[chenow9]

Summary

Implements only the four P0 console UX fixes. Does not change the gateway protocol or security model.

P0-1 — Access modes as first-class UI

• Service list cards show an access-mode badge (凭证访问 / 临时放行 / 公开访问, with existing i18n).
• Service list filters add 访问方式 / Access mode.
• Empty states name all three modes.

P0-2 — Stop framing “no public port” as a fault

• Visitor services show 凭证访问 · 无公网业务端口 instead of 对外端口 不开放.
• Diagnose copy matches the list.
• 需处理 / 节点离线 remains only for real faults.

P0-3 — Confirm before issuing node credentials

• Enroll is now form → confirm → issue.
• Confirm states the node will be written to the list and that the install command/credential is shown once.
• Cancel before issue creates no node.
• Success surface states the node is already in the list and keeps the one-time credential warning.

P0-4 — Validate names / hostnames / CIDR

• Node name, target host/IP, and CIDR are validated on blur and before next/confirm, with inline errors.
• Invalid values cannot advance or submit.
• Existing port checks still apply.
• API rejects the same invalid values so a bad client cannot bypass the UI.

Files changed (why)

Area	Files	Why
List / filters / empty state	service-list.tsx, mappings-page.tsx, styles.css, messages.ts	P0-1, P0-2
Enroll confirm + success	nodes-page.tsx, issued-dialog.tsx, messages.ts	P0-3
Client validation	validate.ts, service.ts, service-editor.tsx, field.tsx, input.tsx	P0-4
API validation	validate.go, http.go, mutate.go, transfer.go	P0-4 (server-side)
Tests	validate.test.ts, service.test.ts, validate_test.go, service_test.go	P0-4 + existing service checks

How verified

• Unit: node --experimental-strip-types --test on src/lib/umbra/{validate,service}.test.ts and related domain tests (107 pass).
• API: go test ./internal/control/ (includes new host/CIDR/name rejection cases).
• Typecheck: npx tsc --noEmit.
• Lint: eslint on changed TS/TSX files.
• Manual (Playwright against a local auth-off umbrad + Vite console):
  • P0-1: empty state names three modes; list badges; filter by 凭证访问 hides spa/public.
  • P0-2: visitor row uses 凭证访问 · 无公网业务端口, not 对外端口 不开放; offline still shows 节点离线; diagnose matches.
  • P0-3: Next → confirm (list + one-time copy); Cancel creates no node; issue shows 节点已出现在列表中 and one-time warning.
  • P0-4: !!! bad/name?, not_a_host!!!, not-a-cidr, port 99999 blocked with inline errors; valid inputs and API rejects still work.

Checklist

• P0-1 Access modes as first-class UI
• P0-2 Stop framing “no public port” as a fault
• P0-3 Confirm before issuing node credentials
• P0-4 Validate names / hostnames / CIDR