Polish HeroUI chrome, topology toolbar, and session client IP.

Checkpoint before workbench facade redesign: list defaults, API key quota, toast portal, topology canvas editor toolbar with More menu, and trusted-proxy client IP for sessions.

Co-authored-by: Cursor <cursoragent@cursor.com>

web/src/i18n/en.ts

@@ -562,7 +562,8 @@ const en = {
     loginFailed: "Login failed",
     logout: "Sign out",
     sessionsTitle: "Login sessions",
-    sessionsHint: "Manage browser/device logins for this account. Revoked sessions must sign in again.",
+    sessionsHint:
+      "Manage browser/device logins for this account. Behind a reverse proxy, IP is taken from trusted forwarded headers; use the Client column to tell browsers apart on the same public IP. Revoked sessions must sign in again.",
     sessionsEmpty: "No active sessions.",
     revokeOtherSessions: "Revoke other sessions",
     revokeSession: "Revoke",
@@ -571,6 +572,7 @@ const en = {
     sessionsRevokedOthers: "Revoked {{count}} other session(s)",
     revokeCurrentConfirm: "This is your current session; revoking it requires signing in again. Continue?",
     colSession: "Session",
+    colClient: "Client",
     colLastSeen: "Last seen",
     colCreated: "Created",
     usersTitle: "User management",
@@ -603,7 +605,9 @@ const en = {
     colIp: "IP",
     apiKeysTitle: "API Key management",
     apiKeysHelp:
-      "The web UI uses login sessions, not API keys — keys are for MCP/scripts. Defaults on create: alarms:read + ne:read + ne:write + ne:exec; refine later with Edit scopes (takes effect immediately, no need to regenerate). Secret is shown once. Admins may issue for other users; scopes cannot exceed the owner's. Unused scopes are reserved for future MCP tools.",
+      "The web UI uses login sessions, not API keys — keys are for MCP/scripts. Defaults on create: alarms:read + ne:read + ne:write + ne:exec; refine later with Edit scopes (takes effect immediately, no need to regenerate). Secret is shown once. Admins may issue for other users; scopes cannot exceed the owner's. Unused scopes are reserved for future MCP tools. System-wide cap: {{max}} non-revoked keys (revoke to free a slot).",
+    tokenQuota: "Active {{active}} / {{max}}",
+    tokenLimitReached: "API key limit reached ({{max}}). Revoke unused keys first.",
     tokenName: "Name",
     expiresIn: "Expiry",
     expire7d: "7 days",
@@ -1511,6 +1515,7 @@ const en = {
     browserRegionsSub: "{{count}} item(s)",
     browserEmptyMaps: "No root map under this root yet.",
     addNe: "Add NE",
+    more: "More",
     backUp: "Back",
     newRegion: "New root",
     newRegionName: "New root",

web/src/i18n/zh.ts

@@ -558,7 +558,8 @@ const zh = {
     loginFailed: "登录失败",
     logout: "退出",
     sessionsTitle: "登录会话",
-    sessionsHint: "管理当前账号在各浏览器/设备上的登录。踢掉会话后对方需重新登录。",
+    sessionsHint:
+      "管理当前账号在各浏览器/设备上的登录。IP 经反代时会取真实客户端地址；同公网出口可用「客户端」列区分浏览器/系统。踢掉会话后对方需重新登录。",
     sessionsEmpty: "当前没有活跃会话。",
     revokeOtherSessions: "踢掉其他会话",
     revokeSession: "踢掉",
@@ -567,6 +568,7 @@ const zh = {
     sessionsRevokedOthers: "已踢掉 {{count}} 个其他会话",
     revokeCurrentConfirm: "这是当前会话，踢掉后需要重新登录。继续？",
     colSession: "会话",
+    colClient: "客户端",
     colLastSeen: "最近活动",
     colCreated: "创建时间",
     usersTitle: "用户管理",
@@ -599,7 +601,9 @@ const zh = {
     colIp: "IP",
     apiKeysTitle: "API Key 管理",
     apiKeysHelp:
-      "网页登录不用 API Key，Key 给 MCP/脚本用。生成时默认 alarms:read + ne:read + ne:write + ne:exec，之后用「改权限」增减（保存即生效，不必重生明文）。明文仅创建时显示一次。管理员可代其他用户签发，权限不能超过所属用户已有能力；未接 MCP 的项为预留。",
+      "网页登录不用 API Key，Key 给 MCP/脚本用。生成时默认 alarms:read + ne:read + ne:write + ne:exec，之后用「改权限」增减（保存即生效，不必重生明文）。明文仅创建时显示一次。管理员可代其他用户签发，权限不能超过所属用户已有能力；未接 MCP 的项为预留。全站未吊销 Key 上限 {{max}} 把（吊销后可再建）。",
+    tokenQuota: "未吊销 {{active}} / {{max}}",
+    tokenLimitReached: "已达 API Key 上限（{{max}}），请先吊销不用的 Key",
     tokenName: "名称",
     expiresIn: "有效期",
     expire7d: "7 天",
@@ -1500,6 +1504,7 @@ const zh = {
     browserRegionsSub: "共 {{count}} 个",
     browserEmptyMaps: "此根下还没有根图。",
     addNe: "添加网元",
+    more: "更多",
     backUp: "返回",
     newRegion: "新建根",
     newRegionName: "新根",