feat: CLI 改密、自定义 TLS、移动端适配与扩展校验

- 新增 one-kvm user set-password（交互式），改密后吊销该用户全部会话
- /api/config/web 支持 PEM 证书/密钥上传与清除，响应含 has_custom_cert
- 移动端：ActionBar 溢出菜单、ATX/粘贴底部 Sheet、BrandMark 与控制台等响应式优化
- GOSTC：校验服务器地址非空，管理器启动条件与 HTTP 热更新一致
- RustDesk：中继密钥 relay_key 校验为标准 Base64 且解码后恰好 32 字节
- StatusCard、InfoBar：合并精简冗余状态信息

web/src/i18n/en-US.ts

@@ -41,6 +41,7 @@ export default {
     expand: 'Expand',
     toggleTheme: 'Toggle theme',
     toggleLanguage: 'Toggle language',
+    retry: 'Retry',
   },
   api: {
     operationFailed: 'Operation Failed',
@@ -64,6 +65,7 @@ export default {
     enterPassword: 'Enter password',
     loginFailed: 'Login failed',
     invalidPassword: 'Invalid username or password',
+    systemNotInitialized: 'System not initialized. Complete setup first.',
     changePassword: 'Change Password',
     currentPassword: 'Current Password',
     currentPasswordPlaceholder: 'Enter current password',
@@ -78,6 +80,9 @@ export default {
     userNotFound: 'User not found',
     sessionExpired: 'Session expired',
     loggedInElsewhere: 'Logged in elsewhere',
+    forgotPassword: 'Forgot password',
+    forgotPasswordHint:
+      'Forgot your password? On the host running One-KVM, open a terminal and run one-kvm user set-password, then enter and confirm the new password when prompted.',
   },
   status: {
     connected: 'Connected',
@@ -105,7 +110,7 @@ export default {
     fullscreen: 'Fullscreen',
     fullscreenTip: 'Toggle fullscreen mode',
     // Video Config
-    videoConfig: 'Video Config',
+    videoConfig: 'Video',
     streamSettings: 'Stream Settings',
     deviceSettings: 'Device Settings',
     videoMode: 'Mode',
@@ -137,7 +142,7 @@ export default {
     multiSourceCodecLocked: '{sources} are enabled. Current codec is locked.',
     multiSourceVideoParamsWarning: '{sources} are enabled. Changing video device and input parameters will interrupt the stream.',
     // HID Config
-    hidConfig: 'Mouse & HID',
+    hidConfig: 'HID',
     mouseSettings: 'Mouse Settings',
     hidDeviceSettings: 'HID Device Settings',
     positioningMode: 'Positioning Mode',
@@ -497,7 +502,6 @@ export default {
     buildInfo: 'Build Info',
     detectDevices: 'Detect Devices',
     detecting: 'Detecting...',
-    builtWith: "Copyright {'@'}2025 SilentWind",
     networkSettings: 'Network Settings',
     msdSettings: 'MSD Settings',
     atxSettings: 'ATX Settings',
@@ -524,10 +528,43 @@ export default {
     addBindAddress: 'Add address',
     bindAddressListEmpty: 'Add at least one IP address.',
     httpsEnabled: 'Enable HTTPS',
-    httpsEnabledDesc: 'Enable HTTPS encrypted connection (self-signed certificate will be auto-generated)',
+    httpsEnabledDesc: 'Enable HTTPS encrypted connection (a self-signed certificate is generated if none is specified)',
+    // Port config
+    portConfig: 'Port & Protocol',
+    portConfigDesc: 'The service runs on a single port at a time, determined by the HTTPS toggle',
+    httpPortReserved: 'HTTP port (reserved)',
+    httpsPortReserved: 'HTTPS port (reserved)',
+    previewUrl: 'Access URL preview',
+    // Listen address
+    listenAddress: 'Listen Address',
+    listenAddressDesc: 'Configure which network interfaces the web server listens on',
+    bindModeAllDesc: '0.0.0.0 — Listen on all network interfaces',
+    bindModeLocalDesc: '127.0.0.1 — Allow local access only',
+    bindModeCustomDesc: 'Specify a list of IP addresses',
+    effectiveAddresses: 'Listen address preview',
+    // SSL certificate
+    sslCertificate: 'SSL Certificate',
+    sslCertificateDesc: 'Upload a custom PEM certificate to replace the self-signed one, restart required',
+    sslCertCustom: 'Custom Certificate',
+    sslCertSelfSigned: 'Self-Signed',
+    sslCertActive: 'Custom certificate is active',
+    sslCertClear: 'Revert to Self-Signed',
+    sslCertSave: 'Save Certificate',
+    sslCertPem: 'Certificate (.crt / .pem)',
+    sslKeyPem: 'Private Key (.key)',
+    sslCertPemPlaceholder: '-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----',
+    sslKeyPemPlaceholder: '-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----',
+    sslCertSaved: 'Certificate saved, restart to apply',
+    sslCertCleared: 'Reverted to self-signed certificate, restart to apply',
     restartRequired: 'Restart Required',
     restartMessage: 'Web server configuration saved. A restart is required for changes to take effect.',
     restarting: 'Restarting...',
+    autoRestarting: 'Restarting automatically',
+    autoRestartingDesc: 'Configuration saved. Will redirect to the new address once the service is back...',
+    autoRestartingHttpsDesc: 'Service is restarting. A redirect link will appear in {sec}s...',
+    autoRestartFailed: 'Auto-restart timed out. Please refresh the page or check the service status.',
+    httpsManualRedirectTitle: 'Click the link below to open the new address',
+    httpsManualRedirectDesc: 'HTTPS with a self-signed certificate requires browser approval. Click the link and choose "Proceed" on the security warning.',
     onlineUpgrade: 'Online Upgrade',
     onlineUpgradeDesc: 'Check and upgrade One-KVM',
     updateChannel: 'Update Channel',
@@ -557,7 +594,6 @@ export default {
     authSettingsDesc: 'Single-user access and session behavior',
     allowMultipleSessions: 'Allow multiple web sessions',
     allowMultipleSessionsDesc: 'When disabled, a new login will kick the previous session.',
-    singleUserSessionNote: 'Single-user mode is enforced; only session concurrency is configurable.',
     // User management
     userManagement: 'User Management',
     userManagementDesc: 'Manage user accounts and permissions',
@@ -817,27 +853,19 @@ export default {
     version: 'Version',
     uptime: 'Uptime',
     running: 'Running',
-    mode: 'Mode',
     format: 'Format',
     resolution: 'Resolution',
-    targetFps: 'Target FPS',
-    fps: 'Actual FPS',
+    fps: 'FPS',
     clients: 'Clients',
     backend: 'Backend',
-    initialized: 'Initialized',
-    yes: 'Yes',
-    no: 'No',
     mouse: 'Mouse',
     mouseSupport: 'Mouse Support',
     currentMode: 'Current Mode',
     absolute: 'Absolute',
     relative: 'Relative',
-    connection: 'Connection',
     channel: 'Channel',
     networkError: 'Network Error',
     disconnected: 'Disconnected',
-    availability: 'Availability',
-    errorCode: 'Error Code',
     hidUnavailable: 'HID Unavailable',
     sampleRate: 'Sample Rate',
     channels: 'Channels',
@@ -889,6 +917,7 @@ export default {
       title: 'GOSTC NAT Traversal',
       desc: 'NAT traversal via GOSTC',
       addr: 'Server Address',
+      addrPlaceholder: 'Hostname or IP (required)',
       key: 'Client Key',
       tls: 'Enable TLS',
     },
@@ -915,9 +944,9 @@ export default {
       relayServerPlaceholder: 'hbbr.example.com:21117',
       relayServerHint: 'Relay server address (port optional, defaults to 21117). Auto-derived if empty',
       relayKey: 'Relay Key',
-      relayKeyPlaceholder: 'Enter relay server key',
-      relayKeySet: '••••••••',
-      relayKeyHint: 'Authentication key for relay server (if server uses -k option)',
+      relayKeyPlaceholder: 'e.g. pLU0pEj2IZnNVKzrIO1pIdwGA3dOVJJLkFIYGOCGH1E=',
+      relayKeySet: 'Saved (32-byte Base64, usually 44 chars; leave empty and save to keep)',
+      relayKeyHint: 'Same as hbbs/hbbr -k: standard Base64 decoding to exactly 32 bytes (typically 44 characters including trailing =)',
       deviceInfo: 'Device Info',
       deviceId: 'Device ID',
       deviceIdHint: 'Use this ID in RustDesk client to connect',