feat: add registration abuse prevention

- Silently block verification code for IPs with 2+ registered accounts
- Silently block Gmail alias emails (containing + or . in local part)
- Add CountByRegistrationIP to UserRepository interface
- Pass client IP to SendVerifyCodeAsync for abuse detection

Both checks return fake success to prevent enumeration attacks.

backend/internal/service/user_service.go

@@ -111,6 +111,9 @@ type UserRepository interface {
 	UpdateTotpSecret(ctx context.Context, userID int64, encryptedSecret *string) error
 	EnableTotp(ctx context.Context, userID int64) error
 	DisableTotp(ctx context.Context, userID int64) error
+
+	// CountByRegistrationIP 统计指定 IP 注册的用户数量
+	CountByRegistrationIP(ctx context.Context, ip string) (int, error)
 }
 
 type UserAuthIdentityRecord struct {