release: prepare v1.2.30

* fix: merge account and mailbox forwarding

* docs: prepare v1.2.20 release

---------

Co-authored-by: zxyszx <299979470+zxyszx@users.noreply.github.com>

.github/release-notes/v1.2.18.md

@@ -0,0 +1,4 @@
+- 修复邮箱选择列表超过侧栏边框的问题，展开列表现在与上方选择框保持相同宽度。
+- 修复含日期年份的邮件可能漏识别验证码的问题，Gate 等验证码邮件可正常显示一键复制按钮。
+- 邮件通知中的网址改为可点击链接，超长追踪地址使用简短文字显示，阅读更清晰。
+- 版本频道通知移除底部按钮，改为正文中的“查看本次更新”文字链接。

.github/release-notes/v1.2.19.md

@@ -0,0 +1,6 @@
+- 优化“全部邮箱”写信：默认使用登录邮箱，可切换其他发件邮箱，切换时保留收件人、主题、正文和附件；写信窗口宽度同步调整。
+- 优化一键安装管理菜单：根据安装状态显示可用功能，补充运行状态、实际版本、访问地址和修复入口，并加强备份、回滚及命令检查。
+- 修复域名密钥变化后 Rspamd 可能继续使用旧 DKIM 私钥的问题；后台 DNS 检测现在会核对实际 DKIM 公钥。
+- 修复部分验证码邮件因收件邮箱或链接内容干扰而不显示验证码及复制按钮的问题。
+- 优化 DNS 记录复制：主机记录和记录值可分别复制，长 DKIM 记录能够正常换行显示。
+- 新邮箱默认创建“个人、家人、朋友、工作、重要”五个标签；已有邮箱升级后自动补齐，“全部邮箱”会合并同名标签并支持跨邮箱筛选与导出。

.github/release-notes/v1.2.20.md

@@ -0,0 +1,3 @@
+- 调整邮件转发规则：账号级转发固定作用于所有邮箱，并与单个邮箱追加的转发目标同时生效。
+- 优化单个邮箱转发设置：账号级目标默认勾选、置顶并锁定，邮箱及转发地址按数字和字母排序，目标较多时可查看完整列表。
+- 优化 Telegram 版本频道通知排版：使用精简标题、分层说明和完整更新链接，提升手机端阅读体验。

.github/release-notes/v1.2.21.md

@@ -0,0 +1,8 @@
+- 优化登录与会话流程：登录后完整返回原页面及查询条件，区分未登录、超时、取消和网络故障，并为服务不可用状态提供明确的重新连接入口。
+- 完善后台与邮箱错误处理：管理员设置、邮件列表、邮件详情、发送队列、个人资料、签名、DNS 检查及注册流程均增加真实失败提示和重试反馈，避免静默失败或错误成功提示。
+- 优化邮箱与个人设置：恢复显示名称编辑，新增可持久化的标准/紧凑邮件布局，移除无效时区和模拟资料，修正发信成功后草稿删除失败的提示逻辑。
+- 保持并强化转发规则：账号级转发目标在所有邮箱中默认勾选、置顶且不可取消，单邮箱可继续追加独立目标，现有单邮箱配置不受影响，目标按数字和字母排序。
+- 统一界面视觉与交互：采用更清晰的中性色、文字层级、焦点状态和紧凑圆角，补充图标按钮名称、工具提示及全屏页面主区域，改善桌面与移动端可访问性。
+- 优化前端加载与开发体验：拆分邮件编辑器相关代码包，控制单个构建文件体积，并支持通过 `VITE_API_TARGET` 指定本地后端代理地址。
+- 加固邮件 HTML 安全：升级 DOMPurify 至已修复版本，依赖审计无已知漏洞；同步清理过时演示数据、无效状态和旧页面逻辑。
+- 完成全量质量复核：前后端构建、Go 全量及竞态测试、SMTP、外部 IMAP、OAuth、Telegram、Webhook、转发、队列、权限隔离、安装、备份、回滚和 DKIM 同步测试均已通过。

.github/release-notes/v1.2.22.md

@@ -0,0 +1,5 @@
+- 修复 QQ 邮箱、网易邮箱、Gmail 等第三方客户端可以收信但无法发信的问题。
+- SMTP 提交服务新增 `AUTH LOGIN` 认证支持，并继续兼容 `AUTH PLAIN`；两种方式均只允许在 TLS 加密连接中使用。
+- 兼容带初始用户名和标准两步用户名/密码挑战的 LOGIN 流程，适配常见手机邮箱、Apple Mail 和 Thunderbird。
+- 客户端配置保持 IMAP 993/SSL、POP3 995/SSL、SMTP 465/SSL，不增加额外服务器地址或备用配置。
+- 新增 SMTP 能力声明、LOGIN 认证、STARTTLS、隐式 TLS 和完整发信回归测试。

.github/release-notes/v1.2.23.md

@@ -0,0 +1,5 @@
+- 优化转发验证完成页：移除“返回邮箱”入口，外部收件人确认 Netflix、ChatGPT 等验证码转发授权后不会进入邮箱登录页，只显示验证结果和关闭页面提示。
+- 合并验证邮箱搜索与添加入口：输入内容会实时筛选已添加地址，输入新邮箱时可直接发送验证邮件，已存在地址会明确显示为“已添加”。
+- 重整验证邮箱管理列表：待验证邮箱置顶展示，已验证邮箱按数字和字母排序并聚合为可折叠分组，邮箱数量较多时仍便于查找和管理。
+- 精简邮件转发主页面：不再平铺全部验证邮箱标签，改为显示已验证与待验证数量汇总，点击即可进入管理列表。
+- 补充验证完成页回归测试，确保页面不再出现邮箱首页或登录入口，并完成前端构建、组件规范、后端全量测试与静态检查。

.github/release-notes/v1.2.24.md

@@ -0,0 +1,3 @@
+- 精简邮件转发页面入口，移除右上角重复的“管理验证邮箱”按钮。
+- 保留下方汇总入口并统一命名为“管理验证邮箱”，继续显示已验证与待验证邮箱数量。
+- 没有验证邮箱时仍显示该入口，用户可直接进入添加和验证邮箱。

.github/release-notes/v1.2.25.md

@@ -0,0 +1,9 @@
+- 修复收信规则移动到自定义文件夹时被错误归入“已归档”的问题，现在会按规则名称真实创建目标文件夹。
+- 修正发件人、附件名、邮件大小和日期条件的匹配边界，拒绝字段不支持的运算符，避免规则保存后永远无法命中。
+- “应用到现有邮件”不再处理已发送和草稿邮件，规则暂停启用时也可执行用户明确选择的现有邮件处理。
+- 完善规则动作失败处理：失败的动作不再误中止后续规则，归档、删除和移动错误不再被静默忽略。
+- 收信规则列表新增适用邮箱显示，并提供独立的上移、下移按钮，多条规则时可完整调整优先级。
+- 新增自定义文件夹图标，支持按名称自动匹配、手动选择以及上传小图标，并内置 Netflix、ChatGPT、账单、购物、旅行、工作等常用类型。
+- 上传图标会在浏览器本地缩放为 64×64 PNG，服务端校验 PNG 文件头并限制在 32 KB；不联网查询品牌，不保留上传原图。
+- 文件夹图标已在侧栏、桌面端与移动端移动菜单中统一显示，数据库升级会自动为旧文件夹补充默认图标。
+- 补充收信规则、自定义文件夹、图标自动匹配、手动图标保留和上传格式安全边界的回归测试。

.github/release-notes/v1.2.26.md

@@ -0,0 +1,7 @@
+- 修复手机端删除自定义文件夹时菜单先消失、确认框无法显示的问题，文件夹菜单现在与移动侧栏保持在同一交互层中。
+- 删除文件夹前会稳定显示确认信息，提交后显示处理中状态，避免重复操作；文件夹内邮件仍会安全移回收件箱。
+- 修复手机侧栏中新建文件夹弹窗被侧栏遮挡或立即关闭的问题，侧栏退出后再打开创建界面。
+- 重做手机端“新建规则 / 编辑规则”布局：标题、表单与底部操作区改为纵向结构，内容区域可独立滚动。
+- 优化规则条件与动作的窄屏排列，字段和运算符并排、输入框独占一行，添加与删除按钮保持易点击且不会挤出屏幕。
+- 规则底部创建和取消按钮固定可见并适配手机安全区域，多条件、多动作时仍可顺畅滚动和提交。
+- 优化通用确认弹窗的手机宽度和按钮触控尺寸，减少误触并避免贴边显示。

.github/release-notes/v1.2.27.md

@@ -0,0 +1,6 @@
+- 修复收信规则选择“移动到自定义文件夹”后立即跳回归档的问题。
+- 移除移动动作右侧显示 `Archive` 等英文内部值的旧输入框，避免系统值与中文选项重复出现。
+- 将移动目标整合为一个文件夹选择器，系统文件夹统一显示中文名称。
+- 文件夹选择器新增“系统文件夹”和“自定义文件夹”分组，自动列出当前邮箱或全部邮箱中已经创建的自定义文件夹。
+- 选择 Netflix、amazon 等自定义文件夹后会直接保存真实文件夹名称，不再错误保存为归档。
+- 已验证规则创建、列表摘要和后端数据均保留所选自定义文件夹。

.github/release-notes/v1.2.28.md

@@ -0,0 +1,8 @@
+- 收信规则页新增规则名称搜索，支持按字母或完整名称快速筛选，并提供清空搜索和空结果提示。
+- 优化规则列表的桌面端与手机端布局，规则名称、适用邮箱、条件和动作可完整换行显示，操作按钮不再挤压内容。
+- 调整新建规则工具栏与表单对齐，搜索框与规则列表等宽，“所有条件”选择器与下方条件字段保持同一左边界。
+- 邮箱侧栏的“文件夹”和“标签”支持点击展开或收起，桌面端和手机侧栏保持一致交互。
+- 降低所有对话框的背景遮罩深度，手机端和桌面端分别使用更轻的灰色层级，避免打开弹窗后页面过黑。
+- 重排“被拦截邮件”页面，统一标题、统计和新增入口，长邮箱地址与拦截原因会自动换行，不再超出边框。
+- 重排“邮件清理”页面的统计卡片和清理操作，修复窄屏文字截断、按钮挤压和横向溢出。
+- 统一前后台文字按钮样式，移除“新建规则”、“新增拦截”、权限配置、账号、域名、邮箱和转发等命令前多余的加号图标。

.github/release-notes/v1.2.29.md

@@ -0,0 +1,13 @@
+- 重构后台账号管理：新增账号统一使用“邮箱前缀 + 已有域名”创建，支持显示名称、密码二次确认、邮箱数量上限、共享存储容量和权限配置。
+- 创建用户账号时自动生成同地址默认邮箱；账号与全部绑定邮箱共用登录密码，账号重置密码后会同步更新所属邮箱。
+- 存储容量改为账号级共享：管理员默认 1 GB，普通用户默认 100 MB，最低可设置 100 MB；新增邮箱不再重复增加容量，容量检查会统计账号下全部邮箱。
+- 在账号编辑中集中管理共享存储容量，并在账号列表显示邮箱数量、共享容量、邮箱搜索与复制入口；移除邮箱地址前多余图标和重复身份标签。
+- 重做邮箱管理页面：按归属账号聚合子邮箱，支持账号或邮箱搜索、展开收起、邮箱数量统计及按地址排序，邮箱较多时仍可快速定位。
+- 默认邮箱与所属账号绑定并受到保护，管理员账号、用户默认邮箱和管理员账号下的默认邮箱均不能删除；默认邮箱也不能单独改归属或停用。
+- 普通子邮箱支持在三点菜单中启用、停用和删除；启用状态使用绿色高亮，停用状态使用红色提示，删除前必须二次确认。
+- 后台与 Open API 创建或改绑邮箱时统一继承所属账号密码和共享容量，修复遗漏容量参数时意外清零及接口绕过默认邮箱保护的问题。
+- 优化权限配置：管理员权限固定只读，普通用户系统权限和使用限制可以编辑，同时保留系统名称与说明，避免系统身份被误改。
+- 每个权限配置均提供“查看全部权限”入口，按分类展示完整权限清单，已开启项目显示勾选，未开启项目保持空框。
+- 统一后台九个功能页的卡片、表格、侧栏选中态、状态文字、操作菜单和空状态，减少重复标签、图标与视觉噪音。
+- 完善桌面端和手机端响应式布局，账号、邮箱和权限页面在窄屏下保持可读、可操作且无横向溢出。
+- 补充账号默认邮箱、管理员保护、共享容量、密码继承、Open API 兼容和权限编辑等回归测试。

.github/release-notes/v1.2.30.md

@@ -0,0 +1,9 @@
+- 修复邮箱侧栏切换目录后，紧凑列表顶部仍可能显示上一个目录名称的问题；收件箱、草稿箱、已发送、已归档、已删除、星标邮件、垃圾邮件、自定义文件夹和标签现在会与当前列表保持一致。
+- 切换邮箱目录时按当前视图重新生成列表区域，避免星标邮件等旧标题或旧操作状态残留到其他目录。
+- 修复“已删除”目录批量删除仍执行“移入已删除”的问题；现在会永久删除所选邮件，并在操作前显示不可恢复的二次确认。
+- 区分普通目录与“已删除”的删除语义：普通目录显示“移入已删除”，已删除目录显示“永久删除”。
+- 统一批量工具栏、邮件详情、右键菜单和列表快捷按钮的删除名称、确认文案与完成提示，避免显示“已移动”但实际执行删除等文字不一致。
+- 优化批量归档、移回收件箱、移入垃圾邮件和移入已删除后的提示，准确显示目标目录及处理数量。
+- 后台邮箱管理中将账号默认邮箱固定置顶，其余子邮箱继续按 A-Z / 0-9 排序，方便快速识别账号主邮箱。
+- 修正邮箱管理表头与账号行的网格结构，“权限管理”和“子邮箱”列标题及内容统一居中对齐。
+- 保留默认邮箱不可停用、不可删除保护；普通子邮箱继续支持启用、停用和二次确认删除。

.github/workflows/ci.yml

@@ -44,9 +44,10 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y shellcheck sqlite3
-          bash -n install.sh tests/install_test.sh
-          shellcheck -x install.sh tests/install_test.sh
+          bash -n install.sh tests/install_test.sh tests/dkim_sync_test.sh
+          shellcheck -x install.sh tests/install_test.sh tests/dkim_sync_test.sh deploy/rspamd/sync-dkim.sh
           bash tests/install_test.sh
+          bash tests/dkim_sync_test.sh
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4

.github/workflows/docker.yml

@@ -31,9 +31,10 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y shellcheck sqlite3
-          bash -n install.sh tests/install_test.sh
-          shellcheck -x install.sh tests/install_test.sh
+          bash -n install.sh tests/install_test.sh tests/dkim_sync_test.sh
+          shellcheck -x install.sh tests/install_test.sh tests/dkim_sync_test.sh deploy/rspamd/sync-dkim.sh
           bash tests/install_test.sh
+          bash tests/dkim_sync_test.sh
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
@@ -288,17 +289,21 @@ jobs:
 
           sections = []
           for index, entry in enumerate(entries, 1):
-              parts = re.split(r"[，；。]", entry, maxsplit=1)
+              parts = re.split(r"[：:]", entry, maxsplit=1)
+              if len(parts) == 1:
+                  parts = re.split(r"[，；。]", entry, maxsplit=1)
               title = parts[0].strip()
               description = parts[1].strip() if len(parts) > 1 else ""
-              section = f"<b>{index:02d}  {html.escape(title)}</b>"
+              section = f"<b>{index:02d} · {html.escape(title)}</b>"
               if description:
-                  section += "\n" + html.escape(description.rstrip("。") + "。")
+                  section += "\n<blockquote>" + html.escape(description.rstrip("。") + "。") + "</blockquote>"
               sections.append(section)
 
           tag = os.environ["RELEASE_TAG"]
-          prefix = f"<b>NewSzxcn Email {html.escape(tag)}</b>\n新版本现已发布\n\n<b>本次更新</b>\n\n"
-          available = max(0, 3600 - len(prefix))
+          prefix = f"<b>NewSzxcn Email {html.escape(tag)}</b>\n<i>新版本现已发布</i>\n\n<b>更新内容 · {len(sections)} 项</b>\n\n"
+          release_url = html.escape(os.environ["RELEASE_URL"], quote=True)
+          footer = f'\n\n<a href="{release_url}">查看完整更新说明 ↗</a>'
+          available = max(0, 3600 - len(prefix) - len(footer))
           visible_sections = []
           used = 0
           for section in sections:
@@ -309,20 +314,18 @@ jobs:
               used += added
           body = "\n\n".join(visible_sections)
           if len(visible_sections) < len(sections):
-              body += "\n\n更新内容较长，请点击下方按钮查看完整内容。"
-          open("telegram-release-message.txt", "w", encoding="utf-8").write(prefix + body)
+              body += "\n\n更新内容较长，请打开下方链接查看完整内容。"
+          open("telegram-release-message.txt", "w", encoding="utf-8").write(prefix + body + footer)
           PY
 
           jq -n \
             --arg chat_id "${TELEGRAM_CHAT_ID}" \
-            --arg release_url "${RELEASE_URL}" \
             --rawfile text telegram-release-message.txt \
             '{
               chat_id:$chat_id,
               text:$text,
               parse_mode:"HTML",
-              disable_web_page_preview:true,
-              reply_markup:{inline_keyboard:[[{text:"查看本次更新 ↗",url:$release_url}]]}
+              disable_web_page_preview:true
             }' > telegram-release-payload.json
 
           http_code="$(curl -sS --retry 2 --retry-all-errors --connect-timeout 10 --max-time 30 \

README.md

@@ -7,7 +7,7 @@ NewSzxcn-Email 是一个可自建、可管理、带完整 Webmail 与管理后
 [![CI](https://github.com/zxyszx/NewSzxcn-Email/actions/workflows/ci.yml/badge.svg)](https://github.com/zxyszx/NewSzxcn-Email/actions/workflows/ci.yml)
 [![License](https://img.shields.io/github/license/zxyszx/NewSzxcn-Email)](LICENSE)
 
-[邮箱指南](docs/GUIDE.md) · [版本发布](https://github.com/zxyszx/NewSzxcn-Email/releases) · [部署文档](deploy/README.md) · [English](README.en.md)
+[邮箱后台配置指南](docs/GUIDE.md) · [版本发布](https://github.com/zxyszx/NewSzxcn-Email/releases) · [部署文档](deploy/README.md) · [English](README.en.md)
 
 ## 主要功能
 
@@ -35,8 +35,60 @@ curl -fsSL https://raw.githubusercontent.com/zxyszx/NewSzxcn-Email/main/install.
 bash <(curl -fsSL https://raw.githubusercontent.com/zxyszx/NewSzxcn-Email/main/install.sh)
 ```
 
-脚本会先显示统一管理菜单。空白服务器默认选择安装，并进入防火墙、邮件服务器域名、邮箱地址域名、管理员
-邮箱和 Web 部署方式的引导；检测到已有安装时默认选择安全更新。选择重新安装会先将
+### 管理面板
+
+脚本会根据服务器当前状态显示不同菜单。空白服务器只显示安装和退出，避免误选尚不可用的更新、回滚或重启功能：
+
+```text
+==================================================
+          NewSzxcn Email 管理面板
+==================================================
+状态：尚未安装
+--------------------------------------------------
+1. 一键安装 NewSzxcn Email
+0. 退出
+==================================================
+请选择 [1]：
+```
+
+检测到已有安装后，会动态读取服务状态、实际镜像版本和访问地址，并默认选择安全更新：
+
+```text
+==================================================
+          NewSzxcn Email 管理面板
+==================================================
+状态：运行中
+版本：v1.2.19（示例，以实际安装版本为准）
+地址：https://mail.example.com
+--------------------------------------------------
+安装与维护
+1. 重新安装（完整备份，失败自动恢复）
+2. 更新系统（自动备份，失败自动回滚）
+3. 检查并修复现有安装
+
+服务管理
+4. 查看运行状态
+5. 重启服务
+6. 查看实时日志
+
+证书与恢复
+7. 管理 SSL 证书
+8. 回滚到上次更新前版本
+
+账号与帮助
+9. 邮箱后台配置指南
+10. 查看管理员登录信息
+11. 重置管理员登录密码
+
+危险操作
+12. 卸载服务（保留数据）
+
+0. 退出
+==================================================
+请选择 [2]：
+```
+
+容器停止后菜单会显示“已停止”；配置存在但运行文件残缺时会显示“安装不完整”并默认选择修复。空白服务器进入安装后，会依次引导配置防火墙、邮件服务器域名、邮箱地址域名、管理员邮箱和 Web 部署方式。选择重新安装会先将
 `/opt/newszxcn-email` 完整改名备份，失败时自动恢复原目录、Nginx 和旧容器。更新前会
 校验数据库备份并保存镜像、Compose、环境、安装脚本和 Nginx，失败时执行完整恢复。
 
@@ -44,7 +96,7 @@ bash <(curl -fsSL https://raw.githubusercontent.com/zxyszx/NewSzxcn-Email/main/i
 
 - 安装或检查 Docker Engine 与 Docker Compose v2
 - 选择自动添加邮局必要端口规则，或保留现有防火墙由用户自行配置
-- 分开确认邮件服务器域名和邮箱地址域名，创建唯一管理员邮箱；默认 `admin@邮箱地址域名`，回车自动生成 12 位密码，自定义密码最少 6 位
+- 自动检测并确认邮箱地址域名；创建管理员邮箱时可选择默认 `admin` 前缀或自行输入前缀，例如服务器域名 `mail.example.com`、前缀 `admin` 会创建 `admin@example.com`；回车自动生成 12 位密码，自定义密码最少 6 位
 - 选择自动 Nginx + SSL、宝塔/已有 Nginx 反代或 HTTP 测试模式
 - 自动模式使用官方 `acme.sh` 签发和续期证书，不会强制停止占用 80 端口的进程
 - 创建 `/opt/newszxcn-email` 持久化目录
@@ -87,6 +139,7 @@ sudo ns
 sudo newszxcn-email guide
 sudo newszxcn-email credentials
 sudo newszxcn-email reset-password
+sudo newszxcn-email repair
 sudo newszxcn-email status
 sudo newszxcn-email logs
 sudo newszxcn-email restart
@@ -178,6 +231,8 @@ pnpm install
 pnpm run dev
 ```
 
+后端不在默认的 `http://localhost:8080` 时，可通过 `VITE_API_TARGET=http://localhost:18080 pnpm run dev` 指定本地代理目标。
+
 提交前建议运行：
 
 ```bash

VERSION

@@ -1 +1 @@
-1.2.15
+1.2.30

apps/api/internal/app/admin_handlers.go

@@ -49,9 +49,9 @@ func (a *App) handleAdminOverview(w http.ResponseWriter, r *http.Request) {
 }
 
 func (a *App) handleListUsers(w http.ResponseWriter, r *http.Request) {
-	rows, err := a.db.QueryContext(r.Context(), `SELECT u.id,u.login_name,u.email,u.display_name,u.role,u.disabled,u.two_factor_enabled,u.mailbox_limit_override,u.created_at,COUNT(mb.id),COALESCE(GROUP_CONCAT(mb.address), '')
+	rows, err := a.db.QueryContext(r.Context(), `SELECT u.id,u.login_name,u.email,u.display_name,u.role,u.disabled,u.two_factor_enabled,u.mailbox_limit_override,u.storage_quota_mb,u.created_at,COUNT(mb.id),COALESCE(GROUP_CONCAT(mb.address), '')
 		FROM users u LEFT JOIN mailboxes mb ON mb.user_id=u.id
-		GROUP BY u.id,u.login_name,u.email,u.display_name,u.role,u.disabled,u.two_factor_enabled,u.mailbox_limit_override,u.created_at
+		GROUP BY u.id,u.login_name,u.email,u.display_name,u.role,u.disabled,u.two_factor_enabled,u.mailbox_limit_override,u.storage_quota_mb,u.created_at
 		ORDER BY CASE WHEN u.role='admin' THEN 0 ELSE 1 END, lower(COALESCE(NULLIF(u.email,''),u.login_name)), lower(u.display_name), u.created_at`)
 	if err != nil {
 		respondError(w, http.StatusInternalServerError, "failed to list users")
@@ -64,7 +64,7 @@ func (a *App) handleListUsers(w http.ResponseWriter, r *http.Request) {
 		var disabled, twoFactorEnabled int
 		var mailboxLimitOverride sql.NullInt64
 		var created, mailboxCSV string
-		if err := rows.Scan(&item.ID, &item.LoginName, &item.Email, &item.DisplayName, &item.Role, &disabled, &twoFactorEnabled, &mailboxLimitOverride, &created, &item.MailboxCount, &mailboxCSV); err != nil {
+		if err := rows.Scan(&item.ID, &item.LoginName, &item.Email, &item.DisplayName, &item.Role, &disabled, &twoFactorEnabled, &mailboxLimitOverride, &item.StorageQuotaMB, &created, &item.MailboxCount, &mailboxCSV); err != nil {
 			respondError(w, http.StatusInternalServerError, "failed to scan users")
 			return
 		}
@@ -101,6 +101,7 @@ func (a *App) handleCreateUser(w http.ResponseWriter, r *http.Request) {
 		Password             string   `json:"password"`
 		Disabled             bool     `json:"disabled"`
 		MailboxLimitOverride *int     `json:"mailboxLimitOverride"`
+		StorageQuotaMB       int      `json:"storageQuotaMb"`
 		PermissionGroupIDs   []string `json:"permissionGroupIds"`
 	}
 	if err := decodeJSON(r, &req); err != nil {
@@ -142,6 +143,14 @@ func (a *App) handleCreateUser(w http.ResponseWriter, r *http.Request) {
 	if role == "admin" {
 		mailboxLimitOverride = nil
 	}
+	storageQuotaMB := req.StorageQuotaMB
+	if storageQuotaMB > 0 && storageQuotaMB < minimumStorageQuotaMB {
+		badRequest(w, errors.New("共享存储容量不能小于 100 MB"))
+		return
+	}
+	if storageQuotaMB == 0 {
+		storageQuotaMB = defaultUserStorageQuotaMB
+	}
 	if !hasMinimumPasswordLength(req.Password) {
 		badRequest(w, errors.New("password must be at least 6 characters"))
 		return
@@ -159,11 +168,22 @@ func (a *App) handleCreateUser(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	defer tx.Rollback()
-	if _, err = tx.ExecContext(r.Context(), `INSERT INTO users(id,login_name,email,display_name,role,password_hash,disabled,mailbox_limit_override,created_at,updated_at)
-		VALUES(?,?,?,?,?,?,?,?,?,?)`, id, primaryEmail, primaryEmail, displayName, role, string(passwordHash), boolInt(req.Disabled), nullableInt(mailboxLimitOverride), now, now); err != nil {
+	if _, err = tx.ExecContext(r.Context(), `INSERT INTO users(id,login_name,email,display_name,role,password_hash,disabled,mailbox_limit_override,storage_quota_mb,created_at,updated_at)
+		VALUES(?,?,?,?,?,?,?,?,?,?,?)`, id, primaryEmail, primaryEmail, displayName, role, string(passwordHash), boolInt(req.Disabled), nullableInt(mailboxLimitOverride), storageQuotaMB, now, now); err != nil {
 		badRequest(w, err)
 		return
 	}
+	localPart, domainName, _ := strings.Cut(primaryEmail, "@")
+	var primaryDomainID string
+	if err := tx.QueryRowContext(r.Context(), `SELECT id FROM domains WHERE lower(name)=lower(?)`, domainName).Scan(&primaryDomainID); err == nil {
+		if _, err := a.createMailboxWithPasswordHashTx(r.Context(), tx, id, primaryDomainID, localPart, displayName, string(passwordHash), storageQuotaMB, "active"); err != nil {
+			badRequest(w, err)
+			return
+		}
+	} else if !errors.Is(err, sql.ErrNoRows) {
+		respondError(w, http.StatusInternalServerError, "failed to load account domain")
+		return
+	}
 	permissionGroupIDs := req.PermissionGroupIDs
 	if role == "admin" {
 		permissionGroupIDs = nil
@@ -194,6 +214,7 @@ func (a *App) handleUpdateUser(w http.ResponseWriter, r *http.Request) {
 		Role                 string    `json:"role"`
 		Disabled             *bool     `json:"disabled"`
 		MailboxLimitOverride *int      `json:"mailboxLimitOverride"`
+		StorageQuotaMB       *int      `json:"storageQuotaMb"`
 		PermissionGroupIDs   *[]string `json:"permissionGroupIds"`
 	}
 	if err := decodeJSON(r, &req); err != nil {
@@ -267,6 +288,18 @@ func (a *App) handleUpdateUser(w http.ResponseWriter, r *http.Request) {
 	if role == "admin" {
 		mailboxLimitOverride = nil
 	}
+	var storageQuotaMB int
+	if err := a.db.QueryRowContext(r.Context(), `SELECT storage_quota_mb FROM users WHERE id=?`, id).Scan(&storageQuotaMB); err != nil {
+		respondError(w, http.StatusInternalServerError, "failed to load storage quota")
+		return
+	}
+	if req.StorageQuotaMB != nil {
+		storageQuotaMB = *req.StorageQuotaMB
+	}
+	if storageQuotaMB < 100 {
+		badRequest(w, errors.New("共享存储容量不能小于 100 MB"))
+		return
+	}
 	if err := a.ensureAdminRemains(r.Context(), id, role, disabled); err != nil {
 		badRequest(w, err)
 		return
@@ -311,8 +344,8 @@ func (a *App) handleUpdateUser(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	defer tx.Rollback()
-	if _, err := tx.ExecContext(r.Context(), `UPDATE users SET login_name=?, email=?, display_name=?, role=?, disabled=?, mailbox_limit_override=?, updated_at=? WHERE id=?`,
-		loginName, primaryEmail, displayName, role, boolInt(disabled), nullableInt(mailboxLimitOverride), a.now().UTC().Format(time.RFC3339Nano), id); err != nil {
+	if _, err := tx.ExecContext(r.Context(), `UPDATE users SET login_name=?, email=?, display_name=?, role=?, disabled=?, mailbox_limit_override=?, storage_quota_mb=?, updated_at=? WHERE id=?`,
+		loginName, primaryEmail, displayName, role, boolInt(disabled), nullableInt(mailboxLimitOverride), storageQuotaMB, a.now().UTC().Format(time.RFC3339Nano), id); err != nil {
 		if strings.Contains(strings.ToLower(err.Error()), "unique") {
 			badRequest(w, errors.New("主登录邮箱已被使用"))
 			return
@@ -409,11 +442,8 @@ func (a *App) handleDeleteUser(w http.ResponseWriter, r *http.Request) {
 	if target, err := a.userByID(r.Context(), id); err != nil {
 		respondError(w, http.StatusNotFound, "user not found")
 		return
-	} else if a.isDefaultAdminUser(target) {
-		badRequest(w, errors.New("default administrator cannot be deleted"))
-		return
-	} else if target.Role == "admin" && (current == nil || current.Role != "admin") {
-		respondError(w, http.StatusForbidden, "only administrators can delete administrator users")
+	} else if target.Role == "admin" {
+		badRequest(w, errors.New("administrator accounts cannot be deleted"))
 		return
 	}
 	if err := a.ensureAdminRemains(r.Context(), id, "user", true); err != nil {
@@ -553,6 +583,7 @@ func (a *App) handleListMailboxes(w http.ResponseWriter, r *http.Request) {
 		m.CreatedAt = parseTime(created)
 		items = append(items, m)
 	}
+	markPrimaryMailboxes(items)
 	respondJSON(w, http.StatusOK, map[string]any{"items": items})
 }
 
@@ -563,7 +594,6 @@ func (a *App) handleCreateMailbox(w http.ResponseWriter, r *http.Request) {
 		DisplayName    string `json:"displayName"`
 		Password       string `json:"password"`
 		QuotaMB        int    `json:"quotaMb"`
-		Role           string `json:"role"`
 		OwnerLoginName string `json:"ownerLoginName"`
 		OwnerEmail     string `json:"ownerEmail"`
 		UserID         string `json:"userId"`
@@ -580,20 +610,9 @@ func (a *App) handleCreateMailbox(w http.ResponseWriter, r *http.Request) {
 		badRequest(w, err)
 		return
 	}
-	if !hasMinimumPasswordLength(req.Password) {
-		badRequest(w, errors.New("password must be at least 6 characters"))
-		return
-	}
-	role := req.Role
-	if role == "" {
-		role = "user"
-	}
-	if role != "user" && role != "admin" {
-		badRequest(w, errors.New("invalid role"))
-		return
-	}
-	if role == "admin" {
-		respondError(w, http.StatusForbidden, "管理员只能由安装流程创建")
+	userID := strings.TrimSpace(req.UserID)
+	if req.QuotaMB < 0 {
+		badRequest(w, errors.New("quotaMb must be zero or greater"))
 		return
 	}
 
@@ -611,15 +630,14 @@ func (a *App) handleCreateMailbox(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	defer tx.Rollback()
-	now := a.now().UTC().Format(time.RFC3339Nano)
-	userID := strings.TrimSpace(req.UserID)
 	displayName := req.DisplayName
 	if displayName == "" {
 		displayName = address
 	}
+	var disabled, ownerStorageQuotaMB int
+	var passwordHash, ownerRole string
 	if userID != "" {
-		var disabled int
-		if err := tx.QueryRowContext(r.Context(), `SELECT disabled FROM users WHERE id=?`, userID).Scan(&disabled); err != nil {
+		if err := tx.QueryRowContext(r.Context(), `SELECT disabled,password_hash,role,storage_quota_mb FROM users WHERE id=?`, userID).Scan(&disabled, &passwordHash, &ownerRole, &ownerStorageQuotaMB); err != nil {
 			if errors.Is(err, sql.ErrNoRows) {
 				respondError(w, http.StatusNotFound, "owner user not found")
 			} else {
@@ -627,11 +645,11 @@ func (a *App) handleCreateMailbox(w http.ResponseWriter, r *http.Request) {
 			}
 			return
 		}
-		if intBool(disabled) {
-			badRequest(w, errors.New("owner user is disabled"))
+	} else {
+		if !hasMinimumPasswordLength(req.Password) {
+			badRequest(w, errors.New("password must be at least 6 characters"))
 			return
 		}
-	} else {
 		ownerEmailInput := req.OwnerEmail
 		if strings.TrimSpace(ownerEmailInput) == "" && strings.Contains(strings.TrimSpace(req.OwnerLoginName), "@") {
 			ownerEmailInput = req.OwnerLoginName
@@ -641,21 +659,20 @@ func (a *App) handleCreateMailbox(w http.ResponseWriter, r *http.Request) {
 			badRequest(w, err)
 			return
 		}
-		err = tx.QueryRowContext(r.Context(), `SELECT id FROM users WHERE email=? AND disabled=0`, ownerEmail).Scan(&userID)
+		err = tx.QueryRowContext(r.Context(), `SELECT id,disabled,password_hash,role,storage_quota_mb FROM users WHERE email=?`, ownerEmail).Scan(&userID, &disabled, &passwordHash, &ownerRole, &ownerStorageQuotaMB)
 		if errors.Is(err, sql.ErrNoRows) {
-			passwordHash, err := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
-			if err != nil {
+			hash, hashErr := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
+			if hashErr != nil {
 				respondError(w, http.StatusInternalServerError, "failed to hash password")
 				return
 			}
 			userID = newID("usr")
-			ownerDisplayName := displayName
-			if !strings.EqualFold(ownerEmail, address) {
-				ownerDisplayName = ownerEmail
-			}
-			_, err = tx.ExecContext(r.Context(), `INSERT INTO users(id,login_name,email,display_name,role,password_hash,disabled,created_at,updated_at)
-				VALUES(?,?,?,?,?,?,?,?,?)`, userID, ownerEmail, ownerEmail, ownerDisplayName, role, string(passwordHash), 0, now, now)
-			if err != nil {
+			passwordHash = string(hash)
+			ownerRole = "user"
+			ownerStorageQuotaMB = defaultUserStorageQuotaMB
+			now := a.now().UTC().Format(time.RFC3339Nano)
+			if _, err = tx.ExecContext(r.Context(), `INSERT INTO users(id,login_name,email,display_name,role,password_hash,disabled,storage_quota_mb,created_at,updated_at)
+				VALUES(?,?,?,?,?,?,?,?,?,?)`, userID, ownerEmail, ownerEmail, displayName, ownerRole, passwordHash, 0, ownerStorageQuotaMB, now, now); err != nil {
 				badRequest(w, err)
 				return
 			}
@@ -664,16 +681,26 @@ func (a *App) handleCreateMailbox(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 	}
-	if err := tx.Commit(); err != nil {
-		respondError(w, http.StatusInternalServerError, "failed to prepare owner user")
+	if intBool(disabled) {
+		badRequest(w, errors.New("owner user is disabled"))
 		return
 	}
-
-	mailboxID, err := a.createMailbox(r.Context(), userID, req.DomainID, local, displayName, req.Password, req.QuotaMB, "active")
+	quotaMB := req.QuotaMB
+	if quotaMB == 0 {
+		quotaMB = ownerStorageQuotaMB
+	}
+	if ownerRole == "admin" {
+		quotaMB = 0
+	}
+	mailboxID, err := a.createMailboxWithPasswordHashTx(r.Context(), tx, userID, req.DomainID, local, displayName, passwordHash, quotaMB, "active")
 	if err != nil {
 		badRequest(w, err)
 		return
 	}
+	if err := tx.Commit(); err != nil {
+		respondError(w, http.StatusInternalServerError, "failed to create mailbox")
+		return
+	}
 	m, err := a.mailboxByID(r.Context(), mailboxID)
 	if err != nil {
 		respondError(w, http.StatusInternalServerError, "failed to load mailbox")
@@ -699,8 +726,9 @@ func (a *App) handleUpdateMailbox(w http.ResponseWriter, r *http.Request) {
 		badRequest(w, errors.New("displayName is required"))
 		return
 	}
-	if req.QuotaMB <= 0 {
-		req.QuotaMB = 1024
+	if req.QuotaMB < 0 {
+		badRequest(w, errors.New("quotaMb must be zero or greater"))
+		return
 	}
 	status := strings.TrimSpace(req.Status)
 	if status == "" {
@@ -710,13 +738,27 @@ func (a *App) handleUpdateMailbox(w http.ResponseWriter, r *http.Request) {
 		badRequest(w, errors.New("invalid status"))
 		return
 	}
+	existingMailbox, err := a.mailboxByID(r.Context(), id)
+	if err != nil {
+		respondError(w, http.StatusNotFound, "mailbox not found")
+		return
+	}
+	if existingMailbox.Primary && status != existingMailbox.Status {
+		badRequest(w, errors.New("用户默认邮箱状态由所属账号管理，不能单独修改"))
+		return
+	}
 	userID := strings.TrimSpace(req.UserID)
 	if userID == "" {
 		badRequest(w, errors.New("userId is required"))
 		return
 	}
+	if existingMailbox.Primary && userID != existingMailbox.UserID {
+		badRequest(w, errors.New("用户默认邮箱归属由所属账号管理，不能单独修改"))
+		return
+	}
 	var disabled int
-	if err := a.db.QueryRowContext(r.Context(), `SELECT disabled FROM users WHERE id=?`, userID).Scan(&disabled); err != nil {
+	var ownerRole, ownerPasswordHash string
+	if err := a.db.QueryRowContext(r.Context(), `SELECT disabled,role,password_hash FROM users WHERE id=?`, userID).Scan(&disabled, &ownerRole, &ownerPasswordHash); err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
 			respondError(w, http.StatusNotFound, "owner user not found")
 		} else {
@@ -728,8 +770,11 @@ func (a *App) handleUpdateMailbox(w http.ResponseWriter, r *http.Request) {
 		badRequest(w, errors.New("owner user is disabled"))
 		return
 	}
-	res, err := a.db.ExecContext(r.Context(), `UPDATE mailboxes SET user_id=?,display_name=?,quota_mb=?,status=?,updated_at=? WHERE id=?`,
-		userID, displayName, req.QuotaMB, status, a.now().UTC().Format(time.RFC3339Nano), id)
+	if ownerRole == "admin" {
+		req.QuotaMB = 0
+	}
+	res, err := a.db.ExecContext(r.Context(), `UPDATE mailboxes SET user_id=?,display_name=?,password_hash=?,quota_mb=?,status=?,updated_at=? WHERE id=?`,
+		userID, displayName, ownerPasswordHash, req.QuotaMB, status, a.now().UTC().Format(time.RFC3339Nano), id)
 	if err != nil {
 		respondError(w, http.StatusInternalServerError, "failed to update mailbox")
 		return
@@ -749,6 +794,14 @@ func (a *App) handleUpdateMailbox(w http.ResponseWriter, r *http.Request) {
 
 func (a *App) handleDeleteMailbox(w http.ResponseWriter, r *http.Request) {
 	id := chi.URLParam(r, "id")
+	if err := a.ensureMailboxDeletable(r.Context(), id); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			respondError(w, http.StatusNotFound, "邮箱不存在或已被删除")
+		} else {
+			badRequest(w, err)
+		}
+		return
+	}
 	rows, err := a.db.QueryContext(r.Context(), `SELECT id FROM messages WHERE mailbox_id=?`, id)
 	if err != nil {
 		respondError(w, http.StatusInternalServerError, "加载邮箱邮件失败")
@@ -1118,15 +1171,15 @@ func (a *App) domainByID(ctx context.Context, id string) (*Domain, error) {
 }
 
 func (a *App) adminUserByID(ctx context.Context, id string) (*AdminUser, error) {
-	row := a.db.QueryRowContext(ctx, `SELECT u.id,u.login_name,u.email,u.display_name,u.role,u.disabled,u.two_factor_enabled,u.mailbox_limit_override,u.created_at,COUNT(mb.id),COALESCE(GROUP_CONCAT(mb.address), '')
+	row := a.db.QueryRowContext(ctx, `SELECT u.id,u.login_name,u.email,u.display_name,u.role,u.disabled,u.two_factor_enabled,u.mailbox_limit_override,u.storage_quota_mb,u.created_at,COUNT(mb.id),COALESCE(GROUP_CONCAT(mb.address), '')
 		FROM users u LEFT JOIN mailboxes mb ON mb.user_id=u.id
 		WHERE u.id=?
-		GROUP BY u.id,u.login_name,u.email,u.display_name,u.role,u.disabled,u.two_factor_enabled,u.mailbox_limit_override,u.created_at`, id)
+		GROUP BY u.id,u.login_name,u.email,u.display_name,u.role,u.disabled,u.two_factor_enabled,u.mailbox_limit_override,u.storage_quota_mb,u.created_at`, id)
 	var item AdminUser
 	var disabled, twoFactorEnabled int
 	var mailboxLimitOverride sql.NullInt64
 	var created, mailboxCSV string
-	if err := row.Scan(&item.ID, &item.LoginName, &item.Email, &item.DisplayName, &item.Role, &disabled, &twoFactorEnabled, &mailboxLimitOverride, &created, &item.MailboxCount, &mailboxCSV); err != nil {
+	if err := row.Scan(&item.ID, &item.LoginName, &item.Email, &item.DisplayName, &item.Role, &disabled, &twoFactorEnabled, &mailboxLimitOverride, &item.StorageQuotaMB, &created, &item.MailboxCount, &mailboxCSV); err != nil {
 		return nil, err
 	}
 	item.Disabled = intBool(disabled)
@@ -1191,9 +1244,48 @@ func (a *App) mailboxByID(ctx context.Context, id string) (*Mailbox, error) {
 		return nil, err
 	}
 	m.CreatedAt = parseTime(created)
+	if err := a.markMailboxPrimary(ctx, &m); err != nil {
+		return nil, err
+	}
 	return &m, nil
 }
 
+func markPrimaryMailboxes(items []Mailbox) {
+	primaryByUser := make(map[string]int)
+	for i := range items {
+		candidate, ok := primaryByUser[items[i].UserID]
+		if !ok || strings.EqualFold(items[i].Address, items[i].UserEmail) || (!strings.EqualFold(items[candidate].Address, items[candidate].UserEmail) && (items[i].CreatedAt.Before(items[candidate].CreatedAt) || (items[i].CreatedAt.Equal(items[candidate].CreatedAt) && items[i].ID < items[candidate].ID))) {
+			primaryByUser[items[i].UserID] = i
+		}
+	}
+	for _, index := range primaryByUser {
+		items[index].Primary = true
+	}
+}
+
+func (a *App) markMailboxPrimary(ctx context.Context, mailbox *Mailbox) error {
+	var primaryID string
+	err := a.db.QueryRowContext(ctx, `SELECT mb.id FROM mailboxes mb JOIN users u ON u.id=mb.user_id
+		WHERE mb.user_id=?
+		ORDER BY CASE WHEN lower(mb.address)=lower(u.email) THEN 0 ELSE 1 END, mb.created_at, mb.id LIMIT 1`, mailbox.UserID).Scan(&primaryID)
+	if err != nil {
+		return err
+	}
+	mailbox.Primary = mailbox.ID == primaryID
+	return nil
+}
+
+func (a *App) ensureMailboxDeletable(ctx context.Context, id string) error {
+	mailbox, err := a.mailboxByID(ctx, id)
+	if err != nil {
+		return err
+	}
+	if mailbox.Primary {
+		return errors.New("用户默认邮箱不能删除")
+	}
+	return nil
+}
+
 func (a *App) mailboxForUser(ctx context.Context, userID string) (*Mailbox, error) {
 	row := a.db.QueryRowContext(ctx, `SELECT id,user_id,domain_id,local_part,address,display_name,quota_mb,status,created_at FROM mailboxes WHERE user_id=? AND status='active' ORDER BY created_at LIMIT 1`, userID)
 	var m Mailbox

apps/api/internal/app/app.go

@@ -40,6 +40,12 @@ type App struct {
 	telegramDeliveryMu sync.Mutex
 }
 
+const (
+	defaultUserStorageQuotaMB  = 100
+	defaultAdminStorageQuotaMB = 1024
+	minimumStorageQuotaMB      = 100
+)
+
 func (a *App) config() Config {
 	a.cfgMu.RLock()
 	defer a.cfgMu.RUnlock()
@@ -97,6 +103,10 @@ func New(cfg Config, logger *slog.Logger) (*App, error) {
 		db.Close()
 		return nil, err
 	}
+	if err := a.normalizeAdministratorMailboxQuotas(context.Background()); err != nil {
+		db.Close()
+		return nil, err
+	}
 	if err := a.initializeTelegramNotificationDefaults(context.Background()); err != nil {
 		db.Close()
 		return nil, err
@@ -168,6 +178,7 @@ func (a *App) migrate(ctx context.Context) error {
 			two_factor_secret TEXT NOT NULL DEFAULT '',
 			two_factor_enabled INTEGER NOT NULL DEFAULT 0,
 			mailbox_limit_override INTEGER,
+			storage_quota_mb INTEGER NOT NULL DEFAULT 100,
 			disabled INTEGER NOT NULL DEFAULT 0,
 			created_at TEXT NOT NULL,
 			updated_at TEXT NOT NULL
@@ -317,6 +328,7 @@ func (a *App) migrate(ctx context.Context) error {
 			mailbox_id TEXT NOT NULL REFERENCES mailboxes(id) ON DELETE CASCADE,
 			name TEXT NOT NULL,
 			role TEXT NOT NULL,
+			icon TEXT NOT NULL DEFAULT 'folder',
 			sort_order INTEGER NOT NULL DEFAULT 0,
 			uid_validity INTEGER NOT NULL DEFAULT 0,
 			uid_next INTEGER NOT NULL DEFAULT 1,
@@ -672,6 +684,9 @@ func (a *App) migrate(ctx context.Context) error {
 	if err := a.migrateUserMailboxLimitOverride(ctx); err != nil {
 		return err
 	}
+	if err := a.migrateUserStorageQuota(ctx); err != nil {
+		return err
+	}
 	if err := a.migrateMailRulesBuilder(ctx); err != nil {
 		return err
 	}
@@ -690,6 +705,9 @@ func (a *App) migrate(ctx context.Context) error {
 	if err := a.migrateFolderSortOrder(ctx); err != nil {
 		return err
 	}
+	if err := a.migrateFolderIcons(ctx); err != nil {
+		return err
+	}
 	if err := a.migrateExternalIMAP(ctx); err != nil {
 		return err
 	}
@@ -705,6 +723,9 @@ func (a *App) migrate(ctx context.Context) error {
 	if err := a.migrateTelegramNotifications(ctx); err != nil {
 		return err
 	}
+	if err := a.migrateDefaultMailLabels(ctx); err != nil {
+		return err
+	}
 	if err := a.ensureDefaultPermissionGroups(ctx); err != nil {
 		return err
 	}
@@ -722,6 +743,48 @@ func (a *App) migrateTelegramNotifications(ctx context.Context) error {
 	return nil
 }
 
+func (a *App) migrateDefaultMailLabels(ctx context.Context) error {
+	const marker = "defaultMailLabelsInitialized"
+	var initialized int
+	if err := a.db.QueryRowContext(ctx, `SELECT COUNT(1) FROM system_settings WHERE key=?`, marker).Scan(&initialized); err != nil {
+		return err
+	}
+	if initialized > 0 {
+		return nil
+	}
+	rows, err := a.db.QueryContext(ctx, `SELECT id FROM mailboxes ORDER BY id`)
+	if err != nil {
+		return err
+	}
+	var mailboxIDs []string
+	for rows.Next() {
+		var mailboxID string
+		if err := rows.Scan(&mailboxID); err != nil {
+			rows.Close()
+			return err
+		}
+		mailboxIDs = append(mailboxIDs, mailboxID)
+	}
+	if err := rows.Close(); err != nil {
+		return err
+	}
+	tx, err := a.db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback()
+	now := a.now().UTC().Format(time.RFC3339Nano)
+	for _, mailboxID := range mailboxIDs {
+		if err := insertDefaultMailLabels(ctx, tx, mailboxID, now); err != nil {
+			return err
+		}
+	}
+	if _, err := tx.ExecContext(ctx, `INSERT INTO system_settings(key,value,updated_at) VALUES(?,?,?)`, marker, "true", now); err != nil {
+		return err
+	}
+	return tx.Commit()
+}
+
 func (a *App) initializeTelegramNotificationDefaults(ctx context.Context) error {
 	now := a.now().UTC().Format(time.RFC3339Nano)
 	var mailboxSettingExists int
@@ -1286,6 +1349,39 @@ func (a *App) migrateUserMailboxLimitOverride(ctx context.Context) error {
 	return err
 }
 
+func (a *App) migrateUserStorageQuota(ctx context.Context) error {
+	rows, err := a.db.QueryContext(ctx, `PRAGMA table_info(users)`)
+	if err != nil {
+		return err
+	}
+	hasColumn := false
+	for rows.Next() {
+		var cid int
+		var name, typ string
+		var notnull int
+		var dflt any
+		var pk int
+		if err := rows.Scan(&cid, &name, &typ, &notnull, &dflt, &pk); err != nil {
+			rows.Close()
+			return err
+		}
+		if name == "storage_quota_mb" {
+			hasColumn = true
+		}
+	}
+	if err := rows.Close(); err != nil {
+		return err
+	}
+	if hasColumn {
+		return nil
+	}
+	if _, err := a.db.ExecContext(ctx, `ALTER TABLE users ADD COLUMN storage_quota_mb INTEGER NOT NULL DEFAULT 100`); err != nil {
+		return err
+	}
+	_, err = a.db.ExecContext(ctx, `UPDATE users SET storage_quota_mb=? WHERE role='admin'`, defaultAdminStorageQuotaMB)
+	return err
+}
+
 func (a *App) migrateMessagesForUnregistered(ctx context.Context) error {
 	rows, err := a.db.QueryContext(ctx, `PRAGMA table_info(messages)`)
 	if err != nil {
@@ -1464,8 +1560,8 @@ func (a *App) seed(ctx context.Context) error {
 	}
 	now := a.now().UTC().Format(time.RFC3339Nano)
 	userID := newID("usr")
-	if _, err := a.db.ExecContext(ctx, `INSERT INTO users(id,login_name,email,display_name,role,password_hash,disabled,created_at,updated_at)
-		VALUES(?,?,?,?,?,?,?,?,?)`, userID, adminEmail, adminEmail, "NewSzxcn Admin", "admin", string(passwordHash), 0, now, now); err != nil {
+	if _, err := a.db.ExecContext(ctx, `INSERT INTO users(id,login_name,email,display_name,role,password_hash,disabled,storage_quota_mb,created_at,updated_at)
+		VALUES(?,?,?,?,?,?,?,?,?,?)`, userID, adminEmail, adminEmail, "NewSzxcn Admin", "admin", string(passwordHash), 0, defaultAdminStorageQuotaMB, now, now); err != nil {
 		return err
 	}
 	a.log.Warn("created default administrator; change LANQIN_ADMIN_PASSWORD in production", "email", adminEmail)
@@ -1486,7 +1582,7 @@ func (a *App) seed(ctx context.Context) error {
 	}
 
 	// Create mailbox for admin
-	mailboxID, err := a.createMailboxWithPasswordHash(ctx, userID, domainID, localPart, adminEmail, string(passwordHash), 1024, "active")
+	mailboxID, err := a.createMailboxWithPasswordHash(ctx, userID, domainID, localPart, adminEmail, string(passwordHash), 0, "active")
 	if err != nil {
 		return err
 	}
@@ -1607,7 +1703,7 @@ func (a *App) migrateConfiguredAdministratorIdentity(ctx context.Context) error
 		if !errors.Is(err, sql.ErrNoRows) {
 			return err
 		}
-		mailboxID, err = a.createMailboxWithPasswordHashTx(ctx, tx, keeper.ID, domainID, localPart, adminEmail, keeper.PasswordHash, 1024, "active")
+		mailboxID, err = a.createMailboxWithPasswordHashTx(ctx, tx, keeper.ID, domainID, localPart, adminEmail, keeper.PasswordHash, 0, "active")
 		if err != nil {
 			return err
 		}
@@ -1769,6 +1865,30 @@ func defaultFolderDefs() []struct{ name, role string } {
 	}
 }
 
+type defaultMailLabel struct {
+	name  string
+	color string
+}
+
+func defaultMailLabelDefs() []defaultMailLabel {
+	return []defaultMailLabel{
+		{name: "个人", color: "#10b981"},
+		{name: "家人", color: "#ec4899"},
+		{name: "朋友", color: "#06b6d4"},
+		{name: "工作", color: "#3b82f6"},
+		{name: "重要", color: "#f59e0b"},
+	}
+}
+
+func insertDefaultMailLabels(ctx context.Context, tx *sql.Tx, mailboxID, now string) error {
+	for _, label := range defaultMailLabelDefs() {
+		if _, err := tx.ExecContext(ctx, `INSERT OR IGNORE INTO mail_labels(id,mailbox_id,name,color,created_at,updated_at) VALUES(?,?,?,?,?,?)`, newID("lbl"), mailboxID, label.name, label.color, now, now); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 func (a *App) createMailbox(ctx context.Context, userID, domainID, localPart, displayName, password string, quotaMB int, status string) (string, error) {
 	passwordHash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
 	if err != nil {
@@ -1798,8 +1918,15 @@ func (a *App) createMailboxWithPasswordHashTx(ctx context.Context, tx *sql.Tx, u
 	if localPart == "" {
 		return "", errors.New("invalid local part")
 	}
-	if quotaMB <= 0 {
-		quotaMB = 1024
+	if quotaMB < 0 {
+		return "", errors.New("quotaMb must be zero or greater")
+	}
+	var ownerRole string
+	if err := tx.QueryRowContext(ctx, `SELECT role FROM users WHERE id=?`, userID).Scan(&ownerRole); err != nil {
+		return "", err
+	}
+	if ownerRole == "admin" {
+		quotaMB = 0
 	}
 	if status == "" {
 		status = "active"
@@ -1826,9 +1953,23 @@ func (a *App) createMailboxWithPasswordHashTx(ctx context.Context, tx *sql.Tx, u
 			return "", err
 		}
 	}
+	if err := insertDefaultMailLabels(ctx, tx, id, now); err != nil {
+		return "", err
+	}
 	return id, nil
 }
 
+func (a *App) normalizeAdministratorMailboxQuotas(ctx context.Context) error {
+	now := a.now().UTC().Format(time.RFC3339Nano)
+	if _, err := a.db.ExecContext(ctx, `UPDATE users SET storage_quota_mb=CASE WHEN role='admin' THEN ? ELSE ? END, updated_at=? WHERE storage_quota_mb<?`, defaultAdminStorageQuotaMB, defaultUserStorageQuotaMB, now, minimumStorageQuotaMB); err != nil {
+		return err
+	}
+	_, err := a.db.ExecContext(ctx, `UPDATE mailboxes
+		SET quota_mb=0, updated_at=?
+		WHERE quota_mb<>0 AND user_id IN (SELECT id FROM users WHERE role='admin')`, now)
+	return err
+}
+
 func (a *App) seedWelcomeMessage(ctx context.Context, mailboxID string) error {
 	cfg := a.config()
 	folderID, err := a.ensureFolder(ctx, mailboxID, "Inbox")

apps/api/internal/app/app_test.go

@@ -363,6 +363,147 @@ func createTestMailbox(t *testing.T, admin *testClient, domainID, localPart, dis
 	return mailbox
 }
 
+func TestAdminMailboxCreationUsesOwnerPasswordAndQuota(t *testing.T) {
+	a := newTestApp(t)
+	ts := httptest.NewServer(a.Router())
+	defer ts.Close()
+	admin := &testClient{t: t, server: ts}
+	var login map[string]any
+	if code := admin.do("POST", "/api/auth/login", map[string]string{"email": "admin@lanqin.local", "password": "ChangeMe123!"}, &login); code != http.StatusOK {
+		t.Fatalf("login code=%d body=%v", code, login)
+	}
+	adminUser, adminMailbox := defaultAdminUserAndMailbox(t, a)
+	adminDetails, err := a.adminUserByID(context.Background(), adminUser.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if adminDetails.StorageQuotaMB != defaultAdminStorageQuotaMB {
+		t.Fatalf("administrator storage quota=%d, want %d", adminDetails.StorageQuotaMB, defaultAdminStorageQuotaMB)
+	}
+	domainID := mustDefaultDomainID(t, a)
+
+	var secondary Mailbox
+	if code := admin.do("POST", "/api/admin/mailboxes", map[string]any{
+		"domainId":  domainID,
+		"localPart": "admin-secondary",
+		"userId":    adminUser.ID,
+	}, &secondary); code != http.StatusCreated {
+		t.Fatalf("create admin secondary mailbox code=%d", code)
+	}
+	if secondary.QuotaMB != 0 {
+		t.Fatalf("admin secondary quota=%d, want unlimited", secondary.QuotaMB)
+	}
+
+	var primaryHash, secondaryHash string
+	if err := a.db.QueryRow(`SELECT password_hash FROM mailboxes WHERE id=?`, adminMailbox.ID).Scan(&primaryHash); err != nil {
+		t.Fatal(err)
+	}
+	if err := a.db.QueryRow(`SELECT password_hash FROM mailboxes WHERE id=?`, secondary.ID).Scan(&secondaryHash); err != nil {
+		t.Fatal(err)
+	}
+	if primaryHash != secondaryHash {
+		t.Fatal("admin secondary mailbox did not inherit the owner password")
+	}
+
+	var regular AdminUser
+	if code := admin.do("POST", "/api/admin/users", map[string]any{
+		"email":       "owner@lanqin.local",
+		"displayName": "Owner",
+		"password":    "OwnerPassword123!",
+		"role":        "user",
+	}, &regular); code != http.StatusCreated {
+		t.Fatalf("create regular owner code=%d", code)
+	}
+	if regular.MailboxCount != 1 {
+		t.Fatalf("new account mailbox count=%d, want one protected primary mailbox", regular.MailboxCount)
+	}
+	if regular.StorageQuotaMB != defaultUserStorageQuotaMB {
+		t.Fatalf("regular account storage quota=%d, want %d", regular.StorageQuotaMB, defaultUserStorageQuotaMB)
+	}
+	if _, err := a.mailboxByAddress(context.Background(), regular.Email); err != nil {
+		t.Fatalf("new account primary mailbox missing: %v", err)
+	}
+	var primaryStatusErr map[string]any
+	primaryMailbox, err := a.mailboxByAddress(context.Background(), regular.Email)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if code := admin.do("POST", "/api/admin/mailboxes/"+primaryMailbox.ID, map[string]any{
+		"userId": regular.ID, "displayName": primaryMailbox.DisplayName, "quotaMb": primaryMailbox.QuotaMB, "status": "disabled",
+	}, &primaryStatusErr); code != http.StatusBadRequest {
+		t.Fatalf("primary mailbox status update code=%d body=%v", code, primaryStatusErr)
+	}
+	var regularMailbox Mailbox
+	if code := admin.do("POST", "/api/admin/mailboxes", map[string]any{
+		"domainId":  domainID,
+		"localPart": "owner-secondary",
+		"userId":    regular.ID,
+	}, &regularMailbox); code != http.StatusCreated {
+		t.Fatalf("create regular secondary mailbox code=%d", code)
+	}
+	if regularMailbox.QuotaMB != defaultUserStorageQuotaMB {
+		t.Fatalf("regular secondary quota=%d, want %d", regularMailbox.QuotaMB, defaultUserStorageQuotaMB)
+	}
+	var userHash, mailboxHash string
+	if err := a.db.QueryRow(`SELECT password_hash FROM users WHERE id=?`, regular.ID).Scan(&userHash); err != nil {
+		t.Fatal(err)
+	}
+	if err := a.db.QueryRow(`SELECT password_hash FROM mailboxes WHERE id=?`, regularMailbox.ID).Scan(&mailboxHash); err != nil {
+		t.Fatal(err)
+	}
+	if userHash != mailboxHash {
+		t.Fatal("regular secondary mailbox did not inherit the owner password")
+	}
+}
+
+func TestAdministratorAccountAndPrimaryMailboxesCannotBeDeleted(t *testing.T) {
+	a := newTestApp(t)
+	ts := httptest.NewServer(a.Router())
+	defer ts.Close()
+	admin := &testClient{t: t, server: ts}
+	var login map[string]any
+	if code := admin.do("POST", "/api/auth/login", map[string]string{"email": "admin@lanqin.local", "password": "ChangeMe123!"}, &login); code != http.StatusOK {
+		t.Fatalf("login code=%d body=%v", code, login)
+	}
+	adminUser, adminMailbox := defaultAdminUserAndMailbox(t, a)
+	var errBody map[string]any
+	if code := admin.do("DELETE", "/api/admin/users/"+adminUser.ID, nil, &errBody); code != http.StatusBadRequest {
+		t.Fatalf("administrator account delete code=%d body=%v", code, errBody)
+	}
+	if code := admin.do("DELETE", "/api/admin/mailboxes/"+adminMailbox.ID, nil, &errBody); code != http.StatusBadRequest {
+		t.Fatalf("administrator primary mailbox delete code=%d body=%v", code, errBody)
+	}
+	if code := admin.do("POST", "/api/admin/users/"+adminUser.ID, map[string]any{
+		"email": adminUser.Email, "displayName": adminUser.DisplayName, "role": "admin", "disabled": false, "storageQuotaMb": 99,
+	}, &errBody); code != http.StatusBadRequest {
+		t.Fatalf("storage quota below 100 MB code=%d body=%v", code, errBody)
+	}
+	var updatedAdmin AdminUser
+	if code := admin.do("POST", "/api/admin/users/"+adminUser.ID, map[string]any{
+		"email": adminUser.Email, "displayName": adminUser.DisplayName, "role": "admin", "disabled": false, "storageQuotaMb": 100,
+	}, &updatedAdmin); code != http.StatusOK || updatedAdmin.StorageQuotaMB != 100 {
+		t.Fatalf("administrator storage quota code=%d user=%+v", code, updatedAdmin)
+	}
+
+	var regular AdminUser
+	if code := admin.do("POST", "/api/admin/users", map[string]any{
+		"email": "protected-primary@lanqin.local", "displayName": "Protected Primary", "role": "user", "password": "Password123!",
+	}, &regular); code != http.StatusCreated {
+		t.Fatalf("create regular user code=%d user=%+v", code, regular)
+	}
+	primary, err := a.mailboxByAddress(context.Background(), regular.Email)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if code := admin.do("DELETE", "/api/admin/mailboxes/"+primary.ID, nil, &errBody); code != http.StatusBadRequest {
+		t.Fatalf("regular primary mailbox delete code=%d body=%v", code, errBody)
+	}
+	secondary := createTestMailbox(t, admin, primary.DomainID, "deletable-secondary", "Secondary", "", map[string]any{"userId": regular.ID})
+	if code := admin.do("DELETE", "/api/admin/mailboxes/"+secondary.ID, nil, &errBody); code != http.StatusOK {
+		t.Fatalf("secondary mailbox delete code=%d body=%v", code, errBody)
+	}
+}
+
 func createTestAPIToken(t *testing.T, client *testClient, name string) string {
 	return createTestAPITokenWithScopes(t, client, name, nil)
 }
@@ -549,16 +690,26 @@ func TestAuthAdminAndLocalDeliveryFlow(t *testing.T) {
 	var labels struct {
 		Items []MailLabel `json:"items"`
 	}
-	if code := bob.do("GET", "/api/mail/labels?mailboxId="+mb2.ID, nil, &labels); code != http.StatusOK || len(labels.Items) != 1 || labels.Items[0].MessageCount != 1 {
+	if code := bob.do("GET", "/api/mail/labels?mailboxId="+mb2.ID, nil, &labels); code != http.StatusOK || len(labels.Items) != len(defaultMailLabelDefs()) {
 		t.Fatalf("labels code=%d items=%+v", code, labels.Items)
 	}
+	var importantLabel MailLabel
+	for _, label := range labels.Items {
+		if label.Name == "重要" {
+			importantLabel = label
+			break
+		}
+	}
+	if importantLabel.ID == "" || importantLabel.MessageCount != 1 {
+		t.Fatalf("important label missing or count is wrong: %+v", labels.Items)
+	}
 	var labeled struct {
 		Items []MailMessage `json:"items"`
 	}
-	if code := bob.do("GET", "/api/mail/messages?mailboxId="+mb2.ID+"&labelId="+labels.Items[0].ID, nil, &labeled); code != http.StatusOK || len(labeled.Items) != 1 || labeled.Items[0].ID != detail.ID {
+	if code := bob.do("GET", "/api/mail/messages?mailboxId="+mb2.ID+"&labelId="+importantLabel.ID, nil, &labeled); code != http.StatusOK || len(labeled.Items) != 1 || labeled.Items[0].ID != detail.ID {
 		t.Fatalf("labeled messages code=%d items=%+v", code, labeled.Items)
 	}
-	if code := bob.do("DELETE", "/api/mail/messages/"+detail.ID+"/labels/"+labels.Items[0].ID, nil, &labelUpdate); code != http.StatusOK || len(labelUpdate.Labels) != 0 {
+	if code := bob.do("DELETE", "/api/mail/messages/"+detail.ID+"/labels/"+importantLabel.ID, nil, &labelUpdate); code != http.StatusOK || len(labelUpdate.Labels) != 0 {
 		t.Fatalf("remove label code=%d labels=%+v", code, labelUpdate.Labels)
 	}
 	var starred struct {
@@ -1040,6 +1191,191 @@ func TestMailRulesForwardingAction(t *testing.T) {
 	}
 }
 
+func TestMailRulesExactSenderCustomFolderAndStopProcessing(t *testing.T) {
+	a := newTestApp(t)
+	ts := httptest.NewServer(a.Router())
+	defer ts.Close()
+	admin := &testClient{t: t, server: ts}
+
+	var login map[string]any
+	if code := admin.do("POST", "/api/auth/login", map[string]string{"email": "admin@lanqin.local", "password": "ChangeMe123!"}, &login); code != http.StatusOK {
+		t.Fatalf("admin login code=%d", code)
+	}
+	domainID := mustDefaultDomainID(t, a)
+	sender := createTestMailbox(t, admin, domainID, "rule-exact-sender", "Sender With Name", "Password123!", nil)
+	recipient := createTestMailbox(t, admin, domainID, "rule-custom-target", "Rule Target", "Password123!", nil)
+
+	rcpt := &testClient{t: t, server: ts}
+	if code := rcpt.do("POST", "/api/auth/login", map[string]string{"email": recipient.Address, "password": "Password123!"}, &login); code != http.StatusOK {
+		t.Fatalf("recipient login=%d", code)
+	}
+	var bad map[string]any
+	if code := rcpt.do("POST", "/api/me/rules", map[string]any{
+		"mailboxId":  recipient.ID,
+		"conditions": []map[string]string{{"field": "size", "operator": "contains", "value": "10"}},
+		"actions":    []map[string]string{{"type": "archive"}},
+	}, &bad); code != http.StatusBadRequest {
+		t.Fatalf("invalid field operator should be rejected code=%d body=%v", code, bad)
+	}
+
+	createRule := func(name string, action map[string]string, stop bool) {
+		t.Helper()
+		var rule MailRule
+		if code := rcpt.do("POST", "/api/me/rules", map[string]any{
+			"mailboxId":      recipient.ID,
+			"name":           name,
+			"conditions":     []map[string]string{{"field": "from", "operator": "equals", "value": sender.Address}},
+			"actions":        []map[string]string{action},
+			"stopProcessing": stop,
+		}, &rule); code != http.StatusCreated {
+			t.Fatalf("create rule %s code=%d rule=%+v", name, code, rule)
+		}
+	}
+	createRule("fallback archive", map[string]string{"type": "archive"}, false)
+	createRule("Netflix folder", map[string]string{"type": "move", "value": "Netflix 验证码"}, true)
+
+	senderClient := &testClient{t: t, server: ts}
+	if code := senderClient.do("POST", "/api/auth/login", map[string]string{"email": sender.Address, "password": "Password123!"}, &login); code != http.StatusOK {
+		t.Fatalf("sender login=%d", code)
+	}
+	var sent MailMessage
+	if code := senderClient.do("POST", "/api/mail/send", map[string]any{"to": []string{recipient.Address}, "subject": "Netflix code", "text": "123456"}, &sent); code != http.StatusCreated {
+		t.Fatalf("send code=%d sent=%+v", code, sent)
+	}
+	var custom struct {
+		Items []MailMessage `json:"items"`
+	}
+	if code := rcpt.do("GET", "/api/mail/messages?mailboxId="+recipient.ID+"&folder="+url.QueryEscape("Netflix 验证码"), nil, &custom); code != http.StatusOK || len(custom.Items) != 1 {
+		t.Fatalf("custom rule folder code=%d items=%+v", code, custom.Items)
+	}
+	var archived struct {
+		Items []MailMessage `json:"items"`
+	}
+	if code := rcpt.do("GET", "/api/mail/messages?mailboxId="+recipient.ID+"&folder=Archive", nil, &archived); code != http.StatusOK || len(archived.Items) != 0 {
+		t.Fatalf("stop processing should prevent fallback archive code=%d items=%+v", code, archived.Items)
+	}
+	var icon string
+	if err := a.db.QueryRow(`SELECT icon FROM folders WHERE mailbox_id=? AND name=?`, recipient.ID, "Netflix 验证码").Scan(&icon); err != nil || icon != "netflix" {
+		t.Fatalf("rule-created folder icon=%q err=%v", icon, err)
+	}
+}
+
+func TestFolderIconForName(t *testing.T) {
+	tests := []struct {
+		name      string
+		requested string
+		want      string
+	}{
+		{name: "Netflix 验证码", requested: "auto", want: "netflix"},
+		{name: "ChatGPT 通知", want: "chatgpt"},
+		{name: "OpenAI 账单", want: "chatgpt"},
+		{name: "项目归档", want: "briefcase"},
+		{name: "其他", want: "folder"},
+		{name: "Netflix", requested: "heart", want: "heart"},
+		{name: "Netflix", requested: "unknown", want: "folder"},
+		{name: "Custom", requested: "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=", want: "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII="},
+		{name: "Egypt archive", want: "folder"},
+		{name: "Custom", requested: "data:image/svg+xml;base64,PHN2Zz4=", want: "folder"},
+		{name: "Custom", requested: "data:image/png;base64,SGVsbG8=", want: "folder"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name+"/"+tt.requested, func(t *testing.T) {
+			if got := folderIconForName(tt.name, tt.requested); got != tt.want {
+				t.Fatalf("folderIconForName(%q, %q)=%q want %q", tt.name, tt.requested, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestRuleFolderAutoIconPreservesManualSelection(t *testing.T) {
+	a := newTestApp(t)
+	ctx := context.Background()
+	admin := &testClient{t: t, server: httptest.NewServer(a.Router())}
+	defer admin.server.Close()
+
+	var login map[string]any
+	if code := admin.do("POST", "/api/auth/login", map[string]string{"email": "admin@lanqin.local", "password": "ChangeMe123!"}, &login); code != http.StatusOK {
+		t.Fatalf("admin login code=%d", code)
+	}
+	domainID := createTestDomain(t, admin, "manual-icon.test")
+	mailbox := createTestMailbox(t, admin, domainID.ID, "rules", "Rules", "Password123!", nil)
+	if _, err := a.ensureCustomFolder(ctx, mailbox.ID, "Netflix", "heart"); err != nil {
+		t.Fatalf("create custom folder: %v", err)
+	}
+	if _, err := a.ensureCustomFolder(ctx, mailbox.ID, "Netflix", "auto"); err != nil {
+		t.Fatalf("reuse custom folder: %v", err)
+	}
+	var icon string
+	if err := a.db.QueryRowContext(ctx, `SELECT icon FROM folders WHERE mailbox_id=? AND name='Netflix'`, mailbox.ID).Scan(&icon); err != nil || icon != "heart" {
+		t.Fatalf("manual icon should be preserved icon=%q err=%v", icon, err)
+	}
+}
+
+func TestMailRuleApplyExistingWhenDisabledExcludesSent(t *testing.T) {
+	a := newTestApp(t)
+	ts := httptest.NewServer(a.Router())
+	defer ts.Close()
+	admin := &testClient{t: t, server: ts}
+
+	var login map[string]any
+	if code := admin.do("POST", "/api/auth/login", map[string]string{"email": "admin@lanqin.local", "password": "ChangeMe123!"}, &login); code != http.StatusOK {
+		t.Fatalf("admin login code=%d", code)
+	}
+	domainID := mustDefaultDomainID(t, a)
+	sender := createTestMailbox(t, admin, domainID, "rule-existing-sender", "Existing Sender", "Password123!", nil)
+	recipient := createTestMailbox(t, admin, domainID, "rule-existing-recipient", "Existing Recipient", "Password123!", nil)
+	subject := "same inbound and sent subject"
+
+	senderClient := &testClient{t: t, server: ts}
+	if code := senderClient.do("POST", "/api/auth/login", map[string]string{"email": sender.Address, "password": "Password123!"}, &login); code != http.StatusOK {
+		t.Fatalf("sender login=%d", code)
+	}
+	var incomingSend MailMessage
+	if code := senderClient.do("POST", "/api/mail/send", map[string]any{"to": []string{recipient.Address}, "subject": subject, "text": "incoming"}, &incomingSend); code != http.StatusCreated {
+		t.Fatalf("incoming send code=%d", code)
+	}
+
+	rcpt := &testClient{t: t, server: ts}
+	if code := rcpt.do("POST", "/api/auth/login", map[string]string{"email": recipient.Address, "password": "Password123!"}, &login); code != http.StatusOK {
+		t.Fatalf("recipient login=%d", code)
+	}
+	var outgoing MailMessage
+	if code := rcpt.do("POST", "/api/mail/send", map[string]any{"to": []string{sender.Address}, "subject": subject, "text": "outgoing"}, &outgoing); code != http.StatusCreated {
+		t.Fatalf("outgoing send code=%d", code)
+	}
+	var rule MailRule
+	if code := rcpt.do("POST", "/api/me/rules", map[string]any{
+		"mailboxId":       recipient.ID,
+		"name":            "existing disabled",
+		"conditions":      []map[string]string{{"field": "subject", "operator": "equals", "value": subject}},
+		"actions":         []map[string]string{{"type": "star"}},
+		"applyToExisting": true,
+		"enabled":         false,
+	}, &rule); code != http.StatusCreated || rule.AppliedExistingCount != 1 || rule.Enabled {
+		t.Fatalf("create disabled existing rule code=%d rule=%+v", code, rule)
+	}
+	var inboundStarred, sentStarred int
+	if err := a.db.QueryRow(`SELECT is_starred FROM messages WHERE mailbox_id=? AND subject=? AND folder_id IN (SELECT id FROM folders WHERE mailbox_id=? AND lower(name)='inbox')`, recipient.ID, subject, recipient.ID).Scan(&inboundStarred); err != nil {
+		t.Fatal(err)
+	}
+	if err := a.db.QueryRow(`SELECT is_starred FROM messages WHERE id=?`, outgoing.ID).Scan(&sentStarred); err != nil {
+		t.Fatal(err)
+	}
+	if inboundStarred != 1 || sentStarred != 0 {
+		t.Fatalf("existing rule starred inbound=%d sent=%d", inboundStarred, sentStarred)
+	}
+}
+
+func TestRuleAttachmentConditionUsesFilenameOnly(t *testing.T) {
+	msg := ruleMessage{AttachmentNames: "notes.txt"}
+	if ruleConditionMatches(MailRuleCondition{Field: "attachment", Operator: "contains", Value: "pdf"}, msg) {
+		t.Fatal("attachment condition must not match MIME type or unrelated extension")
+	}
+	if !ruleConditionMatches(MailRuleCondition{Field: "attachment", Operator: "ends-with", Value: ".txt"}, msg) {
+		t.Fatal("attachment condition should match filename")
+	}
+}
+
 func TestMailRulesMailboxIsolation(t *testing.T) {
 	a := newTestApp(t)
 	ts := httptest.NewServer(a.Router())
@@ -1379,6 +1715,13 @@ func TestOpenRegistrationAtomicallyCreatesLoginUserAndMailbox(t *testing.T) {
 	if code := client.do("POST", "/api/auth/register", registration, &registered); code != http.StatusCreated || registered.User.Email != "newuser@lanqin.local" || registered.User.Role != "user" {
 		t.Fatalf("register code=%d user=%+v", code, registered.User)
 	}
+	var storageQuotaMB int
+	if err := a.db.QueryRow(`SELECT storage_quota_mb FROM users WHERE id=?`, registered.User.ID).Scan(&storageQuotaMB); err != nil {
+		t.Fatal(err)
+	}
+	if storageQuotaMB != defaultUserStorageQuotaMB {
+		t.Fatalf("registered account storage quota=%d, want %d", storageQuotaMB, defaultUserStorageQuotaMB)
+	}
 	var me struct {
 		User User `json:"user"`
 	}
@@ -2020,6 +2363,16 @@ func TestUserCanSelectMultipleMailboxes(t *testing.T) {
 	insertMessage("msg_multi_primary_read", primary.ID, primaryInboxID, "primary read", 1)
 	insertMessage("msg_multi_primary_archived", primary.ID, primaryArchiveID, "primary archived unread", 0)
 	insertMessage("msg_multi_secondary_unread", secondary.ID, secondaryInboxID, "secondary unread", 0)
+	var primaryImportantID, secondaryImportantID string
+	if err := a.db.QueryRowContext(ctx, `SELECT id FROM mail_labels WHERE mailbox_id=? AND name='重要'`, primary.ID).Scan(&primaryImportantID); err != nil {
+		t.Fatal(err)
+	}
+	if err := a.db.QueryRowContext(ctx, `SELECT id FROM mail_labels WHERE mailbox_id=? AND name='重要'`, secondary.ID).Scan(&secondaryImportantID); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := a.db.ExecContext(ctx, `INSERT INTO message_labels(message_id,label_id,created_at) VALUES(?,?,?),(?,?,?)`, "msg_multi_primary_unread_1", primaryImportantID, now, "msg_multi_secondary_unread", secondaryImportantID, now); err != nil {
+		t.Fatal(err)
+	}
 
 	userClient := &testClient{t: t, server: ts}
 	if code := userClient.do("POST", "/api/auth/login", map[string]string{"email": primary.Address, "password": "Password123!"}, &login); code != http.StatusOK {
@@ -2031,6 +2384,28 @@ func TestUserCanSelectMultipleMailboxes(t *testing.T) {
 	if code := userClient.do("GET", "/api/mail/mailboxes", nil, &mine); code != http.StatusOK || len(mine.Items) != 2 {
 		t.Fatalf("my mailboxes code=%d items=%d", code, len(mine.Items))
 	}
+	var allLabels struct {
+		Items []MailLabel `json:"items"`
+	}
+	if code := userClient.do("GET", "/api/mail/labels?mailboxId=all", nil, &allLabels); code != http.StatusOK || len(allLabels.Items) != len(defaultMailLabelDefs()) {
+		t.Fatalf("all labels code=%d items=%+v", code, allLabels.Items)
+	}
+	var allImportant MailLabel
+	for _, label := range allLabels.Items {
+		if label.Name == "重要" {
+			allImportant = label
+			break
+		}
+	}
+	if allImportant.ID == "" || allImportant.MailboxID != "" || allImportant.MessageCount != 2 {
+		t.Fatalf("aggregated important label=%+v", allImportant)
+	}
+	var importantMessages struct {
+		Items []MailMessage `json:"items"`
+	}
+	if code := userClient.do("GET", "/api/mail/messages?mailboxId=all&labelId="+url.QueryEscape(allImportant.ID), nil, &importantMessages); code != http.StatusOK || len(importantMessages.Items) != 2 {
+		t.Fatalf("all important messages code=%d items=%+v", code, importantMessages.Items)
+	}
 	unreadByAddress := map[string]int{}
 	for _, item := range mine.Items {
 		unreadByAddress[item.Address] = item.UnreadCount
@@ -2251,7 +2626,7 @@ func TestCustomMailFoldersCreateAndMove(t *testing.T) {
 	}
 
 	var custom MailFolder
-	if code := admin.do("POST", "/api/mail/folders", map[string]string{"name": "客户归档"}, &custom); code != http.StatusCreated || custom.Name != "客户归档" || custom.Role != "客户归档" {
+	if code := admin.do("POST", "/api/mail/folders", map[string]string{"name": "客户归档", "icon": "netflix"}, &custom); code != http.StatusCreated || custom.Name != "客户归档" || custom.Role != "客户归档" || custom.Icon != "netflix" {
 		t.Fatalf("custom folder create code=%d folder=%+v", code, custom)
 	}
 	var folders struct {
@@ -2260,6 +2635,15 @@ func TestCustomMailFoldersCreateAndMove(t *testing.T) {
 	if code := admin.do("GET", "/api/mail/folders", nil, &folders); code != http.StatusOK || !folderListContains(folders.Items, "客户归档") {
 		t.Fatalf("folder list code=%d items=%+v", code, folders.Items)
 	}
+	foundIcon := ""
+	for _, folder := range folders.Items {
+		if folder.Name == "客户归档" {
+			foundIcon = folder.Icon
+		}
+	}
+	if foundIcon != "netflix" {
+		t.Fatalf("folder icon=%q, want netflix", foundIcon)
+	}
 
 	var sent MailMessage
 	if code := admin.do("POST", "/api/mail/send", map[string]any{"to": []string{"person@example.test"}, "subject": "custom folder", "text": "body"}, &sent); code != http.StatusCreated {
@@ -2571,6 +2955,25 @@ func TestMailSendQueuesSMTPFailureForRetry(t *testing.T) {
 	}
 }
 
+func TestForwardingVerificationPageDoesNotLinkToMailbox(t *testing.T) {
+	a := newTestApp(t)
+	recorder := httptest.NewRecorder()
+
+	a.renderForwardingVerificationPage(recorder, http.StatusOK, true, "friend@example.test", "该邮箱已通过转发验证")
+	body := recorder.Body.String()
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("status=%d", recorder.Code)
+	}
+	for _, forbidden := range []string{`href="/"`, "返回邮箱", "登录"} {
+		if strings.Contains(body, forbidden) {
+			t.Fatalf("verification page contains forbidden navigation %q: %s", forbidden, body)
+		}
+	}
+	if !strings.Contains(body, "可以关闭此页面") {
+		t.Fatalf("verification page is missing close guidance: %s", body)
+	}
+}
+
 func TestInboundForwardingSettingsAndDelivery(t *testing.T) {
 	a := newTestApp(t)
 	stopTestWorkers(a)
@@ -2714,8 +3117,20 @@ func TestInboundForwardingSettingsAndDelivery(t *testing.T) {
 	if err := a.db.QueryRow(`SELECT recipients_json FROM send_queue WHERE source=? AND sent_message_id=?`, sendSourceForwarding, secondID).Scan(&recipientsJSON); err != nil {
 		t.Fatal(err)
 	}
-	if !strings.Contains(recipientsJSON, "mailbox-forward@example.test") || !strings.Contains(recipientsJSON, "mailbox-forward-two@example.test") || strings.Contains(recipientsJSON, "account-forward@example.test") || strings.Contains(recipientsJSON, "account-forward-two@example.test") {
-		t.Fatalf("mailbox forwarding should override account target, recipients=%s", recipientsJSON)
+	if !strings.Contains(recipientsJSON, "account-forward@example.test") || !strings.Contains(recipientsJSON, "account-forward-two@example.test") || !strings.Contains(recipientsJSON, "mailbox-forward@example.test") || !strings.Contains(recipientsJSON, "mailbox-forward-two@example.test") {
+		t.Fatalf("mailbox forwarding should include account and mailbox targets, recipients=%s", recipientsJSON)
+	}
+
+	if code := admin.do("POST", "/api/me/forwarding/account", map[string]any{"targetEmails": []string{"account-forward-two@example.test"}}, &settings); code != http.StatusOK {
+		t.Fatalf("update account forwarding after mailbox forwarding code=%d settings=%+v", code, settings)
+	}
+	raw = []byte("From: sender@example.test\r\nTo: admin@lanqin.local\r\nSubject: account changed\r\nMessage-ID: <account-changed@example.test>\r\n\r\nbody")
+	thirdID := insertInbound("<account-changed@example.test>", "account changed", raw)
+	if err := a.db.QueryRow(`SELECT recipients_json FROM send_queue WHERE source=? AND sent_message_id=?`, sendSourceForwarding, thirdID).Scan(&recipientsJSON); err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(recipientsJSON, "account-forward@example.test") || !strings.Contains(recipientsJSON, "account-forward-two@example.test") || !strings.Contains(recipientsJSON, "mailbox-forward@example.test") || !strings.Contains(recipientsJSON, "mailbox-forward-two@example.test") {
+		t.Fatalf("changing account forwarding should preserve mailbox targets, recipients=%s", recipientsJSON)
 	}
 
 	loopRaw := []byte("From: sender@example.test\r\nTo: admin@lanqin.local\r\nSubject: loop\r\n" + forwardingHeaderName + ": mail.example.test\r\nMessage-ID: <forward-loop@example.test>\r\n\r\nbody")
@@ -2724,8 +3139,8 @@ func TestInboundForwardingSettingsAndDelivery(t *testing.T) {
 	if err := a.db.QueryRow(`SELECT COUNT(1) FROM send_queue WHERE source=?`, sendSourceForwarding).Scan(&queueCount); err != nil {
 		t.Fatal(err)
 	}
-	if queueCount != 2 {
-		t.Fatalf("forwarding queue count=%d, want 2", queueCount)
+	if queueCount != 3 {
+		t.Fatalf("forwarding queue count=%d, want 3", queueCount)
 	}
 }
 
@@ -2910,20 +3325,45 @@ func TestOpenAPIDomainAndMailboxCRUD(t *testing.T) {
 	if code := openAdmin.do("POST", "/api/open/domains/"+domain.ID, map[string]string{"status": "active"}, &domain); code != http.StatusOK {
 		t.Fatalf("reactivate open api domain code=%d domain=%+v", code, domain)
 	}
+	var owner AdminUser
+	if code := admin.do("POST", "/api/admin/users", map[string]any{
+		"email": "open-api-owner@lanqin.local", "displayName": "Open API Owner", "role": "user", "password": "Password123!",
+	}, &owner); code != http.StatusCreated {
+		t.Fatalf("create open api mailbox owner code=%d owner=%+v", code, owner)
+	}
 
 	var mailbox Mailbox
 	if code := openAdmin.do("POST", "/api/open/mailboxes", map[string]any{
 		"domainId":    domain.ID,
 		"localPart":   "api-user",
 		"displayName": "API User",
-		"password":    "Password123!",
+		"password":    "DifferentPassword123!",
 		"quotaMb":     256,
+		"userId":      owner.ID,
 	}, &mailbox); code != http.StatusCreated {
 		t.Fatalf("create open api mailbox code=%d mailbox=%+v", code, mailbox)
 	}
+	ownerPrimary, err := a.mailboxByAddress(context.Background(), owner.Email)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var protectedMailboxErr map[string]any
+	if code := openAdmin.do("POST", "/api/open/mailboxes/"+ownerPrimary.ID, map[string]any{"status": "disabled"}, &protectedMailboxErr); code != http.StatusBadRequest {
+		t.Fatalf("open api primary mailbox status update code=%d body=%v", code, protectedMailboxErr)
+	}
 	if mailbox.Address != "api-user@api.example.test" || mailbox.QuotaMB != 256 {
 		t.Fatalf("mailbox=%+v", mailbox)
 	}
+	var ownerPasswordHash, mailboxPasswordHash string
+	if err := a.db.QueryRowContext(context.Background(), `SELECT password_hash FROM users WHERE id=?`, owner.ID).Scan(&ownerPasswordHash); err != nil {
+		t.Fatal(err)
+	}
+	if err := a.db.QueryRowContext(context.Background(), `SELECT password_hash FROM mailboxes WHERE id=?`, mailbox.ID).Scan(&mailboxPasswordHash); err != nil {
+		t.Fatal(err)
+	}
+	if mailboxPasswordHash != ownerPasswordHash {
+		t.Fatal("open api mailbox did not inherit the owner password")
+	}
 	var mailboxes struct {
 		Items []Mailbox `json:"items"`
 	}
@@ -2940,6 +3380,9 @@ func TestOpenAPIDomainAndMailboxCRUD(t *testing.T) {
 	if updated.DisplayName != "Renamed API User" || updated.QuotaMB != 512 || updated.Status != "disabled" {
 		t.Fatalf("updated mailbox=%+v", updated)
 	}
+	if code := openAdmin.do("POST", "/api/open/mailboxes/"+mailbox.ID, map[string]any{"status": "active"}, &updated); code != http.StatusOK || updated.QuotaMB != 512 {
+		t.Fatalf("open api mailbox omitted quota should preserve 512 MB: code=%d mailbox=%+v", code, updated)
+	}
 	var ok map[string]any
 	if code := openAdmin.do("DELETE", "/api/open/mailboxes/"+mailbox.ID, nil, &ok); code != http.StatusOK {
 		t.Fatalf("delete open api mailbox code=%d body=%v", code, ok)
@@ -4438,6 +4881,49 @@ func TestSubmissionTLSConfigReloadsCertificateFiles(t *testing.T) {
 	}
 }
 
+func TestSubmissionLoginAuthenticationWithAndWithoutInitialResponse(t *testing.T) {
+	a := newTestApp(t)
+	for _, withInitialResponse := range []bool{false, true} {
+		t.Run(fmt.Sprintf("initial-response-%t", withInitialResponse), func(t *testing.T) {
+			session := &submissionSession{app: a}
+			if mechanisms := strings.Join(session.AuthMechanisms(), " "); mechanisms != "PLAIN LOGIN" {
+				t.Fatalf("submission auth mechanisms=%q", mechanisms)
+			}
+			server, err := session.Auth(sasl.Login)
+			if err != nil {
+				t.Fatal(err)
+			}
+			var response []byte
+			if withInitialResponse {
+				response = []byte("admin@lanqin.local")
+			}
+			challenge, done, err := server.Next(response)
+			if err != nil || done {
+				t.Fatalf("initial LOGIN response err=%v done=%t", err, done)
+			}
+			if !withInitialResponse {
+				if string(challenge) != "Username:" {
+					t.Fatalf("username challenge=%q", challenge)
+				}
+				challenge, done, err = server.Next([]byte("admin@lanqin.local"))
+				if err != nil || done {
+					t.Fatalf("username response err=%v done=%t", err, done)
+				}
+			}
+			if string(challenge) != "Password:" {
+				t.Fatalf("password challenge=%q", challenge)
+			}
+			challenge, done, err = server.Next([]byte("ChangeMe123!"))
+			if err != nil || !done || challenge != nil {
+				t.Fatalf("password response challenge=%q err=%v done=%t", challenge, err, done)
+			}
+			if session.user == nil || session.mailbox == nil {
+				t.Fatal("LOGIN authentication did not populate submission session")
+			}
+		})
+	}
+}
+
 func TestSubmissionServersAcceptStartTLSAndImplicitTLS(t *testing.T) {
 	a := newTestApp(t)
 	host, port, received := startCapturingSMTP(t, 2)
@@ -4475,7 +4961,7 @@ func TestSubmissionServersAcceptStartTLSAndImplicitTLS(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err := client.Auth(sasl.NewPlainClient("", "admin@lanqin.local", "ChangeMe123!")); err != nil {
+	if err := client.Auth(sasl.NewLoginClient("admin@lanqin.local", "ChangeMe123!")); err != nil {
 		t.Fatal(err)
 	}
 	if err := client.SendMail("admin@lanqin.local", []string{"person@example.com"}, strings.NewReader(raw)); err != nil {
@@ -4760,6 +5246,72 @@ func TestDNSRecords(t *testing.T) {
 	}
 }
 
+func TestDefaultMailLabelsBackfillOrderAndDeletion(t *testing.T) {
+	a := newTestApp(t)
+	var mailboxID string
+	if err := a.db.QueryRow(`SELECT id FROM mailboxes WHERE address='admin@lanqin.local'`).Scan(&mailboxID); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := a.db.Exec(`DELETE FROM system_settings WHERE key='defaultMailLabelsInitialized'`); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := a.db.Exec(`DELETE FROM mail_labels WHERE mailbox_id=?`, mailboxID); err != nil {
+		t.Fatal(err)
+	}
+	if err := a.migrateDefaultMailLabels(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	labels, err := a.labelsForMailbox(context.Background(), mailboxID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defaults := defaultMailLabelDefs()
+	if len(labels) != len(defaults) {
+		t.Fatalf("labels=%+v", labels)
+	}
+	for index, expected := range defaults {
+		if labels[index].Name != expected.name || labels[index].Color != expected.color {
+			t.Fatalf("label %d=%+v want name=%q color=%q", index, labels[index], expected.name, expected.color)
+		}
+	}
+	if _, err := a.db.Exec(`DELETE FROM mail_labels WHERE id=?`, labels[1].ID); err != nil {
+		t.Fatal(err)
+	}
+	if err := a.migrateDefaultMailLabels(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	labels, err = a.labelsForMailbox(context.Background(), mailboxID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(labels) != len(defaults)-1 {
+		t.Fatalf("deleted default label was restored: %+v", labels)
+	}
+}
+
+func TestCheckDKIMRecordRequiresMatchingPublicKey(t *testing.T) {
+	tests := []struct {
+		name    string
+		records []string
+		key     string
+		ok      bool
+		message string
+	}{
+		{name: "matching", records: []string{"v=DKIM1; k=rsa; p=ABC123"}, key: "ABC123", ok: true, message: "DKIM 公钥匹配"},
+		{name: "split whitespace", records: []string{"v=DKIM1; k=rsa; p=ABC 123\n456"}, key: "ABC123456", ok: true, message: "DKIM 公钥匹配"},
+		{name: "wrong key", records: []string{"v=DKIM1; k=rsa; p=WRONG"}, key: "EXPECTED", ok: false, message: "DKIM 公钥与后台生成的记录不一致"},
+		{name: "unrelated TXT", records: []string{"google-site-verification=token"}, key: "EXPECTED", ok: false, message: "未找到 DKIM 记录"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			status := checkDKIMRecord(tt.records, tt.key)
+			if status.OK != tt.ok || status.Message != tt.message {
+				t.Fatalf("status=%+v", status)
+			}
+		})
+	}
+}
+
 func TestFixedRolesProtectAdminRoutesAndDefaultAdmin(t *testing.T) {
 	a := newTestApp(t)
 	ts := httptest.NewServer(a.Router())
@@ -4819,20 +5371,24 @@ func TestFixedRolesProtectAdminRoutesAndDefaultAdmin(t *testing.T) {
 	}, &errBody); code != http.StatusForbidden {
 		t.Fatalf("system permission group update should be forbidden code=%d body=%v", code, errBody)
 	}
-	var regularUpdateErr map[string]any
+	var updatedRegular PermissionGroup
 	if code := admin.do("POST", "/api/admin/permission-groups/"+PermissionGroupRegular, map[string]any{
 		"name":        "Changed Regular",
 		"description": "Should not change",
-		"permissions": []string{PermissionAdminOverview},
-	}, &regularUpdateErr); code != http.StatusForbidden {
-		t.Fatalf("regular system permission group update should be forbidden code=%d body=%v", code, regularUpdateErr)
+		"permissions": regularUserDefaultPermissions(),
+		"limits":      defaultPermissionLimits(),
+	}, &updatedRegular); code != http.StatusOK {
+		t.Fatalf("regular system permission group update code=%d group=%+v", code, updatedRegular)
+	}
+	if updatedRegular.Name != "普通用户" || updatedRegular.Description != "仅可使用自己的邮箱功能，不包含后台权限。" {
+		t.Fatalf("regular system permission group identity changed: %+v", updatedRegular)
 	}
 	regularGroup, err := a.permissionGroupByID(context.Background(), PermissionGroupRegular)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if !regularGroup.System || !userHasPermission(&User{Role: "user", Permissions: regularGroup.Permissions}, PermissionMailAccess) || userHasPermission(&User{Role: "user", Permissions: regularGroup.Permissions}, PermissionAdminOverview) {
-		t.Fatalf("regular group should stay locked with default permissions=%+v", regularGroup)
+		t.Fatalf("regular group should retain the saved default permissions=%+v", regularGroup)
 	}
 	if code := admin.do("DELETE", "/api/admin/permission-groups/"+PermissionGroupSuperAdmin, nil, &errBody); code != http.StatusForbidden {
 		t.Fatalf("system permission group delete should be forbidden code=%d body=%v", code, errBody)
@@ -5981,7 +6537,7 @@ func TestMailboxQuotaRejectsNewMessage(t *testing.T) {
 	ctx := context.Background()
 	user, mb := defaultAdminUserAndMailbox(t, a)
 	clearMailboxMessagesForTest(t, a, mb.ID)
-	if _, err := a.db.ExecContext(ctx, `UPDATE mailboxes SET quota_mb=1 WHERE id=?`, mb.ID); err != nil {
+	if _, err := a.db.ExecContext(ctx, `UPDATE users SET storage_quota_mb=1 WHERE id=?`, user.ID); err != nil {
 		t.Fatal(err)
 	}
 	_, err := a.sendMailNow(ctx, user, mb, mailComposeInput{
@@ -6057,7 +6613,11 @@ func TestMailStatsQuotaAndCleanupIsolation(t *testing.T) {
 	if code := alice.do("GET", "/api/me/stats?mailboxId="+aliceMB.ID+"&days=7", nil, &stats); code != http.StatusOK {
 		t.Fatalf("stats code=%d stats=%+v", code, stats)
 	}
-	if stats.QuotaBytes != int64(aliceMB.QuotaMB)*1024*1024 || stats.AttachmentBytes == 0 || stats.QuotaUsedPct <= 0 {
+	var aliceStorageQuotaMB int64
+	if err := a.db.QueryRowContext(ctx, `SELECT storage_quota_mb FROM users WHERE id=?`, aliceUser.ID).Scan(&aliceStorageQuotaMB); err != nil {
+		t.Fatal(err)
+	}
+	if stats.QuotaBytes != aliceStorageQuotaMB*1024*1024 || stats.AttachmentBytes == 0 || stats.QuotaUsedPct <= 0 {
 		t.Fatalf("stats quota/attachment not populated: %+v", stats)
 	}
 	if stats.TotalIncoming != 1 || stats.TotalOutgoing != 0 || stats.AverageMessageBytes <= 0 {

apps/api/internal/app/auth_handlers.go

@@ -177,8 +177,8 @@ func (a *App) handleRegister(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	defer tx.Rollback()
-	if _, err := tx.ExecContext(r.Context(), `INSERT INTO users(id,login_name,email,display_name,role,password_hash,disabled,created_at,updated_at)
-		VALUES(?,?,?,?,?,?,?,?,?)`, userID, email, email, displayName, "user", string(passwordHash), 0, now, now); err != nil {
+	if _, err := tx.ExecContext(r.Context(), `INSERT INTO users(id,login_name,email,display_name,role,password_hash,disabled,storage_quota_mb,created_at,updated_at)
+		VALUES(?,?,?,?,?,?,?,?,?,?)`, userID, email, email, displayName, "user", string(passwordHash), 0, defaultUserStorageQuotaMB, now, now); err != nil {
 		if strings.Contains(strings.ToLower(err.Error()), "unique") {
 			respondError(w, http.StatusConflict, "该邮箱已被注册")
 			return
@@ -186,7 +186,7 @@ func (a *App) handleRegister(w http.ResponseWriter, r *http.Request) {
 		respondError(w, http.StatusInternalServerError, "注册失败，请稍后重试")
 		return
 	}
-	if _, err := a.createMailboxWithPasswordHashTx(r.Context(), tx, userID, mailboxDomainID, mailboxLocalPart, displayName, string(passwordHash), 1024, "active"); err != nil {
+	if _, err := a.createMailboxWithPasswordHashTx(r.Context(), tx, userID, mailboxDomainID, mailboxLocalPart, displayName, string(passwordHash), defaultUserStorageQuotaMB, "active"); err != nil {
 		if strings.Contains(strings.ToLower(err.Error()), "unique") {
 			respondError(w, http.StatusConflict, "该邮箱已被注册")
 		} else {

apps/api/internal/app/dns_handlers.go

@@ -70,7 +70,7 @@ func (a *App) checkDNS(ctx context.Context, d *Domain) DNSCheckResult {
 
 	dkimName := d.DKIMSelector + "._domainkey." + d.Name
 	dkimTXT, _ := resolver.LookupTXT(ctx, dkimName)
-	checks["dkim"] = txtContains(dkimTXT, "v=DKIM1", "DKIM 记录存在", "未找到 DKIM 记录")
+	checks["dkim"] = checkDKIMRecord(dkimTXT, d.DKIMPublicKey)
 
 	dmarcTXT, _ := resolver.LookupTXT(ctx, "_dmarc."+d.Name)
 	checks["dmarc"] = txtContains(dmarcTXT, "v=DMARC1", "DMARC 记录存在", "未找到 DMARC 记录")
@@ -85,6 +85,42 @@ func (a *App) checkDNS(ctx context.Context, d *Domain) DNSCheckResult {
 	return DNSCheckResult{Domain: d.Name, Status: status, Checks: checks}
 }
 
+func checkDKIMRecord(records []string, expectedPublicKey string) DNSCheckStatus {
+	found := append([]string{}, records...)
+	expectedPublicKey = compactDKIMPublicKey(expectedPublicKey)
+	dkimFound := false
+	for _, record := range records {
+		tags := map[string]string{}
+		for _, part := range strings.Split(record, ";") {
+			key, value, ok := strings.Cut(part, "=")
+			if !ok {
+				continue
+			}
+			tags[strings.ToLower(strings.TrimSpace(key))] = strings.TrimSpace(value)
+		}
+		if !strings.EqualFold(tags["v"], "DKIM1") {
+			continue
+		}
+		dkimFound = true
+		if expectedPublicKey != "" && compactDKIMPublicKey(tags["p"]) == expectedPublicKey {
+			return DNSCheckStatus{OK: true, Message: "DKIM 公钥匹配", Found: found}
+		}
+	}
+	if dkimFound {
+		return DNSCheckStatus{OK: false, Message: "DKIM 公钥与后台生成的记录不一致", Found: found}
+	}
+	return DNSCheckStatus{OK: false, Message: "未找到 DKIM 记录", Found: found}
+}
+
+func compactDKIMPublicKey(value string) string {
+	return strings.Map(func(r rune) rune {
+		if r == ' ' || r == '\t' || r == '\r' || r == '\n' {
+			return -1
+		}
+		return r
+	}, value)
+}
+
 func txtContains(records []string, needle, okMsg, failMsg string) DNSCheckStatus {
 	found := append([]string{}, records...)
 	for _, item := range records {

apps/api/internal/app/forwarding_delivery.go

@@ -138,10 +138,7 @@ func (a *App) inboundForwardingTargets(ctx context.Context, mailboxID string) (t
 	if err != nil {
 		return nil, "", "", err
 	}
-	targets := forwardingTargetsFromStored(mailboxTarget, mailboxTargetsJSON)
-	if len(targets) == 0 {
-		targets = forwardingTargetsFromStored(accountTarget, accountTargetsJSON)
-	}
+	targets := dedupeEmails(append(forwardingTargetsFromStored(accountTarget, accountTargetsJSON), forwardingTargetsFromStored(mailboxTarget, mailboxTargetsJSON)...))
 	if len(targets) == 0 {
 		return nil, userID, mailboxAddress, nil
 	}

apps/api/internal/app/forwarding_handlers.go

@@ -165,7 +165,7 @@ func (a *App) handleVerifyForwardingEmail(w http.ResponseWriter, r *http.Request
 		a.renderForwardingVerificationPage(w, http.StatusInternalServerError, false, email, "验证失败，请稍后重试")
 		return
 	}
-	a.renderForwardingVerificationPage(w, http.StatusOK, true, email, "验证完成，可以回到设置页选择此转发目标")
+	a.renderForwardingVerificationPage(w, http.StatusOK, true, email, "该邮箱已通过转发验证")
 }
 
 func (a *App) handleDeleteForwardingVerifiedEmail(w http.ResponseWriter, r *http.Request) {
@@ -439,14 +439,18 @@ func (a *App) renderForwardingVerificationPage(w http.ResponseWriter, status int
 	title := "邮箱转发验证"
 	heading := "验证失败"
 	color := "#dc2626"
+	statusMark := "!"
+	closingMessage := "请联系验证发起人重新发送链接"
 	if ok {
 		heading = "验证完成"
-		color = "#2563eb"
+		color = "#16a34a"
+		statusMark = "✓"
+		closingMessage = "验证结果已记录，可以关闭此页面"
 	}
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	w.WriteHeader(status)
-	_, _ = fmt.Fprintf(w, `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>%s</title></head><body style="margin:0;background:#f8fafc;color:#0f172a;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Arial,sans-serif"><main style="min-height:100vh;display:grid;place-items:center;padding:24px"><section style="width:min(100%%,520px);background:white;border:1px solid #e2e8f0;border-radius:14px;padding:34px 30px;box-shadow:0 18px 45px rgba(15,23,42,.08)"><h1 style="margin:0 0 14px;font-size:28px">%s</h1><p style="margin:0 0 10px;font-size:17px;color:#475569">%s</p><p style="margin:0 0 26px;font-size:15px;color:#64748b">%s</p><a href="/" style="display:inline-block;border-radius:8px;background:%s;color:white;text-decoration:none;padding:12px 18px;font-weight:700">返回邮箱</a></section></main></body></html>`,
-		title, heading, htmlEscape(message), htmlEscape(email), color)
+	_, _ = fmt.Fprintf(w, `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>%s</title></head><body style="margin:0;background:#f8fafc;color:#0f172a;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Arial,sans-serif"><main style="min-height:100vh;display:grid;place-items:center;padding:24px"><section style="width:min(100%%,520px);background:white;border:1px solid #e2e8f0;border-radius:8px;padding:34px 30px;box-shadow:0 18px 45px rgba(15,23,42,.08)"><div aria-hidden="true" style="display:grid;place-items:center;width:44px;height:44px;margin:0 0 20px;border-radius:50%%;background:%s;color:white;font-size:24px;font-weight:700">%s</div><h1 style="margin:0 0 14px;font-size:28px">%s</h1><p style="margin:0 0 10px;font-size:17px;color:#475569">%s</p><p style="margin:0 0 24px;font-size:15px;color:#64748b;word-break:break-all">%s</p><p style="margin:0;padding-top:20px;border-top:1px solid #e2e8f0;font-size:15px;color:#64748b">%s</p></section></main></body></html>`,
+		title, color, statusMark, heading, htmlEscape(message), htmlEscape(email), htmlEscape(closingMessage))
 }
 
 func (a *App) cleanForwardingVerificationEmail(w http.ResponseWriter, r *http.Request, userID, value string) (string, bool) {

apps/api/internal/app/imap_metadata.go

@@ -76,6 +76,10 @@ func (a *App) migrateFolderSortOrder(ctx context.Context) error {
 	return nil
 }
 
+func (a *App) migrateFolderIcons(ctx context.Context) error {
+	return a.ensureTableColumn(ctx, "folders", "icon", `ALTER TABLE folders ADD COLUMN icon TEXT NOT NULL DEFAULT 'folder'`)
+}
+
 func (a *App) ensureTableColumn(ctx context.Context, table, column, alterSQL string) error {
 	rows, err := a.db.QueryContext(ctx, `PRAGMA table_info(`+table+`)`)
 	if err != nil {

apps/api/internal/app/mail_handlers.go

@@ -1,12 +1,14 @@
 package app
 
 import (
+	"bytes"
 	"context"
 	"database/sql"
 	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"fmt"
+	"image/png"
 	"io"
 	"net/http"
 	"net/textproto"
@@ -85,6 +87,7 @@ func (a *App) handleMyMailboxes(w http.ResponseWriter, r *http.Request) {
 		m.CreatedAt = parseTime(created)
 		items = append(items, m)
 	}
+	markPrimaryMailboxes(items)
 	respondJSON(w, http.StatusOK, map[string]any{"items": items})
 }
 
@@ -98,12 +101,12 @@ func (a *App) handleMailFolders(w http.ResponseWriter, r *http.Request) {
 		respondError(w, http.StatusNotFound, "mailbox not found")
 		return
 	}
-	rows, err := a.db.QueryContext(r.Context(), `SELECT f.id,f.name,f.role,
+	rows, err := a.db.QueryContext(r.Context(), `SELECT f.id,f.name,f.role,f.icon,
 		COALESCE(SUM(CASE WHEN m.is_read=0 THEN 1 ELSE 0 END),0) AS unread,
 		COUNT(m.id) AS total,
 		f.sort_order,f.uid_validity,f.uid_next,f.highest_modseq
 		FROM folders f LEFT JOIN messages m ON m.folder_id=f.id
-		WHERE f.mailbox_id=? GROUP BY f.id,f.name,f.role,f.sort_order,f.uid_validity,f.uid_next,f.highest_modseq
+		WHERE f.mailbox_id=? GROUP BY f.id,f.name,f.role,f.icon,f.sort_order,f.uid_validity,f.uid_next,f.highest_modseq
 		ORDER BY CASE
 			WHEN lower(f.name)='inbox' THEN 1000
 			WHEN lower(f.name)='sent' THEN 5000
@@ -121,7 +124,7 @@ func (a *App) handleMailFolders(w http.ResponseWriter, r *http.Request) {
 	items := []MailFolder{}
 	for rows.Next() {
 		var f MailFolder
-		if err := rows.Scan(&f.ID, &f.Name, &f.Role, &f.UnreadCount, &f.TotalCount, &f.SortOrder, &f.UIDValidity, &f.UIDNext, &f.HighestModSeq); err != nil {
+		if err := rows.Scan(&f.ID, &f.Name, &f.Role, &f.Icon, &f.UnreadCount, &f.TotalCount, &f.SortOrder, &f.UIDValidity, &f.UIDNext, &f.HighestModSeq); err != nil {
 			respondError(w, http.StatusInternalServerError, "failed to scan folders")
 			return
 		}
@@ -132,7 +135,7 @@ func (a *App) handleMailFolders(w http.ResponseWriter, r *http.Request) {
 
 func (a *App) handleAllMailFolders(w http.ResponseWriter, r *http.Request) {
 	user := currentUser(r)
-	rows, err := a.db.QueryContext(r.Context(), `SELECT 'all-' || lower(f.name),f.name,f.role,
+	rows, err := a.db.QueryContext(r.Context(), `SELECT 'all-' || lower(f.name),f.name,f.role,MIN(f.icon),
 		COALESCE(SUM(CASE WHEN m.is_read=0 THEN 1 ELSE 0 END),0) AS unread,
 		COUNT(m.id) AS total,
 		MIN(f.sort_order),MAX(f.uid_validity),MAX(f.uid_next),MAX(f.highest_modseq)
@@ -158,7 +161,7 @@ func (a *App) handleAllMailFolders(w http.ResponseWriter, r *http.Request) {
 	items := []MailFolder{}
 	for rows.Next() {
 		var f MailFolder
-		if err := rows.Scan(&f.ID, &f.Name, &f.Role, &f.UnreadCount, &f.TotalCount, &f.SortOrder, &f.UIDValidity, &f.UIDNext, &f.HighestModSeq); err != nil {
+		if err := rows.Scan(&f.ID, &f.Name, &f.Role, &f.Icon, &f.UnreadCount, &f.TotalCount, &f.SortOrder, &f.UIDValidity, &f.UIDNext, &f.HighestModSeq); err != nil {
 			respondError(w, http.StatusInternalServerError, "failed to scan folders")
 			return
 		}
@@ -266,6 +269,7 @@ func (a *App) handleReorderMailFolders(w http.ResponseWriter, r *http.Request) {
 func (a *App) handleCreateMailFolder(w http.ResponseWriter, r *http.Request) {
 	var req struct {
 		Name string `json:"name"`
+		Icon string `json:"icon"`
 	}
 	if err := decodeJSON(r, &req); err != nil {
 		badRequest(w, err)
@@ -280,6 +284,7 @@ func (a *App) handleCreateMailFolder(w http.ResponseWriter, r *http.Request) {
 		badRequest(w, errors.New("system folder already exists"))
 		return
 	}
+	icon := folderIconForName(name, req.Icon)
 	if isAllMailboxID(r.URL.Query().Get("mailboxId")) {
 		user := currentUser(r)
 		rows, err := a.db.QueryContext(r.Context(), `SELECT id FROM mailboxes WHERE user_id=? AND status='active' ORDER BY created_at,id`, user.ID)
@@ -308,12 +313,12 @@ func (a *App) handleCreateMailFolder(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 		for _, mailboxID := range mailboxIDs {
-			if _, err := a.ensureCustomFolder(r.Context(), mailboxID, name); err != nil {
+			if _, err := a.ensureCustomFolder(r.Context(), mailboxID, name, icon); err != nil {
 				respondError(w, http.StatusInternalServerError, "failed to create folder")
 				return
 			}
 		}
-		respondJSON(w, http.StatusCreated, MailFolder{ID: "all-" + strings.ToLower(name), Name: name, Role: strings.ToLower(name), SortOrder: customFolderDefaultSortOrderBase})
+		respondJSON(w, http.StatusCreated, MailFolder{ID: "all-" + strings.ToLower(name), Name: name, Role: strings.ToLower(name), Icon: icon, SortOrder: customFolderDefaultSortOrderBase})
 		return
 	}
 	mb, err := a.mailboxForCurrentUser(r)
@@ -321,7 +326,7 @@ func (a *App) handleCreateMailFolder(w http.ResponseWriter, r *http.Request) {
 		respondError(w, http.StatusNotFound, "mailbox not found")
 		return
 	}
-	folderID, err := a.ensureCustomFolder(r.Context(), mb.ID, name)
+	folderID, err := a.ensureCustomFolder(r.Context(), mb.ID, name, icon)
 	if err != nil {
 		respondError(w, http.StatusInternalServerError, "failed to create folder")
 		return
@@ -527,8 +532,88 @@ func (a *App) handleDeleteAllMailFolders(w http.ResponseWriter, r *http.Request,
 	respondJSON(w, http.StatusOK, map[string]any{"ok": true, "moved": moved})
 }
 
-func (a *App) ensureCustomFolder(ctx context.Context, mailboxID, name string) (string, error) {
-	return a.ensureFolder(ctx, mailboxID, name)
+func (a *App) ensureCustomFolder(ctx context.Context, mailboxID, name, icon string) (string, error) {
+	var existingID string
+	err := a.db.QueryRowContext(ctx, `SELECT id FROM folders WHERE mailbox_id=? AND lower(name)=lower(?)`, mailboxID, name).Scan(&existingID)
+	if err == nil && (strings.TrimSpace(icon) == "" || strings.EqualFold(strings.TrimSpace(icon), "auto")) {
+		return existingID, nil
+	}
+	if err != nil && !errors.Is(err, sql.ErrNoRows) {
+		return "", err
+	}
+	id, err := a.ensureFolder(ctx, mailboxID, name)
+	if err != nil {
+		return "", err
+	}
+	_, err = a.db.ExecContext(ctx, `UPDATE folders SET icon=? WHERE id=? AND mailbox_id=?`, folderIconForName(name, icon), id, mailboxID)
+	return id, err
+}
+
+func folderIconForName(name, requested string) string {
+	if icon := strings.TrimSpace(requested); icon != "" && !strings.EqualFold(icon, "auto") {
+		return normalizeFolderIcon(icon)
+	}
+	value := strings.ToLower(strings.TrimSpace(name))
+	for _, match := range []struct {
+		icon  string
+		terms []string
+	}{
+		{"netflix", []string{"netflix", "奈飞", "网飞"}},
+		{"chatgpt", []string{"chatgpt", "openai", "gpt"}},
+		{"receipt", []string{"账单", "发票", "收据", "bill", "invoice", "receipt"}},
+		{"shopping", []string{"购物", "订单", "快递", "shop", "order", "delivery"}},
+		{"plane", []string{"旅行", "旅游", "机票", "酒店", "travel", "trip", "flight", "hotel"}},
+		{"graduation", []string{"学习", "教育", "课程", "学校", "study", "school", "course"}},
+		{"users", []string{"联系人", "团队", "用户", "contact", "team", "people"}},
+		{"briefcase", []string{"工作", "项目", "客户", "work", "project", "business", "client"}},
+		{"heart", []string{"收藏", "喜欢", "favorite", "favourite"}},
+		{"star", []string{"重要", "紧急", "important", "urgent"}},
+		{"shield", []string{"安全", "验证", "密码", "登录", "security", "verify", "password", "login"}},
+		{"bell", []string{"提醒", "通知", "remind", "notification"}},
+		{"mail", []string{"邮件", "邮箱", "mail", "email"}},
+	} {
+		for _, term := range match.terms {
+			if folderNameContainsTerm(value, term) {
+				return match.icon
+			}
+		}
+	}
+	return "folder"
+}
+
+func folderNameContainsTerm(value, term string) bool {
+	if term != "gpt" {
+		return strings.Contains(value, term)
+	}
+	for _, token := range strings.FieldsFunc(value, func(r rune) bool {
+		return (r < 'a' || r > 'z') && (r < '0' || r > '9')
+	}) {
+		if token == term {
+			return true
+		}
+	}
+	return false
+}
+
+func normalizeFolderIcon(raw string) string {
+	icon := strings.TrimSpace(raw)
+	const customPrefix = "data:image/png;base64,"
+	if strings.HasPrefix(icon, customPrefix) {
+		data, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(icon, customPrefix))
+		config, configErr := png.DecodeConfig(bytes.NewReader(data))
+		validDimensions := config.Width > 0 && config.Width <= 128 && config.Height > 0 && config.Height <= 128
+		if err == nil && configErr == nil && validDimensions && len(data) <= 32*1024 {
+			return icon
+		}
+		return "folder"
+	}
+	icon = strings.ToLower(icon)
+	switch icon {
+	case "folder", "mail", "briefcase", "users", "receipt", "shopping", "plane", "graduation", "heart", "star", "bell", "shield", "tag", "netflix", "chatgpt":
+		return icon
+	default:
+		return "folder"
+	}
 }
 
 func (a *App) nextCustomFolderSortOrder(ctx context.Context, mailboxID string) (int, error) {
@@ -546,11 +631,12 @@ func (a *App) handleMailMessages(w http.ResponseWriter, r *http.Request) {
 	if isAllMailboxID(r.URL.Query().Get("mailboxId")) {
 		user := currentUser(r)
 		if labelID := strings.TrimSpace(r.URL.Query().Get("labelId")); labelID != "" {
-			if !a.labelBelongsToUser(r.Context(), labelID, user.ID) {
+			labelName, ok := a.labelNameForUser(r.Context(), labelID, user.ID)
+			if !ok {
 				respondError(w, http.StatusNotFound, "label not found")
 				return
 			}
-			a.respondMailMessageList(w, r, `EXISTS (SELECT 1 FROM mailboxes mb WHERE mb.id=m.mailbox_id AND mb.user_id=? AND mb.status='active') AND EXISTS (SELECT 1 FROM message_labels ml WHERE ml.message_id=m.id AND ml.label_id=?)`, []any{user.ID, labelID})
+			a.respondMailMessageList(w, r, `EXISTS (SELECT 1 FROM mailboxes mb WHERE mb.id=m.mailbox_id AND mb.user_id=? AND mb.status='active') AND EXISTS (SELECT 1 FROM message_labels ml JOIN mail_labels l ON l.id=ml.label_id WHERE ml.message_id=m.id AND lower(l.name)=lower(?))`, []any{user.ID, labelName})
 			return
 		}
 		folder := r.URL.Query().Get("folder")
@@ -2231,14 +2317,14 @@ func (a *App) handleBulkMove(w http.ResponseWriter, r *http.Request) {
 }
 
 func (a *App) folderByID(ctx context.Context, folderID, mailboxID string) (*MailFolder, error) {
-	row := a.db.QueryRowContext(ctx, `SELECT f.id,f.name,f.role,
+	row := a.db.QueryRowContext(ctx, `SELECT f.id,f.name,f.role,f.icon,
 		COALESCE(SUM(CASE WHEN m.is_read=0 THEN 1 ELSE 0 END),0) AS unread,
 		COUNT(m.id) AS total,
 		f.sort_order,f.uid_validity,f.uid_next,f.highest_modseq
 		FROM folders f LEFT JOIN messages m ON m.folder_id=f.id
-		WHERE f.id=? AND f.mailbox_id=? GROUP BY f.id,f.name,f.role,f.sort_order,f.uid_validity,f.uid_next,f.highest_modseq`, folderID, mailboxID)
+		WHERE f.id=? AND f.mailbox_id=? GROUP BY f.id,f.name,f.role,f.icon,f.sort_order,f.uid_validity,f.uid_next,f.highest_modseq`, folderID, mailboxID)
 	var f MailFolder
-	if err := row.Scan(&f.ID, &f.Name, &f.Role, &f.UnreadCount, &f.TotalCount, &f.SortOrder, &f.UIDValidity, &f.UIDNext, &f.HighestModSeq); err != nil {
+	if err := row.Scan(&f.ID, &f.Name, &f.Role, &f.Icon, &f.UnreadCount, &f.TotalCount, &f.SortOrder, &f.UIDValidity, &f.UIDNext, &f.HighestModSeq); err != nil {
 		return nil, err
 	}
 	return &f, nil
@@ -2534,14 +2620,15 @@ func (a *App) ensureMailboxQuotaAvailable(ctx context.Context, db dbExecutor, ma
 		return nil
 	}
 	var quotaMB int64
-	if err := rowDB.QueryRowContext(ctx, `SELECT quota_mb FROM mailboxes WHERE id=? AND status='active'`, mailboxID).Scan(&quotaMB); err != nil {
+	var userID string
+	if err := rowDB.QueryRowContext(ctx, `SELECT u.storage_quota_mb,mb.user_id FROM mailboxes mb JOIN users u ON u.id=mb.user_id WHERE mb.id=? AND mb.status='active'`, mailboxID).Scan(&quotaMB, &userID); err != nil {
 		return err
 	}
 	if quotaMB <= 0 {
 		return nil
 	}
 	var used int64
-	if err := rowDB.QueryRowContext(ctx, `SELECT COALESCE(SUM(size_bytes),0) FROM messages WHERE mailbox_id=?`, mailboxID).Scan(&used); err != nil {
+	if err := rowDB.QueryRowContext(ctx, `SELECT COALESCE(SUM(m.size_bytes),0) FROM messages m JOIN mailboxes mb ON mb.id=m.mailbox_id WHERE mb.user_id=?`, userID).Scan(&used); err != nil {
 		return err
 	}
 	quotaBytes := quotaMB * 1024 * 1024
@@ -2605,7 +2692,7 @@ func (a *App) labelsForMailbox(ctx context.Context, mailboxID string) ([]MailLab
 		FROM mail_labels l LEFT JOIN message_labels ml ON ml.label_id=l.id
 		WHERE l.mailbox_id=?
 		GROUP BY l.id,l.mailbox_id,l.name,l.color
-		ORDER BY lower(l.name)`, mailboxID)
+		ORDER BY `+mailLabelOrderSQL("l")+`, lower(l.name)`, mailboxID)
 	if err != nil {
 		return nil, err
 	}
@@ -2622,13 +2709,13 @@ func (a *App) labelsForMailbox(ctx context.Context, mailboxID string) ([]MailLab
 }
 
 func (a *App) labelsForUser(ctx context.Context, userID string) ([]MailLabel, error) {
-	rows, err := a.db.QueryContext(ctx, `SELECT l.id,l.mailbox_id,l.name,l.color,COUNT(ml.message_id)
+	rows, err := a.db.QueryContext(ctx, `SELECT MIN(l.id),'',MIN(l.name),MIN(l.color),COUNT(ml.message_id)
 		FROM mail_labels l
 		JOIN mailboxes mb ON mb.id=l.mailbox_id
 		LEFT JOIN message_labels ml ON ml.label_id=l.id
 		WHERE mb.user_id=? AND mb.status='active'
-		GROUP BY l.id,l.mailbox_id,l.name,l.color
-		ORDER BY lower(l.name)`, userID)
+		GROUP BY lower(l.name)
+		ORDER BY `+mailLabelNameOrderSQL("MIN(l.name)")+`, lower(MIN(l.name))`, userID)
 	if err != nil {
 		return nil, err
 	}
@@ -2648,7 +2735,7 @@ func (a *App) labelsForMessage(ctx context.Context, messageID string) ([]MailLab
 	rows, err := a.db.QueryContext(ctx, `SELECT l.id,l.mailbox_id,l.name,l.color
 		FROM mail_labels l JOIN message_labels ml ON ml.label_id=l.id
 		WHERE ml.message_id=?
-		ORDER BY lower(l.name)`, messageID)
+		ORDER BY `+mailLabelOrderSQL("l")+`, lower(l.name)`, messageID)
 	if err != nil {
 		return nil, err
 	}
@@ -2679,7 +2766,7 @@ func (a *App) attachLabelsToMessages(ctx context.Context, items []MailMessage) e
 	rows, err := a.db.QueryContext(ctx, `SELECT ml.message_id,l.id,l.mailbox_id,l.name,l.color
 		FROM message_labels ml JOIN mail_labels l ON l.id=ml.label_id
 		WHERE ml.message_id IN (`+strings.Join(ids, ",")+`)
-		ORDER BY lower(l.name)`, args...)
+		ORDER BY `+mailLabelOrderSQL("l")+`, lower(l.name)`, args...)
 	if err != nil {
 		return err
 	}
@@ -2697,6 +2784,14 @@ func (a *App) attachLabelsToMessages(ctx context.Context, items []MailMessage) e
 	return rows.Err()
 }
 
+func mailLabelOrderSQL(alias string) string {
+	return mailLabelNameOrderSQL(alias + `.name`)
+}
+
+func mailLabelNameOrderSQL(expression string) string {
+	return `CASE ` + expression + ` WHEN '个人' THEN 10 WHEN '家人' THEN 20 WHEN '朋友' THEN 30 WHEN '工作' THEN 40 WHEN '重要' THEN 50 ELSE 100 END`
+}
+
 func (a *App) ensureLabel(ctx context.Context, mailboxID, name, color string) (MailLabel, error) {
 	name = normalizeLabelName(name)
 	if name == "" {
@@ -2740,6 +2835,14 @@ func (a *App) labelBelongsToUser(ctx context.Context, labelID, userID string) bo
 	return count > 0
 }
 
+func (a *App) labelNameForUser(ctx context.Context, labelID, userID string) (string, bool) {
+	var name string
+	if err := a.db.QueryRowContext(ctx, `SELECT l.name FROM mail_labels l JOIN mailboxes mb ON mb.id=l.mailbox_id WHERE l.id=? AND mb.user_id=? AND mb.status='active'`, labelID, userID).Scan(&name); err != nil {
+		return "", false
+	}
+	return name, true
+}
+
 func normalizeLabelName(name string) string {
 	name = strings.Join(strings.Fields(strings.TrimSpace(name)), " ")
 	if len([]rune(name)) > 32 {

apps/api/internal/app/mail_transfer_handlers.go

@@ -122,8 +122,17 @@ func (a *App) exportMessageIDs(r *http.Request) ([]string, error) {
 			if labelID == "" || !a.labelBelongsToUser(r.Context(), labelID, user.ID) {
 				return nil, sql.ErrNoRows
 			}
-			where = append(where, "EXISTS (SELECT 1 FROM message_labels ml WHERE ml.message_id=m.id AND ml.label_id=?)")
-			args = append(args, labelID)
+			if isAllMailboxID(mailboxID) {
+				labelName, ok := a.labelNameForUser(r.Context(), labelID, user.ID)
+				if !ok {
+					return nil, sql.ErrNoRows
+				}
+				where = append(where, "EXISTS (SELECT 1 FROM message_labels ml JOIN mail_labels l ON l.id=ml.label_id WHERE ml.message_id=m.id AND lower(l.name)=lower(?))")
+				args = append(args, labelName)
+			} else {
+				where = append(where, "EXISTS (SELECT 1 FROM message_labels ml WHERE ml.message_id=m.id AND ml.label_id=?)")
+				args = append(args, labelID)
+			}
 		default:
 			return nil, errors.New("unsupported mail view")
 		}

apps/api/internal/app/mailbox_delete_test.go

@@ -6,7 +6,7 @@ import (
 	"testing"
 )
 
-func TestAdminCanDeleteOwnLastMailboxWithoutDeletingAccount(t *testing.T) {
+func TestAdminCannotDeleteOwnPrimaryMailbox(t *testing.T) {
 	a := newTestApp(t)
 	ts := httptest.NewServer(a.Router())
 	defer ts.Close()
@@ -21,10 +21,13 @@ func TestAdminCanDeleteOwnLastMailboxWithoutDeletingAccount(t *testing.T) {
 	if code := admin.do("GET", "/api/mail/mailboxes", nil, &mailboxes); code != http.StatusOK || len(mailboxes.Items) != 1 {
 		t.Fatalf("mailboxes code=%d items=%d", code, len(mailboxes.Items))
 	}
-	if code := admin.do("DELETE", "/api/admin/mailboxes/"+mailboxes.Items[0].ID, nil, &map[string]any{}); code != http.StatusOK {
-		t.Fatalf("delete final mailbox code=%d", code)
+	if !mailboxes.Items[0].Primary {
+		t.Fatal("administrator mailbox should be marked as primary")
 	}
-	if code := admin.do("GET", "/api/mail/mailboxes", nil, &mailboxes); code != http.StatusOK || len(mailboxes.Items) != 0 {
+	if code := admin.do("DELETE", "/api/admin/mailboxes/"+mailboxes.Items[0].ID, nil, &map[string]any{}); code != http.StatusBadRequest {
+		t.Fatalf("delete primary mailbox code=%d", code)
+	}
+	if code := admin.do("GET", "/api/mail/mailboxes", nil, &mailboxes); code != http.StatusOK || len(mailboxes.Items) != 1 {
 		t.Fatalf("mailboxes after delete code=%d items=%d", code, len(mailboxes.Items))
 	}
 	var me map[string]any

apps/api/internal/app/open_api_handlers.go

@@ -200,6 +200,10 @@ func (a *App) handleOpenAPICreateMailbox(w http.ResponseWriter, r *http.Request)
 		badRequest(w, errors.New("password must be at least 6 characters"))
 		return
 	}
+	if req.QuotaMB < 0 {
+		badRequest(w, errors.New("quotaMb must be zero or greater"))
+		return
+	}
 	domain, err := a.domainByID(r.Context(), req.DomainID)
 	if err != nil {
 		respondError(w, http.StatusNotFound, "domain not found")
@@ -231,7 +235,20 @@ func (a *App) handleOpenAPICreateMailbox(w http.ResponseWriter, r *http.Request)
 		respondMailboxOwnerError(w, err)
 		return
 	}
-	mailboxID, err := a.createMailboxWithPasswordHashTx(r.Context(), tx, userID, req.DomainID, localPart, displayName, string(passwordHash), req.QuotaMB, "active")
+	var ownerPasswordHash, ownerRole string
+	var ownerStorageQuotaMB int
+	if err := tx.QueryRowContext(r.Context(), `SELECT password_hash,role,storage_quota_mb FROM users WHERE id=?`, userID).Scan(&ownerPasswordHash, &ownerRole, &ownerStorageQuotaMB); err != nil {
+		respondError(w, http.StatusInternalServerError, "failed to load owner user")
+		return
+	}
+	quotaMB := req.QuotaMB
+	if quotaMB == 0 {
+		quotaMB = ownerStorageQuotaMB
+	}
+	if ownerRole == "admin" {
+		quotaMB = 0
+	}
+	mailboxID, err := a.createMailboxWithPasswordHashTx(r.Context(), tx, userID, req.DomainID, localPart, displayName, ownerPasswordHash, quotaMB, "active")
 	if err != nil {
 		badRequest(w, err)
 		return
@@ -279,7 +296,11 @@ func (a *App) handleOpenAPIUpdateMailbox(w http.ResponseWriter, r *http.Request)
 		displayName = current.DisplayName
 	}
 	quotaMB := req.QuotaMB
-	if quotaMB <= 0 {
+	if quotaMB < 0 {
+		badRequest(w, errors.New("quotaMb must be zero or greater"))
+		return
+	}
+	if quotaMB == 0 {
 		quotaMB = current.QuotaMB
 	}
 	status := strings.TrimSpace(req.Status)
@@ -294,12 +315,28 @@ func (a *App) handleOpenAPIUpdateMailbox(w http.ResponseWriter, r *http.Request)
 	if userID == "" {
 		userID = current.UserID
 	}
+	if current.Primary && userID != current.UserID {
+		badRequest(w, errors.New("用户默认邮箱归属由所属账号管理，不能单独修改"))
+		return
+	}
+	if current.Primary && status != current.Status {
+		badRequest(w, errors.New("用户默认邮箱状态由所属账号管理，不能单独修改"))
+		return
+	}
 	if err := a.ensureActiveUserExists(r.Context(), userID); err != nil {
 		respondMailboxOwnerError(w, err)
 		return
 	}
-	res, err := a.db.ExecContext(r.Context(), `UPDATE mailboxes SET user_id=?,display_name=?,quota_mb=?,status=?,updated_at=? WHERE id=?`,
-		userID, displayName, quotaMB, status, a.now().UTC().Format(time.RFC3339Nano), id)
+	var ownerRole, ownerPasswordHash string
+	if err := a.db.QueryRowContext(r.Context(), `SELECT role,password_hash FROM users WHERE id=?`, userID).Scan(&ownerRole, &ownerPasswordHash); err != nil {
+		respondError(w, http.StatusInternalServerError, "failed to load owner user")
+		return
+	}
+	if ownerRole == "admin" {
+		quotaMB = 0
+	}
+	res, err := a.db.ExecContext(r.Context(), `UPDATE mailboxes SET user_id=?,display_name=?,password_hash=?,quota_mb=?,status=?,updated_at=? WHERE id=?`,
+		userID, displayName, ownerPasswordHash, quotaMB, status, a.now().UTC().Format(time.RFC3339Nano), id)
 	if err != nil {
 		respondError(w, http.StatusInternalServerError, "failed to update mailbox")
 		return
@@ -318,6 +355,14 @@ func (a *App) handleOpenAPIUpdateMailbox(w http.ResponseWriter, r *http.Request)
 
 func (a *App) handleOpenAPIDeleteMailbox(w http.ResponseWriter, r *http.Request) {
 	id := chi.URLParam(r, "id")
+	if err := a.ensureMailboxDeletable(r.Context(), id); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			respondError(w, http.StatusNotFound, "邮箱不存在或已被删除")
+		} else {
+			badRequest(w, err)
+		}
+		return
+	}
 	rows, err := a.db.QueryContext(r.Context(), `SELECT id FROM messages WHERE mailbox_id=?`, id)
 	if err != nil {
 		respondError(w, http.StatusInternalServerError, "加载邮箱邮件失败")
@@ -821,8 +866,8 @@ func (a *App) resolveMailboxOwnerTx(ctx context.Context, tx *sql.Tx, userID, own
 	if displayName == "" {
 		displayName = email
 	}
-	_, err = tx.ExecContext(ctx, `INSERT INTO users(id,login_name,email,display_name,role,password_hash,disabled,created_at,updated_at)
-		VALUES(?,?,?,?,?,?,?,?,?)`, userID, email, email, displayName, "user", passwordHash, 0, now, now)
+	_, err = tx.ExecContext(ctx, `INSERT INTO users(id,login_name,email,display_name,role,password_hash,disabled,storage_quota_mb,created_at,updated_at)
+		VALUES(?,?,?,?,?,?,?,?,?,?)`, userID, email, email, displayName, "user", passwordHash, 0, defaultUserStorageQuotaMB, now, now)
 	return userID, err
 }
 

apps/api/internal/app/permission_group_handlers.go

@@ -142,11 +142,12 @@ func (a *App) handleCreatePermissionGroup(w http.ResponseWriter, r *http.Request
 func (a *App) handleUpdatePermissionGroup(w http.ResponseWriter, r *http.Request) {
 	id := chi.URLParam(r, "id")
 	var existingSystem int
-	if err := a.db.QueryRowContext(r.Context(), `SELECT system FROM permission_groups WHERE id=?`, id).Scan(&existingSystem); err != nil {
+	var existingName, existingDescription string
+	if err := a.db.QueryRowContext(r.Context(), `SELECT system,name,description FROM permission_groups WHERE id=?`, id).Scan(&existingSystem, &existingName, &existingDescription); err != nil {
 		respondError(w, http.StatusNotFound, "permission group not found")
 		return
 	}
-	if intBool(existingSystem) {
+	if intBool(existingSystem) && id != PermissionGroupRegular {
 		respondError(w, http.StatusForbidden, "system permission groups cannot be edited")
 		return
 	}
@@ -161,6 +162,10 @@ func (a *App) handleUpdatePermissionGroup(w http.ResponseWriter, r *http.Request
 		return
 	}
 	name := strings.TrimSpace(req.Name)
+	if id == PermissionGroupRegular {
+		name = existingName
+		req.Description = existingDescription
+	}
 	if name == "" {
 		badRequest(w, errors.New("name is required"))
 		return

apps/api/internal/app/personal_handlers.go

@@ -111,7 +111,11 @@ func (a *App) handleApplyMailbox(w http.ResponseWriter, r *http.Request) {
 		badRequest(w, errors.New("displayName must be at most 80 characters"))
 		return
 	}
-	mailboxID, err := a.createMailboxWithPasswordHash(r.Context(), user.ID, domainID, localPart, displayName, passwordHash, 1024, "active")
+	quotaMB := defaultUserStorageQuotaMB
+	if user.Role == "admin" {
+		quotaMB = 0
+	}
+	mailboxID, err := a.createMailboxWithPasswordHash(r.Context(), user.ID, domainID, localPart, displayName, passwordHash, quotaMB, "active")
 	if err != nil {
 		if strings.Contains(strings.ToLower(err.Error()), "unique") {
 			respondError(w, http.StatusConflict, "该邮箱地址已被占用")
@@ -534,12 +538,16 @@ func (a *App) handleCreateRule(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	appliedCount := int64(0)
-	if req.ApplyToExisting && enabled {
-		appliedCount, _ = a.applyRuleToExistingMessages(r.Context(), user.ID, mailboxID, MailRule{
+	if req.ApplyToExisting {
+		appliedCount, err = a.applyRuleToExistingMessages(r.Context(), user.ID, mailboxID, MailRule{
 			ID: id, UserID: user.ID, MailboxID: mailboxID, Name: name, MatchMode: matchMode,
 			Conditions: conditions, Actions: actions, ApplyToExisting: req.ApplyToExisting, StopProcessing: req.StopProcessing,
 			FromContains: fromContains, SubjectContains: subjectContains, Action: action, Enabled: enabled,
 		})
+		if err != nil {
+			respondError(w, http.StatusInternalServerError, "rule saved but failed to apply to existing messages")
+			return
+		}
 	}
 	row := a.db.QueryRowContext(r.Context(), `SELECT id,user_id,mailbox_id,name,match_mode,conditions_json,actions_json,from_contains,subject_contains,action,apply_to_existing,stop_processing,enabled,created_at FROM mail_rules WHERE id=?`, id)
 	item, err := scanRule(row)
@@ -896,26 +904,14 @@ func (a *App) handleMailStats(w http.ResponseWriter, r *http.Request) {
 		respondError(w, http.StatusInternalServerError, "failed to load send queue stats")
 		return
 	}
-	if mailboxID != "" && !isAllMailboxID(mailboxID) {
-		var quotaMB int64
-		if err := a.db.QueryRowContext(r.Context(), `SELECT quota_mb FROM mailboxes WHERE id=? AND user_id=?`, mailboxID, user.ID).Scan(&quotaMB); err != nil {
-			respondError(w, http.StatusInternalServerError, "failed to load quota")
-			return
-		}
-		stats.QuotaBytes = quotaMB * 1024 * 1024
-		if stats.QuotaBytes > 0 {
-			stats.QuotaUsedPct = float64(stats.StorageBytes) / float64(stats.QuotaBytes) * 100
-		}
-	} else {
-		var quotaMB int64
-		if err := a.db.QueryRowContext(r.Context(), `SELECT COALESCE(SUM(mb.quota_mb),0) FROM mailboxes mb WHERE `+where, args...).Scan(&quotaMB); err != nil {
-			respondError(w, http.StatusInternalServerError, "failed to load quota")
-			return
-		}
-		stats.QuotaBytes = quotaMB * 1024 * 1024
-		if stats.QuotaBytes > 0 {
-			stats.QuotaUsedPct = float64(stats.StorageBytes) / float64(stats.QuotaBytes) * 100
-		}
+	var quotaMB int64
+	if err := a.db.QueryRowContext(r.Context(), `SELECT storage_quota_mb FROM users WHERE id=?`, user.ID).Scan(&quotaMB); err != nil {
+		respondError(w, http.StatusInternalServerError, "failed to load quota")
+		return
+	}
+	stats.QuotaBytes = quotaMB * 1024 * 1024
+	if stats.QuotaBytes > 0 {
+		stats.QuotaUsedPct = float64(stats.StorageBytes) / float64(stats.QuotaBytes) * 100
 	}
 	rows, err := a.db.QueryContext(r.Context(), `SELECT f.name,f.role,COUNT(m.id),COALESCE(SUM(CASE WHEN m.is_read=0 THEN 1 ELSE 0 END),0),COALESCE(SUM(m.size_bytes),0)
 		FROM mailboxes mb JOIN folders f ON f.mailbox_id=mb.id LEFT JOIN messages m ON m.folder_id=f.id
@@ -1330,7 +1326,9 @@ func (a *App) applyInboundControls(ctx context.Context, messageID, mailboxID, fr
 		if !ruleMatches(rule, msg) {
 			continue
 		}
-		_ = a.applyRuleActions(ctx, mailboxID, messageID, rule.Actions)
+		if err := a.applyRuleActions(ctx, mailboxID, messageID, rule.Actions); err != nil {
+			continue
+		}
 		if rule.StopProcessing {
 			break
 		}
@@ -1375,7 +1373,7 @@ type ruleMessage struct {
 func (a *App) ruleMessageByID(ctx context.Context, messageID string) (ruleMessage, bool) {
 	var msg ruleMessage
 	var toAddrs, ccAddrs, receivedAt string
-	err := a.db.QueryRowContext(ctx, `SELECT id,COALESCE(mailbox_id,''),trim(from_addr || ' ' || COALESCE(from_name,'')),to_addrs,cc_addrs,subject,snippet,body_text,size_bytes,received_at FROM messages WHERE id=?`, messageID).
+	err := a.db.QueryRowContext(ctx, `SELECT id,COALESCE(mailbox_id,''),from_addr,to_addrs,cc_addrs,subject,snippet,body_text,size_bytes,received_at FROM messages WHERE id=?`, messageID).
 		Scan(&msg.ID, &msg.MailboxID, &msg.From, &toAddrs, &ccAddrs, &msg.Subject, &msg.Snippet, &msg.BodyText, &msg.SizeBytes, &receivedAt)
 	if err != nil {
 		return ruleMessage{}, false
@@ -1407,7 +1405,7 @@ func (a *App) ruleAttachmentNames(ctx context.Context, messageID string) string
 		if err := rows.Scan(&filename, &contentType); err != nil {
 			return strings.Join(parts, " ")
 		}
-		parts = append(parts, filename, contentType)
+		parts = append(parts, filename)
 	}
 	return strings.Join(parts, " ")
 }
@@ -1453,15 +1451,23 @@ func normalizeRuleCondition(item MailRuleCondition) (MailRuleCondition, bool) {
 	if operator == "" {
 		operator = "contains"
 	}
-	switch operator {
-	case "contains", "not-contains", "equals", "not-equals", "starts-with", "ends-with":
-	case "gt", "gte", "lt", "lte", "before", "after", "on":
-	default:
+	if !validRuleConditionOperator(field, operator) {
 		return MailRuleCondition{}, false
 	}
 	return MailRuleCondition{Field: field, Operator: operator, Value: value}, true
 }
 
+func validRuleConditionOperator(field, operator string) bool {
+	switch field {
+	case "size":
+		return operator == "gt" || operator == "gte" || operator == "lt" || operator == "lte" || operator == "equals" || operator == "not-equals"
+	case "date":
+		return operator == "before" || operator == "after" || operator == "on" || operator == "equals" || operator == "not-equals"
+	default:
+		return operator == "contains" || operator == "not-contains" || operator == "equals" || operator == "not-equals" || operator == "starts-with" || operator == "ends-with"
+	}
+}
+
 func normalizeRuleMatchMode(matchMode string) string {
 	switch strings.ToLower(strings.TrimSpace(matchMode)) {
 	case "any", "or":
@@ -1710,23 +1716,37 @@ func (a *App) applyRuleActions(ctx context.Context, mailboxID, messageID string,
 	for _, action := range normalizeRuleActions(actions, "") {
 		switch action.Type {
 		case "archive":
-			if folderID, err := a.ensureFolder(ctx, mailboxID, "Archive"); err == nil {
-				if err := a.moveMessageMaildir(ctx, messageID, folderID); err != nil {
-					return err
-				}
+			folderID, err := a.ensureFolder(ctx, mailboxID, "Archive")
+			if err != nil {
+				return err
+			}
+			if err := a.moveMessageMaildir(ctx, messageID, folderID); err != nil {
+				return err
 			}
 		case "trash":
-			if folderID, err := a.ensureFolder(ctx, mailboxID, "Trash"); err == nil {
-				if err := a.moveMessageMaildir(ctx, messageID, folderID); err != nil {
-					return err
-				}
+			folderID, err := a.ensureFolder(ctx, mailboxID, "Trash")
+			if err != nil {
+				return err
+			}
+			if err := a.moveMessageMaildir(ctx, messageID, folderID); err != nil {
+				return err
 			}
 		case "move":
-			target := ruleTargetFolder(action.Value)
-			if folderID, err := a.ensureFolder(ctx, mailboxID, target); err == nil {
-				if err := a.moveMessageMaildir(ctx, messageID, folderID); err != nil {
-					return err
-				}
+			target, err := normalizeFolderNameForUser(action.Value)
+			if err != nil {
+				return err
+			}
+			var folderID string
+			if isSystemFolderName(target) {
+				folderID, err = a.ensureFolder(ctx, mailboxID, target)
+			} else {
+				folderID, err = a.ensureCustomFolder(ctx, mailboxID, target, "auto")
+			}
+			if err != nil {
+				return err
+			}
+			if err := a.moveMessageMaildir(ctx, messageID, folderID); err != nil {
+				return err
 			}
 		case "star":
 			starred := true
@@ -1789,21 +1809,6 @@ func (a *App) applyRuleLabel(ctx context.Context, mailboxID, messageID string, a
 	return err
 }
 
-func ruleTargetFolder(value string) string {
-	switch strings.ToLower(strings.TrimSpace(value)) {
-	case "inbox":
-		return "Inbox"
-	case "archive":
-		return "Archive"
-	case "spam":
-		return "Spam"
-	case "trash":
-		return "Trash"
-	default:
-		return "Archive"
-	}
-}
-
 func (a *App) applyRuleToExistingMessages(ctx context.Context, userID, mailboxID string, rule MailRule) (int64, error) {
 	args := []any{userID}
 	where := `mb.user_id=?`
@@ -1811,7 +1816,7 @@ func (a *App) applyRuleToExistingMessages(ctx context.Context, userID, mailboxID
 		where += ` AND m.mailbox_id=?`
 		args = append(args, mailboxID)
 	}
-	rows, err := a.db.QueryContext(ctx, `SELECT m.id FROM messages m JOIN mailboxes mb ON mb.id=m.mailbox_id WHERE `+where, args...)
+	rows, err := a.db.QueryContext(ctx, `SELECT m.id FROM messages m JOIN mailboxes mb ON mb.id=m.mailbox_id JOIN folders f ON f.id=m.folder_id WHERE `+where+` AND lower(f.name) NOT IN ('sent','drafts')`, args...)
 	if err != nil {
 		return 0, err
 	}

apps/api/internal/app/submission.go

@@ -121,21 +121,59 @@ type submissionSession struct {
 }
 
 func (s *submissionSession) AuthMechanisms() []string {
-	return []string{sasl.Plain}
+	return []string{sasl.Plain, sasl.Login}
 }
 
 func (s *submissionSession) Auth(mech string) (sasl.Server, error) {
-	if !strings.EqualFold(mech, sasl.Plain) {
-		return nil, smtpserver.ErrAuthUnknownMechanism
-	}
-	return sasl.NewPlainServer(func(identity, username, password string) error {
+	authenticate := func(username, password string) error {
 		user, mailbox, err := s.app.authenticateSubmission(context.Background(), username, password)
 		if err != nil {
 			return smtpserver.ErrAuthFailed
 		}
 		s.user, s.mailbox = user, mailbox
 		return nil
-	}), nil
+	}
+	switch {
+	case strings.EqualFold(mech, sasl.Plain):
+		return sasl.NewPlainServer(func(_, username, password string) error {
+			return authenticate(username, password)
+		}), nil
+	case strings.EqualFold(mech, sasl.Login):
+		return &submissionLoginServer{authenticate: authenticate}, nil
+	default:
+		return nil, smtpserver.ErrAuthUnknownMechanism
+	}
+}
+
+type submissionLoginServer struct {
+	authenticate func(username, password string) error
+	username     string
+	step         int
+}
+
+func (s *submissionLoginServer) Next(response []byte) ([]byte, bool, error) {
+	switch s.step {
+	case 0:
+		if response == nil {
+			s.step = 1
+			return []byte("Username:"), false, nil
+		}
+		s.username = string(response)
+		s.step = 2
+		return []byte("Password:"), false, nil
+	case 1:
+		s.username = string(response)
+		s.step = 2
+		return []byte("Password:"), false, nil
+	case 2:
+		if err := s.authenticate(s.username, string(response)); err != nil {
+			return nil, false, err
+		}
+		s.step = 3
+		return nil, true, nil
+	default:
+		return nil, false, sasl.ErrUnexpectedClientResponse
+	}
 }
 
 func (s *submissionSession) Mail(from string, _ *smtpserver.MailOptions) error {

apps/api/internal/app/telegram.go

@@ -473,6 +473,8 @@ func sanitizeTelegramAttachmentName(value string) string {
 var (
 	telegramOTPKeywordRe   = regexp.MustCompile(`(?i)(验证码|校验码|动态码|登录码|安全码|一次性密码|otp|verification[ -]?code|security[ -]?code|login[ -]?code|passcode|one[ -]?time[ -]?(?:password|code))`)
 	telegramOTPCandidateRe = regexp.MustCompile(`(?i)[a-z0-9]{4,10}`)
+	telegramEmailRe        = regexp.MustCompile(`(?i)[a-z0-9._%+\-]+@[a-z0-9.\-]+\.[a-z]{2,}`)
+	telegramURLRe          = regexp.MustCompile(`(?i)https?://[^\s<>"']+`)
 )
 
 func detectTelegramOTP(subject, body string) string {
@@ -488,7 +490,11 @@ func detectTelegramOTP(subject, body string) string {
 	}
 	scores := map[string]candidateScore{}
 	subjectEnd := len(strings.TrimSpace(subject))
+	excludedRanges := append(telegramEmailRe.FindAllStringIndex(text, -1), telegramURLRe.FindAllStringIndex(text, -1)...)
 	for _, match := range telegramOTPCandidateRe.FindAllStringIndex(text, -1) {
+		if telegramRangeOverlaps(match, excludedRanges) {
+			continue
+		}
 		if match[0] > 0 && isTelegramOTPAlphaNumeric(rune(text[match[0]-1])) {
 			continue
 		}
@@ -506,6 +512,9 @@ func detectTelegramOTP(subject, body string) string {
 		if !hasDigit || telegramOTPKeywordRe.MatchString(value) {
 			continue
 		}
+		if isTelegramOTPNonCode(value) {
+			continue
+		}
 		best := 0
 		for _, keyword := range keywords {
 			distance := match[0] - keyword[1]
@@ -557,6 +566,29 @@ func detectTelegramOTP(subject, body string) string {
 	return items[0].value
 }
 
+func telegramRangeOverlaps(candidate []int, ranges [][]int) bool {
+	for _, item := range ranges {
+		if len(item) == 2 && candidate[0] < item[1] && candidate[1] > item[0] {
+			return true
+		}
+	}
+	return false
+}
+
+func isTelegramOTPNonCode(value string) bool {
+	if len(value) == 4 {
+		if year, err := strconv.Atoi(value); err == nil && year >= 1900 && year <= 2099 {
+			return true
+		}
+	}
+	if len(value) == 8 {
+		if _, err := time.Parse("20060102", value); err == nil {
+			return true
+		}
+	}
+	return false
+}
+
 func isTelegramOTPAlphaNumeric(r rune) bool {
 	return r <= unicode.MaxASCII && (unicode.IsLetter(r) || unicode.IsDigit(r))
 }
@@ -723,7 +755,7 @@ func formatTelegramMailMessage(payload telegramMailPayload) telegramFormattedMes
 		}
 		prefix := strings.Join(lines, "\n") + "\n\n<b>" + label + "</b>\n<blockquote>"
 		suffix := "</blockquote>"
-		body = escapeTelegramWithinBudget(body, telegramMessageBudget-utf8.RuneCountInString(prefix)-utf8.RuneCountInString(suffix))
+		body = formatTelegramBodyHTML(body, telegramMessageBudget-utf8.RuneCountInString(prefix)-utf8.RuneCountInString(suffix))
 		lines = []string{prefix + body + suffix}
 	}
 	htmlText := strings.Join(lines, "\n")
@@ -731,6 +763,73 @@ func formatTelegramMailMessage(payload telegramMailPayload) telegramFormattedMes
 	return telegramFormattedMessage{HTML: htmlText, PlainText: plain, OTP: payload.OTP}
 }
 
+func formatTelegramBodyHTML(value string, budget int) string {
+	if budget <= 3 {
+		return ""
+	}
+	var out strings.Builder
+	used := 0
+	truncated := false
+	appendEscaped := func(text string) bool {
+		for _, r := range text {
+			escaped := html.EscapeString(string(r))
+			length := utf8.RuneCountInString(escaped)
+			if used+length > budget-3 {
+				return false
+			}
+			out.WriteString(escaped)
+			used += length
+		}
+		return true
+	}
+	last := 0
+	for _, match := range telegramURLRe.FindAllStringIndex(value, -1) {
+		if !appendEscaped(value[last:match[0]]) {
+			truncated = true
+			break
+		}
+		rawURL, trailing := trimTelegramURL(value[match[0]:match[1]])
+		parsed, err := url.Parse(rawURL)
+		if err != nil || parsed.Host == "" || (parsed.Scheme != "http" && parsed.Scheme != "https") {
+			if !appendEscaped(value[match[0]:match[1]]) {
+				truncated = true
+				break
+			}
+			last = match[1]
+			continue
+		}
+		display := rawURL
+		if utf8.RuneCountInString(display) > 72 {
+			display = "🔗 " + parsed.Hostname() + " 链接"
+		}
+		anchor := `<a href="` + html.EscapeString(rawURL) + `">` + html.EscapeString(display) + `</a>`
+		length := utf8.RuneCountInString(anchor)
+		if used+length > budget-3 {
+			truncated = true
+			break
+		}
+		out.WriteString(anchor)
+		used += length
+		if !appendEscaped(trailing) {
+			truncated = true
+			break
+		}
+		last = match[1]
+	}
+	if !truncated && last < len(value) && !appendEscaped(value[last:]) {
+		truncated = true
+	}
+	if truncated {
+		out.WriteString("...")
+	}
+	return out.String()
+}
+
+func trimTelegramURL(value string) (string, string) {
+	trimmed := strings.TrimRight(value, ".,;:!?)]}，。；：！？）》】")
+	return trimmed, value[len(trimmed):]
+}
+
 func (a *App) sendTelegramMessage(ctx context.Context, token, chatID, text string) error {
 	_, err := a.sendTelegramPayload(ctx, token, map[string]any{
 		"chat_id":                  chatID,

apps/api/internal/app/telegram_test.go

@@ -223,6 +223,55 @@ func TestTelegramOTPDetectionAndMessageBudget(t *testing.T) {
 	}
 }
 
+func TestTelegramIQiyiOTPDetection(t *testing.T) {
+	subject := "825534 是您的动态安全验证码"
+	body := "哈喽 iqiyi02@newszxcn.com 您正在进行爱奇艺账号的安全验证，以下是您的动态验证码：825534 如果这不是您的邮件，请忽略此邮件，请勿回复 手机·电视 其他 APP 在 LG, Samsung 等应用商店搜索 iQiyi 即可获得 Copyright © 2021 iQiyi All Rights Reserved"
+	otp := detectTelegramOTP(subject, body)
+	if otp != "825534" {
+		t.Fatalf("iQiyi OTP not detected: %q", otp)
+	}
+	message := formatTelegramMailMessage(telegramMailPayload{Subject: subject, From: "no_reply_intl@iq.com", Recipient: "iqiyi02@newszxcn.com", ReceivedAt: time.Now().UTC().Format(time.RFC3339Nano), Body: body, OTP: otp})
+	if !strings.Contains(message.HTML, "<code>825534</code>") || telegramCopyMarkup(message.OTP) == nil {
+		t.Fatalf("iQiyi OTP section or copy button missing: %+v", message)
+	}
+}
+
+func TestTelegramForwardedGateOTPAndLinks(t *testing.T) {
+	body := `---------- Forwarded message ---------
+Date: 2026年8月6日周四 17:59
+Subject: 登录验证码 (https://www.gate.com)
+
+Gate 检测到您的账号正试图从此 IP 获得登录验证码：
+IP: 87.83.105.229
+如为您本人登录，请输入如下验证码完成操作：
+311665
+如非本人操作，请点击此处禁用账户 <https://data.gate.com/track/click?token=abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789>`
+	if otp := detectTelegramOTP("Fwd: 登录验证码 (https://www.gate.com)", body); otp != "311665" {
+		t.Fatalf("forwarded Gate OTP not detected: %q", otp)
+	}
+	if otp := detectTelegramOTP("登录验证码", "日期 2026-08-06，验证码将在稍后发送"); otp != "" {
+		t.Fatalf("year was incorrectly detected as OTP: %q", otp)
+	}
+	message := formatTelegramMailMessage(telegramMailPayload{
+		From: "no-reply@alert.gate.com", Recipient: "admin@example.com", Subject: "登录验证码",
+		ReceivedAt: time.Now().UTC().Format(time.RFC3339Nano), Body: body, BodyMode: "full", OTP: "311665",
+	})
+	if !strings.Contains(message.HTML, `<a href="https://www.gate.com">https://www.gate.com</a>`) {
+		t.Fatalf("normal URL was not linkified: %s", message.HTML)
+	}
+	if !strings.Contains(message.HTML, `>🔗 data.gate.com 链接</a>`) {
+		t.Fatalf("long tracking URL was not shortened: %s", message.HTML)
+	}
+	if strings.Contains(message.HTML, "&lt;a href=") || utf8.RuneCountInString(message.HTML) > telegramMessageBudget {
+		t.Fatalf("generated Telegram HTML is invalid or too long: %s", message.HTML)
+	}
+	markup := telegramCopyMarkup(message.OTP)
+	buttons, ok := markup["inline_keyboard"].([][]map[string]any)
+	if !ok || len(buttons) != 1 || len(buttons[0]) != 1 || buttons[0][0]["text"] != "复制验证码" {
+		t.Fatalf("copy OTP button missing: %#v", markup)
+	}
+}
+
 func TestTelegramPseudoHTMLAndBodyCharset(t *testing.T) {
 	pseudo := `<html><head><style>.hidden{display:none}</style></head><body><p>验证码：778899</p><div>欢迎登录</div></body></html>`
 	text := telegramMessageBody(storedMessage{BodyText: pseudo})

apps/api/internal/app/types.go

@@ -21,8 +21,9 @@ type User struct {
 
 type AdminUser struct {
 	User
-	MailboxCount int      `json:"mailboxCount"`
-	Mailboxes    []string `json:"mailboxes"`
+	MailboxCount   int      `json:"mailboxCount"`
+	Mailboxes      []string `json:"mailboxes"`
+	StorageQuotaMB int      `json:"storageQuotaMb"`
 }
 
 type APIToken struct {
@@ -71,6 +72,7 @@ type Mailbox struct {
 	DisplayName string    `json:"displayName"`
 	QuotaMB     int       `json:"quotaMb"`
 	Status      string    `json:"status"`
+	Primary     bool      `json:"primary"`
 	UnreadCount int       `json:"unreadCount"`
 	CreatedAt   time.Time `json:"createdAt"`
 }
@@ -88,6 +90,7 @@ type MailFolder struct {
 	ID            string `json:"id"`
 	Name          string `json:"name"`
 	Role          string `json:"role"`
+	Icon          string `json:"icon"`
 	SortOrder     int    `json:"sortOrder"`
 	UnreadCount   int    `json:"unreadCount"`
 	TotalCount    int    `json:"totalCount"`

apps/web/package.json

@@ -36,7 +36,7 @@
     "@tiptap/starter-kit": "^3.27.0",
     "class-variance-authority": "^0.7.0",
     "clsx": "2.1.1",
-    "dompurify": "3.4.12",
+    "dompurify": "3.4.13",
     "lucide-react": "^0.468.0",
     "qrcode.react": "^4.2.0",
     "react": "18.3.1",

apps/web/src/components/auth-guard.tsx

@@ -1,15 +1,19 @@
 import React from "react"
 import { Navigate, useLocation } from "react-router-dom"
-import { useMe, isTimeoutError } from "@/hooks/use-me"
+import { useMe } from "@/hooks/use-me"
 import { AuthLoading, AuthError } from "@/components/auth-states"
+import { isUnauthorizedError } from "@/lib/api"
 
 export function AuthGuard({ children }: { children: React.ReactNode }) {
   const me = useMe()
   const location = useLocation()
 
   if (me.isLoading) return <AuthLoading />
-  if (me.isError && isTimeoutError(me.error)) return <AuthError message={me.error.message} onRetry={() => me.refetch()} />
-  if (me.isError || !me.data?.user) return <Navigate to="/login" replace state={{ from: location.pathname }} />
+  if (me.isError && !isUnauthorizedError(me.error)) return <AuthError message={me.error.message} onRetry={() => me.refetch()} />
+  if (me.isError || !me.data?.user) {
+    const from = `${location.pathname}${location.search}${location.hash}`
+    return <Navigate to="/login" replace state={{ from }} />
+  }
 
   return <>{children}</>
 }

apps/web/src/components/auth-states.tsx

@@ -1,17 +1,17 @@
 import { Button } from "@/components/ui/button"
 
 export function AuthLoading() {
-  return <div className="grid min-h-screen place-items-center text-muted-foreground">加载中...</div>
+  return <main className="grid min-h-screen place-items-center text-muted-foreground">加载中...</main>
 }
 
 export function AuthError({ message, onRetry }: { message: string; onRetry: () => void }) {
   return (
-    <div className="grid min-h-screen place-items-center bg-background px-4">
+    <main className="grid min-h-screen place-items-center bg-background px-4">
       <div className="w-full max-w-sm space-y-4 text-center">
-        <div className="text-sm font-medium">无法连接后端服务</div>
+        <div className="text-sm font-medium">服务暂时不可用</div>
         <div className="text-sm text-muted-foreground">{message}</div>
-        <Button type="button" variant="outline" onClick={onRetry}>重新加载</Button>
+        <Button type="button" variant="outline" onClick={onRetry}>重新连接</Button>
       </div>
-    </div>
+    </main>
   )
 }

apps/web/src/components/confirm-dialog.tsx

@@ -26,12 +26,12 @@ export function ConfirmDialog({
 }: ConfirmDialogProps) {
   return (
     <Dialog open={open} onOpenChange={onOpenChange}>
-      <DialogContent>
+      <DialogContent className="w-[calc(100vw-2rem)] max-w-lg rounded-lg">
         <DialogHeader>
           <DialogTitle>{title}</DialogTitle>
         </DialogHeader>
         {description && <div className="text-sm text-muted-foreground">{description}</div>}
-        <DialogFooter>
+        <DialogFooter className="gap-2 [&>button]:min-h-11 sm:[&>button]:min-h-9">
           <Button type="button" variant="outline" onClick={() => onOpenChange(false)} disabled={pending}>
             {cancelText}
           </Button>

apps/web/src/components/protected-layout.tsx

@@ -5,7 +5,6 @@ import { useMe } from "@/hooks/use-me"
 import { useLogout } from "@/hooks/use-logout"
 import { AuthGuard } from "@/components/auth-guard"
 import { Button } from "@/components/ui/button"
-import { Badge } from "@/components/ui/badge"
 import { Avatar, AvatarFallback } from "@/components/ui/avatar"
 import { SystemVersionDialog } from "@/components/system-version-dialog"
 import { hasAnyPermission } from "@/lib/permissions"
@@ -110,9 +109,6 @@ function ProtectedContent() {
                     <span className="truncate font-semibold">{user.displayName}</span>
                     <span className="truncate text-xs text-muted-foreground">{user.email}</span>
                   </div>
-                  <Badge variant={user.role === "admin" ? "default" : "secondary"} className="ml-auto text-[10px]">
-                    {user.role === "admin" ? "管理员" : "普通用户"}
-                  </Badge>
                 </Link>
               </SidebarMenuButton>
             </SidebarMenuItem>

apps/web/src/components/ui/button.tsx

@@ -5,18 +5,18 @@ import { cva, type VariantProps } from "class-variance-authority"
 import { cn } from "@/lib/utils"
 
 const buttonVariants = cva(
-  "inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:size-4 [&_svg]:shrink-0",
+  "inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:ring-offset-background disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:size-4 [&_svg]:shrink-0",
   {
     variants: {
       variant: {
         default:
-          "bg-primary text-primary-foreground shadow hover:bg-primary/90",
+          "bg-primary text-primary-foreground hover:bg-primary/90",
         destructive:
-          "bg-destructive text-destructive-foreground shadow-sm hover:bg-destructive/90",
+          "bg-destructive text-destructive-foreground hover:bg-destructive/90",
         outline:
-          "border border-input bg-background shadow-sm hover:bg-accent hover:text-accent-foreground",
+          "border border-input bg-background hover:bg-accent hover:text-accent-foreground",
         secondary:
-          "bg-secondary text-secondary-foreground shadow-sm hover:bg-secondary/80",
+          "bg-secondary text-secondary-foreground hover:bg-secondary/80",
         ghost: "hover:bg-accent hover:text-accent-foreground",
         link: "text-primary underline-offset-4 hover:underline",
       },

apps/web/src/components/ui/card.tsx

@@ -8,8 +8,9 @@ const Card = React.forwardRef<
 >(({ className, ...props }, ref) => (
   <div
     ref={ref}
+    data-slot="card"
     className={cn(
-      "rounded-xl border bg-card text-card-foreground shadow",
+      "rounded-lg border bg-card text-card-foreground shadow-sm",
       className
     )}
     {...props}
@@ -23,6 +24,7 @@ const CardHeader = React.forwardRef<
 >(({ className, ...props }, ref) => (
   <div
     ref={ref}
+    data-slot="card-header"
     className={cn("flex flex-col space-y-1.5 p-6", className)}
     {...props}
   />
@@ -35,6 +37,7 @@ const CardTitle = React.forwardRef<
 >(({ className, ...props }, ref) => (
   <div
     ref={ref}
+    data-slot="card-title"
     className={cn("font-semibold leading-none tracking-tight", className)}
     {...props}
   />
@@ -57,7 +60,7 @@ const CardContent = React.forwardRef<
   HTMLDivElement,
   React.HTMLAttributes<HTMLDivElement>
 >(({ className, ...props }, ref) => (
-  <div ref={ref} className={cn("p-6 pt-0", className)} {...props} />
+  <div ref={ref} data-slot="card-content" className={cn("p-6 pt-0", className)} {...props} />
 ))
 CardContent.displayName = "CardContent"
 

apps/web/src/components/ui/dialog.tsx

@@ -19,7 +19,7 @@ const DialogOverlay = React.forwardRef<
   <DialogPrimitive.Overlay
     ref={ref}
     className={cn(
-      "fixed inset-0 z-50 bg-black/80  data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0",
+      "fixed inset-0 z-50 bg-black/35 data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 sm:bg-black/45",
       className
     )}
     {...props}

apps/web/src/components/ui/input.tsx

@@ -8,7 +8,7 @@ const Input = React.forwardRef<HTMLInputElement, React.ComponentProps<"input">>(
       <input
         type={type}
         className={cn(
-          "flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors file:border-0 file:bg-transparent file:text-sm file:font-medium file:text-foreground placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm",
+          "flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors file:border-0 file:bg-transparent file:text-sm file:font-medium file:text-foreground placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:ring-offset-background disabled:cursor-not-allowed disabled:opacity-50 md:text-sm",
           className
         )}
         ref={ref}

apps/web/src/components/ui/select.tsx

@@ -17,7 +17,7 @@ const SelectTrigger = React.forwardRef<
   <SelectPrimitive.Trigger
     ref={ref}
     className={cn(
-      "flex h-9 w-full items-center justify-between whitespace-nowrap rounded-md border border-input bg-transparent px-3 py-2 text-sm shadow-sm ring-offset-background data-[placeholder]:text-muted-foreground focus:outline-none focus:ring-1 focus:ring-ring disabled:cursor-not-allowed disabled:opacity-50 [&>span]:line-clamp-1",
+      "flex h-9 w-full items-center justify-between whitespace-nowrap rounded-md border border-input bg-transparent px-3 py-2 text-sm shadow-sm ring-offset-background data-[placeholder]:text-muted-foreground focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50 [&>span]:line-clamp-1",
       className
     )}
     {...props}

apps/web/src/components/ui/table.tsx

@@ -20,7 +20,7 @@ const TableHeader = React.forwardRef<
   HTMLTableSectionElement,
   React.HTMLAttributes<HTMLTableSectionElement>
 >(({ className, ...props }, ref) => (
-  <thead ref={ref} className={cn("[&_tr]:border-b", className)} {...props} />
+  <thead ref={ref} data-slot="table-header" className={cn("[&_tr]:border-b", className)} {...props} />
 ))
 TableHeader.displayName = "TableHeader"
 
@@ -57,6 +57,7 @@ const TableRow = React.forwardRef<
 >(({ className, ...props }, ref) => (
   <tr
     ref={ref}
+    data-slot="table-row"
     className={cn(
       "border-b transition-colors hover:bg-muted/50 data-[state=selected]:bg-muted",
       className
@@ -72,6 +73,7 @@ const TableHead = React.forwardRef<
 >(({ className, ...props }, ref) => (
   <th
     ref={ref}
+    data-slot="table-head"
     className={cn(
       "h-10 px-2 text-left align-middle font-medium text-muted-foreground [&:has([role=checkbox])]:pr-0 [&>[role=checkbox]]:translate-y-[2px]",
       className
@@ -87,6 +89,7 @@ const TableCell = React.forwardRef<
 >(({ className, ...props }, ref) => (
   <td
     ref={ref}
+    data-slot="table-cell"
     className={cn(
       "p-2 align-middle [&:has([role=checkbox])]:pr-0 [&>[role=checkbox]]:translate-y-[2px]",
       className

apps/web/src/components/ui/textarea.tsx

@@ -9,7 +9,7 @@ const Textarea = React.forwardRef<
   return (
     <textarea
       className={cn(
-        "flex min-h-[60px] w-full rounded-md border border-input bg-transparent px-3 py-2 text-base shadow-sm placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm",
+        "flex min-h-[60px] w-full rounded-md border border-input bg-transparent px-3 py-2 text-base shadow-sm placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:ring-offset-background disabled:cursor-not-allowed disabled:opacity-50 md:text-sm",
         className
       )}
       ref={ref}

apps/web/src/hooks/use-me.ts

@@ -1,5 +1,5 @@
 import { useQuery, type UseQueryOptions } from "@tanstack/react-query"
-import { api } from "@/lib/api"
+import { api, isUnauthorizedError } from "@/lib/api"
 import type { User } from "@/lib/api"
 
 type MeResponse = { user: User }
@@ -10,11 +10,7 @@ export function useMe(
   return useQuery({
     queryKey: ["me"],
     queryFn: api.me,
-    retry: 1,
+    retry: (failureCount, error) => !isUnauthorizedError(error) && failureCount < 1,
     ...options,
   })
 }
-
-export function isTimeoutError(error: unknown): boolean {
-  return error instanceof Error && error.message.includes("请求超时")
-}

apps/web/src/index.css

@@ -5,34 +5,34 @@
 @layer base {
   :root {
     --background: 0 0% 100%;
-    --foreground: 222.2 84% 4.9%;
+    --foreground: 0 0% 9%;
     --card: 0 0% 100%;
-    --card-foreground: 222.2 84% 4.9%;
+    --card-foreground: 0 0% 9%;
     --popover: 0 0% 100%;
-    --popover-foreground: 222.2 84% 4.9%;
-    --primary: 224 44% 12%;
+    --popover-foreground: 0 0% 9%;
+    --primary: 0 0% 12%;
     --primary-foreground: 0 0% 98%;
-    --secondary: 210 40% 96.1%;
-    --secondary-foreground: 222.2 84% 4.9%;
-    --muted: 210 40% 96.1%;
-    --muted-foreground: 215.4 16.3% 46.9%;
-    --accent: 210 40% 96.1%;
-    --accent-foreground: 222.2 84% 4.9%;
+    --secondary: 0 0% 96.1%;
+    --secondary-foreground: 0 0% 12%;
+    --muted: 0 0% 96.1%;
+    --muted-foreground: 0 0% 42%;
+    --accent: 0 0% 95%;
+    --accent-foreground: 0 0% 12%;
     --destructive: 358 88% 61%;
     --destructive-foreground: 0 0% 98%;
-    --border: 214.3 31.8% 91.4%;
-    --input: 214.3 31.8% 91.4%;
-    --ring: 216 22% 42%;
+    --border: 0 0% 89.8%;
+    --input: 0 0% 82%;
+    --ring: 0 0% 32%;
     --radius: 0.5rem;
     --app-sidebar-width: 18rem;
     --sidebar-background: 0 0% 100%;
-    --sidebar-foreground: 222.2 84% 4.9%;
-    --sidebar-primary: 224 44% 12%;
+    --sidebar-foreground: 0 0% 16%;
+    --sidebar-primary: 0 0% 12%;
     --sidebar-primary-foreground: 0 0% 98%;
-    --sidebar-accent: 210 40% 96.1%;
-    --sidebar-accent-foreground: 222.2 84% 4.9%;
-    --sidebar-border: 214.3 31.8% 91.4%;
-    --sidebar-ring: 215.4 16.3% 46.9%;
+    --sidebar-accent: 0 0% 95%;
+    --sidebar-accent-foreground: 0 0% 12%;
+    --sidebar-border: 0 0% 89.8%;
+    --sidebar-ring: 0 0% 42%;
   }
 
   * { @apply border-border; }
@@ -140,12 +140,50 @@
   }
 
   [data-sidebar="menu-button"][data-active="true"] {
-    background: hsl(var(--sidebar-accent));
+    background: hsl(var(--sidebar-accent) / 0.82);
     color: hsl(var(--sidebar-accent-foreground));
+    box-shadow: inset 2px 0 0 hsl(var(--foreground));
   }
 
   [data-sidebar="menu-button"][data-active="true"] svg {
-    color: hsl(var(--muted-foreground));
+    color: hsl(var(--foreground));
+  }
+
+  .admin-page [data-slot="card"] {
+    border-radius: 0.5rem;
+    box-shadow: none;
+  }
+
+  .admin-page [data-slot="card-header"] {
+    padding: 1.25rem;
+  }
+
+  .admin-page [data-slot="card-content"] {
+    padding: 0 1.25rem 1.25rem;
+  }
+
+  .admin-page [data-slot="card-title"] {
+    font-size: 0.9375rem;
+    line-height: 1.4;
+  }
+
+  .admin-page [data-slot="table-header"] {
+    background: hsl(var(--muted) / 0.48);
+  }
+
+  .admin-page [data-slot="table-head"] {
+    height: 2.5rem;
+    padding-left: 0.75rem;
+    padding-right: 0.75rem;
+    font-size: 0.75rem;
+  }
+
+  .admin-page [data-slot="table-cell"] {
+    padding: 0.75rem;
+  }
+
+  .admin-page [data-slot="table-row"]:hover {
+    background: hsl(var(--muted) / 0.32);
   }
 }
 

apps/web/src/lib/api-types.ts

@@ -52,12 +52,12 @@ export type PermissionGroupSummary = { id: string; name: string }
 export type PermissionGroup = { id: string; name: string; description: string; permissions: PermissionKey[]; limits: PermissionLimits; system: boolean; userCount: number; createdAt: string; updatedAt: string }
 export type User = { id: string; loginName?: string; email: string; displayName: string; role: "admin" | "user"; disabled: boolean; protected: boolean; twoFactorEnabled: boolean; mailboxLimitOverride?: number | null; permissions: PermissionKey[]; limits: PermissionLimits; permissionGroupIds: string[]; permissionGroups: PermissionGroupSummary[]; createdAt: string }
 export type APIToken = { id: string; name: string; lastUsedAt?: string; expiresAt?: string; disabled: boolean; scopes: string[]; createdAt: string; updatedAt: string }
-export type AdminUser = User & { mailboxCount: number; mailboxes?: string[] }
+export type AdminUser = User & { mailboxCount: number; mailboxes?: string[]; storageQuotaMb: number }
 export type AdminOverview = { users: number; activeUsers: number; domains: number; mailboxes: number; activeMailboxes: number; aliases: number; messages: number; unreadMessages: number; storageBytes: number }
 export type Domain = { id: string; name: string; status: string; dkimSelector: string; dkimPublicKey?: string; dnsStatus: string; dnsCheckedAt?: string; createdAt: string }
-export type Mailbox = { id: string; userId: string; userEmail?: string; domainId: string; localPart: string; address: string; displayName: string; quotaMb: number; status: string; unreadCount?: number; createdAt: string }
+export type Mailbox = { id: string; userId: string; userEmail?: string; domainId: string; localPart: string; address: string; displayName: string; quotaMb: number; status: string; primary?: boolean; unreadCount?: number; createdAt: string }
 export type Alias = { id: string; domainId: string; source: string; destination: string; enabled: boolean; createdAt: string }
-export type MailFolder = { id: string; name: string; role: string; sortOrder: number; unreadCount: number; totalCount: number; uidValidity: number; uidNext: number; highestModseq: number }
+export type MailFolder = { id: string; name: string; role: string; icon: string; sortOrder: number; unreadCount: number; totalCount: number; uidValidity: number; uidNext: number; highestModseq: number }
 export type Attachment = { id: string; messageId: string; filename: string; contentType: string; sizeBytes: number; createdAt: string }
 export type MailLabel = { id: string; mailboxId?: string; name: string; color: string; messageCount?: number }
 export type MailMessage = {

apps/web/src/lib/api.ts

@@ -4,6 +4,17 @@ export * from "./api-types"
 const REQUEST_TIMEOUT_MS = 15_000
 const MAIL_DELIVERY_TIMEOUT_MS = 60_000
 
+export class ApiError extends Error {
+  constructor(message: string, readonly status: number) {
+    super(message)
+    this.name = "ApiError"
+  }
+}
+
+export function isUnauthorizedError(error: unknown): boolean {
+  return error instanceof ApiError && error.status === 401
+}
+
 export type MailSearchParams = {
   q?: string
   from?: string
@@ -45,27 +56,34 @@ function appendMailSearchParams(params: URLSearchParams, search: MailSearchParam
 async function request<T>(path: string, init: RequestInit & { timeoutMs?: number } = {}): Promise<T> {
   const { timeoutMs, ...requestInit } = init
   const controller = new AbortController()
-  const timeout = window.setTimeout(() => controller.abort(), timeoutMs || REQUEST_TIMEOUT_MS)
+  let timedOut = false
+  const timeout = window.setTimeout(() => {
+    timedOut = true
+    controller.abort()
+  }, timeoutMs || REQUEST_TIMEOUT_MS)
   const externalSignal = requestInit.signal
+  const abortFromExternalSignal = () => controller.abort()
   if (externalSignal) {
     if (externalSignal.aborted) controller.abort()
-    else externalSignal.addEventListener("abort", () => controller.abort(), { once: true })
+    else externalSignal.addEventListener("abort", abortFromExternalSignal, { once: true })
   }
   try {
     const res = await fetch(path, { credentials: "include", headers: { "Content-Type": "application/json", ...(requestInit.headers || {}) }, ...requestInit, signal: controller.signal })
     if (!res.ok) {
       let message = `${res.status} ${res.statusText}`
       try { const body = await res.json(); message = body.error || message } catch {}
-      throw new Error(message)
+      throw new ApiError(message, res.status)
     }
     return res.json() as Promise<T>
   } catch (error) {
     if (error instanceof DOMException && error.name === "AbortError") {
-      throw new Error("请求超时，请检查后端服务是否正常")
+      throw new Error(timedOut ? "请求超时，请检查后端服务是否正常" : "请求已取消")
     }
+    if (error instanceof TypeError) throw new Error("无法连接后端服务，请检查服务状态")
     throw error instanceof Error ? error : new Error("网络请求失败")
   } finally {
     window.clearTimeout(timeout)
+    externalSignal?.removeEventListener("abort", abortFromExternalSignal)
   }
 }
 
@@ -154,8 +172,8 @@ export const api = {
   updatePermissionGroup: (id: string, payload: { name: string; description: string; permissions: PermissionKey[]; limits: PermissionLimits }) => request<PermissionGroup>(`/api/admin/permission-groups/${id}`, { method: "POST", body: JSON.stringify(payload) }),
   defaultPermissionLimits: () => request<PermissionLimits>("/api/admin/permission-limits/defaults"),
   deletePermissionGroup: (id: string) => request<{ ok: boolean }>(`/api/admin/permission-groups/${id}`, { method: "DELETE" }),
-  createUser: (payload: { email: string; displayName: string; role: "user"; password: string; disabled: boolean; mailboxLimitOverride?: number }) => request<AdminUser>("/api/admin/users", { method: "POST", body: JSON.stringify(payload) }),
-  updateUser: (id: string, payload: { email?: string; displayName: string; role: "admin" | "user"; disabled: boolean; mailboxLimitOverride?: number; permissionGroupIds?: string[] }) => request<AdminUser>(`/api/admin/users/${id}`, { method: "POST", body: JSON.stringify(payload) }),
+  createUser: (payload: { email: string; displayName: string; role: "user"; password: string; disabled: boolean; mailboxLimitOverride?: number; storageQuotaMb?: number; permissionGroupIds?: string[] }) => request<AdminUser>("/api/admin/users", { method: "POST", body: JSON.stringify(payload) }),
+  updateUser: (id: string, payload: { email?: string; displayName: string; role: "admin" | "user"; disabled: boolean; mailboxLimitOverride?: number; storageQuotaMb?: number; permissionGroupIds?: string[] }) => request<AdminUser>(`/api/admin/users/${id}`, { method: "POST", body: JSON.stringify(payload) }),
   resetUserPassword: (id: string, password: string) => request<{ ok: boolean }>(`/api/admin/users/${id}/password`, { method: "POST", body: JSON.stringify({ password }) }),
   deleteUser: (id: string) => request<{ ok: boolean }>(`/api/admin/users/${id}`, { method: "DELETE" }),
   domains: () => request<ListResponse<Domain>>("/api/admin/domains"),
@@ -163,7 +181,7 @@ export const api = {
   updateDomain: (id: string, payload: { status: string }) => request<Domain>(`/api/admin/domains/${id}`, { method: "POST", body: JSON.stringify(payload) }),
   deleteDomain: (id: string) => request<{ ok: boolean }>(`/api/admin/domains/${id}`, { method: "DELETE" }),
   mailboxes: () => request<ListResponse<Mailbox>>("/api/admin/mailboxes"),
-  createMailbox: (payload: { domainId: string; localPart: string; displayName: string; password: string; quotaMb: number; role: "user"; ownerEmail?: string; userId?: string }) => request<Mailbox>("/api/admin/mailboxes", { method: "POST", body: JSON.stringify(payload) }),
+  createMailbox: (payload: { domainId: string; localPart: string; displayName?: string; userId: string }) => request<Mailbox>("/api/admin/mailboxes", { method: "POST", body: JSON.stringify(payload) }),
   updateMailbox: (id: string, payload: { userId: string; displayName: string; quotaMb: number; status: string }) => request<Mailbox>(`/api/admin/mailboxes/${id}`, { method: "POST", body: JSON.stringify(payload) }),
   deleteMailbox: (id: string) => request<{ ok: boolean }>(`/api/admin/mailboxes/${id}`, { method: "DELETE" }),
   aliases: () => request<ListResponse<Alias>>("/api/admin/aliases"),
@@ -215,9 +233,9 @@ export const api = {
   externalMessage: (id: string, remoteId: string) => request<MailMessage>(`/api/mail/external-accounts/${id}/messages/${encodeURIComponent(remoteId)}`),
   markExternalRead: (id: string, remoteId: string, read: boolean) => request<{ ok: boolean }>(`/api/mail/external-accounts/${id}/messages/${encodeURIComponent(remoteId)}/mark-read`, { method: "POST", body: JSON.stringify({ read }) }),
   folders: (mailboxId?: string) => request<ListResponse<MailFolder>>(`/api/mail/folders${mailboxId ? `?mailboxId=${encodeURIComponent(mailboxId)}` : ""}`),
-  createFolder: (payload: { mailboxId?: string; name: string }) => {
+  createFolder: (payload: { mailboxId?: string; name: string; icon?: string }) => {
     const query = payload.mailboxId ? `?mailboxId=${encodeURIComponent(payload.mailboxId)}` : ""
-    return request<MailFolder>(`/api/mail/folders${query}`, { method: "POST", body: JSON.stringify({ name: payload.name }) })
+    return request<MailFolder>(`/api/mail/folders${query}`, { method: "POST", body: JSON.stringify({ name: payload.name, icon: payload.icon }) })
   },
   reorderFolders: (payload: { mailboxId?: string; folderIds: string[]; folders?: { id: string; sortOrder: number }[] }) => {
     const query = payload.mailboxId ? `?mailboxId=${encodeURIComponent(payload.mailboxId)}` : ""

apps/web/src/lib/navigation.ts

@@ -0,0 +1,4 @@
+export function safeReturnPath(value: unknown, fallback = "/"): string {
+  if (typeof value !== "string" || !value.startsWith("/") || value.startsWith("//")) return fallback
+  return value
+}

apps/web/src/pages/admin.tsx

@@ -2,7 +2,7 @@ import * as React from "react"
 import DOMPurify from "dompurify"
 import { useSearchParams } from "react-router-dom"
 import { useInfiniteQuery, useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
-import { ArrowRight, BookOpen, CheckCircle2, ChevronDown, Circle, ClipboardList, Copy, ExternalLink, Github, Globe2, Mail, Mailbox, MoreHorizontal, Plus, RefreshCcw, Scale, Search, ShieldCheck, Star, Trash2, Users } from "lucide-react"
+import { ArrowRight, BookOpen, CheckCircle2, ChevronDown, Circle, ClipboardList, Copy, ExternalLink, Github, Globe2, Mail, Mailbox, MoreHorizontal, RefreshCcw, Scale, Search, ShieldCheck, Star, Trash2, Users } from "lucide-react"
 import { api, AdminUser, Alias, DNSRecord, Domain, Mailbox as MailboxType, MailMessage, MailTemplate, MaildirSyncHealth, PermissionGroup, PermissionInfo, PermissionLimits, SystemSettings } from "@/lib/api"
 import { cn, decodeMimeHeader, formatBytes, formatDate } from "@/lib/utils"
 import { Button } from "@/components/ui/button"
@@ -32,10 +32,10 @@ type PendingConfirm = { title: string; description?: string; confirmText: string
 
 const sectionMeta: Record<Section, { label: string; frontLabel: string; description: string }> = {
   overview: { label: "数据总览", frontLabel: "数据统计", description: "系统运行、DNS、邮箱和消息状态集中查看。" },
-  users: { label: "账号管理", frontLabel: "账号设置", description: "管理登录账号、身份状态、邮箱数量上限和绑定邮箱。" },
+  users: { label: "账号管理", frontLabel: "账号设置", description: "管理登录账号、身份状态、邮箱数量上限和共享存储容量。" },
   permissionGroups: { label: "权限配置", frontLabel: "账号权限", description: "配置自定义权限、发信频率、附件和邮箱创建额度。" },
   domains: { label: "域名管理", frontLabel: "邮箱地址", description: "维护邮件域名、DKIM 和 DNS 检测。" },
-  mailboxes: { label: "邮箱管理", frontLabel: "邮箱管理", description: "创建、分配、停用邮箱，保持与前台邮箱列表一致。" },
+  mailboxes: { label: "邮箱管理", frontLabel: "邮箱管理", description: "按归属账号查看和管理子邮箱，默认邮箱受保护。" },
   aliases: { label: "邮件转发", frontLabel: "邮件转发", description: "管理域名转发规则。" },
   messages: { label: "全部邮件", frontLabel: "全部邮箱", description: "按邮箱、文件夹和关键词查看全站邮件。" },
   sendAudit: { label: "发送队列", frontLabel: "发送队列", description: "查看发信投递、重试和失败记录。" },
@@ -58,8 +58,12 @@ const projectRepositoryUrl = "https://github.com/zxyszx/NewSzxcn-Email"
 const projectTelegramUrl = "https://t.me/+EhII7MSyi3QwNDQ5"
 const defaultPermissionLimits: PermissionLimits = { maxAttachmentMb: 25, maxMailboxCount: 9, smtpDailyLimit: 200, smtpMinuteLimit: 20, imapMinuteLimit: 200, pop3MinuteLimit: 150 }
 const defaultMailboxLimitOverride = 9
+const defaultUserStorageQuotaMb = 100
+const defaultAdminStorageQuotaMb = 1024
+const superAdminPermissionGroupId = "pg_super_admin"
+const regularUserPermissionGroupId = "pg_regular_user"
+const defaultStorageQuotaMb = (role: AdminUser["role"]) => role === "admin" ? defaultAdminStorageQuotaMb : defaultUserStorageQuotaMb
 const accountPrimaryEmail = (user: Pick<AdminUser, "email" | "loginName">) => user.email || user.loginName || ""
-
 function compareAdminUsers(left: AdminUser, right: AdminUser) {
   if (left.role === "admin" && right.role !== "admin") return -1
   if (left.role !== "admin" && right.role === "admin") return 1
@@ -86,7 +90,7 @@ export function AdminPage() {
   const overview = useQuery({ queryKey: ["admin", "overview"], queryFn: api.adminOverview, enabled: !!user && canOverview })
   const users = useQuery({ queryKey: ["admin", "users"], queryFn: api.users, enabled: !!user && (canUsersView || canMailboxesView) })
   const permissionGroups = useQuery({ queryKey: ["admin", "permission-groups"], queryFn: api.permissionGroups, enabled: !!user && (canPermissionGroupsView || canUsersView) })
-  const domains = useQuery({ queryKey: ["admin", "domains"], queryFn: api.domains, enabled: !!user && (canDomainsView || canDNSView || canMailboxesView || canAliasesView || canSettingsView || canTemplatesView) })
+  const domains = useQuery({ queryKey: ["admin", "domains"], queryFn: api.domains, enabled: !!user && (canUsersView || canDomainsView || canDNSView || canMailboxesView || canAliasesView || canSettingsView || canTemplatesView) })
   const mailboxes = useQuery({ queryKey: ["admin", "mailboxes"], queryFn: api.mailboxes, enabled: !!user && (canMailboxesView || canMessagesView || canSettingsView) })
   const aliases = useQuery({ queryKey: ["admin", "aliases"], queryFn: api.aliases, enabled: !!user && canAliasesView })
   const settings = useQuery({ queryKey: ["admin", "settings"], queryFn: api.systemSettings, enabled: !!user && canSettingsView })
@@ -97,10 +101,18 @@ export function AdminPage() {
   const mailboxItems = mailboxes.data?.items || []
   const aliasItems = aliases.data?.items || []
   const userItems = users.data?.items || []
-  const assignablePermissionGroups = (permissionGroups.data?.items || []).filter((group) => group.id !== "pg_super_admin" && group.id !== "pg_regular_user")
+  const assignablePermissionGroups = (permissionGroups.data?.items || []).filter((group) => group.id !== superAdminPermissionGroupId && group.id !== regularUserPermissionGroupId)
   const visibleSections = sectionKeys.filter((key) => hasAnyPermission(user, sectionPermissions[key]))
   const rawSection = params.get("section") as Section | null
   const section: Section = rawSection && visibleSections.includes(rawSection) ? rawSection : visibleSections[0] || "overview"
+  const sectionQuery = section === "overview" ? overview
+    : section === "users" ? users
+      : section === "permissionGroups" ? permissionGroups
+        : section === "domains" ? domains
+          : section === "mailboxes" ? mailboxes
+            : section === "aliases" ? aliases
+              : section === "settings" ? settings
+                : null
 
   async function refreshAdminPage() {
     if (refreshing) return
@@ -121,9 +133,11 @@ export function AdminPage() {
 
   return (
     <ScrollArea className="h-[calc(100svh-3rem)] md:h-svh">
-      <main className="mx-auto w-full max-w-[1180px] px-3 pb-10 pt-3 sm:px-4 sm:pt-4">
+      <main className="admin-page mx-auto w-full max-w-[1180px] px-3 pb-10 pt-3 sm:px-4 sm:pt-4">
         <AdminPageHeader section={section} refreshing={refreshing} onRefresh={refreshAdminPage} />
 
+        {sectionQuery?.isError && <QueryFailure error={sectionQuery.error} onRetry={() => { void sectionQuery.refetch() }} />}
+
         {section === "overview" && canOverview && (
           <div className="mb-4 grid gap-3 sm:grid-cols-2 xl:grid-cols-4">
             <Stat icon={<Users />} label="账号" value={overview.data?.users || 0} />
@@ -134,7 +148,7 @@ export function AdminPage() {
         )}
 
         {section === "overview" && <OverviewSection overview={overview.data} domains={domainItems} settings={settings.data} visibleSections={visibleSections} onSectionChange={(next) => setParams(next === "overview" ? {} : { section: next })} />}
-        {section === "users" && <UsersSection users={userItems} permissionGroups={assignablePermissionGroups} />}
+        {section === "users" && <UsersSection users={userItems} permissionGroups={assignablePermissionGroups} domains={domainItems} />}
         {section === "permissionGroups" && <PermissionGroupsSection groups={permissionGroups.data?.items || []} catalog={permissionGroups.data?.catalog || []} />}
         {section === "domains" && <DomainsSection domains={domainItems} />}
         {section === "mailboxes" && <MailboxesSection mailboxes={mailboxItems} users={userItems} domains={domainItems} />}
@@ -165,7 +179,6 @@ function AdminPageHeader({ section, refreshing, onRefresh }: { section: Section;
           <Button type="button" variant="outline" size="icon" className="h-8 w-8 shadow-none" onClick={onRefresh} disabled={refreshing} aria-label="刷新后台数据" title="刷新后台数据">
             <RefreshCcw className={cn("h-4 w-4", refreshing && "animate-spin")} />
           </Button>
-          <Badge variant="outline" className="h-7 rounded-md px-2.5 font-normal">NewSzxcn</Badge>
         </div>
       </div>
     </div>
@@ -242,7 +255,7 @@ function InfoLine({ label, value }: { label: string; value: React.ReactNode }) {
   return <div className="flex items-center justify-between gap-3 rounded-md border px-3 py-2"><span>{label}</span><span className="min-w-0 truncate font-medium text-foreground">{value}</span></div>
 }
 
-function UsersSection({ users, permissionGroups }: { users: AdminUser[]; permissionGroups: PermissionGroup[] }) {
+function UsersSection({ users, permissionGroups, domains }: { users: AdminUser[]; permissionGroups: PermissionGroup[]; domains: Domain[] }) {
   const me = useMe()
   const user = me.data?.user
   const qc = useQueryClient()
@@ -269,7 +282,9 @@ function UsersSection({ users, permissionGroups }: { users: AdminUser[]; permiss
       <CardHeader>
         <div className="flex flex-col gap-3 md:flex-row md:items-center md:justify-between">
           <CardTitle>账号管理</CardTitle>
-          {canCreate && <CreateUserDialog permissionGroups={permissionGroups} />}
+          <div className="flex flex-wrap gap-2">
+            {canCreate && <CreateUserDialog permissionGroups={permissionGroups} domains={domains} />}
+          </div>
         </div>
       </CardHeader>
       <CardContent className="space-y-4">
@@ -307,8 +322,8 @@ function UsersSection({ users, permissionGroups }: { users: AdminUser[]; permiss
               </div>
               <div className="mt-3 flex flex-wrap gap-2">
                 <RoleBadge user={user} />
-                <Badge variant={user.disabled ? "secondary" : "default"}>{user.disabled ? "停用" : "正常"}</Badge>
-                <Badge variant="outline">{new Date(user.createdAt).toLocaleDateString()}</Badge>
+                <AccountStatus user={user} />
+                <span className="text-xs text-muted-foreground">{new Date(user.createdAt).toLocaleDateString()}</span>
               </div>
               <div className="mt-3"><UserPermissionGroupsCell user={user} /></div>
               <div className="mt-3"><UserMailboxCell user={user} /></div>
@@ -328,7 +343,7 @@ function UsersSection({ users, permissionGroups }: { users: AdminUser[]; permiss
                   <TableCell><RoleBadge user={user} /></TableCell>
                   <TableCell><UserPermissionGroupsCell user={user} /></TableCell>
                   <TableCell className="w-[22rem] max-w-[22rem]"><UserMailboxCell user={user} /></TableCell>
-                  <TableCell><Badge variant={user.disabled ? "secondary" : "default"}>{user.disabled ? "停用" : "正常"}</Badge></TableCell>
+                  <TableCell><AccountStatus user={user} /></TableCell>
                   <TableCell className="text-muted-foreground">{new Date(user.createdAt).toLocaleDateString()}</TableCell>
                   <TableCell><UserActions user={user} permissionGroups={permissionGroups} onDelete={canDelete ? () => setPendingConfirm({ title: "删除账号？", description: `将删除 ${accountPrimaryEmail(user)} 及其关联数据。`, confirmText: "删除账号", onConfirm: () => remove.mutate(user.id) }) : undefined} /></TableCell>
                 </TableRow>
@@ -350,6 +365,7 @@ function PermissionGroupsSection({ groups, catalog }: { groups: PermissionGroup[
   const { toast } = useToast()
   const [query, setQuery] = React.useState("")
   const [editing, setEditing] = React.useState<PermissionGroup | null>(null)
+  const [viewing, setViewing] = React.useState<PermissionGroup | null>(null)
   const [pendingConfirm, setPendingConfirm] = React.useState<PendingConfirm | null>(null)
   const canCreate = hasPermission(user, "admin.permission_groups.create")
   const canUpdate = hasPermission(user, "admin.permission_groups.update")
@@ -368,14 +384,16 @@ function PermissionGroupsSection({ groups, catalog }: { groups: PermissionGroup[
     if (!keyword) return true
     return [group.name, group.description, ...group.permissions].some((value) => value.toLowerCase().includes(keyword))
   })
-  const isEditable = (group: PermissionGroup) => !group.system
+  const isEditable = (group: PermissionGroup) => !group.system || group.id === regularUserPermissionGroupId
   const isDeletable = (group: PermissionGroup) => !group.system && group.userCount === 0
   return (
     <Card>
       <CardHeader>
         <div className="flex flex-col gap-3 md:flex-row md:items-center md:justify-between">
           <CardTitle>权限配置</CardTitle>
-          {canCreate && <PermissionGroupDialog catalog={catalog} />}
+          <div className="flex flex-wrap gap-2">
+            {canCreate && <PermissionGroupDialog catalog={catalog} />}
+          </div>
         </div>
       </CardHeader>
       <CardContent className="space-y-4">
@@ -390,26 +408,21 @@ function PermissionGroupsSection({ groups, catalog }: { groups: PermissionGroup[
                 <div className="min-w-0">
                   <div className="flex flex-wrap items-center gap-2">
                     <div className="font-medium">{group.name}</div>
-                    {group.system && <Badge variant="outline">系统组</Badge>}
-                    {!group.system && <Badge variant="secondary">自定义</Badge>}
-                    <Badge variant="outline">{group.userCount} 人</Badge>
+                    <span className="text-xs text-muted-foreground">{group.system ? "系统配置" : "自定义配置"} · {group.userCount} 个账号</span>
                   </div>
                   <div className="mt-1 line-clamp-2 text-sm text-muted-foreground">{group.description || "未填写说明"}</div>
                 </div>
-                {(canUpdate || canDelete) && <DropdownMenu>
-                  <DropdownMenuTrigger asChild><Button variant="ghost" size="icon"><MoreHorizontal className="h-4 w-4" /></Button></DropdownMenuTrigger>
-                  <DropdownMenuContent align="end">
-                    <DropdownMenuItem disabled={!isEditable(group) || !canUpdate} onSelect={() => setEditing(group)}>编辑权限配置</DropdownMenuItem>
-                    <DropdownMenuSeparator />
-                    <DropdownMenuItem
-                      className="text-destructive"
-                      disabled={!isDeletable(group) || !canDelete}
-                      onSelect={() => setPendingConfirm({ title: "删除权限配置？", description: `${group.name} 删除后不能再分配给账号。`, confirmText: "删除权限配置", onConfirm: () => remove.mutate(group.id) })}
-                    >
-                      删除权限配置
-                    </DropdownMenuItem>
-                  </DropdownMenuContent>
-                </DropdownMenu>}
+                <div className="flex shrink-0 items-center gap-1">
+                  <Button type="button" variant="outline" size="sm" onClick={() => setViewing(group)}>查看全部权限</Button>
+                  {((isEditable(group) && canUpdate) || (isDeletable(group) && canDelete)) && <DropdownMenu>
+                    <DropdownMenuTrigger asChild><Button variant="ghost" size="icon" aria-label={`管理权限配置 ${group.name}`} title="更多操作"><MoreHorizontal className="h-4 w-4" /></Button></DropdownMenuTrigger>
+                    <DropdownMenuContent align="end">
+                      {isEditable(group) && canUpdate && <DropdownMenuItem onSelect={() => setEditing(group)}>{group.id === regularUserPermissionGroupId ? "编辑普通用户权限" : "编辑权限配置"}</DropdownMenuItem>}
+                      {isEditable(group) && canUpdate && isDeletable(group) && canDelete && <DropdownMenuSeparator />}
+                      {isDeletable(group) && canDelete && <DropdownMenuItem className="text-destructive" onSelect={() => setPendingConfirm({ title: "删除权限配置？", description: `${group.name} 删除后不能再分配给账号。`, confirmText: "删除权限配置", onConfirm: () => remove.mutate(group.id) })}>删除权限配置</DropdownMenuItem>}
+                    </DropdownMenuContent>
+                  </DropdownMenu>}
+                </div>
               </div>
               <PermissionBadges permissions={group.permissions} catalog={catalog} />
               <PermissionLimitBadges limits={group.limits} />
@@ -419,6 +432,7 @@ function PermissionGroupsSection({ groups, catalog }: { groups: PermissionGroup[
         {filtered.length === 0 && <Empty text="暂无匹配的权限配置" />}
       </CardContent>
       {editing && <PermissionGroupDialog group={editing} catalog={catalog} open={!!editing} onOpenChange={(open) => { if (!open) setEditing(null) }} />}
+      {viewing && <PermissionGroupDetailsDialog group={viewing} catalog={catalog} open={!!viewing} onOpenChange={(open) => { if (!open) setViewing(null) }} />}
       <ConfirmDialog open={!!pendingConfirm} title={pendingConfirm?.title || ""} description={pendingConfirm?.description} confirmText={pendingConfirm?.confirmText || "删除"} destructive pending={remove.isPending} onOpenChange={(open) => { if (!open) setPendingConfirm(null) }} onConfirm={() => pendingConfirm?.onConfirm()} />
     </Card>
   )
@@ -430,6 +444,7 @@ function PermissionGroupDialog({ group, catalog, open, onOpenChange }: { group?:
   const [internalOpen, setInternalOpen] = React.useState(false)
   const dialogOpen = open ?? internalOpen
   const setDialogOpen = onOpenChange ?? setInternalOpen
+  const fixedIdentity = group?.id === regularUserPermissionGroupId
   const defaultLimitsQuery = useQuery({ queryKey: ["admin", "permission-limits", "defaults"], queryFn: api.defaultPermissionLimits, enabled: dialogOpen })
   const defaultLimits = defaultLimitsQuery.data || defaultPermissionLimits
   const [permissions, setPermissions] = React.useState<PermissionKey[]>(group?.permissions || [])
@@ -459,18 +474,18 @@ function PermissionGroupDialog({ group, catalog, open, onOpenChange }: { group?:
   })
   const trigger = group ? null : (
     <DialogTrigger asChild>
-      <Button size="sm"><Plus className="h-4 w-4" />权限配置</Button>
+      <Button size="sm" className="self-start">添加权限配置</Button>
     </DialogTrigger>
   )
   return (
     <Dialog open={dialogOpen} onOpenChange={setDialogOpen}>
       {trigger}
       <DialogContent className="max-h-[86vh] overflow-y-auto sm:max-w-3xl">
-        <DialogHeader><DialogTitle>{group ? "编辑权限配置" : "创建权限配置"}</DialogTitle></DialogHeader>
+        <DialogHeader><DialogTitle>{fixedIdentity ? "编辑普通用户权限" : group ? "编辑权限配置" : "创建权限配置"}</DialogTitle></DialogHeader>
         <form className="space-y-4" onSubmit={(event) => { event.preventDefault(); mutation.mutate(new FormData(event.currentTarget)) }}>
           <div className="grid gap-4 md:grid-cols-2">
-            <Field name="name" label="名称" defaultValue={group?.name || ""} placeholder="例如：客服主管" />
-            <Field name="description" label="说明" defaultValue={group?.description || ""} required={false} />
+            <Field name="name" label="名称" defaultValue={group?.name || ""} placeholder="例如：客服主管" readOnly={fixedIdentity} />
+            <Field name="description" label="说明" defaultValue={group?.description || ""} required={false} readOnly={fixedIdentity} />
           </div>
           <PermissionLimitEditor value={limits} onChange={setLimits} />
           <PermissionPicker catalog={catalog} value={permissions} onChange={setPermissions} />
@@ -481,7 +496,20 @@ function PermissionGroupDialog({ group, catalog, open, onOpenChange }: { group?:
   )
 }
 
-function PermissionPicker({ catalog, value, onChange }: { catalog: PermissionInfo[]; value: PermissionKey[]; onChange: (value: PermissionKey[]) => void }) {
+function PermissionGroupDetailsDialog({ group, catalog, open, onOpenChange }: { group: PermissionGroup; catalog: PermissionInfo[]; open: boolean; onOpenChange: (open: boolean) => void }) {
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="max-h-[86vh] overflow-y-auto sm:max-w-3xl">
+        <DialogHeader><DialogTitle>{group.name}的全部权限</DialogTitle></DialogHeader>
+        <p className="text-sm text-muted-foreground">共 {group.permissions.length} 项权限。{group.id === superAdminPermissionGroupId ? "管理员权限由账号身份决定，不能修改。" : ""}</p>
+        <PermissionLimitBadges limits={group.limits} />
+        <PermissionPicker catalog={catalog} value={group.permissions} onChange={() => undefined} readOnly />
+      </DialogContent>
+    </Dialog>
+  )
+}
+
+function PermissionPicker({ catalog, value, onChange, readOnly = false }: { catalog: PermissionInfo[]; value: PermissionKey[]; onChange: (value: PermissionKey[]) => void; readOnly?: boolean }) {
   const grouped = groupPermissionCatalog(catalog)
   function toggle(permission: PermissionKey, checked: boolean) {
     onChange(checked ? Array.from(new Set([...value, permission])) : value.filter((item) => item !== permission))
@@ -494,24 +522,25 @@ function PermissionPicker({ catalog, value, onChange }: { catalog: PermissionInf
     <div className="space-y-3">
       <div className="flex items-center justify-between gap-3">
         <Label>菜单与操作权限</Label>
-        <Badge variant="outline">{value.length} 项</Badge>
+        <span className="text-xs tabular-nums text-muted-foreground">已选 {value.length} 项</span>
       </div>
       <div className="space-y-3">
         {grouped.map(({ category, items }) => {
           const allChecked = items.every((item) => value.includes(item.key))
+          const selectedCount = items.filter((item) => value.includes(item.key)).length
           return (
             <div key={category} className="rounded-lg border">
               <div className="flex items-center justify-between gap-3 border-b px-3 py-2">
-                <label className="flex items-center gap-2 font-medium">
-                  <Checkbox checked={allChecked} onCheckedChange={(next) => toggleCategory(items, next === true)} />
+                <label className={cn("flex items-center gap-2 font-medium", readOnly && "cursor-default")}>
+                  <Checkbox className={cn(readOnly && "disabled:opacity-100")} disabled={readOnly} checked={allChecked ? true : selectedCount > 0 ? "indeterminate" : false} onCheckedChange={(next) => toggleCategory(items, next === true)} />
                   {category}
                 </label>
-                <span className="text-xs text-muted-foreground">{items.filter((item) => value.includes(item.key)).length}/{items.length}</span>
+                <span className="text-xs text-muted-foreground">{selectedCount}/{items.length}</span>
               </div>
               <div className="grid gap-2 p-3 md:grid-cols-2">
                 {items.map((item) => (
-                  <label key={item.key} className="flex min-h-16 items-start gap-3 rounded-md border px-3 py-2">
-                    <Checkbox checked={value.includes(item.key)} onCheckedChange={(next) => toggle(item.key, next === true)} />
+                  <label key={item.key} className={cn("flex min-h-16 items-start gap-3 rounded-md border px-3 py-2", readOnly && "cursor-default")}>
+                    <Checkbox className={cn(readOnly && "disabled:opacity-100")} disabled={readOnly} checked={value.includes(item.key)} onCheckedChange={(next) => toggle(item.key, next === true)} />
                     <span className="min-w-0">
                       <span className="block text-sm font-medium">{item.label}</span>
                       <span className="line-clamp-2 text-xs text-muted-foreground">{item.description}</span>
@@ -535,7 +564,7 @@ function PermissionLimitEditor({ value, onChange }: { value: PermissionLimits; o
   return (
     <div className="space-y-3 rounded-lg border p-3">
       <div className="flex flex-col gap-1 sm:flex-row sm:items-center sm:justify-between">
-        <Label>账号配额</Label>
+        <Label>使用限制</Label>
         <span className="text-xs text-muted-foreground">填 0 表示不限制</span>
       </div>
       <div className="grid gap-3 md:grid-cols-3">
@@ -571,29 +600,14 @@ function PermissionLimitEditor({ value, onChange }: { value: PermissionLimits; o
 function PermissionBadges({ permissions, catalog }: { permissions: PermissionKey[]; catalog: PermissionInfo[] }) {
   const labelByKey = new Map(catalog.map((item) => [item.key, item.label]))
   if (permissions.length === 0) return <div className="mt-3 text-sm text-muted-foreground">无后台权限</div>
-  return (
-    <div className="mt-3 flex flex-wrap gap-1.5">
-      {permissions.slice(0, 10).map((permission) => (
-        <Badge key={permission} variant="outline" className="font-normal">{labelByKey.get(permission) || permission}</Badge>
-      ))}
-      {permissions.length > 10 && <Badge variant="secondary">+{permissions.length - 10}</Badge>}
-    </div>
-  )
+  const visible = permissions.slice(0, 5).map((permission) => labelByKey.get(permission) || permission)
+  return <div className="mt-3 line-clamp-2 text-sm leading-6 text-muted-foreground">权限：{visible.join("、")}{permissions.length > visible.length ? ` 等 ${permissions.length} 项` : ""}</div>
 }
 
 function PermissionLimitBadges({ limits }: { limits?: PermissionLimits }) {
   const defaultLimitsQuery = useQuery({ queryKey: ["admin", "permission-limits", "defaults"], queryFn: api.defaultPermissionLimits })
   const value = limits || defaultLimitsQuery.data || defaultPermissionLimits
-  return (
-    <div className="mt-3 flex flex-wrap gap-1.5">
-      <Badge variant="secondary" className="font-normal">附件 {limitText(value.maxAttachmentMb, "MB")}</Badge>
-      <Badge variant="secondary" className="font-normal">邮箱 {limitText(value.maxMailboxCount, "个")}</Badge>
-      <Badge variant="secondary" className="font-normal">SMTP 每日 {limitText(value.smtpDailyLimit, "封")}</Badge>
-      <Badge variant="secondary" className="font-normal">SMTP 每分钟 {limitText(value.smtpMinuteLimit, "封")}</Badge>
-      <Badge variant="secondary" className="font-normal">IMAP 每分钟 {limitText(value.imapMinuteLimit, "次")}</Badge>
-      <Badge variant="secondary" className="font-normal">POP3 每分钟 {limitText(value.pop3MinuteLimit, "次")}</Badge>
-    </div>
-  )
+  return <div className="mt-2 text-xs leading-5 text-muted-foreground">限制：邮箱 {limitText(value.maxMailboxCount, "个")} · 附件 {limitText(value.maxAttachmentMb, "MB")} · SMTP {limitText(value.smtpDailyLimit, "封/日")} · IMAP {limitText(value.imapMinuteLimit, "次/分钟")} · POP3 {limitText(value.pop3MinuteLimit, "次/分钟")}</div>
 }
 
 function limitText(value: number, unit: string) {
@@ -641,8 +655,8 @@ function DomainsSection({ domains }: { domains: Domain[] }) {
               <div className="text-xs text-muted-foreground">selector: {domain.dkimSelector}</div>
             </div>
             <div className="flex flex-wrap items-center gap-2">
-              <Badge variant={domain.status === "active" ? "default" : "secondary"}>{domain.status === "active" ? "启用" : "停用"}</Badge>
-              <Badge variant={domain.dnsStatus === "ok" ? "default" : "secondary"}>{domain.dnsStatus === "ok" ? "DNS 正常" : domain.dnsStatus}</Badge>
+              <StatusText active={domain.status === "active"} activeLabel="启用" inactiveLabel="停用" />
+              <StatusText active={domain.dnsStatus === "ok"} activeLabel="DNS 正常" inactiveLabel={domain.dnsStatus || "未检测"} />
               {canViewDNS && <DomainDNSDialog domain={domain} />}
               {canUpdate && <Button variant="outline" size="sm" onClick={() => update.mutate({ id: domain.id, status: domain.status === "active" ? "disabled" : "active" })}>{domain.status === "active" ? "停用" : "启用"}</Button>}
               {canDelete && <Button variant="outline" size="sm" onClick={() => setPendingConfirm({ title: "删除域名？", description: `将删除 ${domain.name}，相关邮箱、转发和邮件也可能受影响。`, confirmText: "删除域名", onConfirm: () => remove.mutate(domain.id) })}><Trash2 className="h-4 w-4" />删除</Button>}
@@ -675,56 +689,103 @@ function MailboxesSection({ mailboxes, users, domains }: { mailboxes: MailboxTyp
   const user = me.data?.user
   const qc = useQueryClient()
   const { toast } = useToast()
+  const [query, setQuery] = React.useState("")
+  const [expandedOwners, setExpandedOwners] = React.useState<string[]>([])
   const [pendingConfirm, setPendingConfirm] = React.useState<PendingConfirm | null>(null)
   const canCreate = hasPermission(user, "admin.mailboxes.create")
   const canUpdate = hasPermission(user, "admin.mailboxes.update")
   const canDelete = hasPermission(user, "admin.mailboxes.delete")
+  const update = useMutation({
+    mutationFn: ({ mailbox, status }: { mailbox: MailboxType; status: "active" | "disabled" }) => api.updateMailbox(mailbox.id, { userId: mailbox.userId, displayName: mailbox.displayName || mailbox.address, quotaMb: mailbox.quotaMb, status }),
+    onSuccess: (mailbox) => { invalidateAdmin(qc); toast({ title: mailbox.status === "active" ? "邮箱已启用" : "邮箱已停用" }) },
+    onError: (e) => toast({ title: "状态更新失败", description: e.message }),
+  })
   const remove = useMutation({ mutationFn: api.deleteMailbox, onSuccess: () => { setPendingConfirm(null); invalidateAdmin(qc); toast({ title: "邮箱已删除" }) }, onError: (e) => toast({ title: "删除失败", description: e.message }) })
+  const keyword = query.trim().toLowerCase()
+  const knownOwnerIDs = new Set(users.map((item) => item.id))
+  const compareMailboxes = (left: MailboxType, right: MailboxType) => {
+    if (left.primary !== right.primary) return left.primary ? -1 : 1
+    return left.address.localeCompare(right.address, "en", { sensitivity: "base" })
+  }
+  const mailboxGroups: Array<{ owner?: AdminUser; mailboxes: MailboxType[] }> = [
+    ...users.slice().sort(compareAdminUsers).map((owner) => ({ owner, mailboxes: mailboxes.filter((mailbox) => mailbox.userId === owner.id).sort(compareMailboxes) })),
+    ...mailboxes.filter((mailbox) => !knownOwnerIDs.has(mailbox.userId)).map((mailbox) => ({ owner: undefined, mailboxes: [mailbox] })),
+  ]
+    .filter((group) => group.mailboxes.length > 0)
+    .filter((group) => !keyword || [group.owner ? accountPrimaryEmail(group.owner) : "", group.owner?.displayName || "", ...group.mailboxes.map((mailbox) => mailbox.address)].some((value) => value.toLowerCase().includes(keyword)))
+  const toggleOwner = (ownerID: string) => setExpandedOwners((current) => current.includes(ownerID) ? current.filter((id) => id !== ownerID) : [...current, ownerID])
   return (
     <Card>
       <CardHeader>
         <div className="flex flex-col gap-3 md:flex-row md:items-center md:justify-between">
           <CardTitle>邮箱管理</CardTitle>
-          {canCreate && <CreateMailboxDialog domains={domains} users={users} />}
+          <div className="flex items-center gap-2">
+            <span className="text-sm tabular-nums text-muted-foreground">{mailboxes.length} 个邮箱</span>
+            {canCreate && <CreateMailboxDialog domains={domains} users={users} />}
+          </div>
         </div>
       </CardHeader>
-      <CardContent>
-        <div className="space-y-3 md:hidden">
-          {mailboxes.map((mailbox) => (
-            <div key={mailbox.id} className="rounded-lg border p-4">
-              <div className="flex items-start justify-between gap-3">
-                <div className="min-w-0">
-                  <div className="truncate font-medium">{mailbox.address}</div>
-                  <div className="truncate text-xs text-muted-foreground">{mailbox.userEmail || mailbox.userId}</div>
-                </div>
-                <MailboxActions mailbox={mailbox} users={users} canUpdate={canUpdate} onDelete={canDelete ? () => setPendingConfirm({ title: "删除邮箱？", description: `将删除 ${mailbox.address} 和其中邮件。`, confirmText: "删除邮箱", onConfirm: () => remove.mutate(mailbox.id) }) : undefined} />
-              </div>
-              <div className="mt-3 flex flex-wrap gap-2">
-                <Badge variant={mailbox.status === "active" ? "default" : "secondary"}>{mailbox.status === "active" ? "启用" : "停用"}</Badge>
-                <Badge variant="outline">{mailbox.quotaMb} MB</Badge>
-                <Badge variant="outline">{mailbox.displayName || "未命名"}</Badge>
-              </div>
-            </div>
-          ))}
+      <CardContent className="space-y-4">
+        <div className="relative">
+          <Search className="absolute left-3 top-2.5 h-4 w-4 text-muted-foreground" />
+          <Input value={query} onChange={(event) => setQuery(event.target.value)} placeholder="搜索账号或邮箱" className="pl-9" />
         </div>
-        <div className="hidden md:block">
-          <Table>
-            <TableHeader><TableRow><TableHead>地址</TableHead><TableHead>归属账号</TableHead><TableHead>名称</TableHead><TableHead>配额</TableHead><TableHead>状态</TableHead><TableHead className="w-16"></TableHead></TableRow></TableHeader>
-            <TableBody>
-              {mailboxes.map((mailbox) => (
-                <TableRow key={mailbox.id}>
-                  <TableCell className="font-medium">{mailbox.address}</TableCell>
-                  <TableCell className="text-muted-foreground">{mailbox.userEmail || mailbox.userId}</TableCell>
-                  <TableCell>{mailbox.displayName}</TableCell>
-                  <TableCell>{mailbox.quotaMb} MB</TableCell>
-                  <TableCell><Badge variant={mailbox.status === "active" ? "default" : "secondary"}>{mailbox.status === "active" ? "启用" : "停用"}</Badge></TableCell>
-                  <TableCell><MailboxActions mailbox={mailbox} users={users} canUpdate={canUpdate} onDelete={canDelete ? () => setPendingConfirm({ title: "删除邮箱？", description: `将删除 ${mailbox.address} 和其中邮件。`, confirmText: "删除邮箱", onConfirm: () => remove.mutate(mailbox.id) }) : undefined} /></TableCell>
-                </TableRow>
-              ))}
-            </TableBody>
-          </Table>
+        <div className="divide-y overflow-hidden rounded-md border">
+          <div className="hidden grid-cols-[1rem_minmax(0,1fr)_9rem_8rem] gap-3 bg-muted/40 px-4 py-2 text-xs font-medium text-muted-foreground sm:grid">
+            <span aria-hidden="true" />
+            <span>归属账号</span>
+            <span className="text-center">权限管理</span>
+            <span className="text-center">子邮箱</span>
+          </div>
+          {mailboxGroups.map((group) => {
+            const ownerID = group.owner?.id || group.mailboxes[0].userId
+            const expanded = expandedOwners.includes(ownerID) || !!keyword
+            return (
+              <div key={ownerID}>
+                <Button type="button" variant="ghost" className="grid h-auto min-h-16 w-full grid-cols-[auto_minmax(0,1fr)_auto] gap-3 rounded-none px-4 py-3 text-left font-normal sm:grid-cols-[auto_minmax(0,1fr)_9rem_8rem]" onClick={() => toggleOwner(ownerID)} aria-expanded={expanded}>
+                  <ChevronDown className={cn("h-4 w-4 shrink-0 text-muted-foreground transition-transform", !expanded && "-rotate-90")} />
+                  <div className="min-w-0 flex-1">
+                    <div className="truncate font-medium">{group.owner ? accountPrimaryEmail(group.owner) : group.mailboxes[0].userEmail || "未知账号"}</div>
+                    <div className="truncate text-xs text-muted-foreground">{group.owner?.displayName || "账号信息不可用"}</div>
+                  </div>
+                  <span className="hidden items-center justify-center sm:flex">{group.owner ? <RoleBadge user={group.owner} /> : "-"}</span>
+                  <span className="flex items-center justify-center gap-2 text-sm tabular-nums text-muted-foreground"><span>{group.mailboxes.length} 个</span><span className="hidden text-xs lg:inline">查看邮箱</span></span>
+                </Button>
+                {expanded && (
+                  <div className="border-t bg-muted/20 px-4 py-2 sm:pl-11">
+                    {group.mailboxes.map((mailbox) => (
+                      <div key={mailbox.id} className="flex min-h-14 items-center gap-3 border-b py-2 last:border-b-0">
+                        <Mail className="hidden h-4 w-4 shrink-0 text-muted-foreground sm:block" />
+                        <div className="min-w-0 flex-1">
+                          <div className="truncate text-sm font-medium">{mailbox.address}</div>
+                          <div className="flex min-w-0 items-center gap-2 text-xs text-muted-foreground">
+                            <span className="truncate">{mailbox.displayName || "未命名"}</span>
+                            {mailbox.primary && <span className="shrink-0">默认邮箱</span>}
+                          </div>
+                        </div>
+                        <span className={cn("w-10 shrink-0 text-right text-xs font-medium", mailbox.status === "active" ? "text-emerald-600 dark:text-emerald-400" : "text-destructive")}>{mailbox.status === "active" ? "启用" : "停用"}</span>
+                        <div className="flex h-8 w-8 shrink-0 items-center justify-center">
+                          {!mailbox.primary && (canUpdate || canDelete) && (
+                            <DropdownMenu>
+                              <DropdownMenuTrigger asChild><Button type="button" variant="ghost" size="icon" className="h-8 w-8" aria-label={`管理邮箱 ${mailbox.address}`} title="更多操作"><MoreHorizontal className="h-4 w-4" /></Button></DropdownMenuTrigger>
+                              <DropdownMenuContent align="end">
+                                {canUpdate && <DropdownMenuItem disabled={mailbox.status === "active" || update.isPending} onSelect={() => update.mutate({ mailbox, status: "active" })}>启用</DropdownMenuItem>}
+                                {canUpdate && <DropdownMenuItem disabled={mailbox.status === "disabled" || update.isPending} onSelect={() => update.mutate({ mailbox, status: "disabled" })}>停用</DropdownMenuItem>}
+                                {canUpdate && canDelete && !mailbox.primary && <DropdownMenuSeparator />}
+                                {canDelete && !mailbox.primary && <DropdownMenuItem className="text-destructive" onSelect={() => setPendingConfirm({ title: "删除邮箱？", description: `将删除 ${mailbox.address} 和其中邮件。此操作无法撤销。`, confirmText: "确认删除", onConfirm: () => remove.mutate(mailbox.id) })}>删除邮箱</DropdownMenuItem>}
+                              </DropdownMenuContent>
+                            </DropdownMenu>
+                          )}
+                        </div>
+                      </div>
+                    ))}
+                  </div>
+                )}
+              </div>
+            )
+          })}
         </div>
-        {mailboxes.length === 0 && <Empty text="暂无邮箱" />}
+        {mailboxGroups.length === 0 && <Empty text={query ? "没有匹配的账号或邮箱" : "暂无邮箱"} />}
       </CardContent>
       <ConfirmDialog open={!!pendingConfirm} title={pendingConfirm?.title || ""} description={pendingConfirm?.description} confirmText={pendingConfirm?.confirmText || "删除"} destructive pending={remove.isPending} onOpenChange={(open) => { if (!open) setPendingConfirm(null) }} onConfirm={() => pendingConfirm?.onConfirm()} />
     </Card>
@@ -762,7 +823,7 @@ function AliasesSection({ aliases, domains }: { aliases: Alias[]; domains: Domai
                 <AliasActions alias={alias} onToggle={canUpdate ? () => update.mutate({ id: alias.id, payload: { source: alias.source, destination: alias.destination, enabled: !alias.enabled } }) : undefined} onDelete={canDelete ? () => setPendingConfirm({ title: "删除转发？", description: `${alias.source} 将不再转发到 ${alias.destination}。`, confirmText: "删除转发", onConfirm: () => remove.mutate(alias.id) }) : undefined} />
               </div>
               <div className="mt-3 flex flex-wrap gap-2">
-                <Badge variant={alias.enabled ? "default" : "secondary"}>{alias.enabled ? "启用" : "停用"}</Badge>
+                <StatusText active={alias.enabled} activeLabel="启用" inactiveLabel="停用" />
                 <Badge variant="outline">{domains.find((d) => d.id === alias.domainId)?.name || alias.domainId}</Badge>
               </div>
             </div>
@@ -777,7 +838,7 @@ function AliasesSection({ aliases, domains }: { aliases: Alias[]; domains: Domai
                   <TableCell className="font-medium">{alias.source}</TableCell>
                   <TableCell>{alias.destination}</TableCell>
                   <TableCell className="text-muted-foreground">{domains.find((d) => d.id === alias.domainId)?.name || alias.domainId}</TableCell>
-                  <TableCell><Badge variant={alias.enabled ? "default" : "secondary"}>{alias.enabled ? "启用" : "停用"}</Badge></TableCell>
+                  <TableCell><StatusText active={alias.enabled} activeLabel="启用" inactiveLabel="停用" /></TableCell>
                   <TableCell><AliasActions alias={alias} onToggle={canUpdate ? () => update.mutate({ id: alias.id, payload: { source: alias.source, destination: alias.destination, enabled: !alias.enabled } }) : undefined} onDelete={canDelete ? () => setPendingConfirm({ title: "删除转发？", description: `${alias.source} 将不再转发到 ${alias.destination}。`, confirmText: "删除转发", onConfirm: () => remove.mutate(alias.id) }) : undefined} /></TableCell>
                 </TableRow>
               ))}
@@ -903,7 +964,8 @@ function AdminMessagesSection({ mailboxes, systemAdmin }: { mailboxes: MailboxTy
           </Table>
         </div>
         {messages.isLoading && <Empty text="加载中..." />}
-        {!messages.isLoading && items.length === 0 && <Empty text="暂无邮件" />}
+        {messages.isError && <QueryFailure error={messages.error} onRetry={() => { void messages.refetch() }} compact />}
+        {!messages.isLoading && !messages.isError && items.length === 0 && <Empty text="暂无邮件" />}
         {!messages.isLoading && messages.hasNextPage && (
           <div className="flex justify-center">
             <Button variant="outline" size="sm" disabled={messages.isFetchingNextPage} onClick={() => messages.fetchNextPage()}>
@@ -1016,7 +1078,8 @@ function AdminSendAuditSection({ mailboxes }: { mailboxes: MailboxType[] }) {
           </Table>
         </div>
         {audit.isLoading && <Empty text="加载中..." />}
-        {!audit.isLoading && items.length === 0 && <Empty text="暂无发送记录" />}
+        {audit.isError && <QueryFailure error={audit.error} onRetry={() => { void audit.refetch() }} compact />}
+        {!audit.isLoading && !audit.isError && items.length === 0 && <Empty text="暂无发送记录" />}
         {!audit.isLoading && audit.hasNextPage && (
           <div className="flex justify-center">
             <Button variant="outline" size="sm" disabled={audit.isFetchingNextPage} onClick={() => audit.fetchNextPage()}>
@@ -1330,7 +1393,7 @@ function SystemSettingsSection({ settings, domains, mailboxes, initialTab }: { s
                     <div className="space-y-3 border-l-2 border-primary/50 py-1 pl-3">
                       <div className="flex items-center gap-2">
                         <code className="min-w-0 flex-1 font-mono text-sm font-semibold">{telegramPairing.code}</code>
-                        <Button type="button" variant="ghost" size="icon" title="复制绑定码" onClick={() => navigator.clipboard.writeText(telegramPairing.code)}>
+                        <Button type="button" variant="ghost" size="icon" aria-label="复制绑定码" title="复制绑定码" onClick={() => navigator.clipboard.writeText(telegramPairing.code)}>
                           <Copy className="h-4 w-4" />
                         </Button>
                       </div>
@@ -1429,7 +1492,8 @@ function SystemSettingsSection({ settings, domains, mailboxes, initialTab }: { s
         </CardContent>
       </Card>}
 
-      {settingsTab === "templates" && canViewTemplates && <MailTemplatesPanel templates={templates.data?.items || []} loading={templates.isLoading} canUpdate={canUpdateTemplates} canReset={canResetTemplates} />}
+      {settingsTab === "templates" && canViewTemplates && templates.isError && <QueryFailure error={templates.error} onRetry={() => { void templates.refetch() }} />}
+      {settingsTab === "templates" && canViewTemplates && !templates.isError && <MailTemplatesPanel templates={templates.data?.items || []} loading={templates.isLoading} canUpdate={canUpdateTemplates} canReset={canResetTemplates} />}
 
       {settingsTab === "security" && <Card>
         <CardHeader><CardTitle>安全设置</CardTitle></CardHeader>
@@ -1808,6 +1872,18 @@ function Stat({ icon, label, value }: { icon: React.ReactNode; label: string; va
 }
 function InfoBox({ label, value }: { label: string; value: React.ReactNode }) { return <div className="rounded-lg border p-4"><div className="text-xl font-semibold tracking-tight sm:text-2xl">{value}</div><div className="text-xs text-muted-foreground">{label}</div></div> }
 function Empty({ text }: { text: string }) { return <div className="rounded-lg border border-dashed p-8 text-center text-sm text-muted-foreground">{text}</div> }
+
+function QueryFailure({ error, onRetry, compact = false }: { error: unknown; onRetry: () => void; compact?: boolean }) {
+  return (
+    <div className={cn("mb-4 flex flex-col gap-3 rounded-lg border border-destructive/40 bg-destructive/5 p-4 sm:flex-row sm:items-center sm:justify-between", compact && "mb-0")} role="alert">
+      <div className="min-w-0">
+        <div className="text-sm font-semibold text-destructive">数据读取失败</div>
+        <div className="mt-1 break-words text-sm text-muted-foreground">{queryErrorMessage(error)}</div>
+      </div>
+      <Button type="button" variant="outline" size="sm" className="shrink-0" onClick={onRetry}><RefreshCcw className="h-4 w-4" />重试</Button>
+    </div>
+  )
+}
 function DomainBadgeRow({ domain }: { domain: Domain }) { return <div className="flex items-center justify-between rounded-lg border p-3"><span className="font-medium">{domain.name}</span><Badge variant={domain.dnsStatus === "ok" ? "default" : "secondary"}>{domain.dnsStatus === "ok" ? "正常" : domain.dnsStatus}</Badge></div> }
 function invalidateAdmin(qc: ReturnType<typeof useQueryClient>) { qc.invalidateQueries({ queryKey: ["admin"] }); qc.invalidateQueries({ queryKey: ["mailboxes"] }); qc.invalidateQueries({ queryKey: ["me"] }) }
 
@@ -1830,7 +1906,8 @@ function UserMailboxCell({ user }: { user: AdminUser }) {
     return sortedMailboxes.filter((mailbox) => mailbox.toLowerCase().includes(normalizedQuery))
   }, [normalizedQuery, sortedMailboxes])
   const limit = user.role === "admin" ? "不限" : limitText(user.limits?.maxMailboxCount ?? defaultMailboxLimitOverride, "个")
-  const quota = <div className="text-[11px] text-muted-foreground">邮箱 {user.mailboxCount}/{limit}</div>
+  const storage = formatBytes((user.storageQuotaMb || defaultStorageQuotaMb(user.role)) * 1024 * 1024)
+  const quota = <div className="text-[11px] text-muted-foreground">邮箱 {user.mailboxCount}/{limit} · 共享存储容量 {storage}</div>
   async function copyMailbox(address: string) {
     if (!address) return
     await navigator.clipboard.writeText(address)
@@ -1847,7 +1924,6 @@ function UserMailboxCell({ user }: { user: AdminUser }) {
               className="h-8 min-w-0 flex-1 justify-start gap-1.5 overflow-hidden rounded-md border-input bg-background px-2 text-left font-normal shadow-none hover:bg-background"
               title={selectedAddress}
             >
-              <Mail className="h-3.5 w-3.5 shrink-0 text-muted-foreground" />
               <span className="min-w-0 flex-1 truncate text-[13px] font-medium">{selectedAddress}</span>
               {sortedMailboxes.length > 0 && <span className="shrink-0 rounded bg-muted px-1.5 py-0.5 text-[11px] font-medium text-muted-foreground">{sortedMailboxes.length} 个</span>}
               <ChevronDown className="h-3.5 w-3.5 shrink-0 text-muted-foreground" />
@@ -1873,7 +1949,6 @@ function UserMailboxCell({ user }: { user: AdminUser }) {
                 onSelect={() => setSelectedAddress(mailbox)}
                 className={cn("h-8 min-w-0 gap-2 rounded-sm px-2 text-[13px] font-normal", selectedAddress === mailbox && "bg-accent text-accent-foreground")}
               >
-                <Mail className="h-3.5 w-3.5 shrink-0 text-muted-foreground" />
                 <span className="min-w-0 flex-1 truncate" title={mailbox}>{mailbox}</span>
               </DropdownMenuItem>
             ))}
@@ -1891,17 +1966,10 @@ function UserMailboxCell({ user }: { user: AdminUser }) {
 }
 
 function UserPermissionGroupsCell({ user }: { user: AdminUser }) {
-  const groups = user.permissionGroups || []
-  if (groups.length === 0) return <span className="text-muted-foreground">普通用户</span>
-  return (
-    <div className="flex max-w-md flex-wrap gap-1">
-      {groups.map((group) => (
-        <Badge key={group.id} variant={group.id === "pg_super_admin" ? "default" : "secondary"} className="font-normal">
-          {group.name}
-        </Badge>
-      ))}
-    </div>
-  )
+  const groups = (user.permissionGroups || []).filter((group) => group.id !== "pg_regular_user")
+  if (user.role === "admin") return <span className="text-sm text-muted-foreground">全部权限</span>
+  if (groups.length === 0) return <span className="text-muted-foreground">默认权限</span>
+  return <span className="line-clamp-2 text-sm text-muted-foreground">{groups.map((group) => group.name).join("、")}</span>
 }
 
 function assignableUserGroupIDs(user: AdminUser) {
@@ -1909,6 +1977,7 @@ function assignableUserGroupIDs(user: AdminUser) {
 }
 
 function PermissionGroupPicker({ groups, value, onChange }: { groups: PermissionGroup[]; value: string[]; onChange: (value: string[]) => void }) {
+  if (groups.length === 0) return null
   function toggle(groupID: string, checked: boolean) {
     onChange(checked ? Array.from(new Set([...value, groupID])) : value.filter((id) => id !== groupID))
   }
@@ -1929,18 +1998,20 @@ function PermissionGroupPicker({ groups, value, onChange }: { groups: Permission
           )
         })}
       </div>
-      {groups.length === 0 && <Empty text="暂无可分配自定义权限配置" />}
     </div>
   )
 }
 
 function RoleBadge({ user }: { user: AdminUser }) {
-  return (
-    <div className="flex flex-wrap gap-1">
-      <Badge variant={user.role === "admin" ? "default" : "secondary"}>{user.role === "admin" ? "管理员" : "普通用户"}</Badge>
-      {user.protected && <Badge variant="outline">默认账号</Badge>}
-    </div>
-  )
+  return <span className="text-sm font-medium">{user.role === "admin" ? "管理员" : "普通用户"}</span>
+}
+
+function AccountStatus({ user }: { user: AdminUser }) {
+  return <StatusText active={!user.disabled} activeLabel="正常" inactiveLabel="停用" />
+}
+
+function StatusText({ active, activeLabel, inactiveLabel }: { active: boolean; activeLabel: string; inactiveLabel: string }) {
+  return <span className="inline-flex items-center gap-2 whitespace-nowrap text-sm"><span className={cn("h-1.5 w-1.5 rounded-full", active ? "bg-emerald-600" : "bg-muted-foreground")} />{active ? activeLabel : inactiveLabel}</span>
 }
 
 function UserActions({ user, permissionGroups, onDelete }: { user: AdminUser; permissionGroups: PermissionGroup[]; onDelete?: () => void }) {
@@ -1968,56 +2039,64 @@ function UserActions({ user, permissionGroups, onDelete }: { user: AdminUser; pe
     })
   }
   if (!canUpdate && !canResetPassword && !onDelete) return null
-  return <><DropdownMenu><DropdownMenuTrigger asChild><Button variant="ghost" size="icon"><MoreHorizontal className="h-4 w-4" /></Button></DropdownMenuTrigger><DropdownMenuContent align="end">{canUpdate && <DropdownMenuItem onSelect={() => setEditOpen(true)}>编辑账号</DropdownMenuItem>}{canResetPassword && <DropdownMenuItem onSelect={() => setPasswordOpen(true)}>重置密码</DropdownMenuItem>}{!user.protected && user.role !== "admin" && canUpdate && <><DropdownMenuSeparator /><DropdownMenuItem onSelect={() => quickPatch({ disabled: !user.disabled })}>{user.disabled ? "启用账号" : "停用账号"}</DropdownMenuItem></>}{!user.protected && user.role !== "admin" && onDelete && <><DropdownMenuSeparator /><DropdownMenuItem className="text-destructive" onSelect={onDelete}>删除账号</DropdownMenuItem></>}</DropdownMenuContent></DropdownMenu>{canUpdate && <EditUserDialog user={user} permissionGroups={permissionGroups} open={editOpen} onOpenChange={setEditOpen} />}{canResetPassword && <ResetPasswordDialog user={user} open={passwordOpen} onOpenChange={setPasswordOpen} />}</>
+  return <><DropdownMenu><DropdownMenuTrigger asChild><Button variant="ghost" size="icon" aria-label={`管理账号 ${accountPrimaryEmail(user)}`} title="更多操作"><MoreHorizontal className="h-4 w-4" /></Button></DropdownMenuTrigger><DropdownMenuContent align="end">{canUpdate && <DropdownMenuItem onSelect={() => setEditOpen(true)}>编辑账号</DropdownMenuItem>}{canResetPassword && <DropdownMenuItem onSelect={() => setPasswordOpen(true)}>重置密码</DropdownMenuItem>}{!user.protected && user.role !== "admin" && canUpdate && <><DropdownMenuSeparator /><DropdownMenuItem onSelect={() => quickPatch({ disabled: !user.disabled })}>{user.disabled ? "启用账号" : "停用账号"}</DropdownMenuItem></>}{!user.protected && user.role !== "admin" && onDelete && <><DropdownMenuSeparator /><DropdownMenuItem className="text-destructive" onSelect={onDelete}>删除账号</DropdownMenuItem></>}</DropdownMenuContent></DropdownMenu>{canUpdate && <EditUserDialog user={user} permissionGroups={permissionGroups} open={editOpen} onOpenChange={setEditOpen} />}{canResetPassword && <ResetPasswordDialog user={user} open={passwordOpen} onOpenChange={setPasswordOpen} />}</>
 }
 
-function CreateUserDialog(_props: { permissionGroups: PermissionGroup[] }) {
+function CreateUserDialog({ permissionGroups, domains }: { permissionGroups: PermissionGroup[]; domains: Domain[] }) {
   const qc = useQueryClient()
   const { toast } = useToast()
   const [open, setOpen] = React.useState(false)
-  const [status, setStatus] = React.useState("active")
+  const [domainId, setDomainId] = React.useState("")
+  const [permissionGroupIds, setPermissionGroupIds] = React.useState<string[]>([])
+  React.useEffect(() => { if (!domainId && domains[0]) setDomainId(domains[0].id) }, [domainId, domains])
   const create = useMutation({
-    mutationFn: (form: FormData) => api.createUser({
-      email: String(form.get("email") || ""),
-      displayName: String(form.get("displayName") || ""),
-      password: String(form.get("password") || ""),
-      role: "user",
-      disabled: status === "disabled",
-      mailboxLimitOverride: mailboxLimitFromForm(form),
-    }),
+    mutationFn: (form: FormData) => {
+      const domain = domains.find((item) => item.id === domainId)
+      if (!domain) throw new Error("请选择邮箱域名")
+      const localPart = String(form.get("localPart") || "").trim()
+      if (!localPart) throw new Error("请输入邮箱前缀")
+      const email = `${localPart}@${domain.name}`
+      const inputPassword = String(form.get("password") || "")
+      const confirmPassword = String(form.get("confirmPassword") || "")
+      if (inputPassword !== confirmPassword) throw new Error("两次输入的密码不一致")
+      const password = inputPassword || email
+      if (password.length < 6) throw new Error("密码至少需要 6 位")
+      return api.createUser({ email, displayName: String(form.get("displayName") || ""), password, role: "user", disabled: false, mailboxLimitOverride: mailboxLimitFromForm(form), storageQuotaMb: Number(form.get("storageQuotaMb") || defaultUserStorageQuotaMb), permissionGroupIds })
+    },
     onSuccess: () => { invalidateAdmin(qc); setOpen(false); toast({ title: "账号已创建" }) },
     onError: (e) => toast({ title: "创建失败", description: e.message }),
   })
   return (
     <Dialog open={open} onOpenChange={setOpen}>
-      <DialogTrigger asChild><Button size="sm"><Plus className="h-4 w-4" />账号</Button></DialogTrigger>
+      <DialogTrigger asChild><Button size="sm">添加账号</Button></DialogTrigger>
       <DialogContent>
-        <DialogHeader><DialogTitle>创建账号</DialogTitle></DialogHeader>
+        <DialogHeader><DialogTitle>创建用户账号</DialogTitle></DialogHeader>
         <form className="space-y-4" onSubmit={(event) => { event.preventDefault(); create.mutate(new FormData(event.currentTarget)) }}>
-          <Field name="email" label="主登录邮箱" type="email" autoComplete="off" placeholder="user@example.com" />
-          <Field name="displayName" label="显示名称" placeholder="账号名称" />
-          <Field name="password" label="初始密码" type="password" minLength={6} />
+          <DomainSelect domains={domains} value={domainId} onChange={setDomainId} />
           <div className="grid grid-cols-2 gap-3">
-            <SelectField label="身份" value="user" onValueChange={() => undefined} items={[["user", "普通用户"]]} disabled />
-            <SelectField label="状态" value={status} onValueChange={setStatus} items={[["active", "正常"], ["disabled", "停用"]]} />
+            <Field name="localPart" label="邮箱前缀" placeholder="user" />
+            <Field name="displayName" label="显示名称" placeholder="例如：SZX" />
           </div>
-          <MailboxLimitField defaultValue={defaultMailboxLimitOverride} />
-          <DialogFooter><Button disabled={create.isPending}>{create.isPending ? "创建中..." : "创建"}</Button></DialogFooter>
+          <div className="grid grid-cols-1 gap-3 sm:grid-cols-2">
+            <Field name="password" label="密码（留空则使用邮箱账号）" type="password" required={false} autoComplete="new-password" />
+            <Field name="confirmPassword" label="再次输入密码" type="password" required={false} autoComplete="new-password" />
+          </div>
+          <SelectField label="身份" value="user" onValueChange={() => undefined} items={[["user", "普通用户"]]} disabled />
+          <div className="grid grid-cols-1 gap-3 sm:grid-cols-2">
+            <MailboxLimitField defaultValue={defaultMailboxLimitOverride} />
+            <Field name="storageQuotaMb" label="共享存储容量（MB）" type="number" min={100} defaultValue={String(defaultUserStorageQuotaMb)} />
+          </div>
+          <PermissionGroupPicker groups={permissionGroups} value={permissionGroupIds} onChange={setPermissionGroupIds} />
+          <DialogFooter><Button disabled={create.isPending || !domainId}>{create.isPending ? "创建中..." : "创建用户账号"}</Button></DialogFooter>
         </form>
       </DialogContent>
     </Dialog>
   )
 }
 
-function MailboxActions({ mailbox, users, canUpdate, onDelete }: { mailbox: MailboxType; users: AdminUser[]; canUpdate: boolean; onDelete?: () => void }) {
-  const [open, setOpen] = React.useState(false)
-  if (!canUpdate && !onDelete) return null
-  return <><DropdownMenu><DropdownMenuTrigger asChild><Button variant="ghost" size="icon"><MoreHorizontal className="h-4 w-4" /></Button></DropdownMenuTrigger><DropdownMenuContent align="end">{canUpdate && <DropdownMenuItem onSelect={() => setOpen(true)}>编辑邮箱</DropdownMenuItem>}{canUpdate && onDelete && <DropdownMenuSeparator />}{onDelete && <DropdownMenuItem className="text-destructive" onSelect={onDelete}>删除邮箱</DropdownMenuItem>}</DropdownMenuContent></DropdownMenu>{canUpdate && <EditMailboxDialog mailbox={mailbox} users={users} open={open} onOpenChange={setOpen} />}</>
-}
-
 function AliasActions({ alias, onToggle, onDelete }: { alias: Alias; onToggle?: () => void; onDelete?: () => void }) {
   if (!onToggle && !onDelete) return null
-  return <DropdownMenu><DropdownMenuTrigger asChild><Button variant="ghost" size="icon"><MoreHorizontal className="h-4 w-4" /></Button></DropdownMenuTrigger><DropdownMenuContent align="end">{onToggle && <DropdownMenuItem onSelect={onToggle}>{alias.enabled ? "停用" : "启用"}</DropdownMenuItem>}{onToggle && onDelete && <DropdownMenuSeparator />}{onDelete && <DropdownMenuItem className="text-destructive" onSelect={onDelete}>删除转发</DropdownMenuItem>}</DropdownMenuContent></DropdownMenu>
+  return <DropdownMenu><DropdownMenuTrigger asChild><Button variant="ghost" size="icon" aria-label={`管理转发 ${alias.source}`} title="更多操作"><MoreHorizontal className="h-4 w-4" /></Button></DropdownMenuTrigger><DropdownMenuContent align="end">{onToggle && <DropdownMenuItem onSelect={onToggle}>{alias.enabled ? "停用" : "启用"}</DropdownMenuItem>}{onToggle && onDelete && <DropdownMenuSeparator />}{onDelete && <DropdownMenuItem className="text-destructive" onSelect={onDelete}>删除转发</DropdownMenuItem>}</DropdownMenuContent></DropdownMenu>
 }
 
 function EditUserDialog({ user, permissionGroups, open, onOpenChange }: { user: AdminUser; permissionGroups: PermissionGroup[]; open: boolean; onOpenChange: (open: boolean) => void }) {
@@ -2038,6 +2117,7 @@ function EditUserDialog({ user, permissionGroups, open, onOpenChange }: { user:
       role,
       disabled: disabled === "disabled",
       mailboxLimitOverride: role === "user" ? mailboxLimitFromForm(form, effectiveMailboxLimit(user)) : undefined,
+      storageQuotaMb: Number(form.get("storageQuotaMb") || user.storageQuotaMb || defaultStorageQuotaMb(user.role)),
       permissionGroupIds: role === "user" ? permissionGroupIds : [],
     }),
     onSuccess: () => { invalidateAdmin(qc); onOpenChange(false); toast({ title: "账号已更新" }) },
@@ -2054,7 +2134,10 @@ function EditUserDialog({ user, permissionGroups, open, onOpenChange }: { user:
             <SelectField label="身份" value={role} onValueChange={(value) => setRole(value as "admin" | "user")} items={user.role === "admin" ? [["admin", "管理员"]] : [["user", "普通用户"]]} disabled />
             <SelectField label="状态" value={disabled} onValueChange={setDisabled} items={[["active", "正常"], ["disabled", "停用"]]} disabled={user.protected || user.role === "admin"} />
           </div>
-          {role === "user" && !user.protected && <MailboxLimitField defaultValue={effectiveMailboxLimit(user)} />}
+          <div className="grid grid-cols-1 gap-3 sm:grid-cols-2">
+            {role === "user" && !user.protected && <MailboxLimitField defaultValue={effectiveMailboxLimit(user)} />}
+            <Field name="storageQuotaMb" label="共享存储容量（MB）" type="number" min={100} defaultValue={String(user.storageQuotaMb || defaultStorageQuotaMb(user.role))} />
+          </div>
           {role === "user" && !user.protected && <PermissionGroupPicker groups={permissionGroups} value={permissionGroupIds} onChange={setPermissionGroupIds} />}
           <DialogFooter><Button disabled={mut.isPending}>{mut.isPending ? "保存中..." : "保存"}</Button></DialogFooter>
         </form>
@@ -2068,17 +2151,10 @@ function ResetPasswordDialog({ user, open, onOpenChange }: { user: AdminUser; op
   return <Dialog open={open} onOpenChange={onOpenChange}><DialogContent><DialogHeader><DialogTitle>重置密码</DialogTitle></DialogHeader><form className="space-y-4" onSubmit={(e) => { e.preventDefault(); mut.mutate(new FormData(e.currentTarget)); e.currentTarget.reset() }}><Field name="email" label="主登录邮箱" value={accountPrimaryEmail(user)} readOnly /><Field name="password" label="新密码" type="password" minLength={6} /><DialogFooter><Button disabled={mut.isPending}>{mut.isPending ? "重置中..." : "重置"}</Button></DialogFooter></form></DialogContent></Dialog>
 }
 
-function EditMailboxDialog({ mailbox, users, open, onOpenChange }: { mailbox: MailboxType; users: AdminUser[]; open: boolean; onOpenChange: (open: boolean) => void }) {
-  const qc = useQueryClient(); const { toast } = useToast(); const [userId, setUserId] = React.useState(mailbox.userId); const [status, setStatus] = React.useState(mailbox.status)
-  React.useEffect(() => { setUserId(mailbox.userId); setStatus(mailbox.status) }, [mailbox, open])
-  const mut = useMutation({ mutationFn: (form: FormData) => api.updateMailbox(mailbox.id, { userId, displayName: String(form.get("displayName") || ""), quotaMb: Number(form.get("quotaMb") || 1024), status }), onSuccess: () => { invalidateAdmin(qc); onOpenChange(false); toast({ title: "邮箱已更新" }) }, onError: (e) => toast({ title: "更新失败", description: e.message }) })
-  return <Dialog open={open} onOpenChange={onOpenChange}><DialogContent><DialogHeader><DialogTitle>编辑邮箱</DialogTitle></DialogHeader><form className="space-y-4" onSubmit={(e) => { e.preventDefault(); mut.mutate(new FormData(e.currentTarget)) }}><Field name="address" label="邮箱地址" value={mailbox.address} readOnly /><SelectField label="归属账号" value={userId} onValueChange={setUserId} items={users.filter((u) => !u.disabled).map((u) => [u.id, u.email])} /><div className="grid grid-cols-2 gap-3"><Field name="displayName" label="显示名称" defaultValue={mailbox.displayName} /><Field name="quotaMb" label="配额 MB" type="number" defaultValue={String(mailbox.quotaMb)} /></div><SelectField label="状态" value={status} onValueChange={setStatus} items={[['active','启用'],['disabled','停用']]} /><DialogFooter><Button disabled={mut.isPending}>{mut.isPending ? "保存中..." : "保存"}</Button></DialogFooter></form></DialogContent></Dialog>
-}
-
 function CreateDomainDialog() {
   const qc = useQueryClient(); const { toast } = useToast(); const [open, setOpen] = React.useState(false)
   const mut = useMutation({ mutationFn: (form: FormData) => api.createDomain(String(form.get("name"))), onSuccess: () => { invalidateAdmin(qc); setOpen(false); toast({ title: "域名已创建" }) }, onError: (e) => toast({ title: "创建失败", description: e.message }) })
-  return <Dialog open={open} onOpenChange={setOpen}><DialogTrigger asChild><Button variant="outline"><Plus className="h-4 w-4" />域名</Button></DialogTrigger><DialogContent><DialogHeader><DialogTitle>添加域名</DialogTitle></DialogHeader><form className="space-y-4" onSubmit={(e) => { e.preventDefault(); mut.mutate(new FormData(e.currentTarget)) }}><Field name="name" label="域名" placeholder="example.com" /><DialogFooter><Button disabled={mut.isPending}>创建</Button></DialogFooter></form></DialogContent></Dialog>
+  return <Dialog open={open} onOpenChange={setOpen}><DialogTrigger asChild><Button className="self-start">添加域名</Button></DialogTrigger><DialogContent><DialogHeader><DialogTitle>添加域名</DialogTitle></DialogHeader><form className="space-y-4" onSubmit={(e) => { e.preventDefault(); mut.mutate(new FormData(e.currentTarget)) }}><Field name="name" label="域名" placeholder="example.com" /><DialogFooter><Button disabled={mut.isPending}>创建</Button></DialogFooter></form></DialogContent></Dialog>
 }
 
 function CreateMailboxDialog({ domains, users }: { domains: Domain[]; users: AdminUser[] }) {
@@ -2086,7 +2162,6 @@ function CreateMailboxDialog({ domains, users }: { domains: Domain[]; users: Adm
   const { toast } = useToast()
   const [open, setOpen] = React.useState(false)
   const [domainId, setDomainId] = React.useState("")
-  const [ownerMode, setOwnerMode] = React.useState("new")
   const [userId, setUserId] = React.useState("")
   React.useEffect(() => {
     if (!domainId && domains[0]) setDomainId(domains[0].id)
@@ -2096,38 +2171,22 @@ function CreateMailboxDialog({ domains, users }: { domains: Domain[]; users: Adm
     mutationFn: (form: FormData) => api.createMailbox({
       domainId,
       localPart: String(form.get("localPart")),
-      displayName: String(form.get("displayName")),
-      password: String(form.get("password")),
-      quotaMb: Number(form.get("quotaMb") || 1024),
-      role: "user",
-      ownerEmail: String(form.get("ownerEmail") || ""),
-      userId: ownerMode === "existing" ? userId : "",
+      userId,
     }),
     onSuccess: () => { invalidateAdmin(qc); setOpen(false); toast({ title: "邮箱已创建" }) },
     onError: (e) => toast({ title: "创建失败", description: e.message }),
   })
   return (
     <Dialog open={open} onOpenChange={setOpen}>
-      <DialogTrigger asChild><Button><Plus className="h-4 w-4" />邮箱</Button></DialogTrigger>
+      <DialogTrigger asChild><Button>添加邮箱</Button></DialogTrigger>
       <DialogContent>
         <DialogHeader><DialogTitle>创建邮箱</DialogTitle></DialogHeader>
         <form className="space-y-4" onSubmit={(e) => { e.preventDefault(); mut.mutate(new FormData(e.currentTarget)) }}>
           <DomainSelect domains={domains} value={domainId} onChange={setDomainId} />
-          <div className="grid grid-cols-2 gap-3">
-            <Field name="localPart" label="邮箱前缀" placeholder="alice" />
-            <Field name="displayName" label="显示名" placeholder="Alice" />
-          </div>
-          <SelectField label="归属方式" value={ownerMode} onValueChange={setOwnerMode} items={[["new", "新建/按主登录邮箱匹配账号"], ["existing", "追加到已有账号"]]} />
-          {ownerMode === "existing" ? (
-            <SelectField label="已有账号" value={userId} onValueChange={setUserId} items={users.filter((u) => !u.disabled).map((u) => [u.id, accountPrimaryEmail(u)])} />
-          ) : (
-            <Field name="ownerEmail" label="主登录邮箱" placeholder="留空则使用新邮箱地址" required={false} />
-          )}
-          <div className="grid grid-cols-2 gap-3">
-            <Field name="password" label="密码" type="password" placeholder="至少 6 位" />
-            <Field name="quotaMb" label="配额 MB" type="number" defaultValue="1024" />
-          </div>
-          <DialogFooter><Button disabled={mut.isPending || !domainId}>创建</Button></DialogFooter>
+          <Field name="localPart" label="邮箱前缀" placeholder="alice" />
+          <SelectField label="绑定用户账号" value={userId} onValueChange={setUserId} items={users.filter((item) => !item.disabled).sort(compareAdminUsers).map((item) => [item.id, accountPrimaryEmail(item)])} />
+          <p className="text-xs text-muted-foreground">该邮箱使用绑定账号的登录密码；账号修改密码后会自动同步。</p>
+          <DialogFooter><Button disabled={mut.isPending || !domainId || !userId}>{mut.isPending ? "创建中..." : "创建邮箱"}</Button></DialogFooter>
         </form>
       </DialogContent>
     </Dialog>
@@ -2138,7 +2197,7 @@ function CreateAliasDialog({ domains }: { domains: Domain[] }) {
   const qc = useQueryClient(); const { toast } = useToast(); const [open, setOpen] = React.useState(false); const [domainId, setDomainId] = React.useState("")
   React.useEffect(() => { if (!domainId && domains[0]) setDomainId(domains[0].id) }, [domains, domainId])
   const mut = useMutation({ mutationFn: (form: FormData) => api.createAlias({ domainId, source: String(form.get("source")), destination: String(form.get("destination")), enabled: true }), onSuccess: () => { invalidateAdmin(qc); setOpen(false); toast({ title: "转发已创建" }) }, onError: (e) => toast({ title: "创建失败", description: e.message }) })
-  return <Dialog open={open} onOpenChange={setOpen}><DialogTrigger asChild><Button variant="outline"><Plus className="h-4 w-4" />转发</Button></DialogTrigger><DialogContent><DialogHeader><DialogTitle>创建邮件转发</DialogTitle></DialogHeader><form className="space-y-4" onSubmit={(e) => { e.preventDefault(); mut.mutate(new FormData(e.currentTarget)) }}><DomainSelect domains={domains} value={domainId} onChange={setDomainId} /><Field name="source" label="来源" placeholder="sales 或 sales@example.com" /><Field name="destination" label="目标邮箱" placeholder="alice@example.com" /><DialogFooter><Button disabled={mut.isPending || !domainId}>创建</Button></DialogFooter></form></DialogContent></Dialog>
+  return <Dialog open={open} onOpenChange={setOpen}><DialogTrigger asChild><Button className="self-start">添加转发</Button></DialogTrigger><DialogContent><DialogHeader><DialogTitle>创建邮件转发</DialogTitle></DialogHeader><form className="space-y-4" onSubmit={(e) => { e.preventDefault(); mut.mutate(new FormData(e.currentTarget)) }}><DomainSelect domains={domains} value={domainId} onChange={setDomainId} /><Field name="source" label="来源" placeholder="sales 或 sales@example.com" /><Field name="destination" label="目标邮箱" placeholder="alice@example.com" /><DialogFooter><Button disabled={mut.isPending || !domainId}>创建</Button></DialogFooter></form></DialogContent></Dialog>
 }
 
 function DNSPanel({ domain, embedded = false }: { domain?: Domain; embedded?: boolean }) {
@@ -2146,15 +2205,15 @@ function DNSPanel({ domain, embedded = false }: { domain?: Domain; embedded?: bo
   const user = me.data?.user
   const canCheckDNS = hasPermission(user, "admin.dns.check")
   const { toast } = useToast(); const qc = useQueryClient(); const records = useQuery({ queryKey: ["dns-records", domain?.id], queryFn: () => api.dnsRecords(domain!.id), enabled: !!domain })
-  const check = useMutation({ mutationFn: () => api.checkDns(domain!.id), onSuccess: (res) => { qc.invalidateQueries({ queryKey: ["admin", "domains"] }); toast({ title: res.status === "ok" ? "DNS 检测通过" : "DNS 检测未通过", description: Object.values(res.checks).map((c) => c.message).join("；") }) } })
+  const check = useMutation({ mutationFn: () => api.checkDns(domain!.id), onSuccess: (res) => { qc.invalidateQueries({ queryKey: ["admin", "domains"] }); toast({ title: res.status === "ok" ? "DNS 检测通过" : "DNS 检测未通过", description: Object.values(res.checks).map((c) => c.message).join("；") }) }, onError: (error) => toast({ title: "DNS 检测失败", description: error.message }) })
   if (!domain) return <Card><CardContent className="p-6 text-muted-foreground">请选择域名</CardContent></Card>
   const content = <>
     <p className="mb-3 text-sm text-muted-foreground">以下为需要在域名 DNS 管理中添加的记录：</p>
-    <div className="space-y-3">{records.data?.items.map((r) => <DNSRecordRow key={`${r.type}-${r.name}`} record={r} />)}</div>
+    {records.isError ? <QueryFailure error={records.error} onRetry={() => { void records.refetch() }} compact /> : <div className="space-y-3">{records.data?.items.map((r) => <DNSRecordRow key={`${r.type}-${r.name}`} record={r} />)}</div>}
     {check.data && <>
       <Separator className="my-4" />
       <div className="flex items-center gap-2 text-sm font-medium text-muted-foreground"><CheckCircle2 className="h-4 w-4" />检测结果</div>
-      <div className="mt-2 space-y-2">{Object.entries(check.data.checks).map(([k, v]) => <div key={k} className="flex items-center gap-2 text-sm"><CheckCircle2 className={`h-4 w-4 shrink-0 ${v.ok ? "text-green-600" : "text-destructive"}`} /><span className="font-medium">{k.toUpperCase()}:</span> {v.message}</div>)}</div>
+      <div className="mt-2 space-y-2">{Object.entries(check.data.checks).map(([k, v]) => <DNSCheckRow key={k} name={k} check={v} />)}</div>
     </>}</>
   const checkButton = canCheckDNS ? <Button variant="outline" size="sm" onClick={() => check.mutate()} disabled={check.isPending}><RefreshCcw className="h-4 w-4" />检测</Button> : null
   const header = <div className="flex items-center justify-between"><CardTitle>DNS 记录</CardTitle>{checkButton}</div>
@@ -2162,6 +2221,20 @@ function DNSPanel({ domain, embedded = false }: { domain?: Domain; embedded?: bo
   return <Card><CardHeader>{header}</CardHeader><CardContent>{content}</CardContent></Card>
 }
 
+function DNSCheckRow({ name, check }: { name: string; check: { ok: boolean; message: string; found?: string[] } }) {
+  const visibleRecords = check.found?.filter(Boolean) ?? []
+  return <div className="space-y-1 text-sm">
+    <div className="flex items-start gap-2">
+      <CheckCircle2 className={`mt-0.5 h-4 w-4 shrink-0 ${check.ok ? "text-green-600" : "text-destructive"}`} />
+      <div className="min-w-0"><span className="font-medium">{name.toUpperCase()}:</span> {check.message}</div>
+    </div>
+    {!check.ok && visibleRecords.length > 0 && <div className="ml-6 rounded-md bg-muted/60 px-3 py-2 font-mono text-xs text-muted-foreground">
+      <div className="mb-1 font-sans text-foreground">当前解析</div>
+      <div className="space-y-1">{visibleRecords.map((record, index) => <div key={`${name}-${index}`} className="break-all">{record}</div>)}</div>
+    </div>}
+  </div>
+}
+
 function dnsDescription(record: DNSRecord): string {
   if (record.type === "TXT" && record.name.startsWith("_dmarc")) return "声明域名的 DMARC 策略（如何处理未通过 SPF/DKIM 验证的邮件）。"
   if (record.type === "TXT" && record.value.includes("DKIM1")) return "DKIM 公钥。收件服务器用此密钥验证邮件是否由你发出。"
@@ -2171,18 +2244,32 @@ function dnsDescription(record: DNSRecord): string {
 }
 
 function DNSRecordRow({ record }: { record: DNSRecord }) {
-  const { toast } = useToast(); const text = `${record.type} ${record.name} ${record.value}`
+  const { toast } = useToast()
   const desc = dnsDescription(record)
+  async function copyField(label: string, value: string) {
+    await navigator.clipboard.writeText(value)
+    toast({ title: `${label}已复制` })
+  }
   return <div className="rounded-lg border bg-card p-3">
-    <div className="mb-2 flex items-center justify-between">
+    <div className="mb-2 flex items-center">
       <Badge variant="outline" className="font-mono">{record.type}</Badge>
-      <Button size="sm" variant="ghost" className="h-7 gap-1 text-xs" onClick={() => { navigator.clipboard.writeText(text); toast({ title: "已复制" }) }}><Copy className="h-3.5 w-3.5" />复制</Button>
     </div>
     {desc && <p className="mb-2 text-xs text-muted-foreground">{desc}</p>}
-    <div className="break-all font-mono text-xs text-muted-foreground">
-      <div><span className="text-foreground">Name:</span> {record.name}</div>
-      <div><span className="text-foreground">Value:</span> {record.value}</div>
-      <div><span className="text-foreground">TTL:</span> {record.ttl}s</div>
+    <div className="space-y-1 font-mono text-xs text-muted-foreground">
+      <div className="grid grid-cols-[4.5rem_minmax(0,1fr)_1.75rem] items-start gap-2">
+        <span className="pt-1 text-foreground">主机记录</span>
+        <code className="break-all pt-1 font-mono">{record.name}</code>
+        <Button type="button" size="icon" variant="ghost" className="h-7 w-7" aria-label="复制主机记录" title="复制主机记录" onClick={() => copyField("主机记录", record.name)}><Copy className="h-3.5 w-3.5" /></Button>
+      </div>
+      <div className="grid grid-cols-[4.5rem_minmax(0,1fr)_1.75rem] items-start gap-2">
+        <span className="pt-1 text-foreground">记录值</span>
+        <code className="break-all pt-1 font-mono">{record.value}</code>
+        <Button type="button" size="icon" variant="ghost" className="h-7 w-7" aria-label="复制记录值" title="复制记录值" onClick={() => copyField("记录值", record.value)}><Copy className="h-3.5 w-3.5" /></Button>
+      </div>
+      <div className="grid grid-cols-[4.5rem_minmax(0,1fr)] gap-2">
+        <span className="text-foreground">TTL</span>
+        <code className="font-mono">{record.ttl} 秒</code>
+      </div>
     </div>
   </div>
 }
@@ -2198,19 +2285,25 @@ function fieldNumber(form: FormData, name: string, fallback: number) {
   return Number.isFinite(n) && n > 0 ? n : fallback
 }
 function SwitchRow({ label, checked, onCheckedChange, className = "" }: { label: string; checked: boolean; onCheckedChange: (checked: boolean) => void; className?: string }) {
+  const id = React.useId()
   return (
     <div className={`flex min-h-14 items-center justify-between gap-4 ${className}`}>
-      <Label className="text-base font-medium">{label}</Label>
-      <Switch checked={checked} onCheckedChange={onCheckedChange} />
+      <Label htmlFor={id} className="text-base font-medium">{label}</Label>
+      <Switch id={id} checked={checked} onCheckedChange={onCheckedChange} />
     </div>
   )
 }
-function Field({ label, required = true, ...props }: React.InputHTMLAttributes<HTMLInputElement> & { label: string }) { return <div className="space-y-2"><Label>{label}</Label><Input required={required} {...props} /></div> }
+function Field({ label, required = true, id: suppliedId, ...props }: React.InputHTMLAttributes<HTMLInputElement> & { label: string }) {
+  const generatedId = React.useId()
+  const id = suppliedId || generatedId
+  return <div className="space-y-2"><Label htmlFor={id}>{label}</Label><Input id={id} required={required} {...props} /></div>
+}
 function MailboxLimitField({ defaultValue }: { defaultValue: number }) {
+  const id = React.useId()
   return (
     <div className="space-y-2">
-      <Label>邮箱数量上限</Label>
-      <Input name="mailboxLimitOverride" type="number" min={0} step={1} defaultValue={String(defaultValue)} />
+      <Label htmlFor={id}>邮箱数量上限</Label>
+      <Input id={id} name="mailboxLimitOverride" type="number" min={0} step={1} defaultValue={String(defaultValue)} />
       <div className="text-xs text-muted-foreground">普通用户默认 9 个，填 0 表示不限制。</div>
     </div>
   )
@@ -2222,5 +2315,8 @@ function mailboxLimitFromForm(form: FormData, fallback = defaultMailboxLimitOver
 function effectiveMailboxLimit(user: AdminUser) {
   return user.mailboxLimitOverride ?? user.limits?.maxMailboxCount ?? defaultMailboxLimitOverride
 }
-function SelectField({ label, value, onValueChange, items, disabled = false }: { label: string; value: string; onValueChange: (value: string) => void; items: string[][]; disabled?: boolean }) { return <div className="space-y-2"><Label>{label}</Label><Select value={value} onValueChange={onValueChange} disabled={disabled}><SelectTrigger><SelectValue /></SelectTrigger><SelectContent>{items.map(([value, label]) => <SelectItem key={value} value={value}>{label}</SelectItem>)}</SelectContent></Select></div> }
+function SelectField({ label, value, onValueChange, items, disabled = false }: { label: string; value: string; onValueChange: (value: string) => void; items: string[][]; disabled?: boolean }) {
+  const id = React.useId()
+  return <div className="space-y-2"><Label htmlFor={id}>{label}</Label><Select value={value} onValueChange={onValueChange} disabled={disabled}><SelectTrigger id={id}><SelectValue /></SelectTrigger><SelectContent>{items.map(([value, itemLabel]) => <SelectItem key={value} value={value}>{itemLabel}</SelectItem>)}</SelectContent></Select></div>
+}
 function DomainSelect({ domains, value, onChange }: { domains: Domain[]; value: string; onChange: (value: string) => void }) { return <div className="space-y-2"><Label>域名</Label><Select value={value} onValueChange={onChange}><SelectTrigger><SelectValue placeholder="选择域名" /></SelectTrigger><SelectContent>{domains.map((d) => <SelectItem key={d.id} value={d.id}>{d.name}</SelectItem>)}</SelectContent></Select></div> }

apps/web/src/pages/login.tsx

@@ -1,5 +1,5 @@
 import * as React from "react"
-import { Link, Navigate } from "react-router-dom"
+import { Link, Navigate, useLocation } from "react-router-dom"
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
 import { ArrowRight, KeyRound, LockKeyhole } from "lucide-react"
 import { api } from "@/lib/api"
@@ -10,9 +10,12 @@ import { Button } from "@/components/ui/button"
 import { Input } from "@/components/ui/input"
 import { Label } from "@/components/ui/label"
 import { useToast } from "@/hooks/use-toast"
+import { safeReturnPath } from "@/lib/navigation"
+import { AuthError, AuthLoading } from "@/components/auth-states"
 
 export function LoginPage() {
   const me = useMe()
+  const location = useLocation()
   const qc = useQueryClient()
   const { toast } = useToast()
   const publicSettings = useQuery({ queryKey: ["public-settings"], queryFn: api.publicSettings })
@@ -33,9 +36,12 @@ export function LoginPage() {
     onError: (e) => toast({ title: "登录失败", description: e.message }),
   })
   const turnstileRequired = !!publicSettings.data?.turnstileEnabled
-  if (me.data?.user) return <Navigate to="/" replace />
+  const returnPath = safeReturnPath((location.state as { from?: unknown } | null)?.from)
+  if (me.data?.user) return <Navigate to={returnPath} replace />
+  if (publicSettings.isLoading) return <AuthLoading />
+  if (publicSettings.isError) return <AuthError message={publicSettings.error.message} onRetry={() => { void publicSettings.refetch() }} />
   return (
-    <div className="flex min-h-screen items-center justify-center bg-muted/20 px-4 py-10">
+    <main className="flex min-h-screen items-center justify-center bg-muted/20 px-4 py-10">
       <div className="w-full max-w-[420px]">
         <div className="mb-7 text-center">
           <h1 className="text-3xl font-semibold tracking-tight">NewSzxcn 邮箱</h1>
@@ -82,6 +88,6 @@ export function LoginPage() {
           </div>
         )}
       </div>
-    </div>
+    </main>
   )
 }

apps/web/src/pages/not-found.tsx

@@ -4,7 +4,7 @@ import { Home, MailQuestion } from "lucide-react"
 
 export function NotFoundPage() {
   return (
-    <div className="grid min-h-screen place-items-center bg-background px-4">
+    <main className="grid min-h-screen place-items-center bg-background px-4">
       <div className="w-full max-w-sm text-center">
         <div className="mb-6 flex justify-center">
           <div className="flex h-20 w-20 items-center justify-center rounded-full bg-muted">
@@ -24,6 +24,6 @@ export function NotFoundPage() {
           </Button>
         </div>
       </div>
-    </div>
+    </main>
   )
 }

apps/web/src/pages/register.tsx

@@ -13,6 +13,7 @@ import { useToast } from "@/hooks/use-toast"
 import { PasswordInput } from "@/components/ui/password-input"
 import { TurnstileBox } from "@/components/turnstile-box"
 import { validatePasswordConfirm } from "@/lib/validation"
+import { AuthError, AuthLoading } from "@/components/auth-states"
 
 export function RegisterPage() {
   const me = useMe()
@@ -57,8 +58,10 @@ export function RegisterPage() {
   })
   const turnstileRequired = !!publicSettings.data?.turnstileEnabled
   if (me.data?.user) return <Navigate to="/" replace />
+  if (publicSettings.isLoading) return <AuthLoading />
+  if (publicSettings.isError) return <AuthError message={publicSettings.error.message} onRetry={() => { void publicSettings.refetch() }} />
   return (
-    <div className="flex min-h-screen items-center justify-center bg-muted/20 px-4 py-10">
+    <main className="flex min-h-screen items-center justify-center bg-muted/20 px-4 py-10">
       <div className="w-full max-w-[420px]">
         <div className="mb-7 text-center">
           <h1 className="text-3xl font-semibold tracking-tight">NewSzxcn 邮箱</h1>
@@ -103,7 +106,6 @@ export function RegisterPage() {
               <div className="space-y-2">
                 <Label htmlFor="displayName" className="text-sm font-medium">显示名称</Label>
                 <Input id="displayName" name="displayName" autoComplete="name" required className="h-11 text-base" />
-                <p className="text-xs leading-5 text-muted-foreground">显示名称注册后不可自行修改，如需更换请联系管理员。</p>
               </div>
               <div className="space-y-2">
                 <Label htmlFor="password" className="text-sm font-medium">密码</Label>
@@ -130,6 +132,6 @@ export function RegisterPage() {
           </div>
         )}
       </div>
-    </div>
+    </main>
   )
 }

apps/web/vite.config.ts

@@ -1,19 +1,44 @@
 import path from "node:path"
 import react from "@vitejs/plugin-react"
-import { defineConfig } from "vite"
+import { defineConfig, loadEnv } from "vite"
 
-export default defineConfig({
-  plugins: [react()],
-  resolve: {
-    alias: {
-      "@": path.resolve(__dirname, "./src"),
+export default defineConfig(({ mode }) => {
+  const env = loadEnv(mode, process.cwd(), "")
+  const apiTarget = env.VITE_API_TARGET || "http://localhost:8080"
+
+  return {
+    plugins: [react()],
+    resolve: {
+      alias: {
+        "@": path.resolve(__dirname, "./src"),
+      },
     },
-  },
-  server: {
-    port: 5173,
-    proxy: {
-      "/api": "http://localhost:8080",
-      "/healthz": "http://localhost:8080",
+    server: {
+      port: 5173,
+      proxy: {
+        "/api": apiTarget,
+        "/healthz": apiTarget,
+      },
     },
-  },
+    build: {
+      rolldownOptions: {
+        output: {
+          codeSplitting: {
+            groups: [
+              {
+                name: "prosemirror",
+                test: /node_modules[\\/]prosemirror-/,
+                priority: 30,
+              },
+              {
+                name: "tiptap",
+                test: /node_modules[\\/]@tiptap/,
+                priority: 20,
+              },
+            ],
+          },
+        },
+      },
+    },
+  }
 })

deploy/README.md

@@ -23,7 +23,7 @@ sudo newszxcn-email reset-2fa
 
 一键安装会把配置和数据放在 `/opt/newszxcn-email`，并部署内部 Watchtower 更新服务。该服务不映射公网端口，仅接受带随机令牌的容器内请求；后台“立即更新”也只允许超级管理员执行。
 
-首次安装会依次询问防火墙模式、邮件服务器域名、邮箱地址域名、管理员邮箱/密码和 Web 部署方式。防火墙可以选择自动添加邮局必要端口规则或保留现有规则，不会清空服务器已有防火墙。自动 Web 模式会把容器绑定到 `127.0.0.1:8088`，配置宿主机 Nginx，并使用官方 `acme.sh` 申请和续期证书。管理员邮箱默认 `admin@邮箱地址域名`，自定义管理员密码最少 6 位，留空则生成 12 位密码。
+首次安装会依次询问防火墙模式和邮件服务器域名，自动检测邮箱地址域名，再选择默认 `admin` 前缀或自行创建管理员邮箱前缀，最后输入密码并选择 Web 部署方式。防火墙可以选择自动添加邮局必要端口规则或保留现有规则，不会清空服务器已有防火墙。自动 Web 模式会把容器绑定到 `127.0.0.1:8088`，配置宿主机 Nginx，并使用官方 `acme.sh` 申请和续期证书。例如服务器域名 `mail.newszxcn.com`、选择默认前缀会创建 `admin@newszxcn.com`；自定义管理员密码最少 6 位，留空则生成 12 位密码。
 
 安装后输入 `ns` 可以打开统一管理菜单。更新前会创建包含数据库、镜像、Compose、环境、安装脚本和 Nginx 的回滚快照；更新或健康检查失败时会自动恢复。手动完整回滚前还会单独备份当前数据库，回滚镜像会保持锁定到下一次更新。
 
@@ -181,7 +181,7 @@ TELEGRAM_RELEASE_CHAT_ID
 - Dovecot 读取同一个 SQLite 数据库进行邮箱认证，并使用 `/var/mail/vhosts` 作为 Maildir 根目录。
 - 第三方客户端可使用 IMAP SSL `993`、POP3 SSL `995`、SMTP SSL `465` 或 Submission `587`。
 - Rspamd 通过 milter 接入 Postfix，负责 DKIM 签名和垃圾邮件标记。
-- Rspamd 会周期性从 SQLite 导出域名 DKIM 私钥到容器内 `/var/lib/rspamd/dkim`。
+- Rspamd 会周期性从 SQLite 导出域名 DKIM 私钥到容器内 `/var/lib/rspamd/dkim`；仅当密钥内容变化时重新载入签名配置，避免继续使用内存中的旧密钥。
 - Go API 是 Webmail 和管理后台入口；浏览器不直接连接 SMTP/IMAP/POP3。
 - Go API 会读取 `LANQIN_MAILDIR_ROOT=/var/mail/vhosts`，周期扫描 Maildir，把 Postfix/Dovecot 入站邮件同步成 Webmail 索引。
 - 第三方客户端可通过 LanQin API 提供的 SMTP `465/587` 发信；Webmail/API 和第三方客户端的“已发送”都由 API 写入，外发投递进入发送队列并由 API worker relay/retry，客户端后续 IMAP APPEND 到 Sent 会按 `Message-ID` 去重。

deploy/rspamd/sync-dkim.sh

@@ -13,8 +13,20 @@ chown_dkim_dir() {
   fi
 }
 
+reload_rspamd() {
+  if command -v rspamadm >/dev/null 2>&1 && rspamadm control reload >/dev/null 2>&1; then
+    echo "Rspamd reloaded after DKIM key update"
+    return 0
+  fi
+  if command -v pkill >/dev/null 2>&1 && pkill -HUP -x rspamd 2>/dev/null; then
+    echo "Rspamd reloaded after DKIM key update"
+  fi
+}
+
 sync_keys() {
+  changed_marker="$LANQIN_RSPAMD_DKIM_DIR/.reload-required.$$"
   mkdir -p "$LANQIN_RSPAMD_DKIM_DIR"
+  rm -f "$changed_marker"
   if [ ! -f "$LANQIN_DB_PATH" ]; then
     chown_dkim_dir
     return 0
@@ -24,13 +36,22 @@ sync_keys() {
     [ -n "$domain" ] || continue
     [ -n "$selector" ] || selector="lanqin"
     keyfile="$LANQIN_RSPAMD_DKIM_DIR/${domain}.${selector}.key"
-    tmpfile="${keyfile}.tmp"
+    tmpfile="${keyfile}.tmp.$$"
     printf '%s' "$private_key" | base64 -d > "$tmpfile"
     chmod 0640 "$tmpfile"
-    mv "$tmpfile" "$keyfile"
+    if [ -f "$keyfile" ] && cmp -s "$tmpfile" "$keyfile"; then
+      rm -f "$tmpfile"
+    else
+      mv "$tmpfile" "$keyfile"
+      : > "$changed_marker"
+    fi
   done
 
   chown_dkim_dir
+  if [ -f "$changed_marker" ]; then
+    rm -f "$changed_marker"
+    reload_rspamd
+  fi
 }
 
 if [ "${1:-}" = "--once" ]; then

docs/GUIDE.md

@@ -1,4 +1,4 @@
-# NewSzxcn 邮箱指南
+# NewSzxcn 邮箱后台配置指南
 
 本指南介绍 NewSzxcn Email 的安装入口、首次配置、邮箱申请、无人收件、SSL 证书和日常更新。管理员密码等敏感信息不会保存在本文档中。
 
@@ -10,7 +10,7 @@
 bash <(curl -fsSL https://raw.githubusercontent.com/zxyszx/NewSzxcn-Email/main/install.sh)
 ```
 
-安装脚本会依次询问防火墙配置、邮件服务器域名、邮箱地址域名、管理员邮箱和密码，以及 Web 部署方式。选择“自动配置 Nginx + SSL”时，脚本会安装 Nginx，并使用官方 `acme.sh` 申请 Let's Encrypt 证书。
+安装脚本会依次询问防火墙配置和邮件服务器域名，自动检测邮箱地址域名，再让你选择默认 `admin` 前缀或自定义管理员邮箱前缀，最后输入密码并选择 Web 部署方式。例如输入服务器域名 `mail.newszxcn.com`，确认检测结果 `@newszxcn.com`，选择 `1. 使用默认前缀 admin` 会创建 `admin@newszxcn.com`；选择 `2. 自定义管理员邮箱前缀` 后才需要输入邮箱账号前缀。选择“自动配置 Nginx + SSL”时，脚本会安装 Nginx，并使用官方 `acme.sh` 申请 Let's Encrypt 证书。
 
 安装完成后，请记录终端中显示的访问地址、管理员邮箱和初始密码。初始密码仅在安装时显示；如果以后在后台修改密码，请以新密码为准。
 

docs/ISSUE_LEDGER.md

@@ -41,6 +41,13 @@
 | NSX-20260806-004 | 2026-08-06 | 已完成 | 前端/UI/响应式布局 | “全部邮箱”选择器右侧存在复制按钮空白占位 | S3 | v1.2.15 | 随 v1.2.15 发布 |
 | NSX-20260806-005 | 2026-08-06 | 已完成 | 后端/通知；前端/设置；部署运维/CI | Telegram 私聊邮件通知与 Release 频道通知 | S3 | v1.2.16 | 随 v1.2.16 发布 |
 | NSX-20260806-006 | 2026-08-06 | 已完成 | 后端/通知；邮件核心；前端/设置；质量复核 | Telegram 邮件通知安全、验证码复制和可靠性复核 | S2 | v1.2.17 | 随 v1.2.17 发布 |
+| NSX-20260806-007 | 2026-08-06 | 已完成 | 前端/UI；后端/通知；部署运维/CI | 邮箱下拉层越界、验证码漏识别、邮件与版本通知链接样式 | S3 | v1.2.18 | 随 v1.2.18 发布 |
+| NSX-20260807-008 | 2026-08-07 | 已完成 | 前端/UI；邮件发送；部署运维/安装 | 全部邮箱写信无法选择发件邮箱且默认项错误，写信窗口过宽；安装管理员邮箱流程需明确 | S3 | v1.2.19 | 随 v1.2.19 发布 |
+| NSX-20260807-009 | 2026-08-07 | 已完成 | 部署运维/安装；文档；质量复核 | 一键安装主菜单未按安装状态区分，命令前置条件和状态显示需复核 | S2 | v1.2.19 | 随 v1.2.19 发布 |
+| NSX-20260807-010 | 2026-08-07 | 已完成 | 邮件投递；DKIM；部署运维；质量复核 | Rspamd 在域名密钥变化后继续使用旧私钥，导致外发邮件 DKIM 验证失败 | S2 | v1.2.19 | 随 v1.2.19 发布，线上 DKIM 已验收通过 |
+| NSX-20260807-011 | 2026-08-07 | 已完成 | 后端/通知；验证码识别；质量复核 | 邮件地址中的字母数字片段触发验证码候选冲突，导致 Telegram 不显示验证码与复制按钮 | S3 | v1.2.19 | 随 v1.2.19 发布 |
+| NSX-20260807-012 | 2026-08-07 | 已完成 | 前端/UI；域名管理；质量复核 | DNS 记录复制按钮把类型、名称和值拼成整行，无法直接粘贴到域名服务商对应字段 | S3 | v1.2.19 | 随 v1.2.19 发布 |
+| NSX-20260807-013 | 2026-08-07 | 已完成 | 邮件核心；前端/标签；数据迁移；质量复核 | 邮箱创建后没有常用默认标签，需要手动逐个建立 | S3 | v1.2.19 | 随 v1.2.19 发布 |
 
 ## NSX-20260804-001
 
@@ -252,3 +259,167 @@
 | 2026-08-06 | 用户确认继续修改，并明确保留现有机器人 Token。 |
 | 2026-08-06 | 完成实现和自动化回归，状态流转为待验收。 |
 | 2026-08-06 | 完成桌面端与移动端页面验收及最终回归，状态流转为已完成。 |
+
+## NSX-20260806-007
+
+| 字段 | 内容 |
+| --- | --- |
+| 编号 | NSX-20260806-007 |
+| 日期 | 2026-08-06 |
+| 状态 | 已完成 |
+| 模块 | 前端/UI；后端/通知；部署运维/CI；质量复核 |
+| 现象 | 邮箱选择器展开层超过侧栏边框；含日期年份的验证码邮件未显示复制按钮；邮件长链接难以阅读；Release 通知底部按钮需改为正文文字链接。 |
+| 根因 | 展开层固定为 21rem，未跟随触发按钮；年份与真实验证码同时进入评分后触发歧义保护；正文仅转义未生成显式链接；Release 工作流使用 inline keyboard。 |
+| 实现 | 展开层宽度跟随触发按钮；排除年份和紧凑日期候选；正文 URL 安全转义并生成链接，长追踪地址缩短显示；Release 移除按钮并在正文末尾加入“查看本次更新”链接。 |
+| 目标版本 | v1.2.18 |
+| 测试结果 | Gate 转发邮件验证码与链接专项测试、Telegram 全部竞态测试、Go 全量测试和 vet、前端 check/build、工作流 YAML、差异格式检查均通过；桌面端“全部邮箱”和具体邮箱状态下触发按钮与下拉层均为 263px，左右边界一致且无控制台错误。 |
+| 发布状态 | 随 v1.2.18 发布。 |
+
+### 历史
+
+| 时间 | 记录 |
+| --- | --- |
+| 2026-08-06 | 用户提供三张截图并确认本批修改范围，问题进入处理中。 |
+| 2026-08-06 | 完成实现、自动化回归和桌面端视觉验收，状态流转为待验收。 |
+| 2026-08-06 | v1.2.18 检查、六个 Docker 镜像、GitHub Release 和 Telegram 频道通知全部成功，状态流转为已完成。 |
+
+## NSX-20260807-008
+
+| 字段 | 内容 |
+| --- | --- |
+| 编号 | NSX-20260807-008 |
+| 日期 | 2026-08-07 |
+| 状态 | 已完成 |
+| 模块 | 前端/UI；邮件发送；部署运维/安装；质量复核 |
+| 现象 | “全部邮箱”状态写信时固定使用列表第一项，无法选择发件邮箱；写信窗口在桌面端过宽；安装时邮件服务器域名、邮箱地址域名和管理员邮箱前缀的关系不够直观。 |
+| 根因 | 全部邮箱状态直接将邮箱列表第一项传入写信组件，组件只支持只读展示单个邮箱；窗口最大宽度为 82rem。 |
+| 实现 | “全部邮箱”写信默认优先匹配当前登录邮箱，并可在全部有效邮箱中切换；回复、转发沿用原邮件所属邮箱；发送、定时发送和草稿自动保存统一使用当前选择的发件邮箱；桌面写信窗口参照 Seek 收窄至最大 72rem；表单仅在新写信会话开始时初始化，切换邮箱或加载签名不会清空已填写内容；安装脚本回归测试明确覆盖 mail.newszxcn.com 对应 admin@newszxcn.com。 |
+| 目标版本 | v1.2.19 |
+| 测试结果 | 前端 check/build、Go 全量测试与 go vet、安装脚本测试、bash 语法检查、ShellCheck、git diff 检查均通过；本地双邮箱页面实测默认选择登录邮箱，下拉项完整，切换邮箱后收件人、主题、正文均保留，数据库确认草稿保存到新选择的邮箱；桌面截图确认写信窗口无溢出和遮挡。 |
+| 发布状态 | 随 v1.2.19 发布。 |
+
+### 历史
+
+| 时间 | 记录 |
+| --- | --- |
+| 2026-08-07 | 用户反馈全部邮箱写信的默认发件箱、邮箱选择和窗口宽度问题，进入处理中。 |
+| 2026-08-07 | 完成写信邮箱选择、默认项、回复/转发邮箱、草稿归属、窗口宽度和安装管理员邮箱交互修改；自动化与页面验收通过，状态流转为待验收。 |
+| 2026-08-07 | v1.2.19 检查、六个 Docker 镜像、GitHub Release 和 Telegram 频道通知全部成功，状态流转为已完成。 |
+
+## NSX-20260807-009
+
+| 字段 | 内容 |
+| --- | --- |
+| 编号 | NSX-20260807-009 |
+| 日期 | 2026-08-07 |
+| 状态 | 已完成 |
+| 模块 | 部署运维/安装；文档；质量复核 |
+| 现象 | 空白服务器仍显示更新、回滚、重启等不可用操作；已安装菜单没有运行状态和实际版本；部分直接命令缺少统一安装前置检查；安装残缺时没有明确修复入口。 |
+| 根因 | 主菜单只根据 `.env` 切换默认选项，所有状态共用一套菜单；运行状态、镜像版本和安装完整性没有独立判断；部分前置检查散落在菜单分发层。 |
+| 实现 | 未安装服务器只显示一键安装和退出；已安装服务器按安装维护、服务管理、证书恢复、账号帮助、危险操作分组，动态显示运行状态、镜像版本和访问地址；安装残缺时默认进入修复；新增 `repair` 命令；服务命令统一校验 `.env` 与 Compose 文件；日志、状态、回滚和卸载的 Docker 检查收回各自函数；修复成功文案和缺失版本标签显示已纠正；README 加入两套主菜单示例。 |
+| 兼容性 | 保持既有菜单编号 `1–12` 和 `ns` 快捷命令；现有配置、数据库、邮件、证书和更新流程不变。 |
+| 测试结果 | Bash 语法检查、ShellCheck、安装脚本全量测试、菜单渲染/范围/分发/状态/版本/残缺安装/前置条件测试、前端 check/build、Go 全量测试和 go vet 均通过。 |
+| 目标版本 | v1.2.19 |
+| 发布状态 | 随 v1.2.19 发布。 |
+
+### 历史
+
+| 时间 | 记录 |
+| --- | --- |
+| 2026-08-07 | 用户确认按安装状态拆分主菜单，并要求写入仓库介绍、复核全部命令逻辑。 |
+| 2026-08-07 | 完成动态菜单、命令前置条件、残缺安装修复入口、README 和自动化回归，状态流转为待验收。 |
+| 2026-08-07 | 随 v1.2.19 完成发布，状态流转为已完成。 |
+
+## NSX-20260807-010
+
+| 字段 | 内容 |
+| --- | --- |
+| 编号 | NSX-20260807-010 |
+| 日期 | 2026-08-07 |
+| 状态 | 已完成 |
+| 模块 | 邮件投递；DKIM；部署运维；质量复核 |
+| 现象 | Gmail 显示 SPF 和 DMARC 通过，但 NewSzxcn 发出的邮件 DKIM 验证失败；同内容的 NodeSeek 对照邮件三项认证均通过。 |
+| 诊断 | NewSzxcn 邮件的 relaxed 正文哈希与 Gmail 收到的 `bh` 精确一致，排除正文传输修改；邮件签名无法由当前 DNS 公钥验证，说明发信时使用了不同私钥。`key not secure` 仅表示 DNSSEC 未验证，TXT 分段也属于正常 DNS 表示。 |
+| 根因 | DKIM 同步任务会覆盖容器内密钥文件，但 Rspamd 已载入的签名密钥不会随文件替换自动更新，域名重建或密钥变化后可能继续使用内存中的旧私钥。 |
+| 实现 | DKIM 同步改为先比较密钥内容；相同密钥不再重复替换，密钥新增或变化后立即重新载入 Rspamd；后台 DNS 检查从“仅判断 DKIM 记录存在”升级为核对实际 `p=` 公钥，明确区分缺失与公钥不一致；新增密钥同步和 DNS 公钥匹配回归，并纳入 CI 与发布检查。 |
+| 兼容性 | 不轮换现有 DKIM 密钥、不修改 DNS；已有数据库、邮件和域名配置保持不变。 |
+| 测试结果 | DKIM 同步专项测试、DNS 公钥匹配测试、Go 全量测试与 vet、安装脚本回归均通过；线上 DKIM 已验收通过。 |
+| 目标版本 | v1.2.19 |
+| 发布状态 | 已随 v1.2.19 发布，线上 DKIM 已验收通过。 |
+
+### 历史
+
+| 时间 | 记录 |
+| --- | --- |
+| 2026-08-07 | 用户提供 Gmail 原始邮件和 NodeSeek 对照邮件，完成正文哈希、签名公钥和认证结果比对。 |
+| 2026-08-07 | 完成 DKIM 密钥热更新修复和专项回归，等待服务器实发验收。 |
+| 2026-08-07 | 修复已随 v1.2.19 发布；保留待验收状态，需升级后确认 Gmail 原始邮件显示 `dkim=pass`。 |
+| 2026-08-08 | 用户确认 DKIM 已通过，状态流转为已完成。 |
+
+## NSX-20260807-011
+
+| 字段 | 内容 |
+| --- | --- |
+| 编号 | NSX-20260807-011 |
+| 日期 | 2026-08-07 |
+| 状态 | 已完成 |
+| 模块 | 后端/通知；验证码识别；质量复核 |
+| 现象 | 爱奇艺邮件的主题和正文均包含验证码 `825534`，Telegram 通知却没有独立验证码区域和“复制验证码”按钮。 |
+| 根因 | 正文开头的收件地址 `iqiyi02@newszxcn.com` 被拆成 `iqiyi02`、`newszxcn` 两个候选；它们与主题中的“验证码”距离较近，触发多候选歧义保护后返回空结果。 |
+| 实现 | 验证码评分前排除邮箱地址和 HTTP/HTTPS 链接范围内的字母数字片段，保留真实正文与主题候选；新增爱奇艺原始场景回归，同时检查独立验证码区域和复制按钮。 |
+| 测试结果 | 爱奇艺原始场景、Gate 验证码与链接、Telegram 消息预算专项测试及 Go 全量测试均通过。 |
+| 目标版本 | v1.2.19 |
+| 发布状态 | 随 v1.2.19 发布。 |
+
+### 历史
+
+| 时间 | 记录 |
+| --- | --- |
+| 2026-08-07 | 用户提供 Telegram 实际通知截图，完成邮箱地址候选冲突复现。 |
+| 2026-08-07 | 修复邮箱和链接候选排除逻辑，加入爱奇艺验证码专项回归。 |
+| 2026-08-07 | 随 v1.2.19 完成发布，状态流转为已完成。 |
+
+## NSX-20260807-012
+
+| 字段 | 内容 |
+| --- | --- |
+| 编号 | NSX-20260807-012 |
+| 日期 | 2026-08-07 |
+| 状态 | 已完成 |
+| 模块 | 前端/UI；域名管理；质量复核 |
+| 现象 | DNS 记录顶部“复制”会得到 `TXT newszxcn.com v=spf1 mx -all`，不能直接粘贴到域名服务商的主机记录和记录值输入框。 |
+| 实现 | 删除整行复制；每条记录明确展示记录类型、主机记录、记录值和 TTL；主机记录与记录值分别提供图标复制和对应成功提示，TTL 仅展示。 |
+| 测试结果 | 前端 check/build 通过；本地页面确认 SPF 主机记录和记录值分别复制为 `lanqin.local` 与 `v=spf1 mx -all`，DKIM 长记录正常换行且弹窗没有横向溢出。 |
+| 目标版本 | v1.2.19 |
+| 发布状态 | 随 v1.2.19 发布。 |
+
+### 历史
+
+| 时间 | 记录 |
+| --- | --- |
+| 2026-08-07 | 用户提供 DNS 弹窗截图并指出整行复制无法直接用于 DNS 面板。 |
+| 2026-08-07 | 完成主机记录和记录值分离复制。 |
+| 2026-08-07 | 随 v1.2.19 完成发布，状态流转为已完成。 |
+
+## NSX-20260807-013
+
+| 字段 | 内容 |
+| --- | --- |
+| 编号 | NSX-20260807-013 |
+| 日期 | 2026-08-07 |
+| 状态 | 已完成 |
+| 模块 | 邮件核心；前端/标签；数据迁移；质量复核 |
+| 需求 | 邮箱默认增加个人、家人、朋友、工作、重要五个常用标签，并按名称使用容易辨认的颜色。 |
+| 实现 | 新邮箱创建时由后端事务生成五个标签；已有邮箱升级时一次性补齐；固定顺序为个人、家人、朋友、工作、重要，颜色依次为绿色、玫红、青色、蓝色、橙色；用户后续删除标签不会在重启时恢复；“全部邮箱”按名称合并同名标签并汇总数量，点击或导出时覆盖用户名下所有邮箱。 |
+| 兼容性 | 使用 `INSERT OR IGNORE` 保留已有同名标签及其颜色和邮件关联；不修改用户自建标签。 |
+| 测试结果 | 新邮箱创建、旧邮箱补齐、删除后不重建、多邮箱同名汇总与跨邮箱筛选专项测试，以及 Go 全量测试和 vet 均通过；页面确认五个标签各显示一次、顺序正确，颜色与侧栏宽度正确且无越界。 |
+| 目标版本 | v1.2.19 |
+| 发布状态 | 随 v1.2.19 发布。 |
+
+### 历史
+
+| 时间 | 记录 |
+| --- | --- |
+| 2026-08-07 | 用户提供标签侧栏参考并指定五个默认标签。 |
+| 2026-08-07 | 完成新邮箱默认生成、已有邮箱一次性补齐、固定排序和颜色回归；页面复核时发现全部邮箱重复显示，继续完成同名汇总、跨邮箱筛选与导出回归。 |
+| 2026-08-07 | 随 v1.2.19 完成发布，状态流转为已完成。 |

install.sh

@@ -29,12 +29,13 @@ NewSzxcn Email 管理命令
   menu        显示安装与运维菜单
   install     首次安装；已有安装会先完整备份再重新安装
   update      备份数据库并更新到最新版
+  repair      检查并修复现有安装
   status      查看容器与健康状态
   logs        持续查看运行日志
   restart     重启服务并重载 Nginx
   certificate 申请或续期自动模式的 SSL 证书
   rollback    回滚到上次更新前版本
-  guide       显示并更新 NewSzxcn 邮箱指南
+  guide       显示并更新邮箱后台配置指南
   credentials 查看管理员登录信息和记录密码
   reset-password 重置管理员统一登录密码（含名下邮箱）
   reset-2fa   应急关闭唯一管理员双因素认证
@@ -202,6 +203,18 @@ env_value() {
   sed -n "s/^${key}=//p" "${INSTALL_DIR}/.env" | tail -n 1
 }
 
+installation_configured() {
+  [[ -f "${INSTALL_DIR}/.env" ]]
+}
+
+installation_complete() {
+  installation_configured && [[ -f "${INSTALL_DIR}/docker-compose.yml" ]]
+}
+
+require_installation() {
+  installation_complete || fail "尚未完成安装，请先运行 newszxcn-email install；如果配置残缺，请运行 newszxcn-email repair。"
+}
+
 prompt_value() {
   local variable="$1" prompt="$2" default_value="$3" secret="${4:-false}"
   local value="${!variable:-}"
@@ -318,8 +331,8 @@ prompt_mail_domain() {
   suggestion="$(suggest_mail_domain "${hostname}")"
   value="${LANQIN_MAIL_DOMAIN:-}"
   if [[ -z "${value}" ]] && has_tty; then
-    prompt_text "[提示] 邮件服务器域名是 ${hostname}；邮箱地址域名可以使用 ${suggestion}，请确认。\n"
-    read -r -p "邮箱地址域名 [${suggestion}]: " value </dev/tty
+    prompt_text "[检测] 邮件服务器域名：${hostname}\n[检测] 邮箱地址域名：@${suggestion}\n"
+    read -r -p "邮箱地址域名 [${suggestion}]（直接回车确认）: " value </dev/tty
   fi
   value="${value:-${suggestion}}"
   if [[ -z "${LANQIN_MAIL_DOMAIN:-}" && -z "${admin_email}" ]] && ! has_tty; then
@@ -342,10 +355,10 @@ prompt_admin_email() {
     return
   fi
   if has_tty; then
-    prompt_text "\n创建管理员邮箱 [1]：\n1. 默认 admin，自动创建 admin@${mail_domain}\n2. 自定义前缀\n"
+    prompt_text "\n检测到邮箱地址域名：@${mail_domain}\n创建管理员邮箱 [1]：\n1. 使用默认前缀 admin\n2. 自定义管理员邮箱前缀\n"
     choice="$(prompt_choice LANQIN_ADMIN_EMAIL_MODE "请选择 [1]: " "1" "2")"
     if [[ "${choice}" == "2" ]]; then
-      prefix="$(prompt_value LANQIN_ADMIN_PREFIX "管理员邮箱前缀" "admin")"
+      prefix="$(prompt_value LANQIN_ADMIN_PREFIX "管理员邮箱账号前缀" "admin")"
     else
       prefix="admin"
     fi
@@ -353,7 +366,9 @@ prompt_admin_email() {
     prefix="${LANQIN_ADMIN_PREFIX:-admin}"
   fi
   valid_mail_local_part "${prefix}" || fail "管理员邮箱前缀格式不正确。"
-  printf '%s@%s' "$(lowercase "${prefix}")" "${mail_domain}"
+  email="$(lowercase "${prefix}")@${mail_domain}"
+  prompt_text "[提示] 将创建管理员邮箱：${email}\n"
+  printf '%s' "${email}"
 }
 
 ensure_admin_email_config() {
@@ -974,42 +989,67 @@ restore_update_snapshot() {
 }
 
 do_repair_install() {
+  installation_configured || fail "尚未安装，无法执行修复。"
+  local snapshot_created="false"
   ensure_docker
-  create_update_snapshot || fail "修复前备份失败，未修改现有安装。"
+  if [[ -f "${INSTALL_DIR}/docker-compose.yml" ]]; then
+    create_update_snapshot || fail "修复前备份失败，未修改现有安装。"
+    snapshot_created="true"
+  else
+    warn "安装缺少 docker-compose.yml，将保留现有配置和数据并重新生成运行文件。"
+  fi
   stage_assets
   clear_runtime_image_pin
   if ! apply_staged_assets || ! ensure_update_token || ! ensure_admin_email_config || ! configure_runtime_bindings; then
-    restore_update_snapshot "" false || true
-    fail "修复准备失败，已恢复原安装。"
+    if [[ "${snapshot_created}" == "true" ]]; then
+      restore_update_snapshot "" false || true
+      fail "修复准备失败，已恢复原安装。"
+    fi
+    fail "修复准备失败，原配置和数据未删除。"
   fi
   if ! (configure_firewall && prepare_directories); then
-    restore_update_snapshot "" false || true
-    fail "修复环境准备失败，已恢复原安装。"
+    if [[ "${snapshot_created}" == "true" ]]; then
+      restore_update_snapshot "" false || true
+      fail "修复环境准备失败，已恢复原安装。"
+    fi
+    fail "修复环境准备失败，原配置和数据未删除。"
   fi
   log "正在拉取并修复 NewSzxcn Email 服务..."
   if ! compose pull; then
-    restore_update_snapshot "" false || true
-    fail "修复镜像拉取失败，已恢复原安装。"
+    if [[ "${snapshot_created}" == "true" ]]; then
+      restore_update_snapshot "" false || true
+      fail "修复镜像拉取失败，已恢复原安装。"
+    fi
+    fail "修复镜像拉取失败，原配置和数据未删除。"
   fi
   log "正在启动服务..."
   if ! compose up -d --remove-orphans; then
-    warn "修复后容器启动失败，正在自动回滚。"
-    restore_update_snapshot || fail "修复失败，且自动恢复未完成，请使用回滚快照手动恢复。"
-    fail "修复失败，已恢复到修复前版本。"
+    if [[ "${snapshot_created}" == "true" ]]; then
+      warn "修复后容器启动失败，正在自动回滚。"
+      restore_update_snapshot || fail "修复失败，且自动恢复未完成，请使用回滚快照手动恢复。"
+      fail "修复失败，已恢复到修复前版本。"
+    fi
+    fail "修复后容器启动失败，请查看实时日志；原配置和数据未删除。"
   fi
   if ! wait_for_health 90; then
-    warn "修复后健康检查失败，正在自动回滚。"
-    restore_update_snapshot || fail "修复失败，且自动恢复未完成，请使用回滚快照手动恢复。"
-    fail "修复失败，已恢复到修复前版本。"
+    if [[ "${snapshot_created}" == "true" ]]; then
+      warn "修复后健康检查失败，正在自动回滚。"
+      restore_update_snapshot || fail "修复失败，且自动恢复未完成，请使用回滚快照手动恢复。"
+      fail "修复失败，已恢复到修复前版本。"
+    fi
+    fail "修复后健康检查失败，请查看实时日志；原配置和数据未删除。"
   fi
   if ! (configure_web_mode); then
-    restore_update_snapshot || fail "Web 配置失败，且自动恢复未完成，请使用回滚快照手动恢复。"
-    fail "Web 配置失败，已恢复到修复前版本。"
+    if [[ "${snapshot_created}" == "true" ]]; then
+      restore_update_snapshot || fail "Web 配置失败，且自动恢复未完成，请使用回滚快照手动恢复。"
+      fail "Web 配置失败，已恢复到修复前版本。"
+    fi
+    fail "Web 配置修复失败，原配置和数据未删除。"
   fi
-  generate_guide >/dev/null || warn "安装成功，但邮箱指南生成失败，可稍后执行 newszxcn-email guide 重试。"
-  success "安装完成：$(env_value LANQIN_PUBLIC_BASE_URL)"
+  generate_guide >/dev/null || warn "修复成功，但邮箱后台配置指南生成失败，可稍后执行 newszxcn-email guide 重试。"
+  success "修复完成：$(env_value LANQIN_PUBLIC_BASE_URL)"
   warn "下一步请配置 MX、SPF、DKIM、DMARC，并确认 25/465/587/993/995 端口可访问。"
-  warn "输入 ns 可打开管理菜单；输入 newszxcn-email guide 可查看邮箱指南。"
+  warn "输入 ns 可打开管理菜单；输入 newszxcn-email guide 可查看邮箱后台配置指南。"
 }
 
 do_install() {
@@ -1031,14 +1071,14 @@ do_install() {
   compose up -d --remove-orphans
   wait_for_health 90 || fail "服务未能通过健康检查，请执行 newszxcn-email logs 查看日志。"
   configure_web_mode
-  generate_guide >/dev/null || warn "安装成功，但邮箱指南生成失败，可稍后执行 newszxcn-email guide 重试。"
+  generate_guide >/dev/null || warn "安装成功，但邮箱后台配置指南生成失败，可稍后执行 newszxcn-email guide 重试。"
   success "安装完成：$(env_value LANQIN_PUBLIC_BASE_URL)"
   warn "下一步请配置 MX、SPF、DKIM、DMARC，并确认 25/465/587/993/995 端口可访问。"
-  warn "输入 ns 可打开管理菜单；输入 newszxcn-email guide 可查看邮箱指南。"
+  warn "输入 ns 可打开管理菜单；输入 newszxcn-email guide 可查看邮箱后台配置指南。"
 }
 
 do_update() {
-  [[ -f "${INSTALL_DIR}/.env" ]] || fail "尚未安装，请先执行 install。"
+  require_installation
   ensure_docker
   create_update_snapshot || fail "更新前备份失败，未修改现有安装。"
   stage_assets
@@ -1063,11 +1103,12 @@ do_update() {
     fail "更新失败，已恢复到更新前版本。"
   fi
   ensure_cli_alias
-  generate_guide >/dev/null || warn "更新成功，但邮箱指南生成失败，可稍后执行 newszxcn-email guide 重试。"
+  generate_guide >/dev/null || warn "更新成功，但邮箱后台配置指南生成失败，可稍后执行 newszxcn-email guide 重试。"
   success "系统已更新，配置、邮件、证书和数据库均已保留。"
 }
 
 do_rollback() {
+  require_installation
   [[ -f "${ROLLBACK_POINTER}" ]] || fail "没有可用的完整回滚快照。"
   local confirm="${LANQIN_ROLLBACK_CONFIRM:-}" image timestamp emergency_backup
   if [[ -z "${confirm}" ]] && has_tty; then
@@ -1085,7 +1126,7 @@ do_rollback() {
 }
 
 reload_services() {
-  [[ -f "${INSTALL_DIR}/docker-compose.yml" ]] || return 0
+  require_installation
   ensure_docker
   compose restart lanqin-email >/dev/null
   if [[ -f "${NGINX_CONFIG}" ]]; then
@@ -1100,14 +1141,14 @@ do_restart() {
 }
 
 do_certificate() {
-  [[ -f "${INSTALL_DIR}/.env" ]] || fail "尚未安装。"
+  require_installation
   [[ "$(env_value LANQIN_INSTALL_WEB_MODE || true)" == "1" ]] || fail "只有自动 Nginx + SSL 模式可使用此命令。"
   ensure_nginx
   write_nginx_http_config
   install_certificate
   write_nginx_https_config
   reload_services
-  generate_guide >/dev/null || warn "证书已应用，但邮箱指南生成失败，可稍后执行 newszxcn-email guide 重试。"
+  generate_guide >/dev/null || warn "证书已应用，但邮箱后台配置指南生成失败，可稍后执行 newszxcn-email guide 重试。"
   success "SSL 证书已安装并应用。"
 }
 
@@ -1140,7 +1181,7 @@ generate_guide() {
   tmp="$(mktemp)"
   cat > "${tmp}" <<EOF
 ==================================================
- NewSzxcn 邮箱指南
+ NewSzxcn 邮箱后台配置指南
 ==================================================
 
 【安装信息】
@@ -1199,7 +1240,7 @@ EOF
 }
 
 do_guide() {
-  generate_guide || fail "尚未安装，无法生成邮箱指南。"
+  generate_guide || fail "尚未安装，无法生成邮箱后台配置指南。"
   cat "${GUIDE_FILE}"
   success "指南已更新并保存到 ${GUIDE_FILE}。"
 }
@@ -1233,7 +1274,7 @@ generate_admin_password_hash() {
 }
 
 do_reset_admin_password() {
-  [[ -f "${INSTALL_DIR}/.env" ]] || fail "尚未安装。"
+  require_installation
   local admin_email password user_id hash image timestamp backup env_backup result user_changes mailbox_changes
   ensure_docker
   ensure_admin_email_config
@@ -1277,7 +1318,7 @@ do_reset_admin_password() {
 }
 
 do_reset_admin_two_factor() {
-  [[ -f "${INSTALL_DIR}/.env" ]] || fail "尚未安装。"
+  require_installation
   local admin_email user_id image timestamp backup result user_changes recovery_changes challenge_changes
   ensure_docker
   ensure_admin_email_config
@@ -1306,7 +1347,8 @@ do_reset_admin_two_factor() {
 }
 
 do_status() {
-  [[ -f "${INSTALL_DIR}/docker-compose.yml" ]] || fail "尚未安装。"
+  require_installation
+  ensure_docker
   compose ps
   if wait_for_health 1; then
     success "Web 与 API 健康检查正常。"
@@ -1315,8 +1357,15 @@ do_status() {
   fi
 }
 
+do_logs() {
+  require_installation
+  ensure_docker
+  compose logs -f --tail=200 lanqin-email updater
+}
+
 do_uninstall() {
-  [[ -f "${INSTALL_DIR}/docker-compose.yml" ]] || fail "尚未安装。"
+  require_installation
+  ensure_docker
   local confirm="${LANQIN_UNINSTALL_CONFIRM:-}" remove_renewal="${LANQIN_REMOVE_CERT_RENEWAL:-}" hostname
   if [[ -z "${confirm}" ]] && has_tty; then
     read -r -p "确认停止并卸载服务吗？邮件和配置将保留。[y/N]: " confirm </dev/tty
@@ -1415,58 +1464,112 @@ do_backup_reinstall() {
   fail "重新安装失败，旧安装已自动恢复。失败的新安装保存在 ${failed_dir}。"
 }
 
-do_menu() {
-  local installed="false" default_choice="1" public_url="" choice
-  if [[ -f "${INSTALL_DIR}/.env" ]]; then
-    installed="true"
-    default_choice="2"
-    public_url="$(env_value LANQIN_PUBLIC_BASE_URL || true)"
+menu_service_status() {
+  local container_id
+  if ! installation_complete; then
+    printf '安装不完整'
+    return
   fi
-
-  prompt_text '\n==================================================\n'
-  prompt_text ' NewSzxcn Email 一键安装与管理\n'
-  prompt_text '==================================================\n'
-  if [[ "${installed}" == "true" ]]; then
-    prompt_text " 状态：已安装\n 路径：${INSTALL_DIR}\n"
-    [[ -n "${public_url}" ]] && prompt_text " 地址：${public_url}\n"
+  if ! command -v docker >/dev/null 2>&1 || ! docker compose version >/dev/null 2>&1; then
+    printf '状态未知'
+    return
+  fi
+  container_id="$(compose ps -q lanqin-email 2>/dev/null | head -n 1 || true)"
+  if [[ -n "${container_id}" ]] && [[ "$(docker inspect --format '{{.State.Running}}' "${container_id}" 2>/dev/null || true)" == "true" ]]; then
+    printf '运行中'
   else
-    prompt_text ' 状态：未安装\n'
+    printf '已停止'
   fi
-  prompt_text '--------------------------------------------------\n'
-  prompt_text ' 1. 安装 / 重新安装（完整备份，失败自动恢复）\n'
-  prompt_text ' 2. 更新系统（数据库备份，失败自动回滚）\n'
-  prompt_text ' 3. 检查并修复现有安装\n'
-  prompt_text ' 4. 查看运行状态\n'
-  prompt_text ' 5. 重启服务\n'
-  prompt_text ' 6. 查看实时日志\n'
-  prompt_text ' 7. 申请、检查或续期 SSL 证书\n'
-  prompt_text ' 8. 回滚到上次更新前版本\n'
-  prompt_text ' 9. NewSzxcn 邮箱指南\n'
-  prompt_text ' 10. 查看管理员登录信息\n'
-  prompt_text ' 11. 重置管理员统一登录密码\n'
-  prompt_text ' 12. 卸载服务（保留数据）\n'
-  prompt_text ' 0. 退出\n'
+}
+
+menu_installed_version() {
+  local image version
+  if ! installation_complete || ! command -v docker >/dev/null 2>&1; then
+    printf '未知'
+    return
+  fi
+  image="$(current_image_id 2>/dev/null || true)"
+  if [[ -n "${image}" ]]; then
+    version="$(docker image inspect --format '{{index .Config.Labels "org.opencontainers.image.version"}}' "${image}" 2>/dev/null || true)"
+  fi
+  [[ "${version:-}" == "<no value>" ]] && version=""
+  printf '%s' "${version:-未知}"
+}
+
+render_uninstalled_menu() {
+  prompt_text '\n==================================================\n'
+  prompt_text '          NewSzxcn Email 管理面板\n'
   prompt_text '==================================================\n'
+  prompt_text '状态：尚未安装\n'
+  prompt_text '--------------------------------------------------\n'
+  prompt_text '1. 一键安装 NewSzxcn Email\n'
+  prompt_text '0. 退出\n'
+  prompt_text '==================================================\n'
+}
 
-  choice="$(prompt_menu_choice "${default_choice}" "12")"
-  if [[ "${choice}" != "0" && "${choice}" != "1" && "${installed}" != "true" ]]; then
-    fail "尚未安装，请先选择 1。"
+render_installed_menu() {
+  local status="$1" version="$2" public_url="$3"
+  prompt_text '\n==================================================\n'
+  prompt_text '          NewSzxcn Email 管理面板\n'
+  prompt_text '==================================================\n'
+  prompt_text "状态：${status}\n"
+  prompt_text "版本：${version}\n"
+  prompt_text "地址：${public_url:-未配置}\n"
+  prompt_text '--------------------------------------------------\n'
+  prompt_text '安装与维护\n'
+  prompt_text '1. 重新安装（完整备份，失败自动恢复）\n'
+  prompt_text '2. 更新系统（自动备份，失败自动回滚）\n'
+  prompt_text '3. 检查并修复现有安装\n\n'
+  prompt_text '服务管理\n'
+  prompt_text '4. 查看运行状态\n'
+  prompt_text '5. 重启服务\n'
+  prompt_text '6. 查看实时日志\n\n'
+  prompt_text '证书与恢复\n'
+  prompt_text '7. 管理 SSL 证书\n'
+  prompt_text '8. 回滚到上次更新前版本\n\n'
+  prompt_text '账号与帮助\n'
+  prompt_text '9. 邮箱后台配置指南\n'
+  prompt_text '10. 查看管理员登录信息\n'
+  prompt_text '11. 重置管理员登录密码\n\n'
+  prompt_text '危险操作\n'
+  prompt_text '12. 卸载服务（保留数据）\n\n'
+  prompt_text '0. 退出\n'
+  prompt_text '==================================================\n'
+}
+
+do_menu() {
+  local default_choice="2" public_url="" choice status version
+  if ! installation_configured; then
+    render_uninstalled_menu
+    choice="$(prompt_menu_choice "1" "1")" || return 1
+    case "${choice}" in
+      0) success "已退出，未作任何修改。" ;;
+      1) do_install ;;
+    esac
+    return
   fi
 
+  public_url="$(env_value LANQIN_PUBLIC_BASE_URL || true)"
+  status="$(menu_service_status)"
+  version="$(menu_installed_version)"
+  [[ "${status}" == "安装不完整" ]] && default_choice="3"
+  render_installed_menu "${status}" "${version}" "${public_url}"
+
+  choice="$(prompt_menu_choice "${default_choice}" "12")" || return 1
   case "${choice}" in
     0) success "已退出，未作任何修改。" ;;
     1) do_install ;;
     2) do_update ;;
     3) do_repair_install ;;
-    4) ensure_docker; do_status ;;
+    4) do_status ;;
     5) do_restart ;;
-    6) ensure_docker; compose logs -f --tail=200 lanqin-email updater ;;
+    6) do_logs ;;
     7) do_certificate ;;
-    8) ensure_docker; do_rollback ;;
+    8) do_rollback ;;
     9) do_guide ;;
     10) do_show_admin_credentials ;;
     11) do_reset_admin_password ;;
-    12) ensure_docker; do_uninstall ;;
+    12) do_uninstall ;;
   esac
 }
 
@@ -1486,16 +1589,17 @@ case "${COMMAND}" in
   menu) require_root; require_curl; do_menu ;;
   install) require_root; require_curl; do_install ;;
   update) require_root; require_curl; do_update ;;
-  status) require_root; require_curl; ensure_docker; do_status ;;
-  logs) require_root; require_curl; ensure_docker; compose logs -f --tail=200 lanqin-email updater ;;
+  repair) require_root; require_curl; do_repair_install ;;
+  status) require_root; require_curl; do_status ;;
+  logs) require_root; require_curl; do_logs ;;
   restart) require_root; require_curl; do_restart ;;
   reload) require_root; require_curl; reload_services ;;
   certificate) require_root; require_curl; do_certificate ;;
-  rollback) require_root; require_curl; ensure_docker; do_rollback ;;
+  rollback) require_root; require_curl; do_rollback ;;
   guide) require_root; require_curl; do_guide ;;
   credentials) require_root; require_curl; do_show_admin_credentials ;;
   reset-password) require_root; require_curl; do_reset_admin_password ;;
   reset-2fa) require_root; require_curl; do_reset_admin_two_factor ;;
-  uninstall) require_root; require_curl; ensure_docker; do_uninstall ;;
+  uninstall) require_root; require_curl; do_uninstall ;;
   *) usage; fail "未知命令：${COMMAND}" ;;
 esac

pnpm-lock.yaml

@@ -81,8 +81,8 @@ importers:
         specifier: 2.1.1
         version: 2.1.1
       dompurify:
-        specifier: 3.4.12
-        version: 3.4.12
+        specifier: 3.4.13
+        version: 3.4.13
       lucide-react:
         specifier: ^0.468.0
         version: 0.468.0(react@18.3.1)
@@ -1022,8 +1022,8 @@ packages:
   dlv@1.1.3:
     resolution: {integrity: sha512-+HlytyjlPKnIG8XuRG8WvmBP8xs8P71y+SKKS6ZXWoEgLuePxtDoUEiH7WkdePWrQ5JBpE6aoVqfZfJUQkjXwA==}
 
-  dompurify@3.4.12:
-    resolution: {integrity: sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==}
+  dompurify@3.4.13:
+    resolution: {integrity: sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ==}
 
   electron-to-chromium@1.5.375:
     resolution: {integrity: sha512-ZWP5eB4BVPW/ZYo9252hQZHZ5XavtsTgpbhcmMmRwymavC5AsLWQWBPaKMeNd2LW0KGby5HPXvj7+sr4ta5j/Q==}
@@ -2447,7 +2447,7 @@ snapshots:
 
   dlv@1.1.3: {}
 
-  dompurify@3.4.12:
+  dompurify@3.4.13:
     optionalDependencies:
       '@types/trusted-types': 2.0.7
 

tests/dkim_sync_test.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+TEMP_DIR="$(mktemp -d)"
+trap 'rm -rf "${TEMP_DIR}"' EXIT
+
+fail_test() {
+  printf 'FAIL: %s\n' "$*" >&2
+  exit 1
+}
+
+mkdir -p "${TEMP_DIR}/bin" "${TEMP_DIR}/keys"
+touch "${TEMP_DIR}/lanqin.db" "${TEMP_DIR}/reload.log"
+
+cat > "${TEMP_DIR}/bin/sqlite3" <<'EOF'
+#!/bin/sh
+printf 'example.com|lanqin|%s\n' "$(cat "${FAKE_PRIVATE_KEY_FILE}")"
+EOF
+cat > "${TEMP_DIR}/bin/id" <<'EOF'
+#!/bin/sh
+exit 1
+EOF
+cat > "${TEMP_DIR}/bin/rspamadm" <<'EOF'
+#!/bin/sh
+printf '%s\n' "$*" >> "${FAKE_RELOAD_LOG}"
+EOF
+cat > "${TEMP_DIR}/bin/pkill" <<'EOF'
+#!/bin/sh
+printf 'unexpected pkill fallback\n' >&2
+exit 1
+EOF
+chmod 0755 "${TEMP_DIR}/bin/sqlite3" "${TEMP_DIR}/bin/id" "${TEMP_DIR}/bin/rspamadm" "${TEMP_DIR}/bin/pkill"
+
+export PATH="${TEMP_DIR}/bin:${PATH}"
+export LANQIN_DB_PATH="${TEMP_DIR}/lanqin.db"
+export LANQIN_RSPAMD_DKIM_DIR="${TEMP_DIR}/keys"
+export FAKE_PRIVATE_KEY_FILE="${TEMP_DIR}/private-key.b64"
+export FAKE_RELOAD_LOG="${TEMP_DIR}/reload.log"
+
+printf 'first-private-key' | base64 > "${FAKE_PRIVATE_KEY_FILE}"
+sh "${ROOT_DIR}/deploy/rspamd/sync-dkim.sh" --once
+[[ "$(cat "${TEMP_DIR}/keys/example.com.lanqin.key")" == "first-private-key" ]] || fail_test "initial DKIM key was not exported"
+[[ "$(wc -l < "${FAKE_RELOAD_LOG}" | tr -d ' ')" == "1" ]] || fail_test "initial DKIM key did not reload Rspamd"
+
+sh "${ROOT_DIR}/deploy/rspamd/sync-dkim.sh" --once
+[[ "$(wc -l < "${FAKE_RELOAD_LOG}" | tr -d ' ')" == "1" ]] || fail_test "unchanged DKIM key reloaded Rspamd"
+
+printf 'second-private-key' | base64 > "${FAKE_PRIVATE_KEY_FILE}"
+sh "${ROOT_DIR}/deploy/rspamd/sync-dkim.sh" --once
+[[ "$(cat "${TEMP_DIR}/keys/example.com.lanqin.key")" == "second-private-key" ]] || fail_test "changed DKIM key was not exported"
+[[ "$(wc -l < "${FAKE_RELOAD_LOG}" | tr -d ' ')" == "2" ]] || fail_test "changed DKIM key did not reload Rspamd"
+
+printf 'DKIM sync tests passed.\n'

tests/install_test.sh

@@ -46,6 +46,10 @@ test_password_validation() {
 test_mail_domain_and_admin_email_validation() {
   assert_eq "example.com" "$(suggest_mail_domain "mail.example.com")" "mail host domain suggestion"
   assert_eq "example.co.uk" "$(suggest_mail_domain "mail.example.co.uk")" "multi-label mail host domain suggestion"
+  assert_eq "newszxcn.com" "$(suggest_mail_domain "mail.newszxcn.com")" "NewSzxcn mail host domain suggestion"
+  assert_eq "admin@newszxcn.com" "$(LANQIN_ADMIN_EMAIL='' LANQIN_ADMIN_PREFIX='' prompt_admin_email "newszxcn.com")" "NewSzxcn default administrator email"
+  assert_eq "newszxcn.cm" "$(suggest_mail_domain "mail.newszxcn.cm")" "two-label suffix mail host domain suggestion"
+  assert_eq "admin@newszxcn.cm" "$(LANQIN_ADMIN_EMAIL='' LANQIN_ADMIN_PREFIX='' prompt_admin_email "newszxcn.cm")" "matching administrator email for entered domain"
   LANQIN_MAIL_DOMAIN="example.com"
   LANQIN_ADMIN_EMAIL="admin@example.com"
   assert_eq "example.com" "$(prompt_mail_domain "mail.example.com")" "explicit mail domain"
@@ -147,6 +151,123 @@ test_menu_choice() {
   unset LANQIN_MENU_ACTION
 }
 
+test_menu_rendering() (
+  local output
+  prompt_text() { printf '%b' "$1"; }
+
+  output="$(render_uninstalled_menu)"
+  [[ "${output}" == *'NewSzxcn Email 管理面板'* ]] || fail_test "uninstalled menu title missing"
+  [[ "${output}" == *'状态：尚未安装'* ]] || fail_test "uninstalled menu status missing"
+  [[ "${output}" == *'1. 一键安装 NewSzxcn Email'* ]] || fail_test "uninstalled menu install action missing"
+  [[ "${output}" != *'更新系统'* ]] || fail_test "uninstalled menu exposes update action"
+  [[ "${output}" != *'卸载服务'* ]] || fail_test "uninstalled menu exposes uninstall action"
+
+  output="$(render_installed_menu "运行中" "v1.2.19" "https://mail.example.com")"
+  for expected in \
+    '状态：运行中' \
+    '版本：v1.2.19' \
+    '地址：https://mail.example.com' \
+    '安装与维护' \
+    '服务管理' \
+    '证书与恢复' \
+    '账号与帮助' \
+    '危险操作' \
+    '9. 邮箱后台配置指南' \
+    '12. 卸载服务（保留数据）'; do
+    [[ "${output}" == *"${expected}"* ]] || fail_test "installed menu item missing: ${expected}"
+  done
+)
+
+test_menu_dispatch() (
+  local temp_dir action_file LANQIN_MENU_ACTION=1
+  temp_dir="$(mktemp -d)"
+  INSTALL_DIR="${temp_dir}/install"
+  action_file="${temp_dir}/action"
+  mkdir -p "${INSTALL_DIR}"
+  prompt_text() { :; }
+  do_install() { printf 'install\n' > "${action_file}"; }
+
+  do_menu
+  grep -Fq 'install' "${action_file}" || fail_test "uninstalled menu did not dispatch install"
+  if (LANQIN_MENU_ACTION=2 do_menu >/dev/null 2>&1); then
+    fail_test "uninstalled menu accepted unavailable update action"
+  fi
+
+  printf 'LANQIN_PUBLIC_BASE_URL=https://mail.example.com\n' > "${INSTALL_DIR}/.env"
+  printf 'services: {}\n' > "${INSTALL_DIR}/docker-compose.yml"
+  menu_service_status() { printf '运行中'; }
+  menu_installed_version() { printf 'v1.2.19'; }
+  do_update() { printf 'update\n' > "${action_file}"; }
+  LANQIN_MENU_ACTION=2
+  do_menu
+  grep -Fq 'update' "${action_file}" || fail_test "installed menu did not dispatch update"
+  unset LANQIN_MENU_ACTION
+)
+
+test_menu_runtime_metadata() (
+  local temp_dir running="true" image_version="v1.2.19"
+  temp_dir="$(mktemp -d)"
+  INSTALL_DIR="${temp_dir}/install"
+  mkdir -p "${INSTALL_DIR}"
+  printf 'LANQIN_PUBLIC_BASE_URL=https://mail.example.com\n' > "${INSTALL_DIR}/.env"
+  printf 'services: {}\n' > "${INSTALL_DIR}/docker-compose.yml"
+  compose() {
+    if [[ "$*" == 'ps -q lanqin-email' ]]; then
+      printf 'container-id\n'
+    fi
+  }
+  current_image_id() { printf 'sha256:test-image\n'; }
+  docker() {
+    if [[ "$*" == 'compose version' ]]; then
+      return 0
+    fi
+    if [[ "$*" == *'.State.Running'* ]]; then
+      printf '%s\n' "${running}"
+      return 0
+    fi
+    if [[ "$*" == *'org.opencontainers.image.version'* ]]; then
+      printf '%s\n' "${image_version}"
+    fi
+  }
+
+  assert_eq "运行中" "$(menu_service_status)" "running menu service status"
+  assert_eq "v1.2.19" "$(menu_installed_version)" "installed menu version"
+  running="false"
+  assert_eq "已停止" "$(menu_service_status)" "stopped menu service status"
+  image_version="<no value>"
+  assert_eq "未知" "$(menu_installed_version)" "missing image version label"
+)
+
+test_incomplete_install_defaults_to_repair() (
+  local temp_dir action_file LANQIN_MENU_ACTION=3
+  temp_dir="$(mktemp -d)"
+  INSTALL_DIR="${temp_dir}/install"
+  action_file="${temp_dir}/action"
+  mkdir -p "${INSTALL_DIR}"
+  printf 'LANQIN_PUBLIC_BASE_URL=https://mail.example.com\n' > "${INSTALL_DIR}/.env"
+  prompt_text() { :; }
+  menu_installed_version() { printf '未知'; }
+  do_repair_install() { printf 'repair\n' > "${action_file}"; }
+  do_menu
+  grep -Fq 'repair' "${action_file}" || fail_test "incomplete installation did not dispatch repair"
+  unset LANQIN_MENU_ACTION
+)
+
+test_service_commands_require_complete_installation() (
+  local temp_dir command_name
+  temp_dir="$(mktemp -d)"
+  INSTALL_DIR="${temp_dir}/install"
+  mkdir -p "${INSTALL_DIR}"
+  # Invoked indirectly by the service command functions under test.
+  # shellcheck disable=SC2317,SC2329
+  ensure_docker() { fail_test "service command checked Docker before installation"; }
+  for command_name in do_update do_status do_logs do_restart do_certificate do_rollback do_reset_admin_password do_reset_admin_two_factor do_uninstall; do
+    if ("${command_name}" >/dev/null 2>&1); then
+      fail_test "${command_name} accepted missing installation"
+    fi
+  done
+)
+
 test_admin_credentials() (
   local temp_dir output
   temp_dir="$(mktemp -d)"
@@ -186,6 +307,7 @@ LANQIN_MAIL_DOMAIN=example.com
 LANQIN_ADMIN_EMAIL=admin@example.com
 LANQIN_ADMIN_PASSWORD=old-password
 EOF
+  printf 'services: {}\n' > "${INSTALL_DIR}/docker-compose.yml"
   printf 'database\n' > "${INSTALL_DIR}/data/lanqin.db"
 
   ensure_docker() { return 0; }
@@ -226,6 +348,7 @@ LANQIN_PUBLIC_HOSTNAME=mail.example.com
 LANQIN_MAIL_DOMAIN=example.com
 LANQIN_ADMIN_EMAIL=admin@example.com
 EOF
+  printf 'services: {}\n' > "${INSTALL_DIR}/docker-compose.yml"
   printf 'database\n' > "${INSTALL_DIR}/data/lanqin.db"
 
   ensure_docker() { return 0; }
@@ -571,6 +694,11 @@ test_nginx_configuration
 test_compose_configuration
 test_legacy_configuration_is_preserved
 test_menu_choice
+test_menu_rendering
+test_menu_dispatch
+test_menu_runtime_metadata
+test_incomplete_install_defaults_to_repair
+test_service_commands_require_complete_installation
 test_admin_credentials
 test_admin_password_hash_parsing
 test_admin_password_reset_only_updates_admin_account