appendChild(entry);
+
+    var meta = document.createElement('div');
+    meta.className = 'tb-tag-meta';
+    var count = document.createElement('span');
+    var error = document.createElement('span');
+    error.className = 'tb-tag-error';
+    meta.appendChild(count);
+    meta.appendChild(error);
+
+    var wrap = document.createElement('div');
+    wrap.appendChild(box);
+    wrap.appendChild(meta);
+
+    input.style.display = 'none';
+    if (input.parentNode) { input.parentNode.insertBefore(wrap, input.nextSibling); }
+
+    function sync() { input.value = items.join(','); }
+    function showError(msg) { error.textContent = msg || ''; }
+
+    function commit(raw) {
+      var v = String(raw || '').trim().replace(/[,，]/g, '');
+      if (v === '') { return; }
+      if (items.length >= max) { showError(msgTooMany); return; }
+      if (Array.from(v).length > maxLen) { showError(msgTooLong.replace('%s', v)); return; }
+      if (items.indexOf(v) >= 0) { showError(msgDuplicate); return; }
+      showError('');
+      items.push(v);
+      render();
+    }
+
+    function render() {
+      Array.prototype.slice.call(box.childNodes).forEach(function (node) {
+        if (node !== entry) { box.removeChild(node); }
+      });
+      items.forEach(function (text, i) {
+        var chip = document.createElement('span');
+        chip.className = 'tb-tag-chip';
+        chip.appendChild(document.createTextNode(text));
+        var del = document.createElement('button');
+        del.type = 'button';
+        del.textContent = '×';
+        del.title = text;
+        del.addEventListener('click', function () {
+          items.splice(i, 1);
+          showError('');
+          render();
+        });
+        chip.appendChild(del);
+        box.insertBefore(chip, entry);
+      });
+      entry.disabled = items.length >= max;
+      entry.placeholder = entry.disabled ? '' : hint;
+      count.textContent = items.length + ' / ' + max;
+      sync();
+    }
+
+    box.addEventListener('click', function (e) {
+      if (e.target === box) { entry.focus(); }
+    });
+    entry.addEventListener('input', function () {
+      if (entry.value.indexOf(',') >= 0 || entry.value.indexOf('，') >= 0) {
+        commit(entry.value);
+        entry.value = '';
+      }
+    });
+    entry.addEventListener('keydown', function (e) {
+      if (e.key === 'Enter') {
+        e.preventDefault();
+        commit(entry.value);
+        entry.value = '';
+      } else if (e.key === 'Backspace' && entry.value === '' && items.length > 0) {
+        items.pop();
+        showError('');
+        render();
+      }
+    });
+    // 失焦时收下残留输入，避免"打了字没回车就提交"导致内容丢失
+    entry.addEventListener('blur', function () {
+      if (entry.value.trim() !== '') {
+        commit(entry.value);
+        entry.value = '';
+      }
+    });
+
+    if (input.form) {
+      input.form.addEventListener('submit', function () {
+        commit(entry.value);
+        entry.value = '';
+        sync();
+      });
+    }
+
+    render();
+  }
+
+  document.addEventListener('DOMContentLoaded', function () {
+    document.querySelectorAll('[data-tb-tag-input]').forEach(initTagInput);
+  });
+})();
+</script>
+
+<script data-cfasync="false">
+// ========== 头像 / 背景：选择即弹裁剪框（1:1 / 16:9），确认后写回 file input 随主表单提交 ==========
+(function () {
+  var MSG_AVATAR_TOO_LARGE = '{{t .LangCode "profile.err.avatarTooLarge"}}';
+  var MSG_BG_TOO_LARGE = '{{t .LangCode "profile.err.backgroundTooLarge"}}';
+  var MSG_NO_CROPPER = '{{t .LangCode "profile.err.cropLibUnavailable"}}';
+  var HINT_AVATAR = '{{t .LangCode "profile.avatarCropHint"}}';
+  var HINT_BG = '{{t .LangCode "profile.backgroundCropHint"}}';
+
+  var MAX_FILE = 2 * 1024 * 1024; // 与 storage.MaxAvatarSize / MaxBackgroundSize 一致
+
+  var media = {
+    avatar: {
+      input: document.getElementById('avatar-input'),
+      prev: document.getElementById('avatar-prev'),
+      ratio: 1,
+      hint: HINT_AVATAR,
+      maxSizeMsg: MSG_AVATAR_TOO_LARGE,
+      // 仅限制输出上限，避免小图被强行放大；canvas 宽高比由裁剪框锁定保证
+      canvas: { maxWidth: 512 },
+      fileType: 'image/png', fileExt: 'png', quality: null
+    },
+    background: {
+      input: document.getElementById('background-input'),
+      prev: document.getElementById('bg-prev'),
+      ratio: 16 / 9,
+      hint: HINT_BG,
+      maxSizeMsg: MSG_BG_TOO_LARGE,
+      canvas: { maxWidth: 1920 },
+      fileType: 'image/jpeg', fileExt: 'jpg', quality: 0.92
+    }
+  };
+
+  var modalEl = document.getElementById('media-crop-modal');
+  var stageImg = document.getElementById('media-crop-image');
+  var hintEl = document.getElementById('media-crop-hint');
+  var confirmBtn = document.getElementById('media-crop-confirm');
+  var cropper = null;
+  var pendingKey = null;   // avatar | background
+  var pendingURL = null;   // 原始选中文件的 objectURL
+  var appliedURL = {};     // 已应用裁剪结果的 objectURL（替换新文件时回收）
+  // 不在解析期创建 UIkit 组件：Cloudflare Rocket Loader / defer 环境下 UIkit 可能尚未执行，
+  // 顶层写 UIkit.modal(...) 会抛 ReferenceError 中断整个脚本，导致下方按钮监听全部失效。
+  // 改为在使用前懒创建（见 startCrop），并统一经由 whenReady 等待 UIkit / Cropper 就绪。
+  var modalObj = null;
+
+  function notify(msg) {
+    // UIkit 不可用时退回原生 alert，保证任何环境下用户都能看到原因
+    if (window.UIkit) { UIkit.modal.alert(msg); } else { window.alert(msg); }
+  }
+
+  // UIkit（header defer）与 Cropper（R2 CDN）就绪后回调；Rocket Loader 会延迟第三方脚本执行，
+  // 但最多容忍 3s —— 超时说明资源确实缺失（如 Cropper 尚未上传），给出可理解提示而非静默失败。
+  function whenReady(cb) {
+    if (window.UIkit && window.Cropper) { cb(); return; }
+    var waited = 0;
+    var timer = setInterval(function () {
+      waited += 100;
+      if (window.UIkit && window.Cropper) {
+        clearInterval(timer);
+        cb();
+      } else if (waited >= 3000) {
+        clearInterval(timer);
+        notify(MSG_NO_CROPPER);
+      }
+    }, 100);
+  }
+
+  function revoke(store, key) {
+    if (store[key]) { URL.revokeObjectURL(store[key]); store[key] = null; }
+  }
+
+  function startCrop(key) {
+    var cfg = media[key];
+    if (!cfg) return;
+    // 文件大小即时校验（不依赖第三方库，立即反馈）
+    var file = cfg.input && cfg.input.files && cfg.input.files[0];
+    if (!file) return;
+    if (file.size > MAX_FILE) { notify(cfg.maxSizeMsg); cfg.input.value = ''; return; }
+
+    whenReady(function () {
+      // 等待期间用户可能重新选择了文件，重新读取
+      var f = cfg.input.files && cfg.input.files[0];
+      if (!f) return;
+      if (f.size > MAX_FILE) { notify(cfg.maxSizeMsg); cfg.input.value = ''; return; }
+      if (!modalObj) { modalObj = UIkit.modal(modalEl); }
+
+      revoke(appliedURL, key);
+      pendingKey = key;
+      if (pendingURL) { URL.revokeObjectURL(pendingURL); pendingURL = null; }
+      pendingURL = URL.createObjectURL(f);
+
+      hintEl.textContent = cfg.hint;
+      stageImg.onload = function () { initCropper(); };
+      stageImg.src = pendingURL;
+      modalObj.show();
+    });
+  }
+
+  function initCropper() {
+    if (cropper) { cropper.destroy(); cropper = null; }
+    if (!pendingKey) return;
+    var cfg = media[pendingKey];
+    // 容器宽度优先：modal 显示后再创建，保证测量准确（移动端可用手势拖拽/缩放）
+    var box = stageImg.parentElement;
+    cropper = new Cropper(stageImg, {
+      viewMode: 1,
+      dragMode: 'move',
+      aspectRatio: cfg.ratio,
+      autoCropArea: 1,
+      responsive: true,
+      background: false,
+      rotatable: true,
+      zoomable: true,
+      wheelZoomRatio: 0.08
+    });
+  }
+
+  // 收起时销毁实例，回收资源
+  modalEl.addEventListener('hidden', function () {
+    if (cropper) { cropper.destroy(); cropper = null; }
+    if (pendingURL) { URL.revokeObjectURL(pendingURL); pendingURL = null; }
+    stageImg.removeAttribute('src');
+    pendingKey = null;
+  });
+
+  confirmBtn.addEventListener('click', function () {
+    if (!cropper || !pendingKey || !modalObj) return;
+    var cfg = media[pendingKey];
+    var canvas = cropper.getCroppedCanvas(cfg.canvas);
+    if (!canvas) return;
+    canvas.toBlob(function (blob) {
+      if (!blob) return;
+      var dt = new DataTransfer();
+      dt.items.add(new File([blob], 'cropped-' + pendingKey + '.' + cfg.fileExt, { type: cfg.fileType }));
+      cfg.input.files = dt.files;
+      appliedURL[pendingKey] = URL.createObjectURL(blob);
+      if (cfg.prev) { cfg.prev.src = appliedURL[pendingKey]; cfg.prev.style.display = 'block'; }
+      modalObj.hide();
+    }, cfg.fileType, cfg.quality || undefined);
+  });
+
+  // 入口按钮触发文件选择
+  document.querySelectorAll('[data-pick-image]').forEach(function (btn) {
+    btn.addEventListener('click', function () {
+      var key = btn.getAttribute('data-pick-image');
+      var input = media[key] && media[key].input;
+      if (input) input.click();
+    });
+  });
+
+  // 选择文件后进入裁剪
+  Object.keys(media).forEach(function (key) {
+    var input = media[key].input;
+    if (!input) return;
+    input.addEventListener('change', function () { startCrop(key); });
+  });
+})();
+</script>
+
+{{template "base/footer" .}}
diff --git a/templates/user/question-list.html b/templates/user/question-list.html
new file mode 100644
index 0000000..3c8c53a
--- /dev/null
+++ b/templates/user/question-list.html
@@ -0,0 +1,486 @@
+{{template "base/header" .}}
+
+<style>
+  .qlist-tabs {
+    display: flex;
+    justify-content: center;
+    gap: 4px;
+    padding: 4px;
+    margin: 6px auto 20px;
+    max-width: 320px;
+    border: 1px solid #e5e5e5;
+    border-radius: 9px;
+    background: #fafafa;
+  }
+  .qlist-tab {
+    flex: 1 1 0;
+    border: 0;
+    border-radius: 6px;
+    padding: 8px 15px;
+    background: transparent;
+    color: #666;
+    cursor: pointer;
+    font-size: 0.9rem;
+    transition: background 0.2s ease, color 0.2s ease;
+  }
+  .qlist-tab:hover { color: #1e87f0; }
+  .qlist-tab.is-active {
+    background: #fff;
+    box-shadow: 0 1px 3px rgba(0, 0, 0, 0.10);
+    color: #1e87f0;
+    font-weight: 600;
+  }
+  .qlist-panel[hidden] { display: none !important; }
+  .all-votes-list { display: grid; gap: 10px; }
+  .all-vote-item {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 16px;
+    padding: 14px 16px;
+    border-bottom: 1px solid #e9e9e9;
+    text-decoration: none;
+  }
+  .all-vote-item:first-child { border-top: 1px solid #e9e9e9; }
+  .all-vote-item:hover { background: #f8fbff; text-decoration: none; }
+  .all-vote-item .hot-vote-title { max-width: 100%; }
+  .hot-vote-title {
+    display: block;
+    overflow: hidden;
+    color: #333;
+    font-size: 0.98rem;
+    font-weight: 600;
+    line-height: 1.45;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+  }
+  .hot-vote-title:hover { color: #1e87f0; }
+  .hot-vote-meta {
+    display: flex;
+    flex-wrap: wrap;
+    align-items: center;
+    gap: 7px;
+    margin-top: 8px;
+  }
+  .hot-vote-meta .uk-label { font-size: 0.72rem; line-height: 1.6; }
+  .hot-vote-action { flex: 0 0 auto; color: #1e87f0; font-size: 0.82rem; white-space: nowrap; }
+  /* 提问列表右上角：状态标签与操作按钮统一尺寸（等宽等高、垂直居中、完全对齐）。
+     每个元素显式带 .qlist-pill 类，选择器挂在 .qlist-pills 容器下提升优先级，
+     避免浏览器对 <button> 的默认样式或 UIkit .uk-label 造成差异。
+     移动端默认显示短文字标签（每语言短词，如 未读→新/New，宽度可控）；
+     ≥640px 显示完整文案（配合 title 悬浮提示，多语言安全）。 */
+  .qlist-pills .qlist-pill {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    height: 24px;
+    min-width: 40px;
+    padding: 0 8px;
+    box-sizing: border-box;
+    font-size: 0.72rem;
+    line-height: 1;
+    white-space: nowrap;
+    border-radius: 2px;
+    border: 0;
+    vertical-align: middle;
+  }
+  .qlist-pills .tb-short { display: inline; }
+  .qlist-pills .tb-text { display: none; }
+  /* 按钮额外重置浏览器默认样式，保证与 span 标签渲染完全一致 */
+  .qlist-pills .qlist-pill.tb-label-btn {
+    cursor: pointer;
+    font-family: inherit;
+    -webkit-appearance: none;
+    appearance: none;
+    background-image: none;
+    outline: none;
+    margin: 0;
+  }
+  .qlist-pills .qlist-pill.tb-label-btn:hover { opacity: 0.85; }
+  @media (min-width: 640px) {
+    /* 桌面端纯文字：隐藏移动端短词，只显示完整文案 */
+    .qlist-pills .qlist-pill { min-width: 62px; padding: 0 10px; }
+    .qlist-pills .tb-short { display: none; }
+    .qlist-pills .tb-text { display: inline; }
+  }
+  html[data-theme="dark"] .qlist-tabs { border-color: var(--tb-border); background: var(--tb-surface-2); }
+  html[data-theme="dark"] .qlist-tab { color: var(--tb-text-muted); }
+  html[data-theme="dark"] .qlist-tab.is-active { background: var(--tb-surface); color: var(--tb-primary); }
+  html[data-theme="dark"] .all-vote-item { border-color: var(--tb-border); }
+  html[data-theme="dark"] .all-vote-item:hover { background: rgba(78, 168, 245, 0.10); }
+  html[data-theme="dark"] .hot-vote-title { color: var(--tb-text); }
+  /* 紧凑统计看板：替代原 UIkit 卡片网格。手机端 4 列（7 项=2 行）、桌面端 7 列 1 行，
+     轻量描边小格子、缩字号、去掉大卡片内边距，显著降低纵向高度，减少手机端滚动。
+     --4 修饰类用于项数较少的看板（如私聊 4 项），在所有断点固定 4 列，避免末尾留白过多。 */
+  .qlist-stats {
+    display: grid;
+    grid-template-columns: repeat(4, 1fr);
+    gap: 8px;
+    margin-bottom: 16px;
+  }
+  @media (min-width: 768px) {
+    .qlist-stats { grid-template-columns: repeat(7, 1fr); }
+  }
+  .qlist-stats--4 { grid-template-columns: repeat(4, 1fr); }
+  @media (min-width: 768px) {
+    .qlist-stats--4 { grid-template-columns: repeat(4, 1fr); }
+  }
+  /* --2 修饰类用于项数很少的看板（如投票 2 项），固定 2 列，避免末尾留白 */
+  .qlist-stats--2 { grid-template-columns: repeat(2, 1fr); }
+  @media (min-width: 768px) {
+    .qlist-stats--2 { grid-template-columns: repeat(2, 1fr); }
+  }
+  .qlist-stat {
+    background: #fff;
+    border: 1px solid #e5e5e5;
+    border-radius: 9px;
+    padding: 8px 6px;
+    text-align: center;
+  }
+  .qlist-stat .qlist-stat-num {
+    display: block;
+    font-size: 1.15rem;
+    font-weight: 700;
+    line-height: 1.15;
+    color: #222;
+  }
+  .qlist-stat .qlist-stat-lbl {
+    display: block;
+    margin-top: 2px;
+    font-size: 0.7rem;
+    color: #888;
+    line-height: 1.15;
+  }
+  html[data-theme="dark"] .qlist-stat { background: var(--tb-surface); border-color: var(--tb-border); }
+  html[data-theme="dark"] .qlist-stat .qlist-stat-num { color: var(--tb-text); }
+  html[data-theme="dark"] .qlist-stat .qlist-stat-lbl { color: var(--tb-text-muted); }
+</style>
+
+<div class="uk-container">
+  <div class="uk-flex uk-flex-middle uk-flex-between uk-margin-small-bottom">
+    <h2 class="uk-margin-remove">{{t .LangCode "qlist.title"}}</h2>
+    <a class="uk-button uk-button-default uk-button-small" href="/user/profile">{{t .LangCode "admin.featuresEntry"}}</a>
+  </div>
+
+  <!-- 居中切换：提问 / 投票 / 私聊 -->
+  <div class="qlist-tabs" role="tablist" aria-label="{{t .LangCode "qlist.title"}}">
+    <button type="button" class="qlist-tab is-active" data-qlist-tab="questions" role="tab" aria-selected="true">{{t .LangCode "qlist.questionsTab"}}</button>
+    <button type="button" class="qlist-tab" data-qlist-tab="votes" role="tab" aria-selected="false">{{t .LangCode "qlist.votesTab"}}</button>
+    <button type="button" class="qlist-tab" data-qlist-tab="chats" role="tab" aria-selected="false">{{t .LangCode "qlist.chatsTab"}}</button>
+  </div>
+
+  <!-- 提问面板（默认展示） -->
+  <div class="qlist-panel" data-qlist-panel="questions">
+    <!-- 统一提示区：标记已读/未读、置顶等操作的成功/错误提示沿用 base/alert 样式 -->
+    {{template "base/alert" .}}
+
+    <!-- 提问箱统计看板（紧凑多列网格：手机4列/桌面7列，降低纵向高度） -->
+    <div class="qlist-stats">
+      <div class="qlist-stat"><span class="qlist-stat-num">{{ .Stats.total }}</span><span class="qlist-stat-lbl">{{t .LangCode "qlist.statsTotal"}}</span></div>
+      <div class="qlist-stat"><span class="qlist-stat-num">{{ .Stats.answered }}</span><span class="qlist-stat-lbl">{{t .LangCode "qlist.statsAnswered"}}</span></div>
+      <div class="qlist-stat"><span class="qlist-stat-num">{{ .Stats.unanswered }}</span><span class="qlist-stat-lbl">{{t .LangCode "qlist.statsUnanswered"}}</span></div>
+      <div class="qlist-stat"><span class="qlist-stat-num">{{ .Stats.read }}</span><span class="qlist-stat-lbl">{{t .LangCode "qlist.statsRead"}}</span></div>
+      <div class="qlist-stat"><span class="qlist-stat-num">{{ .Stats.unread }}</span><span class="qlist-stat-lbl">{{t .LangCode "qlist.statsUnread"}}</span></div>
+      <div class="qlist-stat"><span class="qlist-stat-num">{{ .Stats.private }}</span><span class="qlist-stat-lbl">{{t .LangCode "qlist.statsPrivate"}}</span></div>
+      <div class="qlist-stat"><span class="qlist-stat-num">{{ .Stats.pinned }}</span><span class="qlist-stat-lbl">{{t .LangCode "qlist.statsPinned"}}</span></div>
+    </div>
+
+    <div class="uk-margin-medium-bottom uk-text-center">
+      <!-- 全文搜索自己提问箱 -->
+      <form method="get" action="" class="uk-form-stacked">
+        <div class="uk-flex uk-flex-center uk-flex-nowrap uk-overflow-auto">
+          <div class="uk-margin-small-right uk-width-expand" style="max-width: 420px;">
+            <input type="text" name="q" class="uk-input uk-form-small" value="{{ .Keyword }}" placeholder="{{t .LangCode "qlist.searchPlaceholder"}}" aria-label="{{t .LangCode "qlist.searchPlaceholder"}}">
+          </div>
+          <div class="uk-margin-small-right">
+            <button type="submit" class="uk-button uk-button-primary uk-button-small">{{t .LangCode "qlist.searchBtn"}}</button>
+          </div>
+          {{ if ne .Keyword "" }}
+          <div>
+            <a class="uk-button uk-button-default uk-button-small" href="/user/questions">{{t .LangCode "qlist.searchClear"}}</a>
+          </div>
+          {{ end }}
+        </div>
+      </form>
+      <form method="get" action="" class="uk-form-stacked uk-margin-small-top">
+        <div class="uk-flex uk-flex-center uk-flex-nowrap uk-overflow-auto">
+          <div class="uk-margin-small-right" style="width: 120px;">
+            <label class="uk-form-label uk-text-small">{{t .LangCode "qlist.sort"}}</label>
+            <select name="sort" class="uk-select uk-form-small" onchange="this.form.submit()" style="width: 100%;">
+              <option value="latest" {{if eq .SelectedSort "latest"}}selected{{end}}>{{t .LangCode "qlist.latest"}}</option>
+              <option value="oldest" {{if eq .SelectedSort "oldest"}}selected{{end}}>{{t .LangCode "qlist.oldest"}}</option>
+            </select>
+          </div>
+          <div class="uk-margin-small-right" style="width: 120px;">
+            <label class="uk-form-label uk-text-small">{{t .LangCode "qlist.status"}}</label>
+            <select name="status" class="uk-select uk-form-small" onchange="this.form.submit()" style="width: 100%;">
+              <option value="all" {{if eq .SelectedStatus "all"}}selected{{end}}>{{t .LangCode "qlist.all"}}</option>
+              <option value="answered" {{if eq .SelectedStatus "answered"}}selected{{end}}>{{t .LangCode "qlist.answered"}}</option>
+              <option value="unanswered" {{if eq .SelectedStatus "unanswered"}}selected{{end}}>{{t $.LangCode "qlist.unanswered"}}</option>
+            </select>
+          </div>
+          <div class="uk-margin-small-right" style="width: 120px;">
+            <label class="uk-form-label uk-text-small">{{t .LangCode "qlist.type"}}</label>
+            <select name="type" class="uk-select uk-form-small" onchange="this.form.submit()" style="width: 100%;">
+              <option value="all" {{if eq .SelectedType "all"}}selected{{end}}>{{t .LangCode "qlist.all"}}</option>
+              <option value="public" {{if eq .SelectedType "public"}}selected{{end}}>{{t .LangCode "qlist.public"}}</option>
+              <option value="private_question" {{if eq .SelectedType "private_question"}}selected{{end}}>{{t .LangCode "qlist.privateQuestion"}}</option>
+            </select>
+          </div>
+          <div style="width: 120px;">
+            <label class="uk-form-label uk-text-small">{{t .LangCode "qlist.readStatus"}}</label>
+            <select name="read" class="uk-select uk-form-small" onchange="this.form.submit()" style="width: 100%;">
+              <option value="all" {{if eq .SelectedRead "all"}}selected{{end}}>{{t .LangCode "qlist.all"}}</option>
+              <option value="read" {{if eq .SelectedRead "read"}}selected{{end}}>{{t .LangCode "qlist.read"}}</option>
+              <option value="unread" {{if eq .SelectedRead "unread"}}selected{{end}}>{{t .LangCode "qlist.unread"}}</option>
+            </select>
+          </div>
+        </div>
+      </form>
+    </div>
+
+    <!-- 我收到的提问（标签右浮同行时间，内容下一行） -->
+    <h4>{{t .LangCode "qlist.received"}}</h4>
+    {{ if .ReceivedItems }}
+      {{ range .ReceivedItems }}
+      <div class="uk-margin-medium-bottom" id="question-{{.QuestionID}}">
+        <hr>
+        <!-- 标签在左、按钮在右：两组分开布局；移动端状态/按钮只显示 emoji 图标，保持单行紧凑 -->
+        <div class="uk-flex uk-flex-middle uk-flex-wrap qlist-pills" style="gap: 6px;">
+          <!-- 左：时间 + 状态标签 -->
+          <div class="uk-flex uk-flex-middle uk-flex-wrap" style="gap: 6px;">
+            <span class="uk-text-small uk-text-muted">{{Date .CreatedAt "Y-m-d H:i:s"}}</span>
+            {{ if .IsPinned }}
+            <span class="uk-label uk-label-warning qlist-pill" title="{{t $.LangCode "qlist.pinned"}}"><span class="tb-short">{{t $.LangCode "qlist.pinnedShort"}}</span><span class="tb-text">{{t $.LangCode "qlist.pinned"}}</span></span>
+            {{ end }}
+            {{ if eq .Type "question_private" }}
+            <span class="uk-label uk-label-warning qlist-pill" title="{{t $.LangCode "qlist.private"}}"><span class="tb-short">{{t $.LangCode "qlist.privateShort"}}</span><span class="tb-text">{{t $.LangCode "qlist.private"}}</span></span>
+            {{ end }}
+            {{ if not .IsAnswered }}
+            <span class="uk-label qlist-pill" title="{{t $.LangCode "qlist.unanswered"}}"><span class="tb-short">{{t $.LangCode "qlist.unansweredShort"}}</span><span class="tb-text">{{t $.LangCode "qlist.unanswered"}}</span></span>
+            {{ end }}
+            {{ if .IsRead }}
+            <span class="uk-label uk-label-success qlist-pill" title="{{t $.LangCode "qlist.read"}}"><span class="tb-short">{{t $.LangCode "qlist.readShort"}}</span><span class="tb-text">{{t $.LangCode "qlist.read"}}</span></span>
+            {{ else }}
+            <span class="uk-label qlist-pill" title="{{t $.LangCode "qlist.unread"}}"><span class="tb-short">{{t $.LangCode "qlist.unreadShort"}}</span><span class="tb-text">{{t $.LangCode "qlist.unread"}}</span></span>
+            {{ end }}
+          </div>
+          <!-- 右：操作按钮（margin-left:auto 推到最右，换行后仍保持右对齐） -->
+          <div class="uk-flex uk-flex-middle uk-flex-wrap" style="gap: 6px; margin-left: auto;">
+            {{ if not .IsRead }}
+            <!-- 快捷标记已读：沿用原 tb-label-btn 样式，display:contents 不破坏 flex 布局 -->
+            <form method="post" action="/_/{{$.LoggedUser.Domain}}/{{.QuestionID}}/read" style="margin: 0; display: contents;">
+              {{ $.CSRFTokenHTML }}
+              <button type="submit" class="uk-label tb-label-btn uk-label-success qlist-pill" title="{{t $.LangCode "qitem.markRead"}}"><span class="tb-short">{{t $.LangCode "qitem.markReadShort"}}</span><span class="tb-text">{{t $.LangCode "qitem.markRead"}}</span></button>
+            </form>
+            {{ end }}
+            <!-- form 用 display:contents 不产生盒子，置顶按钮直接参与 flex 对齐 -->
+            <form method="post" action="{{.PinLink}}" style="margin: 0; display: contents;">
+              {{ $.CSRFTokenHTML }}
+              <button type="submit" class="uk-label tb-label-btn {{ if .IsPinned }}uk-label-danger{{ else }}uk-label-primary{{ end }} qlist-pill" title="{{ if .IsPinned }}{{t $.LangCode "qlist.unpin"}}{{ else }}{{t $.LangCode "qlist.pin"}}{{ end }}"><span class="tb-short">{{ if .IsPinned }}{{t $.LangCode "qlist.unpinShort"}}{{ else }}{{t $.LangCode "qlist.pinShort"}}{{ end }}</span><span class="tb-text">{{ if .IsPinned }}{{t $.LangCode "qlist.unpin"}}{{ else }}{{t $.LangCode "qlist.pin"}}{{ end }}</span></button>
+            </form>
+          </div>
+        </div>
+        <a href="{{.Link}}">
+          <div class="uk-text-small uk-text-break tb-preline tb-clamp-5 uk-margin-small-top">{{MarkdownPlainText .Content}}</div>
+        </a>
+      </div>
+      {{ end }}
+      {{ if .HasMoreQuestions }}
+      <div class="uk-text-center uk-margin-medium-top">
+        <a class="uk-button uk-button-default uk-button-small" href="{{ .QuestionLoadMoreURL }}">{{t .LangCode "qlist.loadMore"}}</a>
+      </div>
+      {{ end }}
+    {{ else }}
+      <p class="uk-text-muted">{{t .LangCode "qlist.empty"}}</p>
+    {{ end }}
+  </div>
+
+  <!-- 投票面板 -->
+  <div class="qlist-panel" data-qlist-panel="votes" hidden>
+    <!-- 统一提示区：发布/结束/删除等操作的成功/错误提示沿用 base/alert 样式 -->
+    {{template "base/alert" .}}
+
+    <!-- 投票统计看板（与提问/私聊看板一致） -->
+    <div class="qlist-stats qlist-stats--2">
+      <div class="qlist-stat"><span class="qlist-stat-num">{{ .VoteStats.total }}</span><span class="qlist-stat-lbl">{{t .LangCode "vote.statsTotal"}}</span></div>
+      <div class="qlist-stat"><span class="qlist-stat-num">{{ .VoteStats.published }}</span><span class="qlist-stat-lbl">{{t .LangCode "vote.statsPublished"}}</span></div>
+    </div>
+
+    <div class="uk-card uk-card-default uk-card-small uk-card-body uk-margin-bottom uk-flex uk-flex-between uk-flex-middle">
+      <div>
+        <div class="uk-text-bold">{{t .LangCode "qlist.myVotes"}}</div>
+        <div class="uk-text-meta uk-text-small">{{t .LangCode "vote.manageDesc"}}</div>
+      </div>
+      <a class="uk-button uk-button-primary uk-button-small" href="/user/votes/new">{{t .LangCode "qlist.newVote"}}</a>
+    </div>
+
+    {{ if .MyVotes }}
+      {{ range .MyVotes }}
+      <div class="uk-margin-medium-bottom">
+        <hr>
+        <!-- 第一行：标题 + 类型 + 状态 + 元信息 -->
+        <div class="uk-flex uk-flex-middle uk-flex-wrap" style="gap: 8px;">
+          <span class="uk-text-bold">{{ if .Title }}{{ .Title }}{{ else }}{{t $.LangCode "qlist.untitledVote"}}{{ end }}</span>
+          {{ if eq .Type "single" }}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeSingle"}}</span>{{ end }}
+          {{ if eq .Type "multiple" }}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeMultiple"}}</span>{{ end }}
+          {{ if eq .Type "rating" }}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeRating"}}</span>{{ end }}
+          {{ if eq .Type "rank" }}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeRank"}}</span>{{ end }}
+          {{ if eq .Type "form" }}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.typeForm"}}</span>{{ end }}
+          {{ if eq .EffectiveStatus "draft" }}<span class="uk-label">{{t $.LangCode "vote.statusDraft"}}</span>{{ end }}
+          {{ if eq .EffectiveStatus "published" }}<span class="uk-label uk-label-success">{{t $.LangCode "vote.statusPublished"}}</span>{{ end }}
+          {{ if eq .EffectiveStatus "not_started" }}<span class="uk-label uk-label-primary">{{t $.LangCode "vote.statusNotStarted"}}</span>{{ end }}
+          {{ if eq .EffectiveStatus "ended" }}<span class="uk-label uk-label-warning">{{t $.LangCode "vote.statusEnded"}}</span>{{ end }}
+          {{ if eq .EffectiveStatus "archived" }}<span class="uk-label uk-label-secondary">{{t $.LangCode "vote.statusArchived"}}</span>{{ end }}
+          <span class="uk-text-meta">{{t $.LangCode "vote.participants"}}: {{ .SubmissionCount }}</span>
+          {{ if .RemainingText }}<span class="uk-text-meta">{{ .RemainingText }}</span>{{ end }}
+          <span class="uk-text-meta">{{t $.LangCode "vote.createdAt"}}: {{ .CreatedAt.Format "2006-01-02 15:04" }}</span>
+        </div>
+        <!-- 第二行：操作按钮（统一右对齐，所有状态保持一致的两行布局） -->
+        <div class="uk-flex uk-flex-wrap uk-margin-small-top" style="gap: 6px; justify-content: flex-end;">
+          {{ if eq .EffectiveStatus "draft" }}
+          <form method="post" action="/user/votes/{{ .ID }}/publish" class="uk-display-inline">
+            {{ $.CSRFTokenHTML }}
+            <button class="uk-button uk-button-primary uk-button-small" onclick="return confirm('{{t $.LangCode "vote.confirmPublish"}}')">{{t $.LangCode "vote.publish"}}</button>
+          </form>
+          <a class="uk-button uk-button-default uk-button-small" href="/user/votes/{{ .ID }}/preview">{{t $.LangCode "vote.preview"}}</a>
+          {{ end }}
+          {{ if or (eq .EffectiveStatus "published") (eq .EffectiveStatus "not_started") }}
+          <form method="post" action="/user/votes/{{ .ID }}/close" class="uk-display-inline">
+            {{ $.CSRFTokenHTML }}
+            <button class="uk-button uk-button-warning uk-button-small" onclick="return confirm('{{t $.LangCode "vote.confirmClose"}}')">{{t $.LangCode "vote.close"}}</button>
+          </form>
+          {{ end }}
+          {{ if ne .EffectiveStatus "archived" }}
+          <a class="uk-button uk-button-default uk-button-small" href="/user/votes/{{ .ID }}/edit">{{t $.LangCode "vote.edit"}}</a>
+          {{ end }}
+          {{ if ne .EffectiveStatus "draft" }}
+          <a class="uk-button uk-button-default uk-button-small" href="/user/votes/{{ .ID }}/results">{{t $.LangCode "vote.results"}}</a>
+          <a class="uk-button uk-button-default uk-button-small" href="/user/votes/{{ .ID }}/export">{{t $.LangCode "vote.export"}}</a>
+          {{ end }}
+          {{ if or (eq .EffectiveStatus "published") (eq .EffectiveStatus "not_started") }}
+          <button class="uk-button uk-button-default uk-button-small" onclick="copyShareURL('{{ .LinkToken }}', this)">{{t $.LangCode "vote.share"}}</button>
+          {{ end }}
+          <form method="post" action="/user/votes/{{ .ID }}/delete" class="uk-display-inline">
+            {{ $.CSRFTokenHTML }}
+            <button class="uk-button uk-button-danger uk-button-small" onclick="return confirm('{{t $.LangCode "vote.confirmDelete"}}')">{{t $.LangCode "common.delete"}}</button>
+          </form>
+        </div>
+      </div>
+      {{ end }}
+      {{ if .HasMoreVotes }}
+      <div class="uk-text-center uk-margin-medium-top">
+        <a class="uk-button uk-button-default uk-button-small" href="{{ .VoteLoadMoreURL }}">{{t .LangCode "qlist.loadMore"}}</a>
+      </div>
+      {{ end }}
+    {{ else }}
+      <div class="uk-alert uk-alert-primary uk-margin-remove">{{t .LangCode "vote.empty"}}</div>
+    {{ end }}
+  </div>
+
+  <!-- 私聊面板 -->
+  <div class="qlist-panel" data-qlist-panel="chats" hidden>
+    <!-- 统一提示区：私聊相关操作的成功/错误提示沿用 base/alert 样式 -->
+    {{template "base/alert" .}}
+
+    <!-- 私聊统计看板（与提问/投票看板一致） -->
+    <div class="qlist-stats qlist-stats--4">
+      <div class="qlist-stat"><span class="qlist-stat-num">{{ .ChatStats.total }}</span><span class="qlist-stat-lbl">{{t .LangCode "qlist.chatStatsTotal"}}</span></div>
+      <div class="qlist-stat"><span class="qlist-stat-num">{{ .ChatStats.received }}</span><span class="qlist-stat-lbl">{{t .LangCode "qlist.chatStatsReceived"}}</span></div>
+      <div class="qlist-stat"><span class="qlist-stat-num">{{ .ChatStats.initiated }}</span><span class="qlist-stat-lbl">{{t .LangCode "qlist.chatStatsInitiated"}}</span></div>
+      <div class="qlist-stat"><span class="qlist-stat-num">{{ .ChatStats.closed }}</span><span class="qlist-stat-lbl">{{t .LangCode "qlist.chatStatsClosed"}}</span></div>
+    </div>
+
+    <!-- 我收到的私聊 -->
+    <h4>{{t .LangCode "qlist.receivedChats"}}（{{ .ChatStats.received }}）</h4>
+    {{ if .ReceivedChats }}
+      {{ range .ReceivedChats }}
+      <div class="uk-margin-medium-bottom">
+        <hr>
+        <div class="uk-float-right uk-flex uk-flex-middle uk-flex-wrap" style="gap: 6px;">
+          <span class="uk-label uk-label-success">{{t $.LangCode "chat.title"}}</span>
+          {{ if .IsBlocked }}
+          <span class="uk-label uk-label-danger">{{t $.LangCode "qlist.blocked"}}</span>
+          {{ end }}
+        </div>
+        <a href="{{.Link}}">
+          <div class="uk-text-left uk-text-small uk-text-muted">{{Date .CreatedAt "Y-m-d H:i:s"}}</div>
+          <div class="uk-text-small uk-text-break tb-preline tb-clamp-5 uk-margin-small-top">{{.Content}}</div>
+        </a>
+      </div>
+      {{ end }}
+    {{ else }}
+      <p class="uk-text-muted">{{t .LangCode "qlist.chatEmpty"}}</p>
+    {{ end }}
+
+    {{ if .HasMoreChats }}
+    <div class="uk-text-center uk-margin-medium-top">
+      <a class="uk-button uk-button-default uk-button-small" href="{{ .ChatLoadMoreURL }}">{{t .LangCode "qlist.loadMore"}}</a>
+    </div>
+    {{ end }}
+
+    <!-- 我发起的私聊 -->
+    {{ if .ConversationDetails }}
+    <h4 class="uk-margin-top">{{t .LangCode "qlist.myChats"}}（{{ .ChatStats.initiated }}）</h4>
+      {{ range .ConversationDetails }}
+      <a href="/_/{{.OwnerDomain}}/chat/{{.Conversation.Token}}" class="uk-display-block uk-overflow-hidden uk-margin-medium-bottom">
+        <div>
+          <hr>
+          <span class="uk-label uk-label-warning uk-float-right uk-margin-small-right">{{t $.LangCode "chat.title"}}</span>
+          {{ if .IsBlocked }}
+            <span class="uk-label uk-label-danger uk-float-right uk-margin-small-right">{{t $.LangCode "qlist.blocked"}}</span>
+          {{ end }}
+          <div class="uk-text-left uk-text-small uk-text-muted">{{Date .Conversation.CreatedAt "Y-m-d H:i:s"}}</div>
+          <div class="uk-text-small uk-text-break tb-preline tb-clamp-5 uk-margin-small-top">{{.FirstMessage}}</div>
+        </div>
+      </a>
+      {{ end }}
+    {{ end }}
+    {{ if .HasMoreAskedChats }}
+    <div class="uk-text-center uk-margin-medium-top">
+      <a class="uk-button uk-button-default uk-button-small" href="{{ .AskedChatsLoadMoreURL }}">{{t .LangCode "qlist.loadMore"}}</a>
+    </div>
+    {{ end }}
+  </div>
+</div>
+
+<script>
+function copyShareURL(token, btn) {
+  var url = window.location.origin + "/vote/" + token;
+  if (navigator.clipboard && navigator.clipboard.writeText) {
+    navigator.clipboard.writeText(url).then(function () {
+      var old = btn.textContent;
+      btn.textContent = '{{t .LangCode "vote.copied"}}';
+      setTimeout(function () { btn.textContent = old; }, 1500);
+    });
+  } else {
+    prompt('{{t .LangCode "vote.shareURL"}}', url);
+  }
+}
+
+document.addEventListener('DOMContentLoaded', function() {
+  const tabs = document.querySelectorAll('[data-qlist-tab]');
+  const panels = document.querySelectorAll('[data-qlist-panel]');
+  function showQlistPanel(name) {
+    tabs.forEach(function(tab) {
+      const active = tab.dataset.qlistTab === name;
+      tab.classList.toggle('is-active', active);
+      tab.setAttribute('aria-selected', active ? 'true' : 'false');
+    });
+    panels.forEach(function(panel) {
+      panel.hidden = panel.dataset.qlistPanel !== name;
+    });
+    if (window.history && window.history.replaceState) {
+      const hash = name === 'votes' ? '#votes' : (name === 'chats' ? '#chats' : '');
+      window.history.replaceState({}, document.title, window.location.pathname + hash);
+    }
+  }
+  tabs.forEach(function(tab) {
+    tab.addEventListener('click', function() { showQlistPanel(tab.dataset.qlistTab); });
+  });
+  if (window.location.hash === '#votes') showQlistPanel('votes');
+  if (window.location.hash === '#chats') showQlistPanel('chats');
+});
+</script>
+
+{{template "base/footer" .}}
diff --git a/templates/user/vote-form.html b/templates/user/vote-form.html
new file mode 100644
index 0000000..19aefff
--- /dev/null
+++ b/templates/user/vote-form.html
@@ -0,0 +1,392 @@
+{{template "base/header" .}}
+
+<div class="uk-flex uk-flex-between uk-flex-middle uk-margin-bottom">
+  <h3 class="uk-margin-remove">
+    {{ if .IsEdit }}{{t .LangCode "vote.editTitle"}}{{ else }}{{t .LangCode "vote.newTitle"}}{{ end }}
+  </h3>
+  <a class="uk-button uk-button-default uk-button-small" href="/user/questions#votes">{{t .LangCode "common.back"}}</a>
+</div>
+
+<form method="post" action="{{ if .IsEdit }}/user/votes/{{ .Vote.ID }}{{ else }}/user/votes{{ end }}" onsubmit="return validateBuilderForm(event)">
+  {{ .CSRFTokenHTML }}
+
+  {{template "base/alert" .}}
+
+  <!-- 基本设置 -->
+  <div class="uk-card uk-card-default uk-card-small uk-card-body uk-margin-bottom">
+    <h4 class="uk-margin-small-bottom">{{t .LangCode "vote.formBasic"}}</h4>
+
+    {{ if .LockedContent }}
+    <div class="uk-alert uk-alert-warning uk-margin-small-bottom">{{t .LangCode "vote.formLockedHint"}}</div>
+    {{ end }}
+
+    <div class="uk-margin-small">
+      <label class="uk-form-label">{{t .LangCode "vote.formTitle"}} *</label>
+      <input class="uk-input" type="text" name="title" maxlength="100" required value="{{ if .Vote }}{{ .Vote.Title }}{{ end }}" placeholder="{{t .LangCode "vote.formTitlePlaceholder"}}">
+    </div>
+
+    <div class="uk-margin-small">
+      <label class="uk-form-label">{{t .LangCode "vote.formDescription"}}</label>
+      <textarea class="uk-textarea" name="description" rows="3" maxlength="5000" placeholder="{{t .LangCode "vote.formDescriptionPlaceholder"}}">{{ if .Vote }}{{ .Vote.Description }}{{ end }}</textarea>
+    </div>
+
+    <div class="uk-grid-small uk-child-width-1-2@s uk-margin-small-top" uk-grid>
+      <div>
+        <label class="uk-form-label">{{t .LangCode "vote.formType"}}</label>
+        {{ if .LockedContent }}
+        <input class="uk-input" type="text" disabled
+               value="{{ if eq .Vote.Type "single" }}{{t $.LangCode "vote.typeSingle"}}{{ else if eq .Vote.Type "multiple" }}{{t $.LangCode "vote.typeMultiple"}}{{ else if eq .Vote.Type "rating" }}{{t $.LangCode "vote.typeRating"}}{{ else if eq .Vote.Type "rank" }}{{t $.LangCode "vote.typeRank"}}{{ else }}{{t $.LangCode "vote.typeForm"}}{{ end }}">
+        {{ else }}
+        <select class="uk-select" name="type" id="vote-type" onchange="toggleEditor()">
+          <option value="single" {{ if and .Vote (eq .Vote.Type "single") }}selected{{ end }}>{{t .LangCode "vote.typeSingle"}}</option>
+          <option value="multiple" {{ if and .Vote (eq .Vote.Type "multiple") }}selected{{ end }}>{{t .LangCode "vote.typeMultiple"}}</option>
+          <option value="rating" {{ if and .Vote (eq .Vote.Type "rating") }}selected{{ end }}>{{t .LangCode "vote.typeRating"}}</option>
+          <option value="rank" {{ if and .Vote (eq .Vote.Type "rank") }}selected{{ end }}>{{t .LangCode "vote.typeRank"}}</option>
+          <option value="form" {{ if and .Vote (eq .Vote.Type "form") }}selected{{ end }}>{{t .LangCode "vote.typeForm"}}</option>
+        </select>
+        {{ end }}
+      </div>
+      <div>
+        <label class="uk-form-label">{{t .LangCode "vote.formVisibility"}} *</label>
+        <select class="uk-select" name="visibility">
+          <option value="public" {{ if and .Vote (eq .Vote.Visibility "public") }}selected{{ end }}>{{t .LangCode "vote.formVisibilityPublic"}}</option>
+          <option value="link_only" {{ if and .Vote (eq .Vote.Visibility "link_only") }}selected{{ end }}>{{t .LangCode "vote.formVisibilityLinkOnly"}}</option>
+        </select>
+      </div>
+      <div>
+        <label class="uk-form-label">{{t .LangCode "vote.formVoterScope"}} *</label>
+        <select class="uk-select" name="voter_scope">
+          <option value="anyone" {{ if and .Vote (eq .Vote.VoterScope "anyone") }}selected{{ end }}>{{t .LangCode "vote.formVoterScopeAnyone"}}</option>
+          <option value="registered_only" {{ if and .Vote (eq .Vote.VoterScope "registered_only") }}selected{{ end }}>{{t .LangCode "vote.formVoterScopeRegistered"}}</option>
+        </select>
+      </div>
+      <div>
+        <label class="uk-form-label">{{t .LangCode "vote.formShowResult"}} *</label>
+        <select class="uk-select" name="show_result">
+          <option value="after_vote" {{ if and .Vote (eq .Vote.ShowResult "after_vote") }}selected{{ end }}>{{t .LangCode "vote.formShowResultAfterVote"}}</option>
+          <option value="after_end" {{ if and .Vote (eq .Vote.ShowResult "after_end") }}selected{{ end }}>{{t .LangCode "vote.formShowResultAfterEnd"}}</option>
+          <option value="owner_only" {{ if and .Vote (eq .Vote.ShowResult "owner_only") }}selected{{ end }}>{{t .LangCode "vote.formShowResultOwnerOnly"}}</option>
+        </select>
+      </div>
+      <div class="uk-margin-small-top">
+        <label class="uk-form-label">{{t .LangCode "vote.formStartAt"}}</label>
+        <input class="uk-input" type="datetime-local" name="start_at" value="{{ .StartAtStr }}">
+      </div>
+      <div class="uk-margin-small-top">
+        <label class="uk-form-label">{{t .LangCode "vote.formEndAt"}}</label>
+        <input class="uk-input" type="datetime-local" name="end_at" value="{{ .EndAtStr }}">
+      </div>
+      <div class="uk-margin-small-top">
+        <label class="uk-form-label">{{t .LangCode "vote.formQuotaLimit"}}</label>
+        <input class="uk-input" type="number" name="quota_limit" min="0" max="1000000" value="{{ if .Vote }}{{ .Vote.QuotaLimit }}{{ else }}0{{ end }}">
+        <span class="uk-text-meta uk-text-small">{{t .LangCode "vote.formQuotaHint"}}</span>
+      </div>
+      {{ if not .LockedContent }}
+      <div id="max-choices-field" class="uk-margin-small-top">
+        <label class="uk-form-label">{{t .LangCode "vote.formMaxChoices"}}</label>
+        <input class="uk-input" type="number" name="max_choices" min="1" max="20" value="{{ if .Vote }}{{ .Vote.MaxChoices }}{{ else }}3{{ end }}">
+      </div>
+      {{ end }}
+    </div>
+
+    <!-- 限投提醒：移出两列网格，桌面/移动均占满整行，避免与输入框并排显得局促 -->
+    <!-- registered_only 时限制维度变为"每账号"，否则为"每设备"，文案随之切换 -->
+    <div class="uk-margin-small-top">
+      <div id="scope-hint" class="uk-alert uk-alert-primary uk-margin-remove-bottom" role="status">
+        <span id="scope-hint-device"{{ if and .Vote (eq .Vote.VoterScope "registered_only") }} hidden{{ end }}>{{t .LangCode "vote.formMaxVotesPerFingerprint"}}</span><span id="scope-hint-account"{{ if and .Vote (eq .Vote.VoterScope "registered_only") }}{{ else }} hidden{{ end }}>{{t .LangCode "vote.formMaxVotesPerAccount"}}</span>
+      </div>
+    </div>
+
+    <div class="uk-margin-small-top uk-grid-small uk-child-width-1-2@s" uk-grid>
+      <!-- 全局"允许补充自定义选项"仅对单选/多选/排序生效；表单收集与评分类型由各自机制控制，此处隐藏避免误导 -->
+      <label id="global-custom-field" class="uk-form-label" {{ if and .Vote (or (eq .Vote.Type "form") (eq .Vote.Type "rating")) }}hidden{{ end }}><input class="uk-checkbox" type="checkbox" name="allow_custom" {{ if and .Vote .Vote.AllowCustom }}checked{{ end }}> {{t .LangCode "vote.formAllowCustom"}}</label>
+      <label class="uk-form-label"><input class="uk-checkbox" type="checkbox" name="require_captcha" checked disabled> {{t .LangCode "vote.formRequireCaptcha"}}</label>
+    </div>
+  </div>
+
+  {{ if not .LockedContent }}
+  <!-- 选项编辑器（单选/多选/排序；评分题无需选项） -->
+  <div class="uk-card uk-card-default uk-card-small uk-card-body uk-margin-bottom" id="options-editor">
+    <h4 class="uk-margin-small-bottom">{{t .LangCode "vote.formOptions"}}</h4>
+    <div id="rating-hint" class="uk-alert uk-alert-primary uk-margin-small-bottom" hidden>{{t .LangCode "vote.formRatingHint"}}</div>
+    <div id="options-list"></div>
+    <button type="button" class="uk-button uk-button-default uk-button-small" onclick="addOption()">{{t .LangCode "vote.addOption"}}</button>
+    <input type="hidden" name="options" id="options-payload">
+  </div>
+
+  <!-- 表单字段设计器（表单收集类型） -->
+  <div class="uk-card uk-card-default uk-card-small uk-card-body uk-margin-bottom" id="fields-editor" hidden>
+    <h4 class="uk-margin-small-bottom">{{t .LangCode "vote.formFields"}}</h4>
+    <div id="fields-list"></div>
+    <button type="button" class="uk-button uk-button-default uk-button-small" onclick="addField()">{{t .LangCode "vote.addField"}}</button>
+    <input type="hidden" name="form_fields" id="fields-payload">
+  </div>
+  {{ end }}
+
+  <div class="uk-margin">
+    <input type="hidden" name="action" id="vote-action" value="save">
+    {{ if and .IsEdit (not .LockedContent) }}<button class="uk-button uk-button-default" type="submit" onclick="setVoteAction('preview')">{{t .LangCode "vote.preview"}}</button>{{ end }}
+    <button class="uk-button uk-button-primary" type="submit" onclick="setVoteAction('save')">{{ if .IsEdit }}{{t .LangCode "common.save"}}{{ else }}{{t .LangCode "vote.createDraft"}}{{ end }}</button>
+    {{ if not .LockedContent }}<button class="uk-button uk-button-secondary" type="submit" onclick="setVoteAction('publish')">{{t .LangCode "vote.publish"}}</button>{{ end }}
+    <a class="uk-button uk-button-default" href="/user/questions#votes">{{t .LangCode "common.cancel"}}</a>
+  </div>
+  <div id="builder-hint" class="uk-alert uk-alert-danger uk-margin-small-top" hidden></div>
+</form>
+
+<script>
+var INITIAL_OPTIONS = {{ toJSON .InitialOptions }};
+var INITIAL_FIELDS = {{ toJSON .InitialFields }};
+// 站长侧单个选项文本上限，与后端 conf.Limits.VoteOptionLen（[limits] 配置段）同源。
+// 参与者的自定义补充文本上限是另一套 MAX_CUSTOM_LEN（conf.Limits.CustomAnswerLen），二者独立。
+var MAX_OPTION_LEN = {{ .MaxVoteOptionLen }};
+var optionsData = [];
+var fieldsData = [];
+
+function toggleEditor() {
+  var t = document.getElementById('vote-type').value;
+  var optEditor = document.getElementById('options-editor');
+  var fldEditor = document.getElementById('fields-editor');
+  var maxField = document.getElementById('max-choices-field');
+  var ratingHint = document.getElementById('rating-hint');
+  var globalCustom = document.getElementById('global-custom-field');
+  optEditor.hidden = (t === 'form');
+  fldEditor.hidden = (t !== 'form');
+  maxField.hidden = (t !== 'multiple');
+  ratingHint.hidden = (t !== 'rating');
+  if (globalCustom) { globalCustom.hidden = (t === 'form' || t === 'rating'); }
+  updateBuilderHint();
+}
+
+function addOption() { optionsData.push(''); renderOptions(); updateBuilderHint(); }
+function removeOption(i) { optionsData.splice(i, 1); renderOptions(); updateBuilderHint(); }
+
+function renderOptions() {
+  var list = document.getElementById('options-list');
+  list.innerHTML = '';
+  optionsData.forEach(function (val, i) {
+    var row = document.createElement('div');
+    row.className = 'uk-flex uk-flex-middle uk-margin-small-bottom';
+    row.style.gap = '6px';
+    row.innerHTML = '<span class="uk-text-meta">' + (i + 1) + '.</span>' +
+      '<input class="uk-input" style="flex:1" type="text" maxlength="' + MAX_OPTION_LEN + '" placeholder="{{t .LangCode "vote.optionPlaceholder"}}" value="' + escapeAttr(val) + '" oninput="optionsData[' + i + ']=this.value">' +
+      '<button type="button" class="uk-button uk-button-danger uk-button-small" onclick="removeOption(' + i + ')">{{t .LangCode "common.delete"}}</button>';
+    list.appendChild(row);
+  });
+}
+
+function addField() {
+  fieldsData.push({ field_type: 'radio', label: '', required: false, max_length: 0, optionsArr: [], allow_custom: false });
+  renderFields();
+  updateBuilderHint();
+}
+function removeField(i) { fieldsData.splice(i, 1); renderFields(); updateBuilderHint(); }
+// 字段上下移：交换数组元素后重渲染；保存时 payload 顺序即新顺序（后端按数组下标写 SortOrder）
+function moveField(i, dir) {
+  var j = i + dir;
+  if (j < 0 || j >= fieldsData.length) { return; }
+  var tmp = fieldsData[i]; fieldsData[i] = fieldsData[j]; fieldsData[j] = tmp;
+  renderFields();
+  updateBuilderHint();
+}
+
+function renderFields() {
+  var list = document.getElementById('fields-list');
+  list.innerHTML = '';
+  fieldsData.forEach(function (f, i) {
+    var box = document.createElement('div');
+    box.className = 'uk-card uk-card-default uk-card-small uk-card-body uk-margin-small-bottom';
+    box.innerHTML =
+      '<div class="uk-flex uk-flex-between uk-flex-middle uk-margin-small-bottom">' +
+        '<span class="uk-text-bold">{{t .LangCode "vote.field"}} ' + (i + 1) + '</span>' +
+        '<div class="uk-flex uk-flex-middle" style="gap:6px">' +
+          '<button type="button" class="uk-button uk-button-default uk-button-small"' + (i === 0 ? ' disabled' : '') + ' onclick="moveField(' + i + ',-1)" title="{{t .LangCode "common.moveUp"}}">↑</button>' +
+          '<button type="button" class="uk-button uk-button-default uk-button-small"' + (i === fieldsData.length - 1 ? ' disabled' : '') + ' onclick="moveField(' + i + ',1)" title="{{t .LangCode "common.moveDown"}}">↓</button>' +
+          '<button type="button" class="uk-button uk-button-danger uk-button-small" onclick="removeField(' + i + ')">{{t .LangCode "common.delete"}}</button>' +
+        '</div>' +
+      '</div>' +
+      '<div class="uk-grid-small uk-child-width-1-2@s" uk-grid>' +
+        '<div><label class="uk-form-label">{{t .LangCode "vote.formFieldType"}}</label>' +
+          '<select class="uk-select" onchange="fieldsData[' + i + '].field_type=this.value;renderFields()">' +
+            '<option value="radio"' + (f.field_type === 'radio' ? ' selected' : '') + '>{{t .LangCode "vote.fieldTypeRadio"}}</option>' +
+            '<option value="text"' + (f.field_type === 'text' ? ' selected' : '') + '>{{t .LangCode "vote.fieldTypeText"}}</option>' +
+            '<option value="textarea"' + (f.field_type === 'textarea' ? ' selected' : '') + '>{{t .LangCode "vote.fieldTypeTextarea"}}</option>' +
+            '<option value="select"' + (f.field_type === 'select' ? ' selected' : '') + '>{{t .LangCode "vote.fieldTypeSelect"}}</option>' +
+            '<option value="checkbox"' + (f.field_type === 'checkbox' ? ' selected' : '') + '>{{t .LangCode "vote.fieldTypeCheckbox"}}</option>' +
+            '<option value="number"' + (f.field_type === 'number' ? ' selected' : '') + '>{{t .LangCode "vote.fieldTypeNumber"}}</option>' +
+            '<option value="rating"' + (f.field_type === 'rating' ? ' selected' : '') + '>{{t .LangCode "vote.fieldTypeRating"}}</option>' +
+            '<option value="rank"' + (f.field_type === 'rank' ? ' selected' : '') + '>{{t .LangCode "vote.fieldTypeRank"}}</option>' +
+          '</select></div>' +
+        '<div><label class="uk-form-label">{{t .LangCode "vote.formFieldLabel"}}</label>' +
+          '<input class="uk-input" type="text" maxlength="100" value="' + escapeAttr(f.label) + '" oninput="fieldsData[' + i + '].label=this.value"></div>' +
+      '</div>' +
+      '<div class="uk-grid-small uk-child-width-1-3@s uk-margin-small-top" uk-grid>' +
+        '<label class="uk-form-label"><input class="uk-checkbox" type="checkbox"' + (f.required ? ' checked' : '') + ' onchange="fieldsData[' + i + '].required=this.checked"> {{t .LangCode "vote.formFieldRequired"}}</label>' +
+        '<div id="maxlen-' + i + '"' + (isTextType(f.field_type) ? '' : ' style="display:none"') + '><label class="uk-form-label">{{t .LangCode "vote.formFieldMaxLength"}}</label>' +
+          '<input class="uk-input" type="number" min="0" max="2000" value="' + (f.max_length || 0) + '" oninput="fieldsData[' + i + '].max_length=parseInt(this.value||0)"></div>' +
+      '</div>' +
+      '<div class="uk-margin-small-top" id="opts-' + i + '"' + (isChoiceType(f.field_type) ? '' : ' hidden') + '>' +
+        '<label class="uk-form-label">{{t .LangCode "vote.formFieldOptions"}}</label>' +
+        '<div class="uk-text-meta uk-margin-small-top">{{t .LangCode "vote.formFieldOptionsHint"}}</div>' +
+        '<div id="fopts-' + i + '" class="uk-margin-small-top"></div>' +
+        '<button type="button" class="uk-button uk-button-default uk-button-small" onclick="addFieldOption(' + i + ')">{{t .LangCode "vote.addOption"}}</button>' +
+      '</div>' +
+      '<div class="uk-margin-small-top" id="custom-' + i + '"' + (isCustomType(f.field_type) ? '' : ' hidden') + '>' +
+        '<label class="uk-form-label"><input class="uk-checkbox" type="checkbox"' + (f.allow_custom ? ' checked' : '') + ' onchange="fieldsData[' + i + '].allow_custom=this.checked"> {{t .LangCode "vote.fieldAllowCustom"}}</label>' +
+      '</div>';
+    list.appendChild(box);
+    if (isChoiceType(f.field_type)) { renderFieldOptions(i); }
+  });
+  if (typeof UIkit !== 'undefined') { UIkit.update(list); }
+}
+
+function isChoiceType(t) { return t === 'select' || t === 'radio' || t === 'checkbox' || t === 'rank'; }
+
+// 支持"补充自定义选项"的字段类型（rank 排序题不开放）
+function isCustomType(t) { return t === 'select' || t === 'radio' || t === 'checkbox'; }
+
+function isTextType(t) { return t === 'text' || t === 'textarea'; }
+
+// 字段选项兼容处理：后端可能返回数组（新）或逗号字符串（旧数据/回填），统一为数组。
+function normalizeFieldOptions(v) {
+  if (Array.isArray(v)) return v.slice();
+  if (typeof v === 'string' && v !== '') return v.split(',').map(function (x) { return x.trim(); }).filter(function (x) { return x !== ''; });
+  return [];
+}
+
+// 渲染单个字段的选项行（逐条 add/remove），避免整段文本框 + 逗号分隔。
+function renderFieldOptions(i) {
+  var box = document.getElementById('fopts-' + i);
+  if (!box) return;
+  box.innerHTML = '';
+  var arr = fieldsData[i].optionsArr || [];
+  arr.forEach(function (val, j) {
+    var row = document.createElement('div');
+    row.className = 'uk-flex uk-flex-middle uk-margin-small-bottom';
+    row.style.gap = '6px';
+    row.innerHTML = '<span class="uk-text-meta">' + (j + 1) + '.</span>' +
+      '<input class="uk-input" style="flex:1" type="text" maxlength="' + MAX_OPTION_LEN + '" placeholder="{{t .LangCode "vote.optionPlaceholder"}}" value="' + escapeAttr(val) + '" oninput="fieldsData[' + i + '].optionsArr[' + j + ']=this.value">' +
+      '<button type="button" class="uk-button uk-button-danger uk-button-small" onclick="removeFieldOption(' + i + ',' + j + ')">{{t .LangCode "common.delete"}}</button>';
+    box.appendChild(row);
+  });
+}
+
+function addFieldOption(i) { (fieldsData[i].optionsArr = fieldsData[i].optionsArr || []).push(''); renderFieldOptions(i); }
+function removeFieldOption(i, j) { fieldsData[i].optionsArr.splice(j, 1); renderFieldOptions(i); }
+
+// 设置提交动作：save=保存草稿（宽松），publish=发布（一次性完整校验）。
+function setVoteAction(a) { document.getElementById('vote-action').value = a; }
+
+// 前端即时校验：根据题型/字段返回需提示给用户的信息；空字符串表示通过。
+// 锁定模式（已发布投票）下无选项/字段编辑器，直接返回通过。
+function computeBuilderHint() {
+  if (!document.getElementById('options-payload') && !document.getElementById('fields-payload')) {
+    return '';
+  }
+  var t = document.getElementById('vote-type').value;
+  if (t === 'single' || t === 'multiple' || t === 'rank') {
+    var cnt = 0;
+    for (var i = 0; i < optionsData.length; i++) {
+      if (optionsData[i].trim() !== '') cnt++;
+    }
+    if (cnt < 2) return '{{t .LangCode "vote.builderHintOptions"}}';
+  } else if (t === 'form') {
+    if (fieldsData.length < 1) return '{{t .LangCode "vote.builderHintFields"}}';
+    for (var i = 0; i < fieldsData.length; i++) {
+      var f = fieldsData[i];
+      if (isChoiceType(f.field_type)) {
+        var opts = (f.optionsArr || []).map(function (x) { return x.trim(); }).filter(function (x) { return x !== ''; });
+        if (opts.length < (f.field_type === 'rank' ? 2 : 1)) {
+          return '{{t .LangCode "vote.builderHintFieldOptions"}}';
+        }
+      }
+    }
+  }
+  return '';
+}
+
+// 实时更新提示条（切换题型/增删选项或字段时调用）
+function updateBuilderHint() {
+  var m = computeBuilderHint();
+  var el = document.getElementById('builder-hint');
+  if (m) { el.textContent = m; el.hidden = false; } else { el.hidden = true; }
+}
+
+// 提交时执行：先收集 payload，再按当前动作做校验。
+// 发布动作下校验不通过则阻止提交；草稿动作仅提示，不阻止（草稿本就允许暂存）。
+function validateBuilderForm(event) {
+  buildPayload();
+  var m = computeBuilderHint();
+  var el = document.getElementById('builder-hint');
+  if (m) {
+    el.textContent = m; el.hidden = false;
+    if (document.getElementById('vote-action').value === 'publish') {
+      resetSubmitState();
+      var form = event && event.target ? event.target : document.querySelector('form');
+      if (form) form.setAttribute('data-tb-skip-submit-feedback', '1');
+      if (event) event.preventDefault();
+      el.scrollIntoView({ behavior: 'smooth', block: 'center' });
+      return false;
+    }
+  } else {
+    el.hidden = true;
+  }
+  return true;
+}
+
+function buildPayload() {
+  // 发布后锁定模式：无选项/字段编辑器，跳过 JSON 收集
+  var optPayload = document.getElementById('options-payload');
+  if (optPayload) {
+    var options = optionsData.map(function (v) { return v.trim(); }).filter(function (v) { return v !== ''; });
+    optPayload.value = JSON.stringify(options);
+  }
+  var fldPayload = document.getElementById('fields-payload');
+  if (fldPayload) {
+    var fields = fieldsData.map(function (f) {
+      return { field_type: f.field_type, label: f.label, required: f.required, max_length: f.max_length || 0, options: (f.optionsArr || []), allow_custom: !!f.allow_custom };
+    });
+    fldPayload.value = JSON.stringify(fields);
+  }
+  return true;
+}
+
+function escapeAttr(s) {
+  return String(s == null ? '' : s).replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+
+// 限投维度提示：仅注册用户投票时切换为"每账号"，否则"每设备"。
+// 与提交逻辑一致——registered_only 下指纹维度不参与，约束实为每账号一票。
+function updateScopeHint() {
+  var sel = document.querySelector('select[name="voter_scope"]');
+  var dev = document.getElementById('scope-hint-device');
+  var acc = document.getElementById('scope-hint-account');
+  if (!sel || !dev || !acc) return;
+  var isReg = sel.value === 'registered_only';
+  dev.hidden = isReg;
+  acc.hidden = !isReg;
+}
+
+(function init() {
+  // 发布后锁定模式：编辑器未渲染，跳过初始化
+  {{ if .LockedContent }}return;{{ end }}
+  optionsData = INITIAL_OPTIONS.slice();
+  fieldsData = INITIAL_FIELDS.map(function (f) { return { field_type: f.field_type || 'text', label: f.label || '', required: !!f.required, max_length: f.max_length || 0, optionsArr: normalizeFieldOptions(f.options), allow_custom: !!f.allow_custom }; });
+  renderOptions();
+  renderFields();
+  toggleEditor();
+  updateBuilderHint();
+  var scopeSel = document.querySelector('select[name="voter_scope"]');
+  if (scopeSel) { scopeSel.addEventListener('change', updateScopeHint); }
+  updateScopeHint();
+})();
+</script>
+
+{{if .DraftSaved}}
+<script>
+if (window.history && window.history.replaceState) {
+  window.history.replaceState({}, document.title, window.location.pathname);
+}
+</script>
+{{end}}
+
+{{template "base/footer" .}}
diff --git a/templates/user/vote-results.html b/templates/user/vote-results.html
new file mode 100644
index 0000000..7300b1b
--- /dev/null
+++ b/templates/user/vote-results.html
@@ -0,0 +1,182 @@
+{{template "base/header" .}}
+
+<div class="uk-flex uk-flex-between uk-flex-middle uk-margin-bottom">
+  <h3 class="uk-margin-remove">{{t .LangCode "vote.resultsTitle"}}：{{ .Vote.Title }}</h3>
+  <div class="uk-flex uk-flex-middle" style="gap: 8px;">
+    <a class="uk-button uk-button-default uk-button-small" href="/user/votes/{{ .Vote.ID }}/export">{{t .LangCode "vote.export"}}</a>
+    <a class="uk-button uk-button-default uk-button-small" href="/user/questions#votes">{{t .LangCode "common.back"}}</a>
+  </div>
+</div>
+
+<div class="uk-card uk-card-default uk-card-small uk-card-body uk-margin-bottom">
+  <div class="uk-text-large uk-text-bold">{{ .Total }}</div>
+  <div class="uk-text-meta">{{t .LangCode "vote.resultsTotal"}}</div>
+</div>
+
+{{ if eq .Vote.Type "form" }}
+  <!-- 表单收集（混合问卷）字段级聚合统计 -->
+  {{ if .Results.FormFieldStats }}
+  <h4>{{t .LangCode "vote.resultsOptions"}}</h4>
+  <div class="uk-card uk-card-default uk-card-small uk-card-body uk-margin-bottom">
+    {{ range $si, $stat := .Results.FormFieldStats }}
+    <div class="uk-margin">
+      <div class="uk-flex uk-flex-middle uk-margin-small-bottom" style="gap: 8px;">
+        <span class="uk-label">{{ add $si 1 }}</span>
+        <span class="uk-label {{ fieldTypeLabelClass $stat.Field.FieldType }}">{{ fieldTypeLabel $.LangCode $stat.Field.FieldType }}</span>
+        <span class="uk-text-bold">{{ $stat.Field.Label }}</span>
+        <span class="uk-text-meta uk-text-small">{{t $.LangCode "vote.resultsAnswered"}}: {{ $stat.Total }}</span>
+      </div>
+
+      {{ if or (eq $stat.Field.FieldType "radio") (eq $stat.Field.FieldType "select") (eq $stat.Field.FieldType "checkbox") }}
+        {{ $denom := $stat.Total }}
+        {{ if eq $stat.Field.FieldType "checkbox" }}{{ $denom = $stat.TotalSelections }}{{ end }}
+        {{ range $o := $stat.OptionStats }}
+        <div class="uk-margin-small-top">
+          <div class="uk-flex uk-flex-between">
+            <span>{{ $o.Option.Content }}</span>
+            <span class="uk-text-meta">{{ $o.Count }} {{t $.LangCode "vote.resultsVotes"}}（{{ if eq $denom 0 }}0{{ else }}{{ percentOf $o.Count $denom }}{{ end }}%）</span>
+          </div>
+          <div class="uk-progress uk-margin-small-top">
+            <div class="uk-progressbar" style="width: {{ if eq $denom 0 }}0{{ else }}{{ percentOf $o.Count $denom }}{{ end }}%;"></div>
+          </div>
+        </div>
+        {{ end }}
+        {{ if $stat.CustomStats }}
+        <div class="uk-margin-small-top">
+          <div class="uk-text-meta">{{t $.LangCode "vote.page.customStats"}}:</div>
+          {{ range $c := $stat.CustomStats }}
+          <div class="uk-flex uk-flex-between uk-margin-small-top">
+            <span>{{ $c.Text }}</span>
+            <span class="uk-text-meta">{{ $c.Count }} {{t $.LangCode "vote.resultsVotes"}}</span>
+          </div>
+          {{ end }}
+        </div>
+        {{ end }}
+
+      {{ else if eq $stat.Field.FieldType "rating" }}
+        <div class="uk-text-meta uk-margin-small-top">{{t $.LangCode "vote.page.avgRating"}}: {{ printf "%.1f" $stat.AvgRating }}（{{ $stat.Total }} {{t $.LangCode "vote.resultsVotes"}}）</div>
+        {{ range $r := $stat.RatingCounts }}
+        <div class="uk-flex uk-flex-between uk-margin-small-top">
+          <span>{{ $r.Score }} {{t $.LangCode "vote.page.ratingUnit"}}</span>
+          <span class="uk-text-meta">{{ $r.Count }} {{t $.LangCode "vote.resultsVotes"}}（{{ if eq $stat.Total 0 }}0{{ else }}{{ percentOf $r.Count $stat.Total }}{{ end }}%）</span>
+        </div>
+        <div class="uk-progress uk-margin-small-top">
+          <div class="uk-progressbar" style="width: {{ if eq $stat.Total 0 }}0{{ else }}{{ percentOf $r.Count $stat.Total }}{{ end }}%;"></div>
+        </div>
+        {{ end }}
+
+      {{ else if eq $stat.Field.FieldType "rank" }}
+        <div class="uk-text-meta uk-margin-small-top">{{t $.LangCode "vote.page.avgRank"}}: {{ printf "%.2f" $stat.AvgRank }}（{{ $stat.Total }} {{t $.LangCode "vote.resultsVotes"}}）</div>
+        {{ range $o := $stat.OptionStats }}
+        <div class="uk-flex uk-flex-between uk-margin-small-top">
+          <span>{{ $o.Option.Content }}</span>
+          <span class="uk-text-meta">{{t $.LangCode "vote.page.avgRank"}}: {{ if gt $o.Count 0 }}{{ printf "%.2f" $o.AvgRank }}{{ else }}-{{ end }} · {{t $.LangCode "vote.page.rankedTimes"}}: {{ $o.Count }}</span>
+        </div>
+        {{ end }}
+
+      {{ else if eq $stat.Field.FieldType "number" }}
+        <div class="uk-text-meta uk-margin-small-top">{{t $.LangCode "vote.page.avgNumber"}}: {{ printf "%.1f" $stat.AvgNumber }}（{{ $stat.Total }} {{t $.LangCode "vote.resultsVotes"}}）</div>
+
+      {{ else }}
+        <div class="uk-text-meta uk-margin-small-top">{{t $.LangCode "vote.page.fieldFilled"}}: {{ $stat.TextCount }}</div>
+        {{ $replies := index $.TextReplies $stat.Field.Label }}
+        {{ if $replies }}
+        <div class="uk-margin-small-top">
+          <div class="uk-text-small" style="cursor:pointer; user-select:none; color:#1e87f0;" onclick="toggleFieldReplies('{{ $stat.Field.ID }}')" title="{{t $.LangCode "vote.resultsToggleHint"}}">
+            <span id="caret-{{ $stat.Field.ID }}" style="display:inline-block; transition:transform .15s; transform:rotate(-90deg);">▾</span>
+            {{t $.LangCode "vote.resultsViewTexts"}}（{{ len $replies }}）
+          </div>
+          <div id="replies-{{ $stat.Field.ID }}" hidden>
+            <ul class="uk-list uk-list-divider uk-margin-small-top">
+              {{ range $r := $replies }}
+              <li>
+                <div class="uk-text-meta uk-text-small">{{ $r.CreatedAt.Format "2006-01-02 15:04" }}</div>
+                <div style="white-space:pre-wrap;">{{ $r.Text }}</div>
+              </li>
+              {{ end }}
+            </ul>
+          </div>
+        </div>
+        {{ end }}
+      {{ end }}
+    </div>
+    {{ end }}
+  </div>
+  {{ end }}
+
+  <!-- 文本类字段的逐条提交内容已内联在各题目下方（默认收起），此处无需额外区块 -->
+{{ else if .Results }}
+  <!-- 选项 / 评分 / 排序统计 -->
+  <h4>{{t .LangCode "vote.resultsOptions"}}</h4>
+  <div class="uk-card uk-card-default uk-card-small uk-card-body">
+    {{ if or (eq .Results.Type "single") (eq .Results.Type "multiple") }}
+      {{ range .Results.Options }}
+      <div class="uk-margin">
+        <div class="uk-flex uk-flex-between">
+          <span>{{ .Option.Content }}</span>
+          <span class="uk-text-meta">{{ .Count }} {{t $.LangCode "vote.resultsVotes"}}（{{ .Percent }}%）</span>
+        </div>
+        <div class="uk-progress uk-margin-small-top">
+          <div class="uk-progressbar" style="width: {{ .Percent }}%;"></div>
+        </div>
+      </div>
+      {{ end }}
+
+    {{ else if eq .Results.Type "rating" }}
+      <div class="uk-text-meta uk-margin-small-bottom">{{t .LangCode "vote.page.avgRating"}}: {{ printf "%.1f" .Results.AvgRating }}</div>
+      {{ range .Results.Ratings }}
+      <div class="uk-margin">
+        <div class="uk-flex uk-flex-between">
+          <span>{{ .Score }} {{t $.LangCode "vote.page.ratingUnit"}}</span>
+          <span class="uk-text-meta">{{ .Count }} {{t $.LangCode "vote.resultsVotes"}}</span>
+        </div>
+        <div class="uk-progress uk-margin-small-top">
+          <div class="uk-progressbar" style="width: {{ if eq $.Total 0 }}0{{ else }}{{ percentOf .Count $.Total }}{{ end }}%;"></div>
+        </div>
+      </div>
+      {{ end }}
+
+    {{ else if eq .Results.Type "rank" }}
+      <table class="uk-table uk-table-small uk-table-divider">
+        <thead><tr><th>{{t .LangCode "vote.page.optionColumn"}}</th><th>{{t .LangCode "vote.page.avgRank"}}</th></tr></thead>
+        <tbody>
+        {{ range .Results.Rankings }}
+        <tr><td>{{ .Option.Content }}</td><td>{{ if gt .AvgRank 0.0 }}{{ printf "%.2f" .AvgRank }}{{ else }}-{{ end }}</td></tr>
+        {{ end }}
+        </tbody>
+      </table>
+    {{ end }}
+
+    {{ if .Results.CustomStats }}
+    <div class="uk-margin-top">
+      <div class="uk-text-bold">{{t .LangCode "vote.page.customStats"}}</div>
+      {{ range .Results.CustomStats }}
+      <div class="uk-flex uk-flex-between uk-margin-small-top">
+        <span>{{ .Text }}</span>
+        <span class="uk-text-meta">{{ .Count }} {{t $.LangCode "vote.resultsVotes"}}</span>
+      </div>
+      {{ end }}
+    </div>
+    {{ end }}
+  </div>
+{{ else }}
+  <div class="uk-alert uk-alert-primary">{{t .LangCode "vote.resultsEmpty"}}</div>
+{{ end }}
+
+<script>
+// 文本类字段：点击"查看文本提交（N）"按该字段 ID 展开/收起逐条内容
+function toggleFieldReplies(id) {
+  var box = document.getElementById('replies-' + id);
+  var caret = document.getElementById('caret-' + id);
+  if (!box) { return; }
+  if (box.hasAttribute('hidden')) {
+    box.removeAttribute('hidden');
+    if (caret) { caret.style.transform = 'rotate(0deg)'; }
+  } else {
+    box.setAttribute('hidden', '');
+    if (caret) { caret.style.transform = 'rotate(-90deg)'; }
+  }
+}
+</script>
+
+{{template "base/footer" .}}
diff --git a/templates/vote/page.html b/templates/vote/page.html
new file mode 100644
index 0000000..33e895f
--- /dev/null
+++ b/templates/vote/page.html
@@ -0,0 +1,526 @@
+{{template "base/header" .}}
+
+<style>
+  /* 表单字段头：序号 + 类型标签一行，题目文字独占一行（长标题自动换行，不再挤压） */
+  .tb-field-head {
+    display: flex;
+    flex-wrap: wrap;
+    align-items: center;
+    gap: 6px 8px;
+    margin-bottom: 10px;
+  }
+  .tb-field-head .tb-field-label {
+    flex-basis: 100%;
+    font-weight: 600;
+    line-height: 1.5;
+    word-break: break-word;
+    overflow-wrap: anywhere;
+  }
+  /* 卡片式选项：radio/checkbox 统一为可点选卡片，视觉更清晰、间距更舒适 */
+  .tb-choice {
+    display: flex;
+    align-items: flex-start;
+    gap: 10px;
+    padding: 12px 14px;
+    margin-bottom: 8px;
+    border: 1px solid var(--tb-border, #e5e5e5);
+    border-radius: 8px;
+    background: var(--tb-surface, #fff);
+    cursor: pointer;
+    transition: border-color 0.2s ease, background 0.2s ease;
+  }
+  .tb-choice:last-child { margin-bottom: 0; }
+  .tb-choice input[type="radio"], .tb-choice input[type="checkbox"] {
+    margin-top: 3px;
+  }
+  .tb-choice span {
+    flex: 1;
+    min-width: 0;
+    line-height: 1.5;
+    word-break: break-word;
+    overflow-wrap: anywhere;
+  }
+  .tb-choice:hover {
+    border-color: var(--tb-primary, #1e87f0);
+    background: var(--tb-surface-hover, #f5faff);
+  }
+  .tb-choice:has(input:checked) {
+    border-color: var(--tb-primary, #1e87f0);
+    background: var(--tb-surface-active, #edf6ff);
+  }
+  html[data-theme="dark"] .tb-choice {
+    border-color: var(--tb-border);
+    background: var(--tb-surface);
+  }
+  html[data-theme="dark"] .tb-choice:hover {
+    border-color: var(--tb-primary);
+    background: rgba(78, 168, 245, 0.08);
+  }
+  html[data-theme="dark"] .tb-choice:has(input:checked) {
+    border-color: var(--tb-primary);
+    background: rgba(78, 168, 245, 0.14);
+  }
+  /* 自定义补充选项的文本输入：与卡片间距对齐 */
+  .tb-custom-input {
+    margin-top: 2px;
+  }
+  /* 字数计数：紧跟在输入下方，超限由 JS 加 uk-text-danger 标红 */
+  .tb-text-counter {
+    margin-top: 2px;
+    text-align: right;
+  }
+  @media (max-width: 480px) {
+    .tb-choice { padding: 10px 12px; }
+  }
+</style>
+
+{{template "base/alert" .}}
+
+<div class="uk-card uk-card-default uk-card-body uk-margin-bottom">
+  <div class="uk-flex uk-flex-middle uk-margin-small-bottom" style="gap: 10px;">
+    {{ if .Owner }}
+    <img class="uk-border-circle" src="{{ .Owner.Avatar }}" style="width: 40px; height: 40px;">
+    <div>
+      <a class="uk-text-bold" href="/_{{ .Owner.Domain }}">{{ .Owner.Name }}</a>
+      <div class="uk-text-meta uk-text-small">{{t .LangCode "vote.page.by"}}</div>
+    </div>
+    {{ end }}
+    <div class="uk-margin-auto-left">
+      {{ if .NotStarted }}<span class="uk-label">{{t .LangCode "vote.page.notStarted"}}</span>{{ end }}
+      {{ if .Ended }}<span class="uk-label uk-label-warning">{{t .LangCode "vote.page.ended"}}</span>{{ end }}
+      {{ if and .CanVote (not .Ended) }}<span class="uk-label uk-label-success">{{t .LangCode "vote.page.active"}}</span>{{ end }}
+      {{ if and .HasVoted (not .Ended) }}<span class="uk-label uk-label-primary">{{t .LangCode "vote.page.participated"}}</span>{{ end }}
+    </div>
+  </div>
+
+  <h3 class="uk-margin-remove-top uk-margin-small-bottom">{{ .Vote.Title }}</h3>
+  {{ if .Vote.Description }}
+  <p class="uk-margin-remove-top">{{ .Vote.Description }}</p>
+  {{ end }}
+</div>
+
+{{ if .PreviewMode }}
+<div class="uk-alert uk-alert-warning">{{t .LangCode "vote.page.previewHint"}}</div>
+{{ end }}
+
+{{ if .FeatureClosedMessage }}
+<div class="uk-alert uk-alert-warning">{{ .FeatureClosedMessage }}</div>
+{{ end }}
+
+{{ if and .NotStarted (not .Error) }}
+<div class="uk-alert uk-alert-primary">{{t .LangCode "vote.page.notStartedHint"}}</div>
+{{ else if and .Ended (not .ShowResults) (not .Error) }}
+<div class="uk-alert uk-alert-warning">{{t .LangCode "vote.page.endedHint"}}</div>
+{{ end }}
+
+{{ if .CanVote }}
+  {{ if .VoteScopeRegisteredOnly }}
+    {{ if not .IsLogged }}
+    <div class="uk-alert uk-alert-warning">
+      {{t .LangCode "vote.page.loginRequired"}} <a href="/login?to={{ .CurrentURI }}">{{t .LangCode "common.login"}}</a>
+    </div>
+    {{ end }}
+  {{ else }}
+  <div class="uk-alert uk-alert-primary uk-text-small">{{t .LangCode "vote.page.anonymousHint"}}</div>
+  {{ end }}
+
+  <form method="post" action="/vote/{{ .Vote.LinkToken }}/submit" id="vote-form"{{ if not .PreviewMode }} onsubmit="return validateVoteForm()"{{ end }}>
+    {{ .CSRFTokenHTML }}
+    <input type="hidden" name="g-recaptcha-response" id="g-recaptcha-response" value="">
+
+    <div class="uk-card uk-card-default uk-card-body uk-margin-bottom">
+      {{ if eq .Vote.Type "single" }}
+        {{ range .Options }}
+        <label class="tb-choice">
+          <input class="uk-radio" type="radio" name="option_id" value="{{ .ID }}" data-vote-required data-vote-label="{{ $.Vote.Title }}"><span>{{ .Content }}</span>
+        </label>
+        {{ end }}
+
+      {{ else if eq .Vote.Type "multiple" }}
+        <div class="uk-text-meta uk-text-small uk-margin-small-bottom">{{t .LangCode "vote.page.multipleHint"}}（最多 {{ .Vote.MaxChoices }} 项）</div>
+        <div id="multiple-options">
+          {{ range .Options }}
+          <label class="tb-choice">
+            <input class="uk-checkbox" type="checkbox" name="option_ids" value="{{ .ID }}" data-vote-required data-vote-label="{{ $.Vote.Title }}"><span>{{ .Content }}</span>
+          </label>
+          {{ end }}
+        </div>
+
+      {{ else if eq .Vote.Type "rating" }}
+        <label class="uk-form-label">{{t .LangCode "vote.page.ratingLabel"}}</label>
+        <select class="uk-select" name="rating_value" style="max-width: 200px;" data-vote-required data-vote-label="{{ .Vote.Title }}">
+          <option value=""></option>
+          {{ range $i := loop 10 }}
+          <option value="{{ $i }}">{{ $i }} {{t $.LangCode "vote.page.ratingUnit"}}</option>
+          {{ end }}
+        </select>
+
+      {{ else if eq .Vote.Type "rank" }}
+        <div class="uk-text-meta uk-text-small uk-margin-small-bottom">{{t .LangCode "vote.page.rankHint"}}</div>
+        {{ range .Options }}
+        <div class="uk-margin-small-bottom uk-flex uk-flex-middle" style="gap: 10px;">
+          <span style="flex: 1;">{{ .Content }}</span>
+          <input class="uk-input" type="number" name="rank_{{ .ID }}" min="1" max="{{ len $.Options }}" style="width: 90px;" placeholder="{{t $.LangCode "vote.page.rankPlaceholder"}}" data-vote-required data-vote-label="{{ $.Vote.Title }}">
+        </div>
+        {{ end }}
+
+      {{ else if eq .Vote.Type "form" }}
+        {{ range $fi, $f := .FormFields }}
+        <div class="uk-margin">
+          <div class="tb-field-head">
+            <span class="uk-label">{{ add $fi 1 }}</span>
+            <span class="uk-label {{ fieldTypeLabelClass $f.FieldType }}">{{ fieldTypeLabel $.LangCode $f.FieldType }}</span>
+            <div class="tb-field-label">{{ $f.Label }}{{ if $f.Required }} <span class="uk-text-danger">*</span>{{ end }}</div>
+          </div>
+          {{ if eq $f.FieldType "text" }}
+          <input class="uk-input" type="text" name="field_{{ $f.ID }}" {{ if $f.MaxLength }}maxlength="{{ $f.MaxLength }}"{{ end }} {{ if $f.Required }}data-vote-required data-vote-label="{{ $f.Label }}"{{ end }}>
+          {{ else if eq $f.FieldType "textarea" }}
+          <textarea class="uk-textarea" rows="3" name="field_{{ $f.ID }}" {{ if $f.MaxLength }}maxlength="{{ $f.MaxLength }}"{{ end }} {{ if $f.Required }}data-vote-required data-vote-label="{{ $f.Label }}"{{ end }}></textarea>
+          {{ else if eq $f.FieldType "select" }}
+            <select class="uk-select" name="field_{{ $f.ID }}" {{ if $f.Required }}data-vote-required data-vote-label="{{ $f.Label }}"{{ end }}>
+              <option value="">{{t $.LangCode "vote.page.selectPlaceholder"}}</option>
+              {{ range parseOptions $f.Options }}
+              <option value="{{ . }}">{{ . }}</option>
+              {{ end }}
+              {{ if $f.AllowCustom }}
+              <option value="{{ $.CustomFieldMarker }}">{{t $.LangCode "vote.page.customOther"}}</option>
+              {{ end }}
+            </select>
+            {{ if $f.AllowCustom }}
+            <input class="uk-input tb-custom-input" type="text" name="field_{{ $f.ID }}_custom" placeholder="{{t $.LangCode "vote.page.customFieldPlaceholder"}}" data-vote-custom-input="{{ $f.ID }}" data-tb-text-counter disabled {{ if $f.Required }}data-vote-required data-vote-label="{{ $f.Label }}"{{ end }}>
+            {{ end }}
+          {{ else if eq $f.FieldType "radio" }}
+            {{ range parseOptions $f.Options }}
+            <label class="tb-choice">
+              <input class="uk-radio" type="radio" name="field_{{ $f.ID }}" value="{{ . }}" {{ if $f.Required }}data-vote-required data-vote-label="{{ $f.Label }}"{{ end }}><span>{{ . }}</span>
+            </label>
+            {{ end }}
+            {{ if $f.AllowCustom }}
+            <label class="tb-choice">
+              <input class="uk-radio" type="radio" name="field_{{ $f.ID }}" value="{{ $.CustomFieldMarker }}" {{ if $f.Required }}data-vote-required data-vote-label="{{ $f.Label }}"{{ end }}><span>{{t $.LangCode "vote.page.customOther"}}</span>
+            </label>
+            <input class="uk-input tb-custom-input" type="text" name="field_{{ $f.ID }}_custom" placeholder="{{t $.LangCode "vote.page.customFieldPlaceholder"}}" data-vote-custom-input="{{ $f.ID }}" data-tb-text-counter disabled {{ if $f.Required }}data-vote-required data-vote-label="{{ $f.Label }}"{{ end }}>
+            {{ end }}
+          {{ else if eq $f.FieldType "checkbox" }}
+            {{ range parseOptions $f.Options }}
+            <label class="tb-choice">
+              <input class="uk-checkbox" type="checkbox" name="field_{{ $f.ID }}" value="{{ . }}" {{ if $f.Required }}data-vote-required data-vote-label="{{ $f.Label }}"{{ end }}><span>{{ . }}</span>
+            </label>
+            {{ end }}
+            {{ if $f.AllowCustom }}
+            <label class="tb-choice">
+              <input class="uk-checkbox" type="checkbox" name="field_{{ $f.ID }}" value="{{ $.CustomFieldMarker }}" {{ if $f.Required }}data-vote-required data-vote-label="{{ $f.Label }}"{{ end }}><span>{{t $.LangCode "vote.page.customOther"}}</span>
+            </label>
+            <input class="uk-input tb-custom-input" type="text" name="field_{{ $f.ID }}_custom" placeholder="{{t $.LangCode "vote.page.customFieldPlaceholder"}}" data-vote-custom-input="{{ $f.ID }}" data-tb-text-counter disabled {{ if $f.Required }}data-vote-required data-vote-label="{{ $f.Label }}"{{ end }}>
+            {{ end }}
+          {{ else if eq $f.FieldType "number" }}
+          <input class="uk-input" type="number" name="field_{{ $f.ID }}" {{ if $f.Required }}data-vote-required data-vote-label="{{ $f.Label }}"{{ end }}>
+          {{ else if eq $f.FieldType "rating" }}
+          <select class="uk-select" name="field_{{ $f.ID }}" style="max-width: 200px;" {{ if $f.Required }}data-vote-required data-vote-label="{{ $f.Label }}"{{ end }}>
+            <option value=""></option>
+            {{ range $i := loop 10 }}
+            <option value="{{ $i }}">{{ $i }} {{t $.LangCode "vote.page.ratingUnit"}}</option>
+            {{ end }}
+          </select>
+          {{ else if eq $f.FieldType "rank" }}
+            <div class="uk-text-meta uk-text-small uk-margin-small-bottom">
+              {{ if $f.Required }}{{t $.LangCode "vote.page.rankHintRequired"}}{{ else }}{{t $.LangCode "vote.page.rankHintOptional"}}{{ end }}
+            </div>
+            {{ $opts := parseOptions $f.Options }}
+            {{ range $oi, $opt := $opts }}
+            <div class="uk-flex uk-flex-middle" style="gap: 8px;">
+              <span class="uk-flex-1">{{ $opt }}</span>
+              <input class="uk-input" type="number" name="field_{{ $f.ID }}_{{ $oi }}" min="1" max="{{ len $opts }}" style="width: 90px;" placeholder="{{t $.LangCode "vote.page.rankPlaceholder"}}" {{ if $f.Required }}data-vote-required data-vote-label="{{ $f.Label }}"{{ end }}>
+            </div>
+            {{ end }}
+          {{ end }}
+        </div>
+        {{ end }}
+      {{ end }}
+
+      {{ if and .Vote.AllowCustom (or (eq .Vote.Type "single") (eq .Vote.Type "multiple") (eq .Vote.Type "rank")) }}
+      <div class="uk-margin">
+        <label class="uk-form-label">{{t .LangCode "vote.page.customOption"}}</label>
+        <input class="uk-input" type="text" name="custom" placeholder="{{t .LangCode "vote.page.customPlaceholder"}}" data-tb-text-counter data-tb-text-max="{{ $.MaxCustomTextLen }}">
+      </div>
+      {{ end }}
+    </div>
+
+    <div class="uk-margin">
+      {{ if .PreviewMode }}
+      <button type="button" class="uk-button uk-button-primary" disabled>{{t .LangCode "vote.page.submit"}}</button>
+      <span class="uk-text-meta uk-text-small uk-margin-small-left">{{t .LangCode "vote.page.previewSubmitHint"}}</span>
+      {{ else if eq .CaptchaType "math" }}
+      <button type="button" class="uk-button uk-button-primary math-captcha-trigger" onclick="return voteValidate(event)">{{t .LangCode "vote.page.submit"}}</button>
+      {{ else }}
+      <button type="submit" class="uk-button uk-button-primary g-recaptcha"
+              data-sitekey="{{.RecaptchaSiteKey}}" data-callback="onSubmit">{{t .LangCode "vote.page.submit"}}</button>
+      {{ end }}
+    </div>
+  </form>
+
+{{ else if .HasVoted }}
+  {{ if and (not .Success) (not .Error) }}
+  <div class="uk-alert uk-alert-success">{{t .LangCode "vote.page.alreadyVoted"}}</div>
+  {{ end }}
+{{ end }}
+
+{{ if .ShowResults }}
+<div class="uk-card uk-card-default uk-card-body">
+  <h4 class="uk-margin-small-bottom">{{t .LangCode "vote.page.resultsTitle"}}</h4>
+
+  {{ if .Results }}
+    {{ if or (eq .Results.Type "single") (eq .Results.Type "multiple") }}
+      <div class="uk-text-meta uk-margin-small-bottom">{{t .LangCode "vote.page.totalVotes"}}: {{ .Results.Total }}</div>
+      {{ range .Results.Options }}
+      <div class="uk-margin">
+        <div class="uk-flex uk-flex-between">
+          <span>{{ .Option.Content }}</span>
+          <span class="uk-text-meta">{{ .Count }} {{t $.LangCode "vote.resultsVotes"}}（{{ .Percent }}%）</span>
+        </div>
+        <div class="uk-progress uk-margin-small-top">
+          <div class="uk-progressbar" style="width: {{ .Percent }}%;"></div>
+        </div>
+      </div>
+      {{ end }}
+
+    {{ else if eq .Results.Type "rating" }}
+      <div class="uk-text-meta uk-margin-small-bottom">{{t .LangCode "vote.page.totalVotes"}}: {{ .Results.Total }} · {{t .LangCode "vote.page.avgRating"}}: {{ printf "%.1f" .Results.AvgRating }}</div>
+      {{ range .Results.Ratings }}
+      <div class="uk-margin">
+        <div class="uk-flex uk-flex-between">
+          <span>{{ .Score }} {{t $.LangCode "vote.page.ratingUnit"}}</span>
+          <span class="uk-text-meta">{{ .Count }} {{t $.LangCode "vote.resultsVotes"}}</span>
+        </div>
+        <div class="uk-progress uk-margin-small-top">
+          <div class="uk-progressbar" style="width: {{ if eq $.Results.Total 0 }}0{{ else }}{{ percentOf .Count $.Results.Total }}{{ end }}%;"></div>
+        </div>
+      </div>
+      {{ end }}
+
+    {{ else if eq .Results.Type "rank" }}
+      <div class="uk-text-meta uk-margin-small-bottom">{{t .LangCode "vote.page.totalVotes"}}: {{ .Results.Total }}</div>
+      <table class="uk-table uk-table-small uk-table-divider">
+        <thead><tr><th>{{t .LangCode "vote.page.optionColumn"}}</th><th>{{t .LangCode "vote.page.avgRank"}}</th></tr></thead>
+        <tbody>
+        {{ range .Results.Rankings }}
+        <tr><td>{{ .Option.Content }}</td><td>{{ if gt .AvgRank 0.0 }}{{ printf "%.2f" .AvgRank }}{{ else }}-{{ end }}</td></tr>
+        {{ end }}
+        </tbody>
+      </table>
+
+    {{ else if eq .Results.Type "form" }}
+      <div class="uk-alert uk-alert-primary uk-margin-remove">{{t .LangCode "vote.page.formCount"}}: {{ .Results.FormCount }}</div>
+      {{ range $si, $stat := .Results.FormFieldStats }}
+      <div class="uk-margin-top">
+        <div class="uk-flex uk-flex-middle uk-margin-small-bottom" style="gap: 8px;">
+          <span class="uk-label">{{ add $si 1 }}</span>
+          <span class="uk-label {{ fieldTypeLabelClass $stat.Field.FieldType }}">{{ fieldTypeLabel $.LangCode $stat.Field.FieldType }}</span>
+          <span class="uk-text-bold">{{ $stat.Field.Label }}</span>
+          <span class="uk-text-meta uk-text-small">{{t $.LangCode "vote.resultsAnswered"}}: {{ $stat.Total }}</span>
+        </div>
+
+        {{ if or (eq $stat.Field.FieldType "radio") (eq $stat.Field.FieldType "select") (eq $stat.Field.FieldType "checkbox") }}
+          {{ $denom := $stat.Total }}
+          {{ if eq $stat.Field.FieldType "checkbox" }}{{ $denom = $stat.TotalSelections }}{{ end }}
+          {{ range $o := $stat.OptionStats }}
+          <div class="uk-margin-small-top">
+            <div class="uk-flex uk-flex-between">
+              <span>{{ $o.Option.Content }}</span>
+              <span class="uk-text-meta">{{ $o.Count }} {{t $.LangCode "vote.resultsVotes"}}（{{ if eq $denom 0 }}0{{ else }}{{ percentOf $o.Count $denom }}{{ end }}%）</span>
+            </div>
+            <div class="uk-progress uk-margin-small-top">
+              <div class="uk-progressbar" style="width: {{ if eq $denom 0 }}0{{ else }}{{ percentOf $o.Count $denom }}{{ end }}%;"></div>
+            </div>
+          </div>
+          {{ end }}
+          {{ if $stat.CustomStats }}
+          <div class="uk-margin-small-top">
+            <div class="uk-text-meta">{{t $.LangCode "vote.page.customStats"}}:</div>
+            {{ range $c := $stat.CustomStats }}
+            <div class="uk-flex uk-flex-between uk-margin-small-top">
+              <span>{{ $c.Text }}</span>
+              <span class="uk-text-meta">{{ $c.Count }} {{t $.LangCode "vote.resultsVotes"}}</span>
+            </div>
+            {{ end }}
+          </div>
+          {{ end }}
+
+        {{ else if eq $stat.Field.FieldType "rating" }}
+          <div class="uk-text-meta uk-margin-small-top">{{t $.LangCode "vote.page.avgRating"}}: {{ printf "%.1f" $stat.AvgRating }}（{{ $stat.Total }} {{t $.LangCode "vote.resultsVotes"}}）</div>
+          {{ range $r := $stat.RatingCounts }}
+          <div class="uk-flex uk-flex-between uk-margin-small-top">
+            <span>{{ $r.Score }} {{t $.LangCode "vote.page.ratingUnit"}}</span>
+            <span class="uk-text-meta">{{ $r.Count }} {{t $.LangCode "vote.resultsVotes"}}（{{ if eq $stat.Total 0 }}0{{ else }}{{ percentOf $r.Count $stat.Total }}{{ end }}%）</span>
+          </div>
+          <div class="uk-progress uk-margin-small-top">
+            <div class="uk-progressbar" style="width: {{ if eq $stat.Total 0 }}0{{ else }}{{ percentOf $r.Count $stat.Total }}{{ end }}%;"></div>
+          </div>
+          {{ end }}
+
+        {{ else if eq $stat.Field.FieldType "rank" }}
+          <div class="uk-text-meta uk-margin-small-top">{{t $.LangCode "vote.page.avgRank"}}: {{ printf "%.2f" $stat.AvgRank }}（{{ $stat.Total }} {{t $.LangCode "vote.resultsVotes"}}）</div>
+          {{ range $o := $stat.OptionStats }}
+          <div class="uk-flex uk-flex-between uk-margin-small-top">
+            <span>{{ $o.Option.Content }}</span>
+            <span class="uk-text-meta">{{t $.LangCode "vote.page.avgRank"}}: {{ if gt $o.Count 0 }}{{ printf "%.2f" $o.AvgRank }}{{ else }}-{{ end }} · {{t $.LangCode "vote.page.rankedTimes"}}: {{ $o.Count }}</span>
+          </div>
+          {{ end }}
+
+        {{ else if eq $stat.Field.FieldType "number" }}
+          <div class="uk-text-meta uk-margin-small-top">{{t $.LangCode "vote.page.avgNumber"}}: {{ printf "%.1f" $stat.AvgNumber }}（{{ $stat.Total }} {{t $.LangCode "vote.resultsVotes"}}）</div>
+
+        {{ else }}
+          <div class="uk-text-meta uk-margin-small-top">{{t $.LangCode "vote.page.fieldFilled"}}: {{ $stat.TextCount }}</div>
+        {{ end }}
+      </div>
+      {{ end }}
+    {{ end }}
+
+    {{ if .Results.CustomStats }}
+    <div class="uk-margin-top">
+      <div class="uk-text-bold">{{t .LangCode "vote.page.customStats"}}</div>
+      {{ range .Results.CustomStats }}
+      <div class="uk-flex uk-flex-between uk-margin-small-top">
+        <span>{{ .Text }}</span>
+        <span class="uk-text-meta">{{ .Count }} {{t $.LangCode "vote.resultsVotes"}}</span>
+      </div>
+      {{ end }}
+    </div>
+    {{ end }}
+  {{ else }}
+    <div class="uk-alert uk-alert-primary uk-margin-remove">{{t .LangCode "vote.resultsEmpty"}}</div>
+  {{ end }}
+</div>
+{{ end }}
+
+{{ if and .IsOwner (not .ShowResults) }}
+<div class="uk-margin-top uk-text-small">
+  <a href="/user/votes/{{ .Vote.ID }}/results">{{t .LangCode "vote.page.ownerManage"}}</a>
+</div>
+{{ end }}
+
+<script>
+// 自定义补充选项的字数上限，与后端校验同源（conf.Limits.CustomAnswerLen，[limits] 配置段）。
+// 去掉输入框的 maxlength 后由这里做提示：超限不静默截断，而是标红并阻止提交。
+var MAX_CUSTOM_LEN = {{ .MaxCustomTextLen }};
+
+// 按 Unicode 码点计数，与后端 len([]rune(s)) 口径一致：
+// emoji、部分生僻字在 UTF-16 中占两个 code unit，用 .length 会多算一倍。
+function countChars(s) { return Array.from(String(s || '')).length; }
+
+// 给带 data-tb-text-counter 的输入框挂实时字数计数；上限取 data-tb-text-max，缺省 MAX_CUSTOM_LEN。
+function setupTextCounters() {
+  var form = document.getElementById('vote-form');
+  if (!form) { return; }
+  form.querySelectorAll('[data-tb-text-counter]').forEach(function (input) {
+    var max = parseInt(input.getAttribute('data-tb-text-max'), 10);
+    if (!max || max < 1) { max = MAX_CUSTOM_LEN; }
+    var counter = document.createElement('div');
+    counter.className = 'uk-text-meta uk-text-small tb-text-counter';
+    if (input.parentNode) { input.parentNode.insertBefore(counter, input.nextSibling); }
+    var update = function () {
+      var n = countChars(input.value);
+      counter.textContent = n + ' / ' + max;
+      if (n > max) {
+        counter.classList.add('uk-text-danger');
+        input.setAttribute('data-tb-too-long', '1');
+      } else {
+        counter.classList.remove('uk-text-danger');
+        input.removeAttribute('data-tb-too-long');
+      }
+    };
+    input.addEventListener('input', update);
+    update();
+  });
+}
+
+// 前端必填校验：text/textarea/number/select/rating 值非空；radio/checkbox 按 name 至少选一个；
+// 排序题（vote 题型与表单 rank 字段）每个排名输入必填。
+function validateVoteForm() {
+  var form = document.getElementById('vote-form');
+  if (!form) { return true; }
+  // 自定义补充选项超长：计数口径与后端一致，超限直接拦下并聚焦到该输入
+  var tooLong = form.querySelector('[data-tb-text-counter][data-tb-too-long]');
+  if (tooLong) {
+    alert('{{t .LangCode "vote.err.customTooLong" $.MaxCustomTextLen}}');
+    tooLong.focus();
+    return false;
+  }
+  // 单选/多选组：按 name 分组检查
+  var groups = {};
+  form.querySelectorAll('input[data-vote-required][type="radio"], input[data-vote-required][type="checkbox"]').forEach(function (el) {
+    (groups[el.name] = groups[el.name] || []).push(el);
+  });
+  for (var name in groups) {
+    var any = groups[name].some(function (el) { return el.checked; });
+    if (!any) {
+      alert('{{t .LangCode "vote.page.mustComplete"}}「' + groups[name][0].getAttribute('data-vote-label') + '」');
+      return false;
+    }
+  }
+  // 其余必填元素：值非空（disabled 输入跳过——"其他"文本输入在未选中时处于禁用态）
+  var els = form.querySelectorAll('[data-vote-required]:not(input[type="radio"]):not(input[type="checkbox"])');
+  for (var i = 0; i < els.length; i++) {
+    var el = els[i];
+    if (el.disabled) { continue; }
+    if ((el.value || '').trim() === '') {
+      alert('{{t .LangCode "vote.page.mustComplete"}}「' + el.getAttribute('data-vote-label') + '」');
+      return false;
+    }
+  }
+  return true;
+}
+// math 验证码按钮：先校验，失败时阻止冒泡（不打开验证码弹窗）
+function voteValidate(e) {
+  if (!validateVoteForm()) {
+    if (e) { e.stopPropagation(); e.preventDefault(); }
+    return false;
+  }
+  return true;
+}
+// recaptcha/turnstile 成功回调（覆盖 header 的通用 onSubmit）：校验通过才提交
+function onSubmit() {
+  if (validateVoteForm()) {
+    document.getElementById('vote-form').submit();
+  }
+}
+
+(function () {
+  var form = document.getElementById('vote-form');
+  if (!form) { return; }
+  setupTextCounters();
+  var maxChoices = {{ if eq .Vote.Type "multiple" }}{{ .Vote.MaxChoices }}{{ else }}0{{ end }};
+  if (maxChoices > 0) {
+    var boxes = form.querySelectorAll('input[type="checkbox"][name="option_ids"]');
+    boxes.forEach(function (box) {
+      box.addEventListener('change', function () {
+        var checked = form.querySelectorAll('input[type="checkbox"][name="option_ids"]:checked').length;
+        if (checked > maxChoices) { this.checked = false; }
+      });
+    });
+  }
+
+  // 表单字段"其他/自定义选项"输入框联动：选中保留标记时启用文本输入，否则禁用并清空
+  var CUSTOM_MARKER = "{{ .CustomFieldMarker }}";
+  form.querySelectorAll('[data-vote-custom-input]').forEach(function (input) {
+    var fid = input.getAttribute('data-vote-custom-input');
+    var group = form.querySelectorAll('input[name="field_' + fid + '"]');
+    var select = form.querySelector('select[name="field_' + fid + '"]');
+    var sync = function () {
+      var on = false;
+      if (select) {
+        on = (select.value === CUSTOM_MARKER);
+      } else {
+        group.forEach(function (r) { if (r.value === CUSTOM_MARKER && r.checked) { on = true; } });
+      }
+      input.disabled = !on;
+      if (!on) { input.value = ''; }
+    };
+    if (select) { select.addEventListener('change', sync); } else { group.forEach(function (r) { r.addEventListener('change', sync); }); }
+    sync();
+  });
+})();
+</script>
+
+{{template "base/footer" .}}
diff --git a/templates/vote_templates_test.go b/templates/vote_templates_test.go
new file mode 100644
index 0000000..9469b6a
--- /dev/null
+++ b/templates/vote_templates_test.go
@@ -0,0 +1,465 @@
+package templates
+
+import (
+	gotemplate "html/template"
+	"regexp"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/flamego/template"
+
+	"github.com/tamakyi/TamaBox/internal/conf"
+	"github.com/tamakyi/TamaBox/internal/db"
+	"github.com/tamakyi/TamaBox/internal/dbutil"
+)
+
+// voteBaseData 构造投票模板渲染的基础数据（仿 render_test.go 的 base）。
+func voteBaseData() map[string]interface{} {
+	return map[string]interface{}{
+		"Title":            "投票",
+		"LangCode":         "zh-CN",
+		"SupportedLangs":   []map[string]string{{"Code": "zh-CN", "Name": "简体中文"}},
+		"IsLogged":         true,
+		"LoggedUser":       map[string]interface{}{"Domain": "test", "Name": "tester"},
+		"LoggedUserName":   "tester",
+		"CurrentURI":       "/vote/abc123",
+		"IsUserPage":       false,
+		"IsPixel":          false,
+		"VConsole":         false,
+		"CSRFTokenHTML":    gotemplate.HTML(`<input type="hidden" name="_csrf" value="x">`),
+		"RecaptchaSiteKey": "",
+		"CaptchaType":      "recaptcha",
+		"PageUser":         map[string]interface{}{"Domain": "test", "Name": "tester", "Avatar": ""},
+		"ICP":              "",
+		// 参与端自定义补充选项的字数上限（生产由 route/vote 注入 conf.Limits.CustomAnswerLen）
+		"MaxCustomTextLen":  conf.Limits.CustomAnswerLen,
+		"CustomFieldMarker": db.CustomFieldMarker,
+		// 站长侧单个选项文本上限（生产由 route/user 注入 conf.Limits.VoteOptionLen）
+		"MaxVoteOptionLen": conf.Limits.VoteOptionLen,
+		// [limits] 全站上限（生产由 Contexter 全局注入 conf.Limits），
+		// 供 question/list 嵌套的提问框 maxlength 同源
+		"Limits": conf.Limits,
+	}
+}
+
+func TestVoteFormUsesFixedDeviceLimitNotice(t *testing.T) {
+	fs, err := template.EmbedFS(FS, ".", []string{".html"})
+	if err != nil {
+		t.Fatalf("EmbedFS: %v", err)
+	}
+	for _, f := range fs.Files() {
+		if f.Name() != "user/vote-form" && f.Name() != "user/vote-form.html" {
+			continue
+		}
+		data, err := f.Data()
+		if err != nil {
+			t.Fatalf("get template data: %v", err)
+		}
+		source := string(data)
+		if strings.Contains(source, `name="max_votes_per_fingerprint"`) {
+			t.Fatal("fixed fingerprint limit must not be rendered as a form input")
+		}
+		if !strings.Contains(source, `vote.formMaxVotesPerFingerprint`) {
+			t.Fatal("fixed fingerprint limit notice is missing")
+		}
+		return
+	}
+	t.Fatal("user/vote-form.html not found")
+}
+
+func TestRenderVotePage(t *testing.T) {
+	opt1 := &db.VoteOption{Content: "选项 A"}
+	opt2 := &db.VoteOption{Content: "选项 B"}
+
+	t.Run("single can vote", func(t *testing.T) {
+		base := voteBaseData()
+		base["Vote"] = &db.Vote{Title: "测试单选", Description: "描述", Type: db.VoteTypeSingle, LinkToken: "abc123", MaxChoices: 1}
+		base["Owner"] = map[string]interface{}{"Name": "tester", "Domain": "test", "Avatar": ""}
+		base["Options"] = []*db.VoteOption{opt1, opt2}
+		base["HasVoted"] = false
+		base["CanVote"] = true
+		base["NotStarted"] = false
+		base["Ended"] = false
+		base["VoteScopeRegisteredOnly"] = false
+		base["ShowResults"] = false
+		base["IsOwner"] = false
+		if err := renderWithData(t, "vote/page", base); err != nil {
+			t.Fatalf("render vote/page (single) failed: %v", err)
+		}
+	})
+
+	t.Run("multiple can vote", func(t *testing.T) {
+		base := voteBaseData()
+		base["Vote"] = &db.Vote{Title: "多选", Type: db.VoteTypeMultiple, LinkToken: "abc123", MaxChoices: 2}
+		base["Owner"] = map[string]interface{}{"Name": "tester", "Domain": "test", "Avatar": ""}
+		base["Options"] = []*db.VoteOption{opt1, opt2, {Content: "选项 C"}}
+		base["HasVoted"] = false
+		base["CanVote"] = true
+		base["NotStarted"] = false
+		base["Ended"] = false
+		base["VoteScopeRegisteredOnly"] = false
+		base["ShowResults"] = false
+		base["IsOwner"] = false
+		if err := renderWithData(t, "vote/page", base); err != nil {
+			t.Fatalf("render vote/page (multiple) failed: %v", err)
+		}
+	})
+
+	t.Run("rating can vote", func(t *testing.T) {
+		base := voteBaseData()
+		base["Vote"] = &db.Vote{Title: "评分", Type: db.VoteTypeRating, LinkToken: "abc123"}
+		base["Owner"] = map[string]interface{}{"Name": "tester", "Domain": "test", "Avatar": ""}
+		base["HasVoted"] = false
+		base["CanVote"] = true
+		base["NotStarted"] = false
+		base["Ended"] = false
+		base["VoteScopeRegisteredOnly"] = false
+		base["ShowResults"] = false
+		base["IsOwner"] = false
+		if err := renderWithData(t, "vote/page", base); err != nil {
+			t.Fatalf("render vote/page (rating) failed: %v", err)
+		}
+	})
+
+	t.Run("rank can vote", func(t *testing.T) {
+		base := voteBaseData()
+		base["Vote"] = &db.Vote{Title: "排序", Type: db.VoteTypeRank, LinkToken: "abc123"}
+		base["Owner"] = map[string]interface{}{"Name": "tester", "Domain": "test", "Avatar": ""}
+		base["Options"] = []*db.VoteOption{opt1, opt2}
+		base["HasVoted"] = false
+		base["CanVote"] = true
+		base["NotStarted"] = false
+		base["Ended"] = false
+		base["VoteScopeRegisteredOnly"] = false
+		base["ShowResults"] = false
+		base["IsOwner"] = false
+		if err := renderWithData(t, "vote/page", base); err != nil {
+			t.Fatalf("render vote/page (rank) failed: %v", err)
+		}
+	})
+
+	t.Run("preview draft form", func(t *testing.T) {
+		base := voteBaseData()
+		base["Vote"] = &db.Vote{Title: "草稿表单", Type: db.VoteTypeForm, LinkToken: "abc123"}
+		base["Owner"] = map[string]interface{}{"Name": "tester", "Domain": "test", "Avatar": ""}
+		base["FormFields"] = []*db.VoteFormField{
+			{Model: dbutil.Model{ID: 1}, FieldType: db.VoteFormFieldTypeText, Label: "昵称", Required: true, MaxLength: 20},
+			{Model: dbutil.Model{ID: 2}, FieldType: db.VoteFormFieldTypeRadio, Label: "满意度", Options: `["满意","一般"]`},
+		}
+		base["HasVoted"] = false
+		base["CanVote"] = true
+		base["NotStarted"] = false
+		base["Ended"] = false
+		base["VoteScopeRegisteredOnly"] = false
+		base["ShowResults"] = false
+		base["IsOwner"] = true
+		base["IsLogged"] = true
+		base["PreviewMode"] = true
+		if err := renderWithData(t, "vote/page", base); err != nil {
+			t.Fatalf("render vote/page (preview) failed: %v", err)
+		}
+	})
+
+	t.Run("custom text limit injected", func(t *testing.T) {
+		base := voteBaseData()
+		base["Vote"] = &db.Vote{Title: "自定义选项", Type: db.VoteTypeSingle, LinkToken: "abc123", AllowCustom: true}
+		base["Owner"] = map[string]interface{}{"Name": "tester", "Domain": "test", "Avatar": ""}
+		base["FormFields"] = []*db.VoteFormField{
+			{Model: dbutil.Model{ID: 1}, FieldType: db.VoteFormFieldTypeRadio, Label: "满意度", Options: `["满意","一般"]`, AllowCustom: true},
+		}
+		base["HasVoted"] = false
+		base["CanVote"] = true
+		base["NotStarted"] = false
+		base["Ended"] = false
+		base["VoteScopeRegisteredOnly"] = false
+		base["ShowResults"] = false
+		base["IsOwner"] = false
+		out, err := renderToString(t, "vote/page", base)
+		if err != nil {
+			t.Fatalf("render vote/page (custom) failed: %v", err)
+		}
+		// 缺注入时模板不报错，只会渲染出 <no value> 让整段脚本失效，必须显式断言
+		if strings.Contains(out, "<no value>") {
+			t.Fatal("rendered page contains <no value>: MaxCustomTextLen was not injected")
+		}
+		// 注意：html/template 在 <script> 上下文会主动插入安全空格，
+		// 实际输出形如 `var MAX_CUSTOM_LEN =  200 ;`，因此用正则而非字面量匹配。
+		want := regexp.MustCompile(`var MAX_CUSTOM_LEN\s*=\s*` + strconv.Itoa(conf.Limits.CustomAnswerLen) + `\s*;`)
+		if !want.MatchString(out) {
+			t.Fatalf("missing custom text limit constant, want /%s/", want)
+		}
+		if !strings.Contains(out, "data-tb-text-counter") {
+			t.Fatal("custom inputs are missing the data-tb-text-counter hook")
+		}
+	})
+
+	t.Run("form can vote", func(t *testing.T) {
+		base := voteBaseData()
+		base["Vote"] = &db.Vote{Title: "表单", Type: db.VoteTypeForm, LinkToken: "abc123"}
+		base["Owner"] = map[string]interface{}{"Name": "tester", "Domain": "test", "Avatar": ""}
+		base["FormFields"] = []*db.VoteFormField{
+			{Model: dbutil.Model{ID: 1}, FieldType: db.VoteFormFieldTypeText, Label: "昵称", Required: true, MaxLength: 20},
+			{Model: dbutil.Model{ID: 2}, FieldType: db.VoteFormFieldTypeRadio, Label: "满意度", Options: `["满意","一般"]`},
+			{Model: dbutil.Model{ID: 3}, FieldType: db.VoteFormFieldTypeCheckbox, Label: "喜欢的", Options: `["A","B","C"]`},
+			{Model: dbutil.Model{ID: 4}, FieldType: db.VoteFormFieldTypeRating, Label: "评分"},
+			{Model: dbutil.Model{ID: 5}, FieldType: db.VoteFormFieldTypeRank, Label: "排序", Options: `["首选","次选","末选"]`},
+		}
+		base["HasVoted"] = false
+		base["CanVote"] = true
+		base["NotStarted"] = false
+		base["Ended"] = false
+		base["VoteScopeRegisteredOnly"] = false
+		base["ShowResults"] = false
+		base["IsOwner"] = false
+		if err := renderWithData(t, "vote/page", base); err != nil {
+			t.Fatalf("render vote/page (form) failed: %v", err)
+		}
+	})
+
+	t.Run("already voted with results", func(t *testing.T) {
+		base := voteBaseData()
+		base["Vote"] = &db.Vote{Title: "已投", Type: db.VoteTypeSingle, LinkToken: "abc123"}
+		base["Owner"] = map[string]interface{}{"Name": "tester", "Domain": "test", "Avatar": ""}
+		base["Options"] = []*db.VoteOption{opt1, opt2}
+		base["HasVoted"] = true
+		base["CanVote"] = false
+		base["NotStarted"] = false
+		base["Ended"] = false
+		base["VoteScopeRegisteredOnly"] = false
+		base["ShowResults"] = true
+		base["IsOwner"] = false
+		base["Results"] = map[string]interface{}{
+			"Type":    "single",
+			"Total":   int64(2),
+			"Options": []interface{}{},
+		}
+		if err := renderWithData(t, "vote/page", base); err != nil {
+			t.Fatalf("render vote/page (voted) failed: %v", err)
+		}
+	})
+
+	t.Run("not started", func(t *testing.T) {
+		base := voteBaseData()
+		base["Vote"] = &db.Vote{Title: "未开始", Type: db.VoteTypeSingle, LinkToken: "abc123"}
+		base["Owner"] = map[string]interface{}{"Name": "tester", "Domain": "test", "Avatar": ""}
+		base["HasVoted"] = false
+		base["CanVote"] = false
+		base["NotStarted"] = true
+		base["Ended"] = false
+		base["VoteScopeRegisteredOnly"] = false
+		base["ShowResults"] = false
+		base["IsOwner"] = false
+		if err := renderWithData(t, "vote/page", base); err != nil {
+			t.Fatalf("render vote/page (not started) failed: %v", err)
+		}
+	})
+}
+
+func TestRenderVoteManagementPages(t *testing.T) {
+	t.Run("question list votes panel", func(t *testing.T) {
+		base := voteBaseData()
+		base["IsUserPage"] = true
+		// 提问箱页面渲染所需的字段（与 QuestionList 提供的一致）
+		base["Stats"] = map[string]int64{"total": 0, "answered": 0, "unanswered": 0, "private": 0, "pinned": 0, "chats": 0}
+		base["Keyword"] = ""
+		base["SelectedSort"] = "latest"
+		base["SelectedStatus"] = "all"
+		base["SelectedType"] = "all"
+		base["ReceivedItems"] = []interface{}{}
+		base["ConversationDetails"] = []interface{}{}
+		// 投票面板数据：投票管理已合并到「我的提问箱 · 投票」面板
+		base["VoteStats"] = map[string]int64{"total": 4, "published": 2}
+		base["MyVotes"] = []interface{}{
+			map[string]interface{}{
+				"ID": 1, "Title": "投票 1", "Type": "single", "Status": "draft", "EffectiveStatus": "draft",
+				"SubmissionCount": int64(0), "OptionCount": int64(2),
+				"CreatedAt": time.Now(), "LinkToken": "abc",
+			},
+			map[string]interface{}{
+				"ID": 2, "Title": "投票 2", "Type": "multiple", "Status": "published", "EffectiveStatus": "ended",
+				"SubmissionCount": int64(5), "OptionCount": int64(3),
+				"CreatedAt": time.Now(), "LinkToken": "def",
+			},
+			map[string]interface{}{
+				"ID": 3, "Title": "投票 3", "Type": "single", "Status": "published", "EffectiveStatus": "published",
+				"SubmissionCount": int64(2), "OptionCount": int64(2),
+				"CreatedAt": time.Now(), "LinkToken": "ghi", "RemainingText": "剩余 2 天 3 小时",
+			},
+			map[string]interface{}{
+				"ID": 4, "Title": "投票 4", "Type": "form", "Status": "published", "EffectiveStatus": "published",
+				"SubmissionCount": int64(1), "OptionCount": int64(0),
+				"CreatedAt": time.Now(), "LinkToken": "jkl", "RemainingText": "无限期",
+			},
+		}
+		if err := renderWithData(t, "user/question-list", base); err != nil {
+			t.Fatalf("render user/question-list (votes panel) failed: %v", err)
+		}
+	})
+
+	t.Run("vote form new", func(t *testing.T) {
+		base := voteBaseData()
+		base["IsUserPage"] = true
+		base["IsEdit"] = false
+		out, err := renderToString(t, "user/vote-form", base)
+		if err != nil {
+			t.Fatalf("render user/vote-form (new) failed: %v", err)
+		}
+		// 站长侧选项上限常量已注入并应用到两类选项输入（单选/多选选项 + 字段选项）。
+		// 缺注入时渲染出的会是 var MAX_OPTION_LEN = <no value>;，两个 maxlength 也失去同源上限。
+		wantVar := regexp.MustCompile(`var MAX_OPTION_LEN\s*=\s*` + strconv.Itoa(conf.Limits.VoteOptionLen) + `\s*;`)
+		if !wantVar.MatchString(out) {
+			t.Fatalf("vote-form: 缺 MAX_OPTION_LEN 注入，want %d", conf.Limits.VoteOptionLen)
+		}
+		wantMax := `maxlength="' + MAX_OPTION_LEN + '"`
+		if n := strings.Count(out, wantMax); n != 2 {
+			t.Fatalf("vote-form: 选项输入框应有两处引用 MAX_OPTION_LEN，实际 %d 处", n)
+		}
+	})
+
+	t.Run("vote form edit", func(t *testing.T) {
+		base := voteBaseData()
+		base["IsUserPage"] = true
+		base["IsEdit"] = true
+		base["Vote"] = &db.Vote{Model: dbutil.Model{ID: 1}, Title: "编辑中", Type: db.VoteTypeMultiple, Visibility: "public",
+			VoterScope: "anyone", ShowResult: "after_vote", MaxChoices: 3, MaxVotesPerFingerprint: 1, RequireCaptcha: true}
+		base["InitialOptions"] = []string{"A", "B"}
+		base["InitialFields"] = []interface{}{}
+		if err := renderWithData(t, "user/vote-form", base); err != nil {
+			t.Fatalf("render user/vote-form (edit) failed: %v", err)
+		}
+	})
+
+	t.Run("vote form edit locked", func(t *testing.T) {
+		base := voteBaseData()
+		base["IsUserPage"] = true
+		base["IsEdit"] = true
+		base["LockedContent"] = true
+		base["Vote"] = &db.Vote{Model: dbutil.Model{ID: 1}, Title: "进行中", Type: db.VoteTypeSingle, Visibility: "public",
+			VoterScope: "anyone", ShowResult: "after_vote", MaxChoices: 1, MaxVotesPerFingerprint: 1, RequireCaptcha: true}
+		base["InitialOptions"] = []string{"A", "B"}
+		base["InitialFields"] = []interface{}{}
+		if err := renderWithData(t, "user/vote-form", base); err != nil {
+			t.Fatalf("render user/vote-form (locked) failed: %v", err)
+		}
+	})
+
+	t.Run("vote results single", func(t *testing.T) {
+		base := voteBaseData()
+		base["IsUserPage"] = true
+		base["Vote"] = &db.Vote{Model: dbutil.Model{ID: 1}, Title: "结果", Type: db.VoteTypeSingle}
+		base["Total"] = int64(2)
+		base["Results"] = map[string]interface{}{
+			"Type": "single",
+			"Options": []interface{}{
+				map[string]interface{}{"Option": map[string]interface{}{"Content": "A"}, "Count": int64(2), "Percent": 100},
+			},
+			"CustomStats": []interface{}{
+				map[string]interface{}{"Text": "自定义项", "Count": int64(1)},
+			},
+		}
+		if err := renderWithData(t, "user/vote-results", base); err != nil {
+			t.Fatalf("render user/vote-results (single) failed: %v", err)
+		}
+	})
+
+	t.Run("vote results form", func(t *testing.T) {
+		base := voteBaseData()
+		base["IsUserPage"] = true
+		base["Vote"] = &db.Vote{Model: dbutil.Model{ID: 1}, Title: "表单结果", Type: db.VoteTypeForm}
+		base["Total"] = int64(1)
+		base["FormFields"] = []*db.VoteFormField{
+			{Label: "昵称", FieldType: db.VoteFormFieldTypeText},
+			{Label: "满意度", FieldType: db.VoteFormFieldTypeRadio, Options: `["满意","一般"]`},
+		}
+		base["Results"] = map[string]interface{}{
+			"Type": "form", "FormCount": int64(1), "FormFieldStats": []interface{}{
+				map[string]interface{}{
+					"Field": map[string]interface{}{"Label": "最喜欢的水果", "FieldType": "radio", "Options": `["苹果","香蕉"]`},
+					"Total": int64(1),
+					"OptionStats": []interface{}{
+						map[string]interface{}{"Option": map[string]interface{}{"Content": "苹果"}, "Count": int64(1)},
+						map[string]interface{}{"Option": map[string]interface{}{"Content": "香蕉"}, "Count": int64(0)},
+					},
+				},
+				map[string]interface{}{
+					"Field": map[string]interface{}{"Label": "整体评价", "FieldType": "rating"},
+					"Total": int64(1), "AvgRating": 9.0,
+					"RatingCounts": []interface{}{},
+				},
+				map[string]interface{}{
+					"Field": map[string]interface{}{"Label": "按喜好排序", "FieldType": "rank"},
+					"Total": int64(1), "AvgRank": 1.5,
+					"OptionStats": []interface{}{
+						map[string]interface{}{"Option": map[string]interface{}{"Content": "A"}, "Count": int64(1), "AvgRank": 1.0},
+						map[string]interface{}{"Option": map[string]interface{}{"Content": "B"}, "Count": int64(1), "AvgRank": 2.0},
+					},
+				},
+				map[string]interface{}{
+					"Field": map[string]interface{}{"Label": "建议", "FieldType": "textarea"},
+					"Total": int64(1), "TextCount": int64(1),
+				},
+			},
+		}
+		// 文本类字段逐条提交内容按字段标签归类（内联在题目下方折叠展示）
+		base["TextReplies"] = map[string]interface{}{
+			"建议": []interface{}{
+				map[string]interface{}{"CreatedAt": time.Now(), "Text": "希望支持深色模式"},
+			},
+		}
+		if err := renderWithData(t, "user/vote-results", base); err != nil {
+			t.Fatalf("render user/vote-results (form) failed: %v", err)
+		}
+	})
+}
+
+func TestRenderQuestionListWithVotes(t *testing.T) {
+	base := voteBaseData()
+	base["PageUser"] = map[string]interface{}{"Domain": "test", "Name": "tester", "Avatar": "",
+		"Background": "", "Intro": "", "UseCustomQRColor": false, "Qrcodebackcolor": "", "Qrcodecolor": "",
+		"Dotscale": "", "BackgroundImage": "", "Backgroundimagealpha": "", "Qrcodepdpcolor": "",
+		"Acfunlink": "", "Bililink": "", "Weibolink": "", "Xiaohongshulink": "", "Bloglink": "",
+		"Usernamecolor": "#000000", "Introcolor": "#000000"}
+	base["CanAsk"] = true
+	base["VoteEnabled"] = true
+	base["PageVotes"] = []*db.Vote{{Title: "板块投票", LinkToken: "abc123"}}
+	base["PageQuestions"] = []interface{}{}
+	base["AnsweredCount"] = int64(0)
+	base["PageQuestionCursor"] = ""
+	base["AllowChat"] = false
+	base["ChatMaxMessages"] = 20
+	if err := renderWithData(t, "question/list", base); err != nil {
+		t.Fatalf("render question/list with votes failed: %v", err)
+	}
+
+	// 箱主本人访问自己的提问箱：无进行中投票时也应显示管理入口（空态）
+	base["IsOwnPage"] = true
+	base["PageVotes"] = []interface{}{}
+	if err := renderWithData(t, "question/list", base); err != nil {
+		t.Fatalf("render question/list (own page, empty) failed: %v", err)
+	}
+}
+
+func TestRenderExploreWithHotVotes(t *testing.T) {
+	base := voteBaseData()
+	base["Users"] = []interface{}{}
+	base["RecommendUsers"] = []interface{}{}
+	base["HotTags"] = []string{}
+	base["Keyword"] = ""
+	base["Sort"] = "latest"
+	base["Page"] = 1
+	base["TotalPages"] = 1
+	base["PrevPage"] = 0
+	base["NextPage"] = 2
+	base["HotVotes"] = []*db.Vote{
+		{Title: "热门投票 1", LinkToken: "abc1", Type: db.VoteTypeSingle},
+		{Title: "热门投票 2", LinkToken: "abc2", Type: db.VoteTypeForm},
+	}
+	base["AllVotes"] = []*db.Vote{
+		{Title: "全部投票 1", LinkToken: "abc3", Type: db.VoteTypeMultiple, Model: dbutil.Model{CreatedAt: time.Now()}},
+	}
+	if err := renderWithData(t, "user/explore", base); err != nil {
+		t.Fatalf("render user/explore with hot votes failed: %v", err)
+	}
+}