fix(backend): 后台注册限流配置优先并保留注入兜底

fruitshorts-app-api/src/main/resources/application.yml

@@ -43,6 +43,10 @@ springdoc:
     path: /v3/api-docs
 
 fruitshorts:
+  auth:
+    # 仅作 sys_config 缺失/非法时的兜底；运行时优先读取后台「系统配置」
+    register-max-per-ip-per-day: ${REGISTER_MAX_PER_IP_PER_DAY:5}
+    register-max-per-device-per-day: ${REGISTER_MAX_PER_DEVICE_PER_DAY:3}
   interaction:
     # MACHINE_FIRST：机审通过即发布，命中 REVIEW 级敏感词才转人工
     # PRE_REVIEW   ：全部先审后发（生产建议）

fruitshorts-app-api/src/test/java/com/fruitshorts/app/service/AppAuthServiceTest.java

@@ -26,6 +26,7 @@ import com.fruitshorts.user.vo.TokenRespVO;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.test.util.ReflectionTestUtils;
 
 import java.time.Duration;
 import java.time.LocalDateTime;
@@ -193,9 +194,9 @@ class AppAuthServiceTest {
 
     @Test
     void should_fallback_to_default_limit_when_config_is_not_numeric() {
-        setRegisterLimits(5, 3);
-        given(configService.get("app.register.max-per-ip-per-day", "5")).willReturn("invalid");
-        given(userMapper.selectCount(any())).willReturn(5L);
+        ReflectionTestUtils.setField(authService, "maxRegisterPerIpPerDay", 2);
+        given(configService.get("app.register.max-per-ip-per-day", "2")).willReturn("invalid");
+        given(userMapper.selectCount(any())).willReturn(2L);
 
         assertThatThrownBy(() -> authService.register(emailRegister("abcd1234", null), "203.0.113.8"))
                 .isInstanceOf(ServiceException.class)