修复了一些已知问题

backend/internal/api/vnc.go

@@ -18,6 +18,7 @@ import (
 type webVNCTicket struct {
 	ContainerName string
 	ContainerUUID string
+	SubUser       bool
 	ExpiresAt     time.Time
 }
 
@@ -48,6 +49,10 @@ func HandleVNCTicket(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusNotFound, APIResponse{Success: false, Message: "Container not found"})
 		return
 	}
+	if isSubUserRequest(r) && c.PolicyBlocked {
+		jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: policyBlockedMessage(c)})
+		return
+	}
 	if !c.IsKVM() {
 		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "VNC console is only available for KVM VMs"})
 		return
@@ -59,6 +64,7 @@ func HandleVNCTicket(w http.ResponseWriter, r *http.Request) {
 	webVNCTickets.items[ticket] = webVNCTicket{
 		ContainerName: c.Name,
 		ContainerUUID: c.UUID,
+		SubUser:       isSubUserRequest(r),
 		ExpiresAt:     time.Now().Add(60 * time.Second),
 	}
 	webVNCTickets.Unlock()
@@ -94,6 +100,10 @@ func HandleVNCProxy(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "container not found", http.StatusNotFound)
 		return
 	}
+	if item.SubUser && c.PolicyBlocked {
+		http.Error(w, "虚拟机被策略临时封禁", http.StatusForbidden)
+		return
+	}
 	if !c.IsKVM() {
 		http.Error(w, "VNC console is only available for KVM VMs", http.StatusBadRequest)
 		return