fix(backend): 后台注册限流配置优先并保留注入兜底

fruitshorts-module-user/src/main/java/com/fruitshorts/user/service/AppAuthService.java

@@ -26,6 +26,7 @@ import com.fruitshorts.user.vo.LogoutReqVO;
 import com.fruitshorts.user.vo.RegisterReqVO;
 import com.fruitshorts.user.vo.TokenRespVO;
 import lombok.RequiredArgsConstructor;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.dao.DuplicateKeyException;
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.stereotype.Service;
@@ -61,6 +62,14 @@ public class AppAuthService {
     private final PasswordEncoder passwordEncoder;
     private final ConfigService configService;
 
+    /** 后台 sys_config 缺失或非法时使用；小于等于 0 表示不限制。 */
+    @Value("${fruitshorts.auth.register-max-per-ip-per-day:5}")
+    private int maxRegisterPerIpPerDay = 5;
+
+    /** 后台 sys_config 缺失或非法时使用；小于等于 0 表示不限制。 */
+    @Value("${fruitshorts.auth.register-max-per-device-per-day:3}")
+    private int maxRegisterPerDevicePerDay = 3;
+
     @Transactional(rollbackFor = Exception.class)
     public TokenRespVO register(RegisterReqVO req, String clientIp) {
         String targetType = AppIdentifier.normalizeType(req.getTargetType());
@@ -305,8 +314,6 @@ public class AppAuthService {
 
     private static final String REGISTER_IP_LIMIT_KEY = "app.register.max-per-ip-per-day";
     private static final String REGISTER_DEVICE_LIMIT_KEY = "app.register.max-per-device-per-day";
-    private static final int DEFAULT_REGISTER_IP_LIMIT = 5;
-    private static final int DEFAULT_REGISTER_DEVICE_LIMIT = 3;
 
     private static final int PASSWORD_MIN_LENGTH = 8;
     private static final int PASSWORD_MAX_LENGTH = 64;
@@ -339,8 +346,8 @@ public class AppAuthService {
      */
     private void guardRegisterRisk(String clientIp, String deviceId) {
         LocalDateTime since = LocalDateTime.now().minusDays(1);
-        int ipLimit = registerLimit(REGISTER_IP_LIMIT_KEY, DEFAULT_REGISTER_IP_LIMIT);
-        int deviceLimit = registerLimit(REGISTER_DEVICE_LIMIT_KEY, DEFAULT_REGISTER_DEVICE_LIMIT);
+        int ipLimit = registerLimit(REGISTER_IP_LIMIT_KEY, maxRegisterPerIpPerDay);
+        int deviceLimit = registerLimit(REGISTER_DEVICE_LIMIT_KEY, maxRegisterPerDevicePerDay);
         String ip = AppIdentifier.nullSafe(clientIp);
         if (ipLimit > 0 && StringUtils.hasText(ip)) {
             Long byIp = appUserMapper.selectCount(Wrappers.<AppUser>lambdaQuery()