fix(app-iced, presenter): M114 r2 —— 登录失败走结构化错误码 + i18n，修 4 条 p2 与 3 条看图意见

p1（语言泄漏）：后端诊断串不再上屏
- presenter 新增 LoginFailure 原因码（denied / whitelist_pending / unreachable /
  not_authlib_server / bad_credentials / no_profile / store_failed / other）
- 页面按码查 i18n 出标题+正文+「Code: …」，原文只进日志/详细信息
- 进行中（Requesting）也走 i18n，不再复读后端中文状态串
- presenter/state 不再发中文 toast（成败由页面按 i18n 画）
- 新增守门测试：注入带 AADSTS 的失败事件，断言英文视图无 CJK 且含 code

p2-1 复制：on_account 返回 Task，page_messages 把 iced::clipboard::write 交回 runtime
p2-2 可见失败态：新增 AccountNotice（added/removed/switched/名字非法/重名/落盘失败/
      找不到），页面用 M3 内联 alert 画（不是 toast）；离线名字先按 3–16 位规则校验，
      失败不再清空输入
p2-3 重新登录按账户类型分派：微软→授权码流；第三方→预填服务器/登录名并提示补密码；
      离线→明确说明没有可重登的服务器账户
p2-4 入口收敛：删 chip 行；空态=三卡片；有账号时三卡收进 Add an account（按钮不再绑死微软轨）

看图意见/tower 三条：
- 失败横幅改成 M3 alert（SurfaceContainerHigh + 描边，errorContainer 只作图标块，
  不再通栏实心红）；色值本身经复审像素采样确认是 90/30 档，未改角色
- 当前账户卡补齐与列表一致的「服务器/登录名」行；无皮肤时明说 No skin available
- 页面级 scrollable 加 8px 右 gutter，滚动条不再压卡片
- 倒计时改 mm:ss（15:00 left），数字与冒号语言无关

p3（顺带）：AuthlibRequest / Form 手写 Debug 脱敏密码；HTTP 响应体与 base64 输出加上限；
离线提示文案与行为对齐；删除无人使用的 key；皮肤测试断言帽子层真的 blend

测试：app-iced lib 418 绿、presenter 151 / i18n 24 绿（workspace 全量另跑）

crates/presenter/src/host/accounts.rs

@@ -19,7 +19,10 @@ use unlucky_core::auth::offline::offline_meta;
 use unlucky_core::auth::{AccountStore, AuthResult};
 use unlucky_core::download::blocking::block_on;
 
-use crate::dto::{AccountKind, AccountView, DeviceLoginView};
+use crate::dto::CoreEvent;
+use crate::dto::{
+    AccountKind, AccountNotice, AccountNoticeCode, AccountView, DeviceLoginView, LoginFailure,
+};
 
 use super::env::HostEnv;
 use super::job::{spawn, HostTask, JobSender};
@@ -28,8 +31,33 @@ use super::opener;
 /// 第三方轨（服务发现 / 密码登录 / 皮肤抓取）。
 pub mod authlib;
 
+mod failure;
+
+pub use failure::{valid_offline_name, AccountFailure};
+
+use failure::classify;
+
 pub use authlib::{fetch_skin, spawn_probe, start_login as start_authlib_login};
 
+impl super::CoreHost {
+    /// 推一条账户页横幅（一次性操作结果；页面渲染后由用户关掉）。
+    pub(super) fn notice(&mut self, code: AccountNoticeCode, subject: &str, detail: &str) {
+        self.send(CoreEvent::AccountNoticeChanged(Some(AccountNotice::new(
+            code, subject, detail,
+        ))));
+    }
+
+    /// 账户写操作失败：**原文进日志**，页面只拿结构化码 + 主题名。
+    pub(super) fn notice_failure(&mut self, failure: AccountFailure, subject: &str) {
+        eprintln!(
+            "[accounts] 操作失败（{}，subject={subject}）：{}",
+            failure.code.code(),
+            failure.detail
+        );
+        self.notice(failure.code, subject, &failure.detail);
+    }
+}
+
 /// 账户列表（公开字段）。
 pub fn accounts(env: &HostEnv, active: Option<&str>) -> Vec<AccountView> {
     let store = AccountStore::open(env.layout.auth_data());
@@ -85,18 +113,25 @@ fn civil_from_days(days: i64) -> (i64, u32, u32) {
 ///
 /// # Errors
 ///
-/// 名字不合法、同名冲突、落盘失败时返回用户可读文案。
-pub fn add_offline(env: &HostEnv, name: &str) -> Result<String, String> {
+/// 名字不合法、同名冲突、落盘失败时返回 [`AccountFailure`]（带结构化码）。
+pub fn add_offline(env: &HostEnv, name: &str) -> Result<String, AccountFailure> {
     let name = name.trim();
-    let meta = offline_meta(name, now_ms()).map_err(|error| error.to_string())?;
+    if !valid_offline_name(name) {
+        return Err(AccountFailure {
+            code: AccountNoticeCode::OfflineNameInvalid,
+            detail: format!("离线名字必须是 3–16 位字母/数字/下划线，收到 {name:?}"),
+        });
+    }
+    let meta = offline_meta(name, now_ms())
+        .map_err(|error| AccountFailure::classify(error, AccountNoticeCode::OfflineNameInvalid))?;
     let display = meta.display_name().to_string();
     let mut store = AccountStore::open(env.layout.auth_data());
     store
         .insert(meta, Credentials::Offline)
-        .map_err(|error| format!("添加账户失败：{error}"))?;
+        .map_err(|error| AccountFailure::classify(error, AccountNoticeCode::AccountExists))?;
     store
         .save()
-        .map_err(|error| format!("保存账户失败：{error}"))?;
+        .map_err(|error| AccountFailure::classify(error, AccountNoticeCode::StoreFailed))?;
     Ok(display)
 }
 
@@ -104,15 +139,15 @@ pub fn add_offline(env: &HostEnv, name: &str) -> Result<String, String> {
 ///
 /// # Errors
 ///
-/// 找不到、落盘失败时返回用户可读文案。
-pub fn remove(env: &HostEnv, key: &str) -> Result<String, String> {
+/// 找不到、落盘失败时返回 [`AccountFailure`]。
+pub fn remove(env: &HostEnv, key: &str) -> Result<String, AccountFailure> {
     let mut store = AccountStore::open(env.layout.auth_data());
     let meta = store
         .remove(key)
-        .map_err(|error| format!("删除账户失败：{error}"))?;
+        .map_err(|error| AccountFailure::classify(error, AccountNoticeCode::NotFound))?;
     store
         .save()
-        .map_err(|error| format!("保存账户失败：{error}"))?;
+        .map_err(|error| AccountFailure::classify(error, AccountNoticeCode::StoreFailed))?;
     Ok(meta.display_name().to_string())
 }
 
@@ -147,7 +182,7 @@ pub fn start_login(env: HostEnv, tx: JobSender, job: LoginJob) {
     spawn("msa-login", move || {
         let auth = match microsoft_auth(&env) {
             Ok(auth) => auth,
-            Err(message) => return fail(&tx, message),
+            Err(message) => return fail(&tx, LoginFailure::Other, message),
         };
         let tx_prompt = tx.clone();
         let result = block_on(auth.device_code_login(|prompt| {
@@ -170,7 +205,7 @@ pub fn start_browser_login(env: HostEnv, tx: JobSender, job: LoginJob) {
     spawn("msa-authcode", move || {
         let auth = match microsoft_auth(&env) {
             Ok(auth) => auth,
-            Err(message) => return fail(&tx, message),
+            Err(message) => return fail(&tx, LoginFailure::Other, message),
         };
         let tx_prompt = tx.clone();
         let result = block_on(auth.authcode_login(|prompt| {
@@ -197,8 +232,13 @@ fn microsoft_auth(env: &HostEnv) -> Result<MicrosoftAuth, String> {
         .map_err(|error| error.to_string())
 }
 
-fn fail(tx: &JobSender, message: String) {
-    let _ = tx.send(HostTask::Login(Box::new(DeviceLoginView::failed(message))));
+/// 失败收尾（带**原因码**）：原文进日志，页面据码出 i18n（复审 r1 P1-1）。
+fn fail(tx: &JobSender, failure: LoginFailure, detail: impl Into<String>) {
+    let detail = detail.into();
+    eprintln!("[auth] 微软登录失败（{}）：{detail}", failure.code());
+    let _ = tx.send(HostTask::Login(Box::new(DeviceLoginView::failed_as(
+        failure, detail,
+    ))));
 }
 
 /// 收尾：取消就吞掉结果；成功入库；失败带 core 的诊断文案（M38 的 403 也走这条）。
@@ -213,9 +253,12 @@ fn finish(env: &HostEnv, tx: &JobSender, job: &LoginJob, result: AuthResult<Micr
                 let _ = tx.send(HostTask::Login(Box::new(DeviceLoginView::succeeded(&name))));
                 let _ = tx.send(HostTask::Accounts(accounts(env, None)));
             }
-            Err(message) => fail(tx, message),
+            Err(message) => fail(tx, LoginFailure::StoreFailed, message),
         },
-        Err(error) => fail(tx, error.to_string()),
+        Err(error) => {
+            let failure = classify(&error);
+            fail(tx, failure, error.to_string());
+        }
     }
 }
 
@@ -239,6 +282,9 @@ fn store_session(env: &HostEnv, session: MicrosoftSession) -> Result<String, Str
 #[cfg(test)]
 mod tests {
     use super::*;
+    use unlucky_core::auth::AuthError;
+
+    use super::failure::mentions_whitelist;
 
     #[test]
     fn time_display_matches_known_timestamps() {
@@ -271,6 +317,57 @@ mod tests {
         std::fs::remove_dir_all(&dir).ok();
     }
 
+    #[test]
+    fn failure_codes_are_classified_from_variants_not_chinese_text() {
+        assert_eq!(
+            classify(&AuthError::Network {
+                url: "https://x".to_string(),
+                detail: "dns".to_string()
+            }),
+            LoginFailure::Unreachable
+        );
+        assert_eq!(
+            classify(&AuthError::Denied {
+                code: "AADSTS7000218".to_string(),
+                description: "request body must contain client_assertion".to_string(),
+            }),
+            LoginFailure::NotWhitelisted
+        );
+        assert_eq!(
+            classify(&AuthError::Denied {
+                code: "invalid_grant".to_string(),
+                description: "bad".to_string(),
+            }),
+            LoginFailure::Denied
+        );
+        assert_eq!(classify(&AuthError::Canceled), LoginFailure::Other);
+        assert!(mentions_whitelist("AADSTS7000218"));
+        assert!(!mentions_whitelist("invalid_grant"));
+    }
+
+    #[test]
+    fn offline_name_rule_matches_the_ui_contract() {
+        assert!(valid_offline_name("Steve"));
+        assert!(valid_offline_name("a_1"));
+        assert!(!valid_offline_name("ab"), "太短");
+        assert!(!valid_offline_name("中文名字"), "非 ascii");
+        assert!(!valid_offline_name("has space"));
+        assert!(!valid_offline_name("x"));
+    }
+
+    #[test]
+    fn a_bad_offline_name_is_classified_not_stringified() {
+        let dir =
+            std::env::temp_dir().join(format!("ull-host-accounts-name-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        let env = HostEnv::at_root(&dir);
+        std::fs::create_dir_all(env.layout.auth_data()).expect("auth 目录");
+        let failure = add_offline(&env, "ab").expect_err("太短要报错");
+        assert_eq!(failure.code, AccountNoticeCode::OfflineNameInvalid);
+        assert!(!failure.detail.is_empty());
+        std::fs::remove_dir_all(&dir).ok();
+    }
+
     #[test]
     fn login_job_cancel_flag_is_shared() {
         let job = LoginJob::new();