feat: improve authentication and user management

- Fix token missing issue after email code registration/login
- Add last login time update for code-based login
- Support email login in addition to username login
- Fix password login for code-registered users (allow setting password)
- Fix referral code parameter passing from URL hash
- Add email column to user management table
- Improve profile page layout (align card heights, reorganize layout)
- Add i18n support for Register Bonus, Referral Bonus, Code Lock Minutes, Code Max Attempts
- Fix billing service add_credits to support reference_id parameter
- Update password handling documentation

backend_api_python/env.example

@@ -7,6 +7,7 @@
 SECRET_KEY=quantdinger-secret-key-change-me
 ADMIN_USER=quantdinger
 ADMIN_PASSWORD=123456
+ADMIN_EMAIL=admin@example.com
 
 # =========================
 # Demo Mode
@@ -217,3 +218,71 @@ SEARCH_BING_API_KEY=
 # Internal API key (optional, if you add internal-service auth later)
 INTERNAL_API_KEY=
 
+# =========================
+# Registration & Security (注册与安全)
+# =========================
+# Enable user registration (允许用户注册)
+ENABLE_REGISTRATION=true
+
+# Cloudflare Turnstile (人机验证)
+# Get your keys at: https://dash.cloudflare.com/?to=/:account/turnstile
+TURNSTILE_SITE_KEY=
+TURNSTILE_SECRET_KEY=
+
+# Frontend URL (for OAuth redirects)
+FRONTEND_URL=http://localhost:8080
+
+# Google OAuth
+# Get your credentials at: https://console.cloud.google.com/apis/credentials
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+GOOGLE_REDIRECT_URI=http://localhost:5000/api/auth/oauth/google/callback
+
+# GitHub OAuth
+# Get your credentials at: https://github.com/settings/developers
+GITHUB_CLIENT_ID=
+GITHUB_CLIENT_SECRET=
+GITHUB_REDIRECT_URI=http://localhost:5000/api/auth/oauth/github/callback
+
+# Security: IP rate limit (防爆破 - IP维度)
+# Block IP after N failed attempts within M minutes for X minutes
+SECURITY_IP_MAX_ATTEMPTS=10
+SECURITY_IP_WINDOW_MINUTES=5
+SECURITY_IP_BLOCK_MINUTES=15
+
+# Security: Account rate limit (防爆破 - 账户维度)
+SECURITY_ACCOUNT_MAX_ATTEMPTS=5
+SECURITY_ACCOUNT_WINDOW_MINUTES=60
+SECURITY_ACCOUNT_BLOCK_MINUTES=30
+
+# Verification code settings (验证码设置)
+VERIFICATION_CODE_EXPIRE_MINUTES=10
+VERIFICATION_CODE_RATE_LIMIT=60
+VERIFICATION_CODE_IP_HOURLY_LIMIT=10
+VERIFICATION_CODE_MAX_ATTEMPTS=5
+VERIFICATION_CODE_LOCK_MINUTES=30
+
+# =========================
+# Billing & Credits (积分计费系统)
+# =========================
+# Enable billing system (启用计费系统)
+BILLING_ENABLED=False
+
+# VIP users can use all paid features for free (VIP用户免费)
+BILLING_VIP_BYPASS=True
+
+# Credits consumed per feature (各功能消耗积分数)
+BILLING_COST_AI_ANALYSIS=10
+BILLING_COST_STRATEGY_RUN=5
+BILLING_COST_BACKTEST=3
+BILLING_COST_PORTFOLIO_MONITOR=8
+
+# Telegram customer service URL for recharge (充值跳转的Telegram链接)
+RECHARGE_TELEGRAM_URL=https://t.me/your_support_bot
+
+# New user registration bonus credits (新用户注册赠送积分)
+CREDITS_REGISTER_BONUS=100
+
+# Referral bonus credits (邀请用户赠送积分，邀请人获得)
+CREDITS_REFERRAL_BONUS=50
+