feat: 易支付积分充值 + 站内公告 + OpenAI 视频修复 + grok/adobe 失败处理

充值/订单(易支付 mapi):
- 订单表 + 30 分钟自动取消;支付弹窗(二维码/跳转监控、倒计时、轮询、5s 倒计时关闭)
- 系统设置可配:开关/商户ID/密钥/支付地址(根地址拼 /mapi)/支付方式/最低额/积分比例(默认 1元=100积分)
- 异步通知 MD5 验签、幂等到账;用户累计充值;前台/后台订单页(筛选+搜索+分页,前后台分风格);用户管理累计充值列

站内公告:
- Markdown 公告,登录用户首次访问/刷新弹出;内容哈希做版本,改了就重新推;管理员不弹;空内容=下线

OpenAI 视频(/v1/videos)修复:
- /content 拿不到视频:grok 资源 URL 需鉴权,改为用生成账号 token 取流;adobe/runway 公开 URL 直代理(不存 RustFS)
- size→分辨率用短边判定(1280x720 = 720p,之前误判 1080p 被拒)

失败处理:
- grok 429「Too many requests」/403 anti-bot 改判临时错误(不再误封号),真额度耗尽才算 quota
- adobe 视频 408 / system under load 归为临时错误 → tempAsDead 封号

其它:
- 充值默认关闭;签到格子浅色可见;登录验证码按钮浅色可读;并发/账户信息展示
- 创作记录/画图台只显示画图台作品(排除 API);日志页 API 视频预览显示 —
- 视频去画中画/下载/投屏(全局);图片缩略图改背景图规避 Edge 视觉搜索
- 订单/兑换码/配置/日志菜单文案与图标;充值版块样式

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/internal/service/v1.go

@@ -722,6 +722,8 @@ func (s *V1Service) runVideoJob(ctx context.Context, principal *APIPrincipal, in
 	defer s.cleanupReferenceImages(ctx, eventID, refFiles)
 	startedAt := time.Now()
 
+	// No-store: capture only the UPSTREAM video URL. /content streams it on demand
+	// (grok URLs are auth-gated → fetched with the generating account's token).
 	var videoURL string
 	var execErr error
 	switch s.effectiveProvider(genCtx, modelItem) {
@@ -748,7 +750,7 @@ func (s *V1Service) runVideoJob(ctx context.Context, principal *APIPrincipal, in
 		_ = s.events.UpdateStatus(ctx, eventID, "failed", "upstream returned no video url", 0)
 		return
 	}
-	// Store the upstream URL as the event's "file"; /content proxies it.
+	// Store the upstream URL as the event's "file"; /content fetches it on demand.
 	if err := s.events.MarkVideoReady(ctx, eventID, videoURL, int(time.Since(startedAt).Milliseconds())); err != nil {
 		return
 	}
@@ -787,6 +789,22 @@ func (s *V1Service) OpenVideoContent(ctx context.Context, principal *APIPrincipa
 	if ev.Status != "success" || strings.TrimSpace(ev.File) == "" {
 		return nil, "", ErrVideoNotReady
 	}
+	// grok asset URLs (assets.grok.com) are auth-gated — a plain GET 403s. Stream
+	// them through the SAME account that generated the clip, using its token. If
+	// that account is gone (grok pools churn often), the clip is unrecoverable.
+	if ev.Provider == "grok" && s.grok != nil {
+		if s.settings != nil {
+			if proxy, perr := s.settings.GetValue(ctx, "proxy.url"); perr == nil {
+				s.grok.SetProxy(proxy)
+			}
+		}
+		acct, _ := s.tokens.Get(ctx, "grok", ev.AccountID)
+		if acct == nil || strings.TrimSpace(acct.Value) == "" {
+			return nil, "", fmt.Errorf("%w: grok account no longer available for this video", ErrProviderTemporary)
+		}
+		return s.grok.OpenAsset(ctx, acct.Value, ev.File)
+	}
+	// Other providers return publicly-fetchable URLs — proxy directly.
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, ev.File, nil)
 	if err != nil {
 		return nil, "", err
@@ -1251,9 +1269,9 @@ const maxTempDeadAccounts = 3
 //       • tempAsDead=false (default): retry the SAME account up to
 //         maxSameAccountAttempts times (not counted); if still failing, STOP
 //         (no fan-out — an upstream-wide blip fails identically everywhere).
-//       • tempAsDead=true (adobe): treat the temporary error as a DEAD account —
-//         mark it like a 401 and fail over to the next account, capped at
-//         maxTempDeadAccounts accounts so a pool-wide blip can't kill everything.
+//       • tempAsDead=true (adobe): BAN the account (mark dead/disabled) and fail
+//         over to the next account, capped at maxTempDeadAccounts accounts so a
+//         pool-wide blip can't kill everything. Dead accounts don't auto-recover.
 //   - 参数错 / request-level (anything else) → return immediately, no retry, no
 //     account penalty (the account isn't at fault).
 //
@@ -1356,10 +1374,17 @@ func (s *V1Service) tryAccount(ctx context.Context, eventID, pool string, token
 		if isTemp {
 			if tempAsDead {
 				// Ops policy (adobe): a temporary upstream error ("system under
-				// load" etc.) means this account is effectively dead — mark it
-				// like a 401 and fail over to the next account. The pool driver
-				// caps how many accounts this is allowed to burn.
-				s.markTokenFailure(ctx, pool, token, kind, true, false)
+				// load" etc.) BANS this account — mark it dead/disabled and fail
+				// over to the next account. The pool driver caps how many accounts
+				// this is allowed to burn per request (maxTempDeadAccounts). Note:
+				// dead accounts do NOT auto-recover — they need a manual re-enable.
+				_, _ = s.tokens.Update(ctx, pool, token.ID, map[string]any{
+					"status":       "disabled",
+					"dead":         true,
+					"last_used_at": time.Now(),
+					"fail_total":   gorm.Expr("fail_total + 1"),
+					"fails":        gorm.Expr("fails + 1"),
+				})
 				return nil, err, true, true
 			}
 			tempAttempts++