fix: settings 安全加固 + UX 迭代 — 10项修复

安全修复:
- S-01 SSRF: parse-subscription 加私有IP封禁+重定向限制+响应大小限制
- S-02 值校验: PUT /{key} 加 key 白名单 + INT 范围校验(1-1000/1-100/10-600)
- S-05 重登录: 改密码成功后跳转login.html+绿色提示
- S-07 审计: add_manual_ips/remove_allowlist_ip 补全审计日志
- S-09 TOTP: 已启用TOTP时改密码需输入验证码

UX改进:
- UX-01: 密码框focus ring + 设置项input type映射(number/url/text)
- UX-02: 改密码按钮loading状态(disabled+提交中...)
- UX-03: 3处空catch块→console.error+toast
- UX-04: 保存失败时reloadSettings恢复原值
- UX-05: IP格式校验(前端正则+后端Pydantic model_validator)

server/api/auth.py

@@ -99,6 +99,7 @@ class TotpVerifyRequest(BaseModel):
 class ChangePasswordRequest(BaseModel):
     current_password: str = Field(..., min_length=1, max_length=255)
     new_password: str = Field(..., min_length=6, max_length=255)
+    totp_code: Optional[str] = None  # S-09: required if TOTP enabled
 
 
 class WebsshTokenRequest(BaseModel):
@@ -285,6 +286,14 @@ async def change_password(
     if not bcrypt.checkpw(payload.current_password.encode(), current_admin.password_hash.encode()):
         raise HTTPException(status_code=400, detail="当前密码错误")
 
+    # S-09: If TOTP is enabled, require TOTP code for password change
+    if current_admin.totp_enabled:
+        if not payload.totp_code:
+            raise HTTPException(status_code=400, detail="已启用 TOTP 的账户修改密码需要验证码")
+        from server.application.services.auth_service import AuthService
+        if not AuthService._verify_totp(payload.totp_code, current_admin.totp_secret):
+            raise HTTPException(status_code=400, detail="TOTP 验证码错误")
+
     # Hash new password
     new_hash = bcrypt.hashpw(payload.new_password.encode(), bcrypt.gensalt()).decode()