perf: harden quotas and reduce compression overhead

src/api/auth.rs

@@ -267,16 +267,19 @@ async fn login(
         .fetch_optional(&state.db)
         .await
     }
-    .map_err(|err| AppError::new(ErrorCode::Internal, "查询用户失败").with_source(err))?
-    .ok_or_else(|| AppError::new(ErrorCode::Unauthorized, "账号或密码错误"))?;
+    .map_err(|err| AppError::new(ErrorCode::Internal, "查询用户失败").with_source(err))?;
 
-    if !user.is_active {
-        return Err(AppError::new(ErrorCode::Forbidden, "账号已被禁用"));
-    }
+    let Some(user) = user else {
+        credentials::consume_dummy_password_work(&req.password).await?;
+        return Err(AppError::new(ErrorCode::Unauthorized, "账号或密码错误"));
+    };
 
     if !credentials::verify_password(&req.password, &user.password_hash).await? {
         return Err(AppError::new(ErrorCode::Unauthorized, "账号或密码错误"));
     }
+    if !user.is_active {
+        return Err(AppError::new(ErrorCode::Forbidden, "账号已被禁用"));
+    }
     let verification_required = policy.auth.email_verification_required;
 
     let (token, expires_at) = auth::issue_jwt(