phsl / new-api

* fix: use GORM v2 row locking for subscription resets

* docs: codify GORM row locking rules

controller/task_video.go and service/pre_consume_quota.go were already
removed in ba25ba88 and 116004fd (logic lives in service/task_polling.go
and BillingSession now), then brought back as stale copies by a42b3976.
Both have zero callers.

controller/swag_video.go is a leftover swag stub: the swaggo pipeline is
gone and docs/openapi/relay.json already documents these routes.

Signed-off-by: zuiho <2324465096@qq.com>

* 支持渠道表格列宽拖拽

* fix(web): address column resize review feedback

* feat(web): auto-fit resized table columns

* fix(web): reduce column resize persistence work

---------

Signed-off-by: zuiho <2324465096@qq.com>

* fix(wallet): honor configured quota units for reward transfers

* fix(i18n): localize quota preview descriptions

* fix(settings): normalize invalid quota input

The ratio column normalized input to number on every keystroke, so
typing 0.05 got stuck at 0.0 which Number() collapses to 0. Keep the
value as a string draft like the top-up ratio column and only convert
to number when serializing.

Fixes #5986

* feat(subscription): add admin quota reset actions

* fix(subscription): keep quota reset in plan row actions

* refactor(subscription): move user subscription actions into menu

* Create zh-TW.json

* Update _sync-report.json

* Update languages.ts

* Update config.ts

* fix(i18n): update language codes and improve translations for zh-CN and zh-TW

Thread int32 saturation clamps from tiered settlement and video task
recompute into the consume/task logs under admin_info, so oversized or
malformed billing inputs stay auditable. Clamp negative audio duration
before token conversion and gate the saturation UI markers on admin.

Bound max-tokens fields across all relay format validators, saturate
tiered-expression rounding and audio/tool/task token conversions, and
route legacy remix ratios through the guarded setter.

Bound user-supplied count/duration parameters at request validation,
route ratio multipliers through guarded setters, and use saturating
int conversions in all quota math paths.

* Revert "fix(classic): fix classic web build failures"

This reverts commit 997926bb.

* fix(classic): use available Slack icon export

* fix: avoid stale stream writes after client disconnect

* fix: wait for stream ping goroutines before returning

* fix: log stream results after goroutine cleanup

* fix: broadcast stream stop signals

* fix: abort upstream on client disconnect and restore write error contracts

Keep the goroutine-lifecycle fix (unconditional wg.Wait before returning the
gin.Context, close resp.Body inside cleanup), but drop the drain-on-disconnect
behavior: when the client goes away, cleanup now runs immediately so the
upstream body is closed, the provider stops generating, and users are not
billed for tokens produced after they disconnected.

Also restore FlushWriter/StringData/PingData returning an error when the
request context is done, so non-scanner relay loops (ollama, fake-stream,
audio, image) keep their disconnect awareness instead of silently consuming
the upstream to completion. ResponseChunkData now propagates write errors.

Add a bounded per-write deadline (http.NewResponseController) before each
locked stream write so a slow-but-connected client cannot block a write
forever and hang the unconditional wg.Wait.

---------

Co-authored-by: CaIon <i@caion.me>

* feat: optimize legacy top-up warning banner copy (#5851)

* fix(i18n): use standard Latin period at the end of Vietnamese translations

The sign-in route already redirects logged-in users to /dashboard in its
beforeLoad guard, but the sign-up route (and its /register alias) had no
such guard, leaving authenticated users on the registration form. This
mirrors the classic theme's AuthRedirect behavior. Add an equivalent
beforeLoad guard using the same useAuthStore, redirecting to /dashboard
for consistency with the sign-in route.

Closes #5908

Co-authored-by: 贺. <kuang@M1.local>

Shadow DOM 的样式隔离特性导致外部 html 元素上的 dark class 无法被
Shadow DOM 内部的 Tailwind dark: 选择器匹配到。通过 MutationObserver
监听 document.documentElement 的 class 变化，将 dark class 同步到
Shadow DOM 内的包装容器上，使深色模式样式正常生效。

* fix: apply default ali video duration when value is non-positive

* fix: persist task quota after async settlement

Pin down the checkUpdatePassword contract:

- changing a password requires the correct current password
- OAuth/passwordless accounts (empty password hash) cannot set a
  password through the self-service endpoint and must use the password
  reset flow instead
- setupLogin never writes back the password column

These guard against regressing the password-change path back into a
short-circuit that lets passwordless accounts set a password directly.