feat(oauth): 账号封禁前置 OAuth 验证、抽取 provider_context、完善账号状态分类

- 新增 verify_oauth_before_account_block：在标记账号封禁前先尝试刷新 token，
  区分 OAuth 过期与真正的账号级封禁，避免误标
- 抽取 provider_context.py 统一解析 provider_type，解决 ORM detached 访问问题
- account_state 新增 workspace_deactivated 分类和 auto-removable 状态集合，
  补充中文验证关键词匹配
- OAuth refresh 成功后仅清除可恢复的 token 错误，不再自动清除账号级 block
- deploy.sh 依赖指纹改用纯 shell 实现，移除对 Python tomllib 的依赖
- 前端 Pool 管理页面新增筛选和批量操作优化
- 补充对应测试用例

frontend/src/features/pool/components/PoolAccountBatchDialog.vue

@@ -107,15 +107,15 @@
             <div class="flex items-center gap-1.5">
               <span class="text-xs font-medium truncate">{{ key.key_name || '未命名' }}</span>
               <Badge
-                v-if="isOAuthInvalid(key)"
-                variant="destructive"
-                class="text-[10px] px-1 py-0 h-4 shrink-0"
-              >OAuth失效</Badge>
-              <Badge
-                v-else
                 variant="outline"
                 class="text-[10px] px-1 py-0 h-4 shrink-0"
               >{{ normalizeAuthTypeLabel(key.auth_type) }}</Badge>
+              <Badge
+                v-if="getStatusBadgeLabel(key)"
+                variant="destructive"
+                class="text-[10px] px-1 py-0 h-4 shrink-0"
+                :title="getStatusBadgeTitle(key)"
+              >{{ getStatusBadgeLabel(key) }}</Badge>
               <Badge
                 v-if="key.oauth_plan_type"
                 variant="outline"
@@ -127,11 +127,6 @@
                 class="text-[10px] px-1 py-0 h-4 shrink-0"
                 :title="getOAuthOrgBadge(key)?.title"
               >{{ getOAuthOrgBadge(key)?.label }}</Badge>
-              <Badge
-                v-if="isBannedKey(key)"
-                variant="destructive"
-                class="text-[10px] px-1 py-0 h-4 shrink-0"
-              >封号</Badge>
             </div>
             <div class="flex items-center gap-1.5 mt-0.5 text-[11px] text-muted-foreground flex-wrap">
               <span :class="key.is_active ? '' : 'text-destructive'">{{ key.is_active ? '启用' : '禁用' }}</span>
@@ -283,6 +278,7 @@ import {
 import { exportKey, refreshProviderQuota } from '@/api/endpoints/keys'
 import { refreshProviderOAuth } from '@/api/endpoints/provider_oauth'
 import { useProxyNodesStore } from '@/stores/proxy-nodes'
+import { classifyAccountBlockLabel, cleanAccountBlockReason, isAccountLevelBlockReason, isRefreshFailedReason } from '@/utils/accountBlock'
 import { getOAuthOrgBadge } from '@/utils/oauthIdentity'
 
 type QuickSelectorValue =
@@ -321,12 +317,12 @@ const emit = defineEmits<{
 }>()
 
 const QUICK_SELECT_OPTIONS: Array<{ value: QuickSelectorValue; label: string }> = [
-  { value: 'banned', label: '已封号' },
+  { value: 'banned', label: '账号异常' },
   { value: 'no_5h_limit', label: '无5H限额' },
   { value: 'no_weekly_limit', label: '无周限额' },
   { value: 'plan_free', label: '全部 Free' },
   { value: 'plan_team', label: '全部 Team' },
-  { value: 'oauth_invalid', label: 'OAuth 失效' },
+  { value: 'oauth_invalid', label: 'Token 异常' },
   { value: 'proxy_unset', label: '未配置代理' },
   { value: 'proxy_set', label: '已配置独立代理' },
   { value: 'disabled', label: '已禁用' },
@@ -426,25 +422,43 @@ function normalizeAuthTypeLabel(authType: string): string {
   return 'API Key'
 }
 
-function isBannedKey(key: PoolKeyDetail): boolean {
-  const reason = normalizeText(key.oauth_invalid_reason)
-  if (reason && /(banned|forbidden|blocked|suspend|封|禁|受限)/.test(reason)) return true
-  if (Array.isArray(key.scheduling_reasons)) {
-    return key.scheduling_reasons.some((item) => {
-      const code = normalizeText(item.code)
-      return code === 'account_banned' || code === 'account_forbidden' || code === 'account_blocked'
-    })
+function getStatusBadgeLabel(key: PoolKeyDetail): string | null {
+  const explicitLabel = String(key.account_status_label || '').trim()
+  if (explicitLabel) return explicitLabel
+
+  const reason = String(key.oauth_invalid_reason || '').trim()
+  if (isAccountLevelBlockReason(reason)) {
+    const cleaned = cleanAccountBlockReason(reason)
+    return classifyAccountBlockLabel(cleaned || reason)
   }
-  return false
+
+  if (normalizeText(key.auth_type) !== 'oauth') return null
+  if (isRefreshFailedReason(reason)) return '续期失败'
+  if (key.oauth_invalid_at != null || normalizeText(reason)) return 'Token 失效'
+  if (typeof key.oauth_expires_at === 'number' && key.oauth_expires_at > 0) {
+    return key.oauth_expires_at * 1000 <= Date.now() ? 'Token 过期' : null
+  }
+  return null
 }
 
-function isOAuthInvalid(key: PoolKeyDetail): boolean {
-  if (normalizeText(key.auth_type) !== 'oauth') return false
-  if (key.oauth_invalid_at != null || normalizeText(key.oauth_invalid_reason)) return true
-  if (typeof key.oauth_expires_at === 'number' && key.oauth_expires_at > 0) {
-    return key.oauth_expires_at * 1000 <= Date.now()
+function getStatusBadgeTitle(key: PoolKeyDetail): string {
+  const label = getStatusBadgeLabel(key)
+  if (!label) return ''
+
+  const explicitReason = String(key.account_status_reason || '').trim()
+  if (explicitReason) return `${label}: ${explicitReason}`
+
+  const reason = String(key.oauth_invalid_reason || '').trim()
+  if (!reason) return label
+  if (isAccountLevelBlockReason(reason)) {
+    const cleaned = cleanAccountBlockReason(reason)
+    return cleaned ? `${label}: ${cleaned}` : label
   }
-  return false
+  if (isRefreshFailedReason(reason)) {
+    const cleaned = reason.replace(/^\[REFRESH_FAILED\]\s*/i, '').trim()
+    return cleaned ? `${label}: ${cleaned}` : label
+  }
+  return `${label}: ${reason}`
 }
 
 function formatRelativeTime(value: string): string {

frontend/src/features/pool/components/PoolAdvancedDialog.vue

@@ -28,7 +28,7 @@
           <div class="space-y-0.5">
             <span class="text-sm font-medium">主动探测</span>
             <p class="text-xs text-muted-foreground">
-              定期检查 Key 可用性，提前发现异常
+              按固定间隔主动刷新 Key 的账号状态与额度
             </p>
           </div>
           <Switch
@@ -57,9 +57,9 @@
         </div>
         <div class="flex items-center justify-between p-3 border rounded-lg bg-muted/50">
           <div class="space-y-0.5">
-            <span class="text-sm font-medium">封号自动清除</span>
+            <span class="text-sm font-medium">异常自动清除</span>
             <p class="text-xs text-muted-foreground">
-              检测到账号被封禁时自动从号池中移除
+              仅在检测到不可恢复的账号异常时自动从号池中移除，不处理纯 Token 失效
             </p>
           </div>
           <Switch