修复：调整游客取号限流策略

问题：移动网络共享出口 IP 会造成游客取号被误限流。

实现：移除公开取号 IP 限制，改用项目总量与手机号 HMAC 限流，并支持 Retry-After 倒计时。

web/src/pages/VisitorTakeTicketPage.test.tsx

@@ -100,4 +100,23 @@ describe("VisitorTakeTicketForm", () => {
       createTicket.mockRestore();
     }
   });
+
+  it("shows the Retry-After wait without clearing the visitor form", async () => {
+    const createTicket = vi.spyOn(api, "publicCreateTicket").mockRejectedValueOnce(
+      new ApiError("取号次数过多，请稍后再试", 429, undefined, "PUBLIC_TICKET_RATE_LIMITED", 17),
+    );
+
+    try {
+      render(<MemoryRouter><VisitorTakeTicketForm /></MemoryRouter>);
+      const phoneInput = screen.getByLabelText("手机号");
+      fireEvent.change(phoneInput, { target: { value: "13800138000" } });
+      fireEvent.click(screen.getByRole("button", { name: "创建排队号码" }));
+
+      await waitFor(() => expect(screen.getByText(/17 秒后重试/)).toBeVisible());
+      expect(phoneInput).toHaveValue("13800138000");
+      expect(screen.getByRole("button", { name: /请等待 17 秒/ })).toBeDisabled();
+    } finally {
+      createTicket.mockRestore();
+    }
+  });
 });