[Feature] Add user token usage limits (weekly / monthly / total)

1Panel Version

v2.3.1

Please describe your needs or suggestions for improvements

Background

Currently, API tokens (or user tokens) created in 1Panel have no call count or usage limits. In multi-user collaboration scenarios or when exposing the 1Panel API to external services, a leaked or abused token can generate a large number of requests, consume server resources, and be difficult to track and control.

I would like to request support for token usage limits, so administrators can manage quotas per user or per token.

Desired functionality

Add usage limit configuration for each user or each API token, with support for the following dimensions:

• Weekly usage limit: maximum usage allowed per calendar week
• Monthly usage limit: maximum usage allowed per calendar month
• Total usage limit: maximum total usage allowed over the lifetime of the token
• (Optional) Daily usage limit and hourly usage limit

Each limit should be independently enabled or disabled, with a configurable value. The usage metric should be selectable as needed:

• Request count
• Data transfer volume
• Number of specific business operations

When a limit is reached, the following behavior should be supported:

• Reject subsequent requests and return a clear error code/message
• Send an alert when a certain percentage is reached (e.g. 80%)
• Automatically disable the token
• Allow administrators to manually reset usage

The admin UI should also provide:

• Current-period usage and remaining quota for each token
• Reset period and next reset time
• Ability for administrators to view, filter, and export usage records
• Support for manually resetting usage for a specific token

Use cases

1. Shared 1Panel in a team: Assign different API tokens to different members and limit each member's usage to prevent excessive use by any individual.
2. Public API service: Prevent a single user or third-party application from making unlimited calls to the 1Panel API.
3. Security protection: If a token is accidentally leaked, an attacker cannot cause large-scale resource consumption within a short period.
4. Cost and resource control: Make it easier to evaluate API usage by week/month and allocate resources reasonably.

Additional notes

• It may be helpful to reference quota management designs from other platforms, such as cloud provider API gateways.
• If this feature is better suited for the Pro edition, please also consider providing a basic version in the Community edition.
• It would be ideal to configure and view this directly in the UI, rather than only through configuration files.

Thank you for your work!

Please describe the solution you suggest

No response

Additional Information

No response