refactor: 拆分调度器为独立子模块，增强 Sub2API 多认证方式支持

调度器重构:
- 将 CacheAwareScheduler 拆分为 candidate_builder、candidate_sorter、
  concurrency_checker、restriction_checker、scheduling_config、schemas、utils 等独立模块
- 删除旧的 _candidate_builder.py 和 _candidate_sorter.py
- 新增调度并发拒绝 Prometheus 指标

Sub2API 架构增强:
- 支持账号密码登录和 Refresh Token 两种认证方式
- 实现 JWT 自动刷新和 Token Rotation 持久化
- 前端 ProviderAuthDialog 支持多认证方式切换和 credentials_schema 动态渲染
- 验证接口返回 updated_credentials 以同步轮换后的 token

其他改进:
- 并发管理器增加 RPM guard 和动态预留逻辑
- RequestCandidate 支持 mark_skipped 附加 extra_data
- TaskService 增强健壮性
- 补充相关单元测试和契约测试

tests/unit/test_request_candidate_mark_skipped.py

@@ -0,0 +1,40 @@
+from __future__ import annotations
+
+from types import SimpleNamespace
+from unittest.mock import MagicMock
+
+from src.services.request.candidate import RequestCandidateService
+
+
+def test_mark_candidate_skipped_merges_extra_data_and_sets_fields() -> None:
+    candidate = SimpleNamespace(
+        status="available",
+        skip_reason=None,
+        finished_at=None,
+        status_code=None,
+        concurrent_requests=None,
+        extra_data={"needs_conversion": True},
+    )
+
+    query = MagicMock()
+    query.filter.return_value.first.return_value = candidate
+
+    db = MagicMock()
+    db.query.return_value = query
+
+    RequestCandidateService.mark_candidate_skipped(
+        db=db,
+        candidate_id="c1",
+        skip_reason="并发限制",
+        status_code=429,
+        concurrent_requests=12,
+        extra_data={"concurrency_denied": True},
+    )
+
+    assert candidate.status == "skipped"
+    assert candidate.skip_reason == "并发限制"
+    assert candidate.status_code == 429
+    assert candidate.concurrent_requests == 12
+    assert candidate.extra_data == {"needs_conversion": True, "concurrency_denied": True}
+    assert candidate.finished_at is not None
+    db.flush.assert_called_once()