实现叫号播报并调整现场业务规则

需求描述：发布屏在员工叫号后播放语音；同场次手机号被叫号后可重新取号；登录连续失败限制调整为10次。

实现思路：发布屏按新批次去重触发中文语音；重复手机号仅拦截WAITING号码；登录限流使用10次阈值，并补充前后端回归测试与接口说明。

server/internal/httpapi/limiter_test.go

@@ -24,3 +24,21 @@ func TestQueryLimiterResetsAfterWindow(t *testing.T) {
 		t.Fatal("query should be allowed after the window resets")
 	}
 }
+
+func TestLoginLimiterBlocksAfterTenFailures(t *testing.T) {
+	now := time.Unix(100, 0)
+	limiter := newLoginLimiter(func() time.Time { return now })
+	const key = "staff|127.0.0.1"
+
+	for attempt := 1; attempt < 10; attempt++ {
+		limiter.failure(key)
+		if allowed, _ := limiter.allow(key); !allowed {
+			t.Fatalf("login should remain allowed after %d failures", attempt)
+		}
+	}
+
+	limiter.failure(key)
+	if allowed, retry := limiter.allow(key); allowed || retry != 10*time.Minute {
+		t.Fatalf("login should be locked for 10 minutes after 10 failures, got allowed=%v retry=%s", allowed, retry)
+	}
+}