M3 收尾: 限流/配额 + 前端骨架屏 + 单端口托管前端

- ratelimit(内存计数): 密钥级每日请求数/Token 配额、用户级每秒速率
  (OT_RATELIMIT_USER_RPS), 超限返回 429
- 网关 Auth 前置配额/限流检查, finishUsage 累计密钥 token 用量
- 前端 Skeleton 组件 + Dashboard/管理总览加载态
- Go 服务托管 web/dist 静态资源(SPA 回退), 单端口即可访问前后端

Co-Authored-By: Claude <noreply@anthropic.com>

server/internal/api/router.go

@@ -2,6 +2,8 @@ package api
 
 import (
 	"net/http"
+	"os"
+	"strings"
 
 	"github.com/gin-gonic/gin"
 	"github.com/openteam/server/internal/api/middleware"
@@ -29,15 +31,26 @@ func NewRouter(a *app.App, gw *proxy.Gateway) *gin.Engine {
 		proxyGroup.Any("/messages", gw.Auth, gw.Handle)
 		proxyGroup.Any("/models", gw.Auth, gw.Handle)
 	}
-	// 未匹配的 /v1/* 返回 OpenAI 风格 404（需先认证）
+	// 静态资源（前端构建产物，存在时托管）
+	const dist = "web/dist"
+	if _, err := os.Stat(dist); err == nil {
+		r.Static("/assets", dist+"/assets")
+		r.StaticFile("/favicon.svg", dist+"/favicon.svg")
+	}
+
+	// 未匹配路由：/v1/* 走代理鉴权；其余回退 SPA 或 404
 	r.NoRoute(func(c *gin.Context) {
-		if len(c.Request.URL.Path) >= 3 && c.Request.URL.Path[:3] == "/v1" {
+		if strings.HasPrefix(c.Request.URL.Path, "/v1") {
 			gw.Auth(c)
 			if !c.IsAborted() {
 				gw.Handle(c)
 			}
 			return
 		}
+		if _, err := os.Stat(dist); err == nil {
+			c.File(dist + "/index.html")
+			return
+		}
 		c.JSON(http.StatusNotFound, gin.H{"error": "not found"})
 	})
 

server/internal/app/app.go

@@ -10,6 +10,7 @@ import (
 	"github.com/openteam/server/internal/config"
 	"github.com/openteam/server/internal/pkg/crypto"
 	"github.com/openteam/server/internal/pkg/jwt"
+	"github.com/openteam/server/internal/pkg/ratelimit"
 	"github.com/openteam/server/internal/store"
 	"github.com/openteam/server/internal/usage"
 	"gorm.io/gorm"
@@ -23,6 +24,7 @@ type App struct {
 	JWT       *jwt.Manager
 	Usage     *usage.Recorder
 	Health    *channel.HealthMonitor
+	Limit     *ratelimit.Limiter
 	startedAt time.Time
 	ctx       context.Context
 	cancel    context.CancelFunc
@@ -44,6 +46,7 @@ func New(cfg *config.Config) (*App, error) {
 	}
 	a.ctx, a.cancel = context.WithCancel(context.Background())
 	a.Usage = usage.NewRecorder(db)
+	a.Limit = ratelimit.New()
 
 	if err := a.Seed(); err != nil {
 		return nil, err

server/internal/config/config.go

@@ -11,13 +11,19 @@ import (
 )
 
 type Config struct {
-	Env    string // development | production
-	Port   int
-	DB     DBConfig
-	JWT    JWTConfig
-	Auth   AuthConfig
-	Proxy  ProxyConfig
-	Master string // 渠道密钥 AES-GCM 主密钥（来自环境变量）
+	Env       string // development | production
+	Port      int
+	DB        DBConfig
+	JWT       JWTConfig
+	Auth      AuthConfig
+	Proxy     ProxyConfig
+	RateLimit RateLimitConfig
+	Master    string // 渠道密钥 AES-GCM 主密钥（来自环境变量）
+}
+
+// RateLimitConfig 限流参数（MVP 内存计数，Redis 后置）。
+type RateLimitConfig struct {
+	UserRPS int // 用户级每秒请求数上限（0=不限制）
 }
 
 type DBConfig struct {
@@ -116,6 +122,8 @@ func Load() (*Config, error) {
 	v.SetDefault("proxy.health_interval", "60s")
 	v.SetDefault("proxy.health_fail_threshold", 2)
 
+	v.SetDefault("ratelimit.user_rps", 20)
+
 	return &Config{
 		Env:  v.GetString("env"),
 		Port: v.GetInt("port"),
@@ -149,6 +157,9 @@ func Load() (*Config, error) {
 			HealthInterval:      v.GetDuration("proxy.health_interval"),
 			HealthFailThreshold: v.GetInt("proxy.health_fail_threshold"),
 		},
+		RateLimit: RateLimitConfig{
+			UserRPS: v.GetInt("ratelimit.user_rps"),
+		},
 		Master: v.GetString("master_key"),
 	}, nil
 }

server/internal/pkg/ratelimit/ratelimit.go

@@ -0,0 +1,112 @@
+// Package ratelimit 内存限流与配额（MVP 起步，Redis 后置）。
+// 覆盖：密钥级每日请求数 / 每日 token 数配额、用户级每秒速率。
+package ratelimit
+
+import (
+	"sync"
+	"time"
+)
+
+type dayCounter struct {
+	date string
+	n    int64
+}
+
+type hitWindow struct {
+	times  []time.Time
+	limit  int
+	window time.Duration
+}
+
+// Limiter 内存计数器。并发安全。
+type Limiter struct {
+	mu       sync.Mutex
+	reqDaily map[uint64]*dayCounter // 密钥每日请求数
+	tokDaily map[uint64]*dayCounter // 密钥每日 token 用量
+	userHits map[uint64]*hitWindow  // 用户速率窗口
+}
+
+func New() *Limiter {
+	return &Limiter{
+		reqDaily: map[uint64]*dayCounter{},
+		tokDaily: map[uint64]*dayCounter{},
+		userHits: map[uint64]*hitWindow{},
+	}
+}
+
+func today() string { return time.Now().UTC().Format("2006-01-02") }
+
+// AllowRequestDaily 检查并计数密钥每日请求配额；无配额（limit<=0）时仅计数。
+// 返回 false 表示超过配额。
+func (l *Limiter) AllowRequestDaily(keyID uint64, limit int) bool {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	d := today()
+	c, ok := l.reqDaily[keyID]
+	if !ok || c.date != d {
+		c = &dayCounter{date: d}
+		l.reqDaily[keyID] = c
+	}
+	c.n++
+	if limit > 0 && c.n > int64(limit) {
+		return false
+	}
+	return true
+}
+
+// AddTokens 累计密钥今日 token 用量（请求结束后记账）。
+func (l *Limiter) AddTokens(keyID uint64, n int64) {
+	if n <= 0 {
+		return
+	}
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	d := today()
+	c, ok := l.tokDaily[keyID]
+	if !ok || c.date != d {
+		c = &dayCounter{date: d}
+		l.tokDaily[keyID] = c
+	}
+	c.n += n
+}
+
+// TokensUsed 返回密钥今日已用 token。
+func (l *Limiter) TokensUsed(keyID uint64) int64 {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	c, ok := l.tokDaily[keyID]
+	if !ok || c.date != today() {
+		return 0
+	}
+	return c.n
+}
+
+// AllowUserRate 用户级每秒请求速率限制（滑动窗口）；limit<=0 不限制。
+func (l *Limiter) AllowUserRate(userID uint64, limit int) bool {
+	if limit <= 0 {
+		return true
+	}
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	now := time.Now()
+	win := time.Second
+	w, ok := l.userHits[userID]
+	if !ok || w.limit != limit || w.window != win {
+		w = &hitWindow{limit: limit, window: win}
+		l.userHits[userID] = w
+	}
+	// 清理窗口外的时间戳
+	cutoff := now.Add(-win)
+	keep := w.times[:0]
+	for _, t := range w.times {
+		if t.After(cutoff) {
+			keep = append(keep, t)
+		}
+	}
+	w.times = keep
+	if len(w.times) >= limit {
+		return false
+	}
+	w.times = append(w.times, now)
+	return true
+}

server/internal/pkg/ratelimit/ratelimit_test.go

@@ -0,0 +1,52 @@
+package ratelimit
+
+import "testing"
+
+func TestAllowRequestDaily(t *testing.T) {
+	l := New()
+	if !l.AllowRequestDaily(1, 2) {
+		t.Fatal("first request should be allowed")
+	}
+	if !l.AllowRequestDaily(1, 2) {
+		t.Fatal("second request should be allowed")
+	}
+	if l.AllowRequestDaily(1, 2) {
+		t.Fatal("third request should be blocked")
+	}
+	// 另一个 key 不受影响
+	if !l.AllowRequestDaily(2, 2) {
+		t.Fatal("other key should be allowed")
+	}
+}
+
+func TestTokensDaily(t *testing.T) {
+	l := New()
+	l.AddTokens(1, 100)
+	l.AddTokens(1, 50)
+	if got := l.TokensUsed(1); got != 150 {
+		t.Fatalf("tokens = %d, want 150", got)
+	}
+	if got := l.TokensUsed(2); got != 0 {
+		t.Fatalf("other key tokens = %d, want 0", got)
+	}
+	// 配额检查语义：已达 150 再设配额 150 应拒绝
+	l.AddTokens(3, 150)
+	if l.TokensUsed(3) >= 150 {
+		// 注意：>= 表示已达上限，Auth 层据此拒绝
+	}
+}
+
+func TestAllowUserRate(t *testing.T) {
+	l := New()
+	// limit=1：立即第二次应被拒绝
+	if !l.AllowUserRate(9, 1) {
+		t.Fatal("first should be allowed")
+	}
+	if l.AllowUserRate(9, 1) {
+		t.Fatal("second in same second should be blocked")
+	}
+	// limit<=0 不限制
+	if !l.AllowUserRate(9, 0) {
+		t.Fatal("limit 0 should always allow")
+	}
+}

server/internal/proxy/gateway.go

@@ -12,6 +12,7 @@ import (
 	"github.com/openteam/server/internal/channel"
 	"github.com/openteam/server/internal/pkg/apikey"
 	"github.com/openteam/server/internal/pkg/crypto"
+	"github.com/openteam/server/internal/pkg/ratelimit"
 	"github.com/openteam/server/internal/proxy/convert"
 	"github.com/openteam/server/internal/store"
 	"github.com/openteam/server/internal/usage"
@@ -25,20 +26,24 @@ const (
 )
 
 type Gateway struct {
-	db  *gorm.DB
-	ch  *channel.Service
-	rec *usage.Recorder
-	enc *crypto.Encryptor
-	hc  *http.Client
+	db      *gorm.DB
+	ch      *channel.Service
+	rec     *usage.Recorder
+	enc     *crypto.Encryptor
+	lim     *ratelimit.Limiter
+	userRPS int
+	hc      *http.Client
 }
 
-func NewGateway(db *gorm.DB, enc *crypto.Encryptor, rec *usage.Recorder) *Gateway {
+func NewGateway(db *gorm.DB, enc *crypto.Encryptor, rec *usage.Recorder, lim *ratelimit.Limiter, userRPS int) *Gateway {
 	return &Gateway{
-		db:  db,
-		ch:  channel.NewService(db, enc),
-		rec: rec,
-		enc: enc,
-		hc:  &http.Client{Timeout: 120 * time.Second},
+		db:      db,
+		ch:      channel.NewService(db, enc),
+		rec:     rec,
+		enc:     enc,
+		lim:     lim,
+		userRPS: userRPS,
+		hc:      &http.Client{Timeout: 120 * time.Second},
 	}
 }
 
@@ -81,6 +86,25 @@ func (g *Gateway) Auth(c *gin.Context) {
 		return
 	}
 
+	// 限流与配额（内存计数）
+	if g.lim != nil {
+		if k.QuotaRequestsPerDay != nil && !g.lim.AllowRequestDaily(k.ID, *k.QuotaRequestsPerDay) {
+			apiError(c, http.StatusTooManyRequests, "rate_limit_exceeded", "Daily request quota exceeded for this API key")
+			c.Abort()
+			return
+		}
+		if k.QuotaTokensPerDay != nil && g.lim.TokensUsed(k.ID) >= *k.QuotaTokensPerDay {
+			apiError(c, http.StatusTooManyRequests, "rate_limit_exceeded", "Daily token quota exceeded for this API key")
+			c.Abort()
+			return
+		}
+		if !g.lim.AllowUserRate(u.ID, g.userRPS) {
+			apiError(c, http.StatusTooManyRequests, "rate_limit_exceeded", "Too many requests. Please slow down.")
+			c.Abort()
+			return
+		}
+	}
+
 	c.Set(CtxUserID, u.ID)
 	c.Set(CtxKeyID, k.ID)
 	c.Set(CtxTrace, newTraceID())

server/internal/proxy/passthrough.go

@@ -433,6 +433,11 @@ func (g *Gateway) finishUsage(c *gin.Context, ch *store.Channel, start time.Time
 		chID = ch.ID
 	}
 
+	// 密钥今日 token 用量累计（配额检查用）
+	if g.lim != nil && kidVal > 0 {
+		g.lim.AddTokens(kidVal, in+out)
+	}
+
 	g.rec.Record(&store.UsageLog{
 		RequestID:           fmt.Sprintf("trace-%s", traceStr),
 		TraceID:             traceStr,