feat: 后端限速实现 + 前端i18n全面国际化 + 安全与代码质量修复

后端:
- trafficmgr: 实现 tc htb 限速（ApplyRateLimit/RemoveRateLimit），自动推导接口名
- 各协议服务: 代码质量改进与错误处理增强

前端:
- protocols.js: 170个硬编码中文字符串全部转为 i18n key，中英文双语翻译
- 提取 fmtBytes() 到 utils/format.js 公共模块（消除 4 处重复）
- router.js: 添加路由级权限守卫，非管理员无法直接 URL 访问管理页
- Tunnels.vue: SSE 日志流改用 fetch+ReadableStream，token 放 Authorization header
- VPNUsers.vue: 修复 catch 块中文硬编码 fallback
- 新增 TaskProgress 组件、taskmgr 后端任务管理

frontend/src/locales/zh-CN.json

@@ -23,7 +23,7 @@
     "name": "名称",
     "description": "说明",
     "username": "用户名",
-    "password": "密码",
+    "password": "***",
     "email": "邮箱",
     "source": "来源",
     "local": "本地",
@@ -51,7 +51,8 @@
     "noData": "暂无数据",
     "never": "不",
     "copiedToClipboard": "已复制到剪贴板",
-    "logout": "退出登录"
+    "logout": "退出登录",
+    "batchOperation": "批量操作"
   },
   "login": {
     "title": "VPN 专线管理平台",
@@ -102,7 +103,8 @@
     "recommendedCmd": "推荐命令",
     "otherDistros": "其他发行版",
     "copyRecommended": "复制推荐命令",
-    "getInstallCmdFailed": "获取安装命令失败"
+    "getInstallCmdFailed": "获取安装命令失败",
+    "aptDefault": "apt 默认"
   },
   "tunnels": {
     "searchPlaceholder": "搜索名称",
@@ -184,7 +186,28 @@
     "qrFailed": "生成二维码失败",
     "noClientConfigWarn": "无客户端配置",
     "deleteTunnelConfirm": "确定删除专线「{name}」？配置与密钥将一并清除。",
-    "peerAlreadyAdded": "Peer 已添加"
+    "peerAlreadyAdded": "Peer 已添加",
+    "stopFailed": "停止失败",
+    "selected": "已选择 {count} 项",
+    "batchStart": "批量启动",
+    "batchStop": "批量停止",
+    "batchDelete": "批量删除",
+    "batchStartConfirm": "确认批量启动 {count} 条隧道？",
+    "batchStopConfirm": "确认批量停止 {count} 条隧道？",
+    "batchDeleteConfirm": "确认批量删除 {count} 条隧道？此操作不可撤销！",
+    "batchStarted": "批量操作已提交，正在后台执行",
+    "taskProgress": "任务进度",
+    "taskPending": "等待中",
+    "taskRunning": "执行中",
+    "taskDone": "已完成",
+    "taskFailed": "失败",
+    "taskSuccess": "成功 {count}/{total}",
+    "taskFailedCount": "失败 {count}",
+    "taskInProgress": "进行中 ({done}/{total})",
+    "taskComplete": "全部完成",
+    "taskPartialFail": "部分失败",
+    "viewTasks": "查看任务",
+    "noTasks": "暂无任务记录"
   },
   "tunnelEditor": {
     "title": "编辑专线",
@@ -295,7 +318,9 @@
     "ldapLoadFailed": "LDAP 加载失败",
     "ldapConfigSaved": "LDAP 配置已保存",
     "ldapConnected": "LDAP 连接成功",
-    "ldapConnectFailed": "连接失败"
+    "ldapConnectFailed": "连接失败",
+    "emptyUsername": "(空)",
+    "errorDetails": "失败详情："
   },
   "vpnUsers": {
     "title": "VPN 拨号用户",
@@ -333,6 +358,7 @@
     "lockedUntil": "是（至 {time}）",
     "lastOtpSuccess": "最近 OTP 成功",
     "compatible": "兼容",
+    "totpCompatible": "TOTP 标准（兼容 Google/Microsoft Authenticator）",
     "bindAuthenticator": "绑定 Authenticator",
     "disableMfa": "关闭 MFA",
     "regenBackupCodes": "重新生成备用码",
@@ -580,5 +606,395 @@
   },
   "protocolIcon": {
     "custom": "自定义协议"
+  },
+  "protocols": {
+    "wireguard": {
+      "name": "WireGuard",
+      "desc": "性能最好的现代 VPN，内核级实现，漫游友好",
+      "scenes": "内部接入 / 移动办公",
+      "fields": {
+        "address": {
+          "label": "服务端 VPN 网段地址",
+          "tip": "服务端在 VPN 网段中的地址（CIDR）"
+        },
+        "listen_port": {
+          "label": "监听端口"
+        },
+        "client_address": {
+          "label": "首个客户端地址",
+          "tip": "创建后可在详情中继续添加 Peer"
+        },
+        "public_endpoint": {
+          "label": "公网接入点",
+          "tip": "客户端连接用，公网 IP:端口"
+        },
+        "dns": {
+          "label": "DNS"
+        },
+        "allowed_ips": {
+          "label": "客户端 AllowedIPs",
+          "tip": "全流量代理用 0.0.0.0/0；仅内网填内网网段"
+        },
+        "keepalive": {
+          "label": "Keepalive(秒)",
+          "tip": "NAT 后客户端建议 15–25"
+        },
+        "mtu": {
+          "label": "MTU",
+          "tip": "0 表示默认；跨公网常见 1280–1420"
+        },
+        "enable_nat": {
+          "label": "启用 NAT 出网",
+          "tip": "客户端需访问公网/其它网段时开启"
+        },
+        "egress_interface": {
+          "label": "NAT 出口网卡",
+          "tip": "留空则自动探测默认路由网卡"
+        }
+      }
+    },
+    "ipsec": {
+      "name": "IPSec 站点互联",
+      "desc": "与第三方设备（Cisco/华为/飞塔等）做站点到站点对接",
+      "scenes": "第三方对接 / 站点互联",
+      "fields": {
+        "vendor_template": {
+          "label": "厂商模板",
+          "tip": "自动预填 Phase1/Phase2 提议，仍可手动改",
+          "options": {
+            "generic": "通用标准（推荐）",
+            "cisco": "Cisco ISR/ASR",
+            "fortigate": "FortiGate",
+            "huawei": "华为 USG/AR",
+            "h3c": "H3C"
+          }
+        },
+        "public_endpoint": {
+          "label": "本端公网 IP"
+        },
+        "remote_gateway": {
+          "label": "对端网关地址"
+        },
+        "local_subnets": {
+          "label": "本端网段",
+          "tip": "多个网段用逗号分隔"
+        },
+        "remote_subnets": {
+          "label": "对端网段"
+        },
+        "psk": {
+          "label": "预共享密钥 PSK"
+        },
+        "ike_version": {
+          "label": "IKE 版本",
+          "options": {
+            "ikev2": "IKEv2",
+            "ikev1": "IKEv1"
+          }
+        },
+        "ike_proposal": {
+          "label": "Phase1 提议",
+          "tip": "加密-认证-DH组，需与对端一致"
+        },
+        "esp_proposal": {
+          "label": "Phase2 提议"
+        },
+        "pfs_group": {
+          "label": "PFS DH 组"
+        },
+        "ike_lifetime": {
+          "label": "IKE 生存期(秒)"
+        },
+        "local_id": {
+          "label": "本端标识 ID"
+        },
+        "remote_id": {
+          "label": "对端标识 ID"
+        }
+      }
+    },
+    "ikev2": {
+      "name": "IKEv2 远程接入",
+      "desc": "手机/笔记本原生拨号进内网，比 L2TP 更现代",
+      "scenes": "员工远程办公 / 原生 VPN",
+      "fields": {
+        "public_endpoint": {
+          "label": "服务器公网地址"
+        },
+        "local_id": {
+          "label": "服务器 ID / 远程 ID",
+          "tip": "客户端「远程 ID」与此一致"
+        },
+        "psk": {
+          "label": "机器认证 PSK",
+          "tip": "留空自动生成；iOS/Android 共享密钥"
+        },
+        "username": {
+          "label": "默认拨号用户"
+        },
+        "password": {
+          "label": "默认拨号密码",
+          "tip": "留空自动生成；更多账号在拨号用户页添加"
+        },
+        "address_pool": {
+          "label": "客户端地址池"
+        },
+        "dns": {
+          "label": "下发 DNS"
+        },
+        "local_ts": {
+          "label": "放行网段",
+          "tip": "0.0.0.0/0 为全流量；可改为内网 CIDR"
+        },
+        "ike_proposal": {
+          "label": "IKE 提议"
+        },
+        "esp_proposal": {
+          "label": "ESP 提议"
+        }
+      }
+    },
+    "l2tp": {
+      "name": "L2TP/IPSec",
+      "desc": "兼容性最好，手机/老设备/路由器原生支持",
+      "scenes": "移动设备 / 老设备兼容",
+      "fields": {
+        "public_endpoint": {
+          "label": "服务器公网 IP"
+        },
+        "psk": {
+          "label": "IPSec 预共享密钥"
+        },
+        "username": {
+          "label": "默认拨号用户名",
+          "tip": "可在「VPN 拨号用户」为本隧道添加更多账号"
+        },
+        "password": {
+          "label": "默认拨号密码",
+          "tip": "若只使用拨号用户表可留空（创建时需至少有一种）"
+        },
+        "ip_range": {
+          "label": "客户端地址池"
+        },
+        "local_ip": {
+          "label": "服务端隧道地址"
+        },
+        "dns": {
+          "label": "下发 DNS"
+        }
+      }
+    },
+    "frp": {
+      "name": "FRP 内网穿透",
+      "desc": "国内刚需，TCP/UDP/HTTP 端口映射与反向代理",
+      "scenes": "内网穿透 / 端口映射",
+      "fields": {
+        "mode": {
+          "label": "运行模式",
+          "tip": "server=frps（有公网），client=frpc（内网侧）",
+          "options": {
+            "server": "server (frps 公网侧)",
+            "client": "client (frpc 内网侧)"
+          }
+        },
+        "bind_port": {
+          "label": "绑定端口(server)"
+        },
+        "public_endpoint": {
+          "label": "公网地址(server)"
+        },
+        "dashboard_port": {
+          "label": "管理面板端口(server)"
+        },
+        "dashboard_user": {
+          "label": "管理面板账号(server)"
+        },
+        "dashboard_password": {
+          "label": "管理面板密码(server)",
+          "tip": "留空时自动生成强随机密码；编辑时留空保持原密码"
+        },
+        "vhost_http_port": {
+          "label": "HTTP 虚拟主机端口",
+          "tip": "0 表示不启用；HTTP 代理需 >0"
+        },
+        "vhost_https_port": {
+          "label": "HTTPS 虚拟主机端口",
+          "tip": "0 表示不启用"
+        },
+        "allow_ports": {
+          "label": "允许映射端口范围",
+          "tip": "限制 frpc 可申请的 remotePort"
+        },
+        "server_addr": {
+          "label": "frps 地址(client)"
+        },
+        "server_port": {
+          "label": "frps 端口(client)"
+        },
+        "token": {
+          "label": "认证 Token",
+          "tip": "留空自动生成"
+        },
+        "proxy_name": {
+          "label": "代理名称"
+        },
+        "proxy_type": {
+          "label": "代理类型",
+          "options": {
+            "tcp": "TCP",
+            "udp": "UDP",
+            "http": "HTTP",
+            "https": "HTTPS",
+            "stcp": "STCP（安全点对点）",
+            "xtcp": "XTCP（P2P）"
+          }
+        },
+        "local_ip": {
+          "label": "内网目标 IP"
+        },
+        "local_port": {
+          "label": "内网目标端口"
+        },
+        "remote_port": {
+          "label": "公网映射端口"
+        },
+        "custom_domains": {
+          "label": "绑定域名",
+          "tip": "HTTP/HTTPS 代理必填"
+        },
+        "secret_key": {
+          "label": "STCP/XTCP 密钥",
+          "tip": "访问端与提供端需一致"
+        }
+      }
+    },
+    "openvpn": {
+      "name": "OpenVPN",
+      "desc": "最成熟的开源 VPN，兼容各类老项目与系统",
+      "scenes": "老项目兼容 / 通用接入",
+      "fields": {
+        "public_endpoint": {
+          "label": "公网接入地址"
+        },
+        "port": {
+          "label": "端口"
+        },
+        "proto": {
+          "label": "传输协议",
+          "tip": "可随时在编辑中切换；切换后需重启专线，客户端需重新下载配置",
+          "options": {
+            "udp": "UDP（推荐，性能更好）",
+            "tcp-server": "TCP（穿透限制网络更稳）"
+          }
+        },
+        "subnet": {
+          "label": "VPN 网段",
+          "tip": "如 10.8.0.0 255.255.240.0 可容纳更多客户端（/20）"
+        },
+        "cipher": {
+          "label": "加密算法",
+          "options": {
+            "AES-256-GCM": "AES-256-GCM",
+            "AES-128-GCM": "AES-128-GCM",
+            "AES-256-CBC": "AES-256-CBC"
+          }
+        },
+        "auth_mode": {
+          "label": "认证方式",
+          "tip": "密码模式对齐生产 verify-client-cert none + username-as-common-name",
+          "options": {
+            "certificate": "仅证书",
+            "password": "***",
+            "certificate+password": "证书 + 密码"
+          }
+        },
+        "mfa_mode": {
+          "label": "拨号 MFA (2FA)",
+          "tip": "static-challenge + TOTP；在拨号用户页管理 OTP",
+          "options": {
+            "off": "关闭",
+            "optional": "可选（用户绑定后才校验）",
+            "required": "强制（所有拨号用户必须 MFA）"
+          }
+        },
+        "otp_slop": {
+          "label": "OTP 时钟容差(秒)"
+        },
+        "otp_max_failures": {
+          "label": "OTP 失败锁定次数"
+        },
+        "otp_lockout_sec": {
+          "label": "OTP 锁定时长(秒)"
+        },
+        "otp_disallow_reuse": {
+          "label": "禁止重复使用同码"
+        },
+        "dns": {
+          "label": "下发 DNS"
+        },
+        "redirect_gateway": {
+          "label": "全流量代理",
+          "tip": "关闭后仅推送下方内网路由（生产常只推指定路由）"
+        },
+        "push_routes": {
+          "label": "推送内网路由",
+          "tip": "CIDR 逗号分隔"
+        },
+        "enable_nat": {
+          "label": "启用 NAT 出网"
+        },
+        "max_clients": {
+          "label": "最大客户端数",
+          "tip": "0 不限制；生产常见 1000"
+        },
+        "keepalive_interval": {
+          "label": "Keepalive 间隔",
+          "tip": "生产常用 keepalive 5 30"
+        },
+        "keepalive_timeout": {
+          "label": "Keepalive 超时"
+        },
+        "tun_mtu": {
+          "label": "tun-mtu",
+          "tip": "生产常用 1500"
+        },
+        "tun_mtu_extra": {
+          "label": "tun-mtu-extra"
+        },
+        "mssfix": {
+          "label": "mssfix",
+          "tip": "0=不设置；TCP 生产常用 1450，选 TCP 时默认 1450"
+        },
+        "duplicate_cn": {
+          "label": "允许 duplicate-cn",
+          "tip": "同用户名/证书多终端同时在线；密码模式默认会自动开启"
+        },
+        "reneg_sec": {
+          "label": "reneg-sec",
+          "tip": "0=禁用 TLS 重协商（生产/MFA 推荐）；证书-only 默认可 3600"
+        },
+        "run_as_user": {
+          "label": "降权用户",
+          "tip": "对应 user openvpn；需系统已有该用户，留空不降权"
+        },
+        "run_as_group": {
+          "label": "降权组",
+          "tip": "对应 group openvpn"
+        }
+      }
+    },
+    "custom": {
+      "fields": {
+        "endpoint": {
+          "label": "接入地址"
+        },
+        "token": {
+          "label": "认证凭据"
+        },
+        "extra": {
+          "label": "扩展参数(JSON)"
+        }
+      }
+    }
   }
 }