feat: 易支付积分充值 + 站内公告 + OpenAI 视频修复 + grok/adobe 失败处理

充值/订单(易支付 mapi):
- 订单表 + 30 分钟自动取消;支付弹窗(二维码/跳转监控、倒计时、轮询、5s 倒计时关闭)
- 系统设置可配:开关/商户ID/密钥/支付地址(根地址拼 /mapi)/支付方式/最低额/积分比例(默认 1元=100积分)
- 异步通知 MD5 验签、幂等到账;用户累计充值;前台/后台订单页(筛选+搜索+分页,前后台分风格);用户管理累计充值列

站内公告:
- Markdown 公告,登录用户首次访问/刷新弹出;内容哈希做版本,改了就重新推;管理员不弹;空内容=下线

OpenAI 视频(/v1/videos)修复:
- /content 拿不到视频:grok 资源 URL 需鉴权,改为用生成账号 token 取流;adobe/runway 公开 URL 直代理(不存 RustFS)
- size→分辨率用短边判定(1280x720 = 720p,之前误判 1080p 被拒)

失败处理:
- grok 429「Too many requests」/403 anti-bot 改判临时错误(不再误封号),真额度耗尽才算 quota
- adobe 视频 408 / system under load 归为临时错误 → tempAsDead 封号

其它:
- 充值默认关闭;签到格子浅色可见;登录验证码按钮浅色可读;并发/账户信息展示
- 创作记录/画图台只显示画图台作品(排除 API);日志页 API 视频预览显示 —
- 视频去画中画/下载/投屏(全局);图片缩略图改背景图规避 Edge 视觉搜索
- 订单/兑换码/配置/日志菜单文案与图标;充值版块样式

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/main.js

@@ -13,6 +13,8 @@ import PlaygroundView from './views/PlaygroundView.vue'
 import UserLogsView from './views/UserLogsView.vue'
 import UserLogsTableView from './views/UserLogsTableView.vue'
 import SettingsView from './views/SettingsView.vue'
+import OrdersView from './views/OrdersView.vue'
+import AdminOrdersView from './views/AdminOrdersView.vue'
 import InviteView from './views/InviteView.vue'
 import DocsView from './views/DocsView.vue'
 import AboutView from './views/AboutView.vue'
@@ -40,6 +42,7 @@ const routes = [
       { path: 'invite', component: InviteView, meta: { label: '邀请' } },
       { path: 'docs', component: DocsView, meta: { label: '文档' } },
       { path: 'about', component: AboutView, meta: { label: '关于' } },
+      { path: 'orders', component: OrdersView, meta: { label: '订单' } },
       { path: 'settings', component: SettingsView, meta: { label: '设置' } },
     ],
   },
@@ -53,12 +56,13 @@ const routes = [
       { path: 'accounts', component: AccountsView, meta: { label: '账号管理' } },
       { path: 'users',    component: UsersView,    meta: { label: '用户管理' } },
       { path: 'concurrency', component: ConcurrencyView, meta: { label: '并发分组' } },
-      { path: 'cdks',     component: CdksView,     meta: { label: '兑换码' } },
+      { path: 'orders', component: AdminOrdersView, meta: { label: '订单管理' } },
+      { path: 'cdks',     component: CdksView,     meta: { label: '兑换码管理' } },
       { path: 'invites',  component: InvitesAdminView, meta: { label: '邀请日志' } },
       { path: 'images',   component: ImagesView,   meta: { label: '图片管理' } },
       { path: 'showcase', component: ShowcaseView, meta: { label: '首页内容' } },
-      { path: 'logs',     component: LogsView,     meta: { label: '日志' } },
-      { path: 'config',   component: ConfigView,   meta: { label: '配置' } },
+      { path: 'logs',     component: LogsView,     meta: { label: '日志管理' } },
+      { path: 'config',   component: ConfigView,   meta: { label: '系统配置' } },
     ],
   },
   // legacy redirects
@@ -83,7 +87,7 @@ const router = createRouter({
 
 // Pages that require a login. The home page (/) stays public; everything a
 // signed-in user touches (画图/记录/设置) and the whole admin area is gated.
-const PROTECTED = ['/user', '/logs', '/invite', '/settings']
+const PROTECTED = ['/user', '/logs', '/invite', '/settings', '/orders']
 function isProtected(path) {
   return path.startsWith('/admin') || PROTECTED.includes(path)
 }
@@ -119,3 +123,25 @@ router.afterEach(applyTitle)
 loadSite().then(() => applyTitle(router.currentRoute.value))
 
 createApp(App).use(router).mount('#app')
+
+// Globally strip the browser's video extras (画中画/PiP、下载、投屏、播放速率/增强菜单)
+// from EVERY <video> — applied to existing nodes + anything Vue renders later.
+// (Edge's image "视觉搜索" is handled by rendering thumbnails as CSS background
+//  images instead of <img>, since there's no attribute to disable it.)
+function hardenVideo(v) {
+  try {
+    v.disablePictureInPicture = true
+    v.disableRemotePlayback = true
+    v.setAttribute('controlslist', 'nodownload noremoteplayback noplaybackrate')
+  } catch { /* ignore */ }
+}
+new MutationObserver((muts) => {
+  for (const m of muts) {
+    for (const n of m.addedNodes) {
+      if (n.nodeType !== 1) continue
+      if (n.tagName === 'VIDEO') hardenVideo(n)
+      else n.querySelectorAll && n.querySelectorAll('video').forEach(hardenVideo)
+    }
+  }
+}).observe(document.documentElement, { childList: true, subtree: true })
+document.querySelectorAll('video').forEach(hardenVideo)