fix(security): Tailscale内网(100.64/10)免API_KEY+外部强制校验；修复账号重复提交400(提交锁+唯一约束兜底)

static/js/modals.js

@@ -231,7 +231,7 @@ const AccountModal = {
         <p v-if="store.accountModal.editing" class="text-xs text-slate-400">修改账号标识后，引用该账号的资产会自动同步更新。</p>
         <div class="flex justify-end gap-2">
           <button type="button" @click="store.accountModal.show=false" class="px-4 py-2 rounded-lg border border-slate-300 dark:border-slate-700 text-sm text-slate-600 dark:text-slate-300">取消</button>
-          <button type="submit" class="px-4 py-2 rounded-lg bg-blue-600 text-white text-sm hover:bg-blue-700">保存</button>
+          <button type="submit" :disabled="store.accountSaving" class="px-4 py-2 rounded-lg bg-blue-600 text-white text-sm hover:bg-blue-700 disabled:opacity-60">{{ store.accountSaving ? '保存中…' : '保存' }}</button>
         </div>
       </form>
     </div>

static/js/store.js

@@ -26,6 +26,7 @@ const store = reactive({
   assetModal: { show: false, editing: null, form: null },
   providerModal: { show: false, editing: null, form: null },
   accountModal: { show: false, editing: null, form: null },
+  accountSaving: false, // 账号保存中锁，防止双击/重复提交触发后端 400 重名
   accountsModal: { show: false, providerSlug: null }, // 账号查看弹窗：providerSlug 为 null 时看全部
 });
 
@@ -181,7 +182,10 @@ function openAccountEdit(a) {
   store.accountModal = { show: true, editing: a.id, form: { name: a.name, platform: a.platform || '', remark: a.remark || '', login_user: a.login_user || '', login_password: '', api_config: '' } };
 }
 async function saveAccount() {
+  // 提交锁：双击/网络慢时重复点击会发出两次请求，第二次必然重名 400
+  if (store.accountSaving) return;
   store.error = '';
+  store.accountSaving = true;
   const f = store.accountModal.form;
   const payload = {
     name: f.name, platform: f.platform || null, remark: f.remark || null,
@@ -196,6 +200,7 @@ async function saveAccount() {
     // 重命名会同步更新资产端引用，需一并刷新资产
     await Promise.all([loadAccounts(), loadAssets()]);
   } catch (e) { store.error = e.message; }
+  finally { store.accountSaving = false; }
 }
 async function deleteAccount(a) {
   let msg = '确认删除账号「' + a.name + '」？';