feat(user): support disallowed name

app/auth.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 from datetime import datetime, timedelta
 import hashlib
+import re
 import secrets
 import string
 
@@ -26,6 +27,36 @@ pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
 bcrypt_cache = {}
 
 
+def validate_username(username: str) -> list[str]:
+    """验证用户名"""
+    errors = []
+
+    if not username:
+        errors.append("Username is required")
+        return errors
+
+    if len(username) < 3:
+        errors.append("Username must be at least 3 characters long")
+
+    if len(username) > 15:
+        errors.append("Username must be at most 15 characters long")
+
+    # 检查用户名格式（只允许字母、数字、下划线、连字符）
+    if not re.match(r"^[a-zA-Z0-9_-]+$", username):
+        errors.append(
+            "Username can only contain letters, numbers, underscores, and hyphens"
+        )
+
+    # 检查是否以数字开头
+    if username[0].isdigit():
+        errors.append("Username cannot start with a number")
+
+    if username.lower() in settings.banned_name:
+        errors.append("This username is not allowed")
+
+    return errors
+
+
 def verify_password_legacy(plain_password: str, bcrypt_hash: str) -> bool:
     """
     验证密码 - 使用 osu! 的验证方式