Add custom image handling and access policy management

- Implement tests for custom KVM and LXC image creation, ensuring invalid sources and architecture mismatches are rejected.
- Introduce access policy management in CLI, allowing configuration of allowed sources and trusted proxies.
- Add NAT network configuration with validation for RFC1918 compliance and subnet parsing.
- Create panel access policy management, including normalization and evaluation of access decisions based on client IPs and forwarded headers.
- Develop middleware for enforcing access policies in the server, returning appropriate responses for allowed and denied requests.
- Enhance custom image downloading and validation, ensuring integrity and security of downloaded root filesystem archives.
- Include comprehensive tests for all new functionalities to ensure reliability and correctness.

frontend/src/utils/i18n.ts

@@ -138,6 +138,8 @@ const exact: Record<string, string> = {
   '输入密码': 'Enter password',
   '登录': 'Log in',
   '登录中...': 'Logging in...',
+  '用户名或密码错误': 'Incorrect username or password',
+  '访问码或密码错误': 'Incorrect access code or password',
   '登录失败，请检查用户名和密码': 'Login failed. Check your username and password.',
   'Authentication required': 'Authentication required',
   'Administrator permission required': 'Administrator permission required',
@@ -193,6 +195,33 @@ const exact: Record<string, string> = {
   '请按红色提示修改 vCPU、内存或磁盘配置': 'Fix the vCPU, memory, or disk fields marked in red',
   '创建失败': 'Create failed',
   '创建新容器': 'Create New Container',
+  '创建步骤': 'Creation steps',
+  '基础信息': 'Basics',
+  '镜像选择': 'Image',
+  '网络配置': 'Network',
+  '预览清单': 'Review',
+  '基础信息有误': 'Invalid basic information',
+  '请填写有效且未被占用的容器名称': 'Enter a valid, available container name',
+  'KVM 磁盘': 'KVM Disk',
+  '请选择镜像': 'Select an image',
+  '请选择用于创建容器的系统镜像': 'Select the system image used to create the container',
+  '网络配置有误': 'Invalid network configuration',
+  '请至少启用一种网络连接方式': 'Enable at least one network connection mode',
+  'NAT 端口配置有误': 'Invalid NAT port configuration',
+  '自动分配': 'Auto assign',
+  '个端口': 'ports',
+  '局域网': 'LAN',
+  '未配置网络': 'No network configured',
+  '创建数量': 'Count',
+  '自动选择': 'Automatic',
+  '镜像与登录': 'Image and Login',
+  '镜像默认': 'Image default',
+  '自动生成密码': 'Auto-generated password',
+  '子用户可用镜像': 'Sub-user Images',
+  '主要网络': 'Primary Network',
+  '上一步': 'Back',
+  '下一步': 'Next',
+  '确认创建': 'Create',
   '批量创建数量': 'Batch Count',
   '虚拟化架构': 'Virtualization',
   'LXC 容器': 'LXC Container',
@@ -407,7 +436,25 @@ const exact: Record<string, string> = {
   '存储配置已保存': 'Storage settings saved',
   '保存存储配置失败': 'Failed to save storage settings',
   '任务队列、账号、安全证书与访问记录': 'Task queue, account, certificates, and access records',
+  '任务队列、账号、访问控制、安全证书与访问记录': 'Task queue, account, access control, certificates, and access records',
   '设置分类': 'Settings categories',
+  '访问来源': 'Access Sources',
+  '访问来源策略': 'Access Source Policy',
+  '限制可访问面板、登录和 API 的来源地址': 'Restrict source addresses that can access the panel, login, and APIs',
+  '启用访问白名单': 'Enable Access Allowlist',
+  '关闭后不限制访问来源': 'No source restrictions when disabled',
+  '关闭访问白名单': 'Disable Access Allowlist',
+  '允许的 IP / CIDR': 'Allowed IP / CIDR',
+  '可信代理 IP / CIDR': 'Trusted Proxy IP / CIDR',
+  '仅可信代理可提供真实客户端地址；未使用反向代理时留空': 'Only trusted proxies may supply the real client address. Leave empty without a reverse proxy.',
+  '当前识别来源': 'Detected Source',
+  '直接连接来源': 'Direct Connection Source',
+  '保存访问策略': 'Save Access Policy',
+  '面板访问来源策略已保存并立即生效': 'Panel access source policy saved and applied immediately',
+  '面板访问来源限制已关闭': 'Panel access source restriction disabled',
+  '面板访问来源策略保存失败': 'Failed to save panel access source policy',
+  '面板访问来源策略': 'Panel Access Source Policy',
+  '更新面板访问来源策略': 'Update Panel Access Source Policy',
   'WebSSH 访问': 'WebSSH Access',
   '账号设置': 'Account Settings',
   '当前用户名': 'Current Username',
@@ -668,6 +715,32 @@ const exact: Record<string, string> = {
   '快照配额': 'Snapshot Quota',
   '模板列表': 'Template List',
   '镜像管理列表': 'Image Management List',
+  '第三方镜像': 'Third-party Image',
+  '下载第三方 KVM 镜像': 'Download Third-party KVM Image',
+  '下载第三方 LXC 镜像': 'Download Third-party LXC Image',
+  '支持 tar、tar.gz、tar.xz、tar.zst 格式的 Linux rootfs': 'Supports Linux rootfs archives in tar, tar.gz, tar.xz, and tar.zst formats',
+  '移除第三方镜像': 'Remove Third-party Image',
+  '第三方镜像已移除': 'Third-party image removed',
+  '移除第三方镜像失败': 'Failed to remove third-party image',
+  '第三方镜像已添加，下载任务已启动': 'Third-party image added and download started',
+  '镜像格式必须与所选无人值守安装模板匹配': 'The image format must match the selected unattended installation template',
+  '无人值守安装模板': 'Unattended Installation Template',
+  '镜像名称': 'Image Name',
+  '版本 / 代号': 'Version / Codename',
+  '镜像下载地址': 'Image Download URL',
+  '镜像来源、版本或用途': 'Image source, version, or purpose',
+  '用于校验下载文件完整性': 'Used to verify download integrity',
+  '添加并下载': 'Add and Download',
+  '正在添加...': 'Adding...',
+  '添加第三方镜像失败': 'Failed to add third-party image',
+  '添加第三方 KVM 镜像源': 'Add Third-party KVM Image Source',
+  '移除第三方 KVM 镜像源': 'Remove Third-party KVM Image Source',
+  '添加第三方 LXC/KVM 镜像源': 'Add Third-party LXC/KVM Image Source',
+  '移除第三方 LXC/KVM 镜像源': 'Remove Third-party LXC/KVM Image Source',
+  '请填写名称、发行版、版本和下载地址': 'Enter the name, distribution, version, and download URL',
+  'SHA-256 必须是 64 位十六进制字符串': 'SHA-256 must be a 64-character hexadecimal string',
+  '安装 ISO': 'Installation ISO',
+  '校验中': 'Validating',
   '取消镜像下载': 'Cancel Image Download',
   '启用/禁用镜像': 'Enable / Disable Image',
   '安全连接日志': 'Security Connection Logs',