feat: 忘记密码增设脱敏邮箱二次手动输入一致性核对安全锁

resources/js/password-forgot.js

@@ -139,6 +139,9 @@ async function submitAccountDetect(event) {
             const hasEmail = body.has_email;
             const hasWechat = body.has_wechat;
 
+            const hintLabel = document.getElementById("masked-email-hint");
+            const emailInput = document.getElementById("email");
+
             if (hasEmail && hasWechat) {
                 summary.innerHTML = `检测到账号 <strong style="color:var(--gold);">${currentUsername}</strong> 已同时绑定了微信和邮箱。您可以选择以下任意一种方式找回密码：`;
                 tabs.style.display = "grid";
@@ -149,15 +152,24 @@ async function submitAccountDetect(event) {
                     wechatTabBtn.classList.add("active");
                 }
                 panelWechat.style.display = "block";
+                
+                if (hintLabel) {
+                    hintLabel.innerHTML = `📬 绑定的邮箱提示：<span style="color:#fff;">${body.masked_email}</span>`;
+                }
+                if (emailInput instanceof HTMLInputElement) {
+                    emailInput.value = "";
+                }
             } else if (hasWechat) {
                 summary.innerHTML = `检测到账号 <strong style="color:var(--gold);">${currentUsername}</strong> 仅绑定了微信。系统不支持邮箱找回，建议您使用微信助手进行重置：`;
                 panelWechat.style.display = "block";
             } else if (hasEmail) {
                 summary.innerHTML = `检测到账号 <strong style="color:var(--gold);">${currentUsername}</strong> 仅绑定了邮箱。建议您使用邮箱发送重置链接找回：`;
                 panelEmail.style.display = "block";
-                const emailInput = document.getElementById("email");
+                if (hintLabel) {
+                    hintLabel.innerHTML = `📬 绑定的邮箱提示：<span style="color:#fff;">${body.masked_email}</span>`;
+                }
                 if (emailInput instanceof HTMLInputElement) {
-                    emailInput.value = body.masked_email;
+                    emailInput.value = "";
                 }
             } else {
                 summary.innerHTML = `检测到账号 <strong style="color:var(--gold);">${currentUsername}</strong> 尚未绑定微信或邮箱找回途径：`;
@@ -195,6 +207,9 @@ async function submitPasswordRecovery(event) {
     hideAlert();
 
     try {
+        const emailInput = document.getElementById("email");
+        const emailVal = emailInput instanceof HTMLInputElement ? emailInput.value.trim() : "";
+
         const response = await fetch(form.getAttribute("data-password-email-url") ?? "", {
             method: "POST",
             headers: {
@@ -204,6 +219,7 @@ async function submitPasswordRecovery(event) {
             },
             body: JSON.stringify({
                 username: currentUsername,
+                email: emailVal,
             }),
         });
         const body = await response.json();