fix: defaut ui triage (#4802)

* fix: theme-aware payment paths, auto-group validation, route guards, perf group filtering

- Add common.ThemeAwarePath to generate correct redirect URLs based on
  active theme (default vs classic), replacing hardcoded /console/* paths
  in 7 controllers and service/quota.go (#4765)
- Validate auto-group availability against getUserGroups before defaulting
  form values; playground falls back to 'default' group when 'auto' is
  unavailable (#4796, #4799)
- Enforce HeaderNavModules settings in rankings route (frontend + backend
  API) and SidebarModulesAdmin in playground route to block direct URL
  access when features are disabled (#4704, #4512)
- Filter perf_metrics API response to only include currently configured
  groups, hiding stale data from deleted groups (#4790)
- Preserve query params (pay=success/fail) in /console/topup → /wallet
  frontend redirect

* fix: update hero section text and localization strings for clarity

controller/rankings.go

@@ -3,11 +3,51 @@ package controller
 import (
 	"net/http"
 
+	"github.com/QuantumNous/new-api/common"
 	"github.com/QuantumNous/new-api/service"
 	"github.com/gin-gonic/gin"
 )
 
+func isRankingsEnabled() bool {
+	common.OptionMapRWMutex.RLock()
+	raw := common.OptionMap["HeaderNavModules"]
+	common.OptionMapRWMutex.RUnlock()
+
+	if raw == "" {
+		return true
+	}
+
+	var parsed map[string]interface{}
+	if err := common.Unmarshal([]byte(raw), &parsed); err != nil {
+		return true
+	}
+	rankings, ok := parsed["rankings"]
+	if !ok {
+		return true
+	}
+	switch v := rankings.(type) {
+	case bool:
+		return v
+	case map[string]interface{}:
+		if enabled, ok := v["enabled"]; ok {
+			if b, ok := enabled.(bool); ok {
+				return b
+			}
+		}
+		return true
+	}
+	return true
+}
+
 func GetRankings(c *gin.Context) {
+	if !isRankingsEnabled() {
+		c.JSON(http.StatusForbidden, gin.H{
+			"success": false,
+			"message": "rankings is disabled",
+		})
+		return
+	}
+
 	result, err := service.GetRankingsSnapshot(c.DefaultQuery("period", "week"))
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{