feat: Implement account role management and banning functionality

- Added role management for accounts, allowing accounts to be set as "normal" or "standby".
- Introduced banning functionality, marking accounts as banned and preventing their use.
- Updated account pool logic to exclude banned and standby accounts from active usage.
- Implemented API endpoints for setting account roles and banning/unbanning accounts.
- Enhanced UI components to support role selection and display account statuses (banned, standby).
- Added localization strings for new features in English and Chinese.
- Updated runtime settings to include a backup release count for standby account promotions.

internal/account/pool_core.go

@@ -46,9 +46,14 @@ func (p *Pool) Reset() {
 	ids := make([]string, 0, len(accounts))
 	for _, a := range accounts {
 		id := a.Identifier()
-		if id != "" {
-			ids = append(ids, id)
+		if id == "" {
+			continue
 		}
+		// Only include normal (non-standby) and non-banned accounts in the pool.
+		if a.Role == "standby" || a.Banned {
+			continue
+		}
+		ids = append(ids, id)
 	}
 	if p.store != nil {
 		p.maxInflightPerAccount = p.store.RuntimeAccountMaxInflight()
@@ -117,10 +122,25 @@ func (p *Pool) Status() map[string]any {
 		}
 	}
 	sort.Strings(inUseAccounts)
+	allAccounts := p.store.Accounts()
+	normalCount := 0
+	standbyCount := 0
+	bannedCount := 0
+	for _, acc := range allAccounts {
+		if acc.Banned {
+			bannedCount++
+			continue
+		}
+		if acc.Role == "standby" {
+			standbyCount++
+		} else {
+			normalCount++
+		}
+	}
 	return map[string]any{
 		"available":                len(available),
 		"in_use":                   inUseSlots,
-		"total":                    len(p.store.Accounts()),
+		"total":                    len(allAccounts),
 		"available_accounts":       available,
 		"in_use_accounts":          inUseAccounts,
 		"max_inflight_per_account": p.maxInflightPerAccount,
@@ -128,5 +148,8 @@ func (p *Pool) Status() map[string]any {
 		"recommended_concurrency":  p.recommendedConcurrency,
 		"waiting":                  len(p.waiters),
 		"max_queue_size":           p.maxQueueSize,
+		"normal_count":             normalCount,
+		"standby_count":            standbyCount,
+		"banned_count":             bannedCount,
 	}
 }

internal/auth/request.go

@@ -152,6 +152,10 @@ func FromContext(ctx context.Context) (*RequestAuth, bool) {
 func (r *Resolver) loginAndPersist(ctx context.Context, a *RequestAuth) error {
 	token, err := r.Login(ctx, a.Account)
 	if err != nil {
+		// Detect USER_IS_BANNED: auto-ban the account and promote standby accounts.
+		if strings.Contains(strings.ToUpper(err.Error()), "USER_IS_BANNED") {
+			r.handleBannedAccount(a.AccountID)
+		}
 		return err
 	}
 	a.Account.Token = token
@@ -160,6 +164,39 @@ func (r *Resolver) loginAndPersist(ctx context.Context, a *RequestAuth) error {
 	return r.Store.UpdateAccountToken(a.AccountID, token)
 }
 
+// handleBannedAccount marks an account as banned and promotes standby accounts
+// based on the segment-based rule: if active normal accounts fall below half of
+// total normal accounts (per segment), promote standby accounts.
+func (r *Resolver) handleBannedAccount(accountID string) {
+	if r.Store == nil || r.Pool == nil {
+		return
+	}
+	acc, err := r.Store.SetAccountBanned(accountID, true)
+	if err != nil {
+		config.Logger.Error("[banned] failed to mark account as banned", "account", accountID, "error", err)
+		return
+	}
+	// Only auto-promote if the banned account was a normal (non-standby) account.
+	if acc.Role == "standby" {
+		return
+	}
+	config.Logger.Warn("[banned] account banned, checking standby promotion", "account", accountID)
+
+	activeNormal := r.Store.ActiveNormalAccounts()
+	totalNormal := r.Store.TotalNormalAccounts()
+	// Segment rule: promote when active normal accounts < half of total normal accounts.
+	// e.g. 2 normal -> both must be banned; 4 normal -> promote when only 1 active.
+	threshold := (totalNormal + 1) / 2 // ceiling of totalNormal/2
+	if activeNormal < threshold {
+		releaseCount := r.Store.RuntimeBackupReleaseCount()
+		promoted := r.Store.PromoteStandbyAccounts(releaseCount)
+		if len(promoted) > 0 {
+			config.Logger.Info("[banned] promoted standby accounts", "count", len(promoted), "accounts", promoted)
+			r.Pool.Reset()
+		}
+	}
+}
+
 func (r *Resolver) RefreshToken(ctx context.Context, a *RequestAuth) bool {
 	if !a.UseConfigToken || a.AccountID == "" {
 		return false

internal/config/config.go

@@ -34,6 +34,8 @@ type Account struct {
 	Password string `json:"password,omitempty"`
 	Token    string `json:"token,omitempty"`
 	ProxyID  string `json:"proxy_id,omitempty"`
+	Role     string `json:"role,omitempty"`  // "normal" (default) or "standby"
+	Banned   bool   `json:"banned,omitempty"` // true when USER_IS_BANNED detected
 }
 
 type APIKey struct {
@@ -154,6 +156,7 @@ type RuntimeConfig struct {
 	AccountMaxQueue           int `json:"account_max_queue,omitempty"`
 	GlobalMaxInflight         int `json:"global_max_inflight,omitempty"`
 	TokenRefreshIntervalHours int `json:"token_refresh_interval_hours,omitempty"`
+	BackupReleaseCount        int `json:"backup_release_count,omitempty"`
 }
 
 type ResponsesConfig struct {

internal/config/store_accessors.go

@@ -1,6 +1,8 @@
 package config
 
 import (
+	"errors"
+	"fmt"
 	"os"
 	"strconv"
 	"strings"
@@ -174,3 +176,108 @@ func (s *Store) ThinkingInjectionPrompt() string {
 	defer s.mu.RUnlock()
 	return strings.TrimSpace(s.cfg.ThinkingInjection.Prompt)
 }
+
+func (s *Store) RuntimeBackupReleaseCount() int {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	if s.cfg.Runtime.BackupReleaseCount > 0 {
+		return s.cfg.Runtime.BackupReleaseCount
+	}
+	return 2
+}
+
+// SetAccountBanned marks an account as banned or unbanned. Returns the updated account.
+func (s *Store) SetAccountBanned(identifier string, banned bool) (Account, error) {
+	identifier = strings.TrimSpace(identifier)
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	idx, ok := s.findAccountIndexLocked(identifier)
+	if !ok {
+		return Account{}, errors.New("account not found")
+	}
+	s.cfg.Accounts[idx].Banned = banned
+	if banned {
+		s.cfg.Accounts[idx].Token = ""
+	}
+	return s.cfg.Accounts[idx], s.saveLocked()
+}
+
+// SetAccountRole changes an account's role. Returns the updated account.
+func (s *Store) SetAccountRole(identifier string, role string) (Account, error) {
+	identifier = strings.TrimSpace(identifier)
+	role = strings.ToLower(strings.TrimSpace(role))
+	if role != "normal" && role != "standby" {
+		return Account{}, fmt.Errorf("invalid role: %s, must be normal or standby", role)
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	idx, ok := s.findAccountIndexLocked(identifier)
+	if !ok {
+		return Account{}, errors.New("account not found")
+	}
+	s.cfg.Accounts[idx].Role = role
+	return s.cfg.Accounts[idx], s.saveLocked()
+}
+
+// ActiveNormalAccounts returns the count of normal accounts that are not banned.
+func (s *Store) ActiveNormalAccounts() int {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	count := 0
+	for _, acc := range s.cfg.Accounts {
+		if acc.Role != "standby" && !acc.Banned {
+			count++
+		}
+	}
+	return count
+}
+
+// TotalNormalAccounts returns the total count of normal accounts (including banned).
+func (s *Store) TotalNormalAccounts() int {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	count := 0
+	for _, acc := range s.cfg.Accounts {
+		if acc.Role != "standby" {
+			count++
+		}
+	}
+	return count
+}
+
+// StandbyAccounts returns all standby accounts that are not banned.
+func (s *Store) StandbyAccounts() []Account {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	var result []Account
+	for _, acc := range s.cfg.Accounts {
+		if acc.Role == "standby" && !acc.Banned {
+			result = append(result, acc)
+		}
+	}
+	return result
+}
+
+// PromoteStandbyAccounts promotes up to n standby accounts to normal role.
+// Returns the identifiers of promoted accounts.
+func (s *Store) PromoteStandbyAccounts(n int) []string {
+	if n <= 0 {
+		return nil
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	var promoted []string
+	for i := range s.cfg.Accounts {
+		if s.cfg.Accounts[i].Role == "standby" && !s.cfg.Accounts[i].Banned {
+			s.cfg.Accounts[i].Role = "normal"
+			promoted = append(promoted, s.cfg.Accounts[i].Identifier())
+			if len(promoted) >= n {
+				break
+			}
+		}
+	}
+	if len(promoted) > 0 {
+		_ = s.saveLocked()
+	}
+	return promoted
+}

internal/config/validation.go

@@ -96,6 +96,9 @@ func ValidateRuntimeConfig(runtime RuntimeConfig) error {
 	if err := ValidateIntRange("runtime.token_refresh_interval_hours", runtime.TokenRefreshIntervalHours, 1, 720, false); err != nil {
 		return err
 	}
+	if err := ValidateIntRange("runtime.backup_release_count", runtime.BackupReleaseCount, 1, 100, false); err != nil {
+		return err
+	}
 	if runtime.AccountMaxInflight > 0 && runtime.GlobalMaxInflight > 0 && runtime.GlobalMaxInflight < runtime.AccountMaxInflight {
 		return fmt.Errorf("runtime.global_max_inflight must be >= runtime.account_max_inflight")
 	}

internal/httpapi/admin/accounts/handler_account_role.go

@@ -0,0 +1,86 @@
+package accounts
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/url"
+
+	"github.com/go-chi/chi/v5"
+)
+
+func (h *Handler) setAccountRole(w http.ResponseWriter, r *http.Request) {
+	identifier := chi.URLParam(r, "identifier")
+	if decoded, err := url.PathUnescape(identifier); err == nil {
+		identifier = decoded
+	}
+
+	var req struct {
+		Role string `json:"role"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeJSON(w, http.StatusBadRequest, map[string]any{"detail": "invalid json"})
+		return
+	}
+
+	acc, err := h.Store.SetAccountRole(identifier, req.Role)
+	if err != nil {
+		writeJSON(w, http.StatusBadRequest, map[string]any{"detail": err.Error()})
+		return
+	}
+
+	h.Pool.Reset()
+	writeJSON(w, http.StatusOK, map[string]any{
+		"success":    true,
+		"identifier": acc.Identifier(),
+		"role":       acc.Role,
+	})
+}
+
+func (h *Handler) setAccountBanned(w http.ResponseWriter, r *http.Request) {
+	identifier := chi.URLParam(r, "identifier")
+	if decoded, err := url.PathUnescape(identifier); err == nil {
+		identifier = decoded
+	}
+
+	var req struct {
+		Banned bool `json:"banned"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeJSON(w, http.StatusBadRequest, map[string]any{"detail": "invalid json"})
+		return
+	}
+
+	acc, err := h.Store.SetAccountBanned(identifier, req.Banned)
+	if err != nil {
+		writeJSON(w, http.StatusBadRequest, map[string]any{"detail": err.Error()})
+		return
+	}
+
+	h.Pool.Reset()
+	writeJSON(w, http.StatusOK, map[string]any{
+		"success":    true,
+		"identifier": acc.Identifier(),
+		"banned":     acc.Banned,
+	})
+}
+
+func (h *Handler) promoteStandby(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		Count int `json:"count"`
+	}
+	_ = json.NewDecoder(r.Body).Decode(&req)
+	if req.Count <= 0 {
+		req.Count = h.Store.RuntimeBackupReleaseCount()
+	}
+
+	promoted := h.Store.PromoteStandbyAccounts(req.Count)
+	if len(promoted) > 0 {
+		h.Pool.Reset()
+	}
+
+	writeJSON(w, http.StatusOK, map[string]any{
+		"success":  true,
+		"promoted": promoted,
+		"count":    len(promoted),
+	})
+}

internal/httpapi/admin/accounts/handler_accounts_crud.go

@@ -69,6 +69,8 @@ func (h *Handler) listAccounts(w http.ResponseWriter, r *http.Request) {
 			"has_token":     token != "",
 			"token_preview": maskSecretPreview(token),
 			"test_status":   testStatus,
+			"role":          acc.Role,
+			"banned":        acc.Banned,
 		})
 	}
 	writeJSON(w, http.StatusOK, map[string]any{"items": items, "total": total, "page": page, "page_size": pageSize, "total_pages": totalPages})

internal/httpapi/admin/accounts/routes.go

@@ -14,6 +14,9 @@ func RegisterRoutes(r chi.Router, h *Handler) {
 	r.Post("/accounts", h.addAccount)
 	r.Put("/accounts/{identifier}", h.updateAccount)
 	r.Delete("/accounts/{identifier}", h.deleteAccount)
+	r.Put("/accounts/{identifier}/role", h.setAccountRole)
+	r.Put("/accounts/{identifier}/banned", h.setAccountBanned)
+	r.Post("/accounts/promote-standby", h.promoteStandby)
 	r.Get("/queue/status", h.queueStatus)
 	r.Post("/accounts/test", h.testSingleAccount)
 	r.Post("/accounts/test-all", h.testAllAccounts)

internal/httpapi/admin/settings/handler_settings_parse.go

@@ -75,6 +75,13 @@ func parseSettingsUpdateRequest(req map[string]any) (*config.AdminConfig, *confi
 			}
 			cfg.TokenRefreshIntervalHours = n
 		}
+		if v, exists := raw["backup_release_count"]; exists {
+			n := intFrom(v)
+			if err := config.ValidateIntRange("runtime.backup_release_count", n, 1, 100, true); err != nil {
+				return nil, nil, nil, nil, nil, nil, nil, nil, err
+			}
+			cfg.BackupReleaseCount = n
+		}
 		if cfg.AccountMaxInflight > 0 && cfg.GlobalMaxInflight > 0 && cfg.GlobalMaxInflight < cfg.AccountMaxInflight {
 			return nil, nil, nil, nil, nil, nil, nil, nil, fmt.Errorf("runtime.global_max_inflight must be >= runtime.account_max_inflight")
 		}

internal/httpapi/admin/settings/handler_settings_read.go

@@ -24,6 +24,7 @@ func (h *Handler) getSettings(w http.ResponseWriter, _ *http.Request) {
 				"account_max_queue":            snap.Runtime.AccountMaxQueue,
 				"global_max_inflight":          snap.Runtime.GlobalMaxInflight,
 				"token_refresh_interval_hours": snap.Runtime.TokenRefreshIntervalHours,
+				"backup_release_count":         snap.Runtime.BackupReleaseCount,
 			},
 			"responses":   snap.Responses,
 			"embeddings":  snap.Embeddings,
@@ -49,6 +50,7 @@ func (h *Handler) getSettings(w http.ResponseWriter, _ *http.Request) {
 			"account_max_queue":            h.Store.RuntimeAccountMaxQueue(recommended),
 			"global_max_inflight":          h.Store.RuntimeGlobalMaxInflight(recommended),
 			"token_refresh_interval_hours": h.Store.RuntimeTokenRefreshIntervalHours(),
+			"backup_release_count":         h.Store.RuntimeBackupReleaseCount(),
 		},
 		"responses":   snap.Responses,
 		"embeddings":  snap.Embeddings,

internal/httpapi/admin/settings/handler_settings_runtime.go

@@ -17,6 +17,9 @@ func validateMergedRuntimeSettings(current config.RuntimeConfig, incoming *confi
 		if incoming.TokenRefreshIntervalHours > 0 {
 			merged.TokenRefreshIntervalHours = incoming.TokenRefreshIntervalHours
 		}
+		if incoming.BackupReleaseCount > 0 {
+			merged.BackupReleaseCount = incoming.BackupReleaseCount
+		}
 	}
 	return validateRuntimeSettings(merged)
 }

internal/httpapi/admin/settings/handler_settings_write.go

@@ -52,6 +52,9 @@ func (h *Handler) updateSettings(w http.ResponseWriter, r *http.Request) {
 			if runtimeCfg.TokenRefreshIntervalHours > 0 {
 				c.Runtime.TokenRefreshIntervalHours = runtimeCfg.TokenRefreshIntervalHours
 			}
+			if runtimeCfg.BackupReleaseCount > 0 {
+				c.Runtime.BackupReleaseCount = runtimeCfg.BackupReleaseCount
+			}
 		}
 		if responsesCfg != nil && responsesCfg.StoreTTLSeconds > 0 {
 			c.Responses.StoreTTLSeconds = responsesCfg.StoreTTLSeconds

internal/httpapi/admin/shared/deps.go

@@ -32,12 +32,18 @@ type ConfigStore interface {
 	RuntimeAccountMaxQueue(defaultSize int) int
 	RuntimeGlobalMaxInflight(defaultSize int) int
 	RuntimeTokenRefreshIntervalHours() int
+	RuntimeBackupReleaseCount() int
 	AutoDeleteMode() string
 	CurrentInputFileEnabled() bool
 	CurrentInputFileMinChars() int
 	ThinkingInjectionEnabled() bool
 	ThinkingInjectionPrompt() string
 	AutoDeleteSessions() bool
+	SetAccountBanned(identifier string, banned bool) (config.Account, error)
+	SetAccountRole(identifier string, role string) (config.Account, error)
+	ActiveNormalAccounts() int
+	TotalNormalAccounts() int
+	PromoteStandbyAccounts(n int) []string
 }
 
 type PoolController interface {

internal/httpapi/admin/shared/helpers.go

@@ -161,6 +161,10 @@ func toStringSlice(v any) ([]string, bool) {
 func toAccount(m map[string]any) config.Account {
 	email := fieldString(m, "email")
 	mobile := config.NormalizeMobileForStorage(fieldString(m, "mobile"))
+	role := strings.ToLower(strings.TrimSpace(fieldString(m, "role")))
+	if role != "normal" && role != "standby" {
+		role = "" // default to normal (empty string treated as normal)
+	}
 	return config.Account{
 		Name:     fieldString(m, "name"),
 		Remark:   fieldString(m, "remark"),
@@ -168,6 +172,7 @@ func toAccount(m map[string]any) config.Account {
 		Mobile:   mobile,
 		Password: fieldString(m, "password"),
 		ProxyID:  fieldString(m, "proxy_id"),
+		Role:     role,
 	}
 }
 
@@ -324,6 +329,10 @@ func normalizeAccountForStorage(acc config.Account) config.Account {
 	acc.Email = strings.TrimSpace(acc.Email)
 	acc.Mobile = config.NormalizeMobileForStorage(acc.Mobile)
 	acc.ProxyID = strings.TrimSpace(acc.ProxyID)
+	acc.Role = strings.ToLower(strings.TrimSpace(acc.Role))
+	if acc.Role != "normal" && acc.Role != "standby" {
+		acc.Role = ""
+	}
 	return acc
 }
 

webui/src/features/account/AccountManagerContainer.jsx

@@ -66,6 +66,8 @@ export default function AccountManagerContainer({ config, onRefresh, onMessage,
         testAllAccounts,
         deleteAllSessions,
         updateAccountProxy,
+        toggleRole,
+        toggleBanned,
     } = useAccountActions({
         apiFetch,
         t,
@@ -136,6 +138,8 @@ export default function AccountManagerContainer({ config, onRefresh, onMessage,
                 onDeleteAccount={deleteAccount}
                 onDeleteAllSessions={deleteAllSessions}
                 onUpdateAccountProxy={updateAccountProxy}
+                onToggleRole={toggleRole}
+                onToggleBanned={toggleBanned}
                 onPrevPage={() => fetchAccounts(page - 1)}
                 onNextPage={() => fetchAccounts(page + 1)}
                 onPageSizeChange={changePageSize}

webui/src/features/account/AccountsTable.jsx

@@ -1,5 +1,5 @@
 import { useState } from 'react'
-import { ChevronLeft, ChevronRight, Check, Copy, Pencil, Play, Plus, Trash2, FolderX } from 'lucide-react'
+import { ChevronLeft, ChevronRight, Check, Copy, Pencil, Play, Plus, Trash2, FolderX, Shield, ShieldOff, ArrowLeftRight } from 'lucide-react'
 import clsx from 'clsx'
 
 export default function AccountsTable({
@@ -25,6 +25,8 @@ export default function AccountsTable({
     onDeleteAccount,
     onDeleteAllSessions,
     onUpdateAccountProxy,
+    onToggleRole,
+    onToggleBanned,
     onPrevPage,
     onNextPage,
     onPageSizeChange,
@@ -109,13 +111,20 @@ export default function AccountsTable({
                         const assignedProxy = proxies.find(proxy => proxy.id === acc.proxy_id)
                         const runtimeUnknown = envBacked && !acc.test_status
                         const isActive = acc.test_status === 'ok' || acc.has_token
+                        const isStandby = acc.role === 'standby'
+                        const isBanned = acc.banned
                         return (
-                            <div key={i} className="p-4 flex flex-col md:flex-row md:items-center justify-between gap-4 hover:bg-muted/50 transition-colors">
+                            <div key={i} className={clsx(
+                                "p-4 flex flex-col md:flex-row md:items-center justify-between gap-4 transition-colors",
+                                isBanned ? "bg-red-500/5 hover:bg-red-500/10" : isStandby ? "bg-amber-500/5 hover:bg-amber-500/10" : "hover:bg-muted/50"
+                            )}>
                                 <div className="flex items-center gap-3 min-w-0">
                                     <div className={clsx(
                                         "w-2 h-2 rounded-full shrink-0",
+                                        isBanned ? "bg-red-500 shadow-[0_0_8px_rgba(239,68,68,0.5)]" :
                                         acc.test_status === 'failed' ? "bg-red-500 shadow-[0_0_8px_rgba(239,68,68,0.5)]" :
-                                        isActive ? "bg-emerald-500 shadow-[0_0_8px_rgba(16,185,129,0.5)]" :
+                                        isActive && !isStandby ? "bg-emerald-500 shadow-[0_0_8px_rgba(16,185,129,0.5)]" :
+                                        isStandby ? "bg-amber-500 shadow-[0_0_8px_rgba(245,158,11,0.5)]" :
                                         runtimeUnknown ? "bg-blue-500 shadow-[0_0_8px_rgba(59,130,246,0.5)]" : "bg-amber-500"
                                     )} />
                                     <div className="min-w-0">
@@ -134,7 +143,17 @@ export default function AccountsTable({
                                             <div className="text-xs text-muted-foreground truncate mt-0.5">{acc.remark}</div>
                                         )}
                                         <div className="flex items-center gap-2 text-xs text-muted-foreground mt-0.5">
-                                            <span>{acc.test_status === 'failed' ? t('accountManager.testStatusFailed') : isActive ? t('accountManager.sessionActive') : runtimeUnknown ? t('accountManager.runtimeStatusUnknown') : t('accountManager.reauthRequired')}</span>
+                                            <span>{isBanned ? t('accountManager.bannedStatus') : isStandby ? t('accountManager.standbyStatus') : acc.test_status === 'failed' ? t('accountManager.testStatusFailed') : isActive ? t('accountManager.sessionActive') : runtimeUnknown ? t('accountManager.runtimeStatusUnknown') : t('accountManager.reauthRequired')}</span>
+                                            {isStandby && !isBanned && (
+                                                <span className="font-mono bg-amber-500/10 text-amber-500 px-1.5 py-0.5 rounded text-[10px]">
+                                                    {t('accountManager.roleStandby')}
+                                                </span>
+                                            )}
+                                            {isBanned && (
+                                                <span className="font-mono bg-red-500/10 text-red-500 px-1.5 py-0.5 rounded text-[10px]">
+                                                    {t('accountManager.bannedBadge')}
+                                                </span>
+                                            )}
                                             {acc.token_preview && (
                                                 <span className="font-mono bg-muted px-1.5 py-0.5 rounded text-[10px]">
                                                     {acc.token_preview}
@@ -181,6 +200,20 @@ export default function AccountsTable({
                                             </option>
                                         ))}
                                     </select>
+                                    <button
+                                        onClick={() => onToggleRole(id, isStandby ? 'normal' : 'standby')}
+                                        className="p-1 lg:p-1.5 text-muted-foreground hover:text-amber-500 hover:bg-amber-500/10 rounded-md transition-colors"
+                                        title={isStandby ? t('accountManager.switchToNormal') : t('accountManager.switchToStandby')}
+                                    >
+                                        <ArrowLeftRight className="w-3.5 h-3.5 lg:w-4 lg:h-4" />
+                                    </button>
+                                    <button
+                                        onClick={() => onToggleBanned(id, !isBanned)}
+                                        className="p-1 lg:p-1.5 text-muted-foreground hover:text-red-500 hover:bg-red-500/10 rounded-md transition-colors"
+                                        title={isBanned ? t('accountManager.unbanAccount') : t('accountManager.banAccount')}
+                                    >
+                                        {isBanned ? <ShieldOff className="w-3.5 h-3.5 lg:w-4 lg:h-4" /> : <Shield className="w-3.5 h-3.5 lg:w-4 lg:h-4" />}
+                                    </button>
                                     <button
                                         onClick={() => onEditAccount(acc)}
                                         disabled={!id}

webui/src/features/account/AddAccountModal.jsx

@@ -23,6 +23,57 @@ export default function AddAccountModal({
                     </button>
                 </div>
                 <div className="p-6 space-y-4">
+                    <div>
+                        <label className="block text-sm font-medium mb-1.5">{t('accountManager.accountTypeLabel')}</label>
+                        <div className="flex gap-3">
+                            <label className={`flex-1 flex items-center gap-2 p-3 rounded-lg border cursor-pointer transition-colors ${
+                                (newAccount.role || 'normal') === 'normal'
+                                    ? 'border-primary bg-primary/10 text-primary'
+                                    : 'border-border hover:border-primary/50'
+                            }`}>
+                                <input
+                                    type="radio"
+                                    name="account-role"
+                                    value="normal"
+                                    checked={(newAccount.role || 'normal') === 'normal'}
+                                    onChange={() => setNewAccount({ ...newAccount, role: 'normal' })}
+                                    className="sr-only"
+                                />
+                                <div className={`w-4 h-4 rounded-full border-2 flex items-center justify-center ${
+                                    (newAccount.role || 'normal') === 'normal' ? 'border-primary' : 'border-muted-foreground'
+                                }`}>
+                                    {(newAccount.role || 'normal') === 'normal' && <div className="w-2 h-2 rounded-full bg-primary" />}
+                                </div>
+                                <div>
+                                    <div className="text-sm font-medium">{t('accountManager.roleNormal')}</div>
+                                    <div className="text-xs text-muted-foreground">{t('accountManager.roleNormalDesc')}</div>
+                                </div>
+                            </label>
+                            <label className={`flex-1 flex items-center gap-2 p-3 rounded-lg border cursor-pointer transition-colors ${
+                                newAccount.role === 'standby'
+                                    ? 'border-amber-500 bg-amber-500/10 text-amber-500'
+                                    : 'border-border hover:border-amber-500/50'
+                            }`}>
+                                <input
+                                    type="radio"
+                                    name="account-role"
+                                    value="standby"
+                                    checked={newAccount.role === 'standby'}
+                                    onChange={() => setNewAccount({ ...newAccount, role: 'standby' })}
+                                    className="sr-only"
+                                />
+                                <div className={`w-4 h-4 rounded-full border-2 flex items-center justify-center ${
+                                    newAccount.role === 'standby' ? 'border-amber-500' : 'border-muted-foreground'
+                                }`}>
+                                    {newAccount.role === 'standby' && <div className="w-2 h-2 rounded-full bg-amber-500" />}
+                                </div>
+                                <div>
+                                    <div className="text-sm font-medium">{t('accountManager.roleStandby')}</div>
+                                    <div className="text-xs text-muted-foreground">{t('accountManager.roleStandbyDesc')}</div>
+                                </div>
+                            </label>
+                        </div>
+                    </div>
                     <div>
                         <label className="block text-sm font-medium mb-1.5">{t('accountManager.nameOptional')}</label>
                         <input

webui/src/features/account/QueueCards.jsx

@@ -1,4 +1,4 @@
-import { CheckCircle2, Server, ShieldCheck } from 'lucide-react'
+import { CheckCircle2, Server, ShieldCheck, ShieldAlert, ShieldOff } from 'lucide-react'
 
 export default function QueueCards({ queueStatus, t }) {
     if (!queueStatus) {
@@ -6,7 +6,7 @@ export default function QueueCards({ queueStatus, t }) {
     }
 
     return (
-        <div className="grid grid-cols-1 md:grid-cols-3 gap-4">
+        <div className="grid grid-cols-1 md:grid-cols-3 lg:grid-cols-5 gap-4">
             <div className="bg-card border border-border rounded-xl p-4 flex flex-col justify-between shadow-sm relative overflow-hidden group">
                 <div className="absolute right-0 top-0 p-4 opacity-5 group-hover:opacity-10 transition-opacity">
                     <CheckCircle2 className="w-16 h-16" />
@@ -31,9 +31,29 @@ export default function QueueCards({ queueStatus, t }) {
                 <div className="absolute right-0 top-0 p-4 opacity-5 group-hover:opacity-10 transition-opacity">
                     <ShieldCheck className="w-16 h-16" />
                 </div>
-                <p className="text-xs font-medium text-muted-foreground uppercase tracking-widest">{t('accountManager.totalPool')}</p>
+                <p className="text-xs font-medium text-muted-foreground uppercase tracking-widest">{t('accountManager.roleNormal')}</p>
                 <div className="mt-2 flex items-baseline gap-2">
-                    <span className="text-3xl font-bold text-foreground">{queueStatus.total}</span>
+                    <span className="text-3xl font-bold text-foreground">{queueStatus.normal_count ?? '-'}</span>
+                    <span className="text-xs text-muted-foreground">{t('accountManager.accountsUnit')}</span>
+                </div>
+            </div>
+            <div className="bg-card border border-amber-500/20 rounded-xl p-4 flex flex-col justify-between shadow-sm relative overflow-hidden group">
+                <div className="absolute right-0 top-0 p-4 opacity-5 group-hover:opacity-10 transition-opacity">
+                    <ShieldAlert className="w-16 h-16 text-amber-500" />
+                </div>
+                <p className="text-xs font-medium text-amber-500/80 uppercase tracking-widest">{t('accountManager.roleStandby')}</p>
+                <div className="mt-2 flex items-baseline gap-2">
+                    <span className="text-3xl font-bold text-amber-500">{queueStatus.standby_count ?? '-'}</span>
+                    <span className="text-xs text-muted-foreground">{t('accountManager.accountsUnit')}</span>
+                </div>
+            </div>
+            <div className="bg-card border border-red-500/20 rounded-xl p-4 flex flex-col justify-between shadow-sm relative overflow-hidden group">
+                <div className="absolute right-0 top-0 p-4 opacity-5 group-hover:opacity-10 transition-opacity">
+                    <ShieldOff className="w-16 h-16 text-red-500" />
+                </div>
+                <p className="text-xs font-medium text-red-500/80 uppercase tracking-widest">{t('accountManager.bannedBadge')}</p>
+                <div className="mt-2 flex items-baseline gap-2">
+                    <span className="text-3xl font-bold text-red-500">{queueStatus.banned_count ?? '-'}</span>
                     <span className="text-xs text-muted-foreground">{t('accountManager.accountsUnit')}</span>
                 </div>
             </div>

webui/src/features/account/useAccountActions.js

@@ -8,7 +8,7 @@ export function useAccountActions({ apiFetch, t, onMessage, onRefresh, config, f
     const [editingAccount, setEditingAccount] = useState(null)
     const [newKey, setNewKey] = useState({ key: '', name: '', remark: '' })
     const [copiedKey, setCopiedKey] = useState(null)
-    const [newAccount, setNewAccount] = useState({ name: '', remark: '', email: '', mobile: '', password: '' })
+    const [newAccount, setNewAccount] = useState({ name: '', remark: '', email: '', mobile: '', password: '', role: 'normal' })
     const [editAccount, setEditAccount] = useState({ name: '', remark: '' })
     const [loading, setLoading] = useState(false)
     const [testing, setTesting] = useState({})
@@ -45,13 +45,13 @@ export function useAccountActions({ apiFetch, t, onMessage, onRefresh, config, f
         setShowEditAccount(false)
         setEditingAccount(null)
         setEditAccount({ name: '', remark: '' })
-        setNewAccount({ name: '', remark: '', email: '', mobile: '', password: '' })
+        setNewAccount({ name: '', remark: '', email: '', mobile: '', password: '', role: 'normal' })
         setShowAddAccount(true)
     }
 
     const closeAddAccount = () => {
         setShowAddAccount(false)
-        setNewAccount({ name: '', remark: '', email: '', mobile: '', password: '' })
+        setNewAccount({ name: '', remark: '', email: '', mobile: '', password: '', role: 'normal' })
     }
 
     const openEditAccount = (account) => {
@@ -345,6 +345,56 @@ export function useAccountActions({ apiFetch, t, onMessage, onRefresh, config, f
         }
     }
 
+    const toggleRole = async (identifier, newRole) => {
+        const accountID = String(identifier || '').trim()
+        if (!accountID) {
+            onMessage('error', t('accountManager.invalidIdentifier'))
+            return
+        }
+        try {
+            const res = await apiFetch(`/admin/accounts/${encodeURIComponent(accountID)}/role`, {
+                method: 'PUT',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ role: newRole }),
+            })
+            const data = await res.json()
+            if (!res.ok) {
+                onMessage('error', data.detail || t('messages.requestFailed'))
+                return
+            }
+            onMessage('success', newRole === 'standby' ? t('accountManager.switchToStandbySuccess') : t('accountManager.switchToNormalSuccess'))
+            fetchAccounts()
+            onRefresh()
+        } catch (_err) {
+            onMessage('error', t('messages.networkError'))
+        }
+    }
+
+    const toggleBanned = async (identifier, banned) => {
+        const accountID = String(identifier || '').trim()
+        if (!accountID) {
+            onMessage('error', t('accountManager.invalidIdentifier'))
+            return
+        }
+        try {
+            const res = await apiFetch(`/admin/accounts/${encodeURIComponent(accountID)}/banned`, {
+                method: 'PUT',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ banned }),
+            })
+            const data = await res.json()
+            if (!res.ok) {
+                onMessage('error', data.detail || t('messages.requestFailed'))
+                return
+            }
+            onMessage('success', banned ? t('accountManager.banSuccess') : t('accountManager.unbanSuccess'))
+            fetchAccounts()
+            onRefresh()
+        } catch (_err) {
+            onMessage('error', t('messages.networkError'))
+        }
+    }
+
     return {
         showAddKey,
         openAddKey,
@@ -382,5 +432,7 @@ export function useAccountActions({ apiFetch, t, onMessage, onRefresh, config, f
         testAllAccounts,
         deleteAllSessions,
         updateAccountProxy,
+        toggleRole,
+        toggleBanned,
     }
 }

webui/src/features/settings/RuntimeSection.jsx

@@ -2,7 +2,7 @@ export default function RuntimeSection({ t, form, setForm }) {
     return (
         <div className="bg-card border border-border rounded-xl p-5 space-y-4">
             <h3 className="font-semibold">{t('settings.runtimeTitle')}</h3>
-            <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-4 gap-4">
+            <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-5 gap-4">
                 <label className="text-sm space-y-2">
                     <span className="text-muted-foreground">{t('settings.accountMaxInflight')}</span>
                     <input
@@ -57,6 +57,21 @@ export default function RuntimeSection({ t, form, setForm }) {
                         className="w-full bg-background border border-border rounded-lg px-3 py-2"
                     />
                 </label>
+                <label className="text-sm space-y-2">
+                    <span className="text-muted-foreground">{t('settings.backupReleaseCount')}</span>
+                    <input
+                        type="number"
+                        min={1}
+                        max={100}
+                        step={1}
+                        value={form.runtime.backup_release_count}
+                        onChange={(e) => setForm((prev) => ({
+                            ...prev,
+                            runtime: { ...prev.runtime, backup_release_count: Number(e.target.value || 2) },
+                        }))}
+                        className="w-full bg-background border border-border rounded-lg px-3 py-2"
+                    />
+                </label>
             </div>
         </div>
     )

webui/src/features/settings/useSettingsForm.js

@@ -12,7 +12,7 @@ const MAX_AUTO_FETCH_FAILURES = 3
 
 const DEFAULT_FORM = {
     admin: { jwt_expire_hours: 24 },
-    runtime: { account_max_inflight: 2, account_max_queue: 10, global_max_inflight: 10, token_refresh_interval_hours: 6 },
+    runtime: { account_max_inflight: 2, account_max_queue: 10, global_max_inflight: 10, token_refresh_interval_hours: 6, backup_release_count: 2 },
     responses: { store_ttl_seconds: 900 },
     embeddings: { provider: '' },
     auto_delete: { mode: 'none' },
@@ -67,6 +67,7 @@ function fromServerForm(data) {
             account_max_queue: Number(runtimeSource?.account_max_queue || 10),
             global_max_inflight: Number(runtimeSource?.global_max_inflight || 10),
             token_refresh_interval_hours: Number(runtimeSource?.token_refresh_interval_hours || 6),
+            backup_release_count: Number(runtimeSource?.backup_release_count || 2),
         },
         responses: {
             store_ttl_seconds: Number(responsesSource?.store_ttl_seconds || 900),
@@ -99,6 +100,7 @@ function toServerPayload(form) {
             account_max_queue: Number(form.runtime.account_max_queue),
             global_max_inflight: Number(form.runtime.global_max_inflight),
             token_refresh_interval_hours: Number(form.runtime.token_refresh_interval_hours),
+            backup_release_count: Number(form.runtime.backup_release_count),
         },
         responses: { store_ttl_seconds: Number(form.responses.store_ttl_seconds) },
         embeddings: { provider: String(form.embeddings.provider || '').trim() },

webui/src/locales/en.json

@@ -171,6 +171,22 @@
         "proxyNone": "Direct connection",
         "proxyBadge": "Proxy: {name}",
         "proxyUpdateSuccess": "Account proxy updated.",
+        "accountTypeLabel": "Account type",
+        "roleNormal": "Normal",
+        "roleNormalDesc": "Participates in request rotation",
+        "roleStandby": "Standby",
+        "roleStandbyDesc": "Activated when normal accounts are banned",
+        "standbyStatus": "Standby",
+        "bannedStatus": "Banned",
+        "bannedBadge": "Banned",
+        "switchToNormal": "Switch to normal",
+        "switchToStandby": "Switch to standby",
+        "switchToNormalSuccess": "Switched to normal account",
+        "switchToStandbySuccess": "Switched to standby account",
+        "banAccount": "Ban account",
+        "unbanAccount": "Unban account",
+        "banSuccess": "Account banned",
+        "unbanSuccess": "Account unbanned",
         "envModeRiskTitle": "Environment-variable config mode detected (persistence risk)",
         "envModeRiskDesc": "Detected DS2API_CONFIG_JSON. If DS2API_ENV_WRITEBACK is not enabled, Admin UI edits are in-memory only and may be lost after restart.",
         "envModeWritebackPendingTitle": "Env mode + auto-persistence enabled (pending file handoff)",
@@ -403,6 +419,7 @@
         "accountMaxQueue": "Account max queue size",
         "globalMaxInflight": "Global max inflight",
         "tokenRefreshIntervalHours": "Managed token refresh interval (hours)",
+        "backupReleaseCount": "Standby accounts released per batch",
         "behaviorTitle": "Behavior",
         "responsesTTL": "Responses store TTL (seconds)",
         "embeddingsProvider": "Embeddings provider",

webui/src/locales/zh.json

@@ -171,6 +171,22 @@
         "proxyNone": "不走代理",
         "proxyBadge": "代理: {name}",
         "proxyUpdateSuccess": "账号代理已更新",
+        "accountTypeLabel": "账号类型",
+        "roleNormal": "正常账号",
+        "roleNormalDesc": "参与请求轮询",
+        "roleStandby": "后备账号",
+        "roleStandbyDesc": "正常账号被封时启用",
+        "standbyStatus": "后备待命",
+        "bannedStatus": "已被封禁",
+        "bannedBadge": "封禁",
+        "switchToNormal": "切换为正常账号",
+        "switchToStandby": "切换为后备账号",
+        "switchToNormalSuccess": "已切换为正常账号",
+        "switchToStandbySuccess": "已切换为后备账号",
+        "banAccount": "封禁账号",
+        "unbanAccount": "解封账号",
+        "banSuccess": "账号已封禁",
+        "unbanSuccess": "账号已解封",
         "envModeRiskTitle": "当前为环境变量配置模式（有持久化风险）",
         "envModeRiskDesc": "检测到 DS2API_CONFIG_JSON。若未开启 DS2API_ENV_WRITEBACK，管理台改动仅在内存生效，重启可能丢失。",
         "envModeWritebackPendingTitle": "环境变量模式 + 自动持久化已开启（等待落盘）",
@@ -403,6 +419,7 @@
         "accountMaxQueue": "账号等待队列上限",
         "globalMaxInflight": "全局并发上限",
         "tokenRefreshIntervalHours": "托管账号 Token 刷新间隔（小时）",
+        "backupReleaseCount": "后备账号每次释放个数",
         "behaviorTitle": "行为设置",
         "responsesTTL": "Responses 缓存 TTL（秒）",
         "embeddingsProvider": "Embeddings Provider",