fix: clarify New-API authentication failures

backend/app/services/upstream_client.py

@@ -176,6 +176,12 @@ def _clean_auth_header_value(value: Any, field_name: str) -> str:
     return text
 
 
+def _is_dashboard_jwt(value: Any) -> bool:
+    """识别 New-API 面板登录 JWT，避免将其当作长期 API Token 使用。"""
+    token = str(value or "").strip()
+    return len(token) > 512 and token.count(".") == 2
+
+
 def _find_user_id(value: Any) -> str:
     if isinstance(value, dict):
         for key in ("id", "user_id", "userId"):
@@ -537,6 +543,11 @@ class UpstreamClient:
                 headers["Nox-Api-User"] = user_id
         elif self.auth_type == "new_api_token":
             token = _clean_auth_header_value(self.auth_config.get("token", ""), "New-API access token")
+            if _is_dashboard_jwt(token):
+                raise UpstreamError(
+                    "New-API token 是面板登录 JWT，不是用户 API Token；"
+                    "请在上游 Token 页面重新生成 Access Token"
+                )
             user_id = self._user_header_value()
             if token:
                 headers["Authorization"] = f"Bearer {token}"
@@ -1095,6 +1106,15 @@ class UpstreamClient:
         if not email or not password:
             raise UpstreamError("login_password auth requires email and password in auth_config")
         resp = self._request("POST", login_path, {username_field: email, "password": password}, auth=False)
+        data = _unwrap_data(resp)
+        if isinstance(data, dict) and data.get("require_2fa"):
+            raise UpstreamError(
+                "New-API 账号启用了二次验证，SmartUp 暂不支持密码登录 2FA；"
+                "请改用 Access Token 或 Cookie"
+            )
+        if not _is_success_response(resp):
+            message = _response_message(resp, "New-API 登录失败")
+            raise UpstreamError(message)
         token = _find_token(resp)
         if token:
             self._token = token