feat(oauth): 账号封禁前置 OAuth 验证、抽取 provider_context、完善账号状态分类

- 新增 verify_oauth_before_account_block：在标记账号封禁前先尝试刷新 token，
  区分 OAuth 过期与真正的账号级封禁，避免误标
- 抽取 provider_context.py 统一解析 provider_type，解决 ORM detached 访问问题
- account_state 新增 workspace_deactivated 分类和 auto-removable 状态集合，
  补充中文验证关键词匹配
- OAuth refresh 成功后仅清除可恢复的 token 错误，不再自动清除账号级 block
- deploy.sh 依赖指纹改用纯 shell 实现，移除对 Python tomllib 的依赖
- 前端 Pool 管理页面新增筛选和批量操作优化
- 补充对应测试用例

tests/services/test_error_handler_auto_remove_banned.py

@@ -1,8 +1,12 @@
 from __future__ import annotations
 
+import sys
+import types
 from types import SimpleNamespace
 from typing import Any, cast
 
+import pytest
+
 from src.services.orchestration.error_handler import ErrorHandlerService
 
 
@@ -31,11 +35,16 @@ def _build_key() -> SimpleNamespace:
     )
 
 
-def test_mark_oauth_key_blocked_auto_remove_enabled(monkeypatch: Any) -> None:
+def test_mark_oauth_key_blocked_auto_remove_enabled_skips_verification_state(
+    monkeypatch: Any,
+) -> None:
     db = _FakeDB()
     service = ErrorHandlerService(db=cast(Any, db))
     key = _build_key()
-    provider = SimpleNamespace(config={"pool_advanced": {"auto_remove_banned_keys": True}})
+    provider = SimpleNamespace(
+        provider_type="codex",
+        config={"pool_advanced": {"auto_remove_banned_keys": True}},
+    )
 
     monkeypatch.setattr(
         ErrorHandlerService,
@@ -46,8 +55,8 @@ def test_mark_oauth_key_blocked_auto_remove_enabled(monkeypatch: Any) -> None:
     service._mark_oauth_key_blocked(cast(Any, key), "req-1", provider=cast(Any, provider))
 
     assert db.commit_count == 1
-    assert db.deleted == [key]
-    assert key.is_active is False
+    assert db.deleted == []
+    assert key.is_active is True
     assert str(key.oauth_invalid_reason).startswith("[ACCOUNT_BLOCK] ")
 
 
@@ -61,5 +70,62 @@ def test_mark_oauth_key_blocked_auto_remove_disabled() -> None:
 
     assert db.commit_count == 1
     assert db.deleted == []
-    assert key.is_active is False
+    assert key.is_active is True
     assert str(key.oauth_invalid_reason).startswith("[ACCOUNT_BLOCK] ")
+
+
+def test_mark_oauth_key_blocked_auto_remove_enabled_for_deactivated_account(
+    monkeypatch: Any,
+) -> None:
+    db = _FakeDB()
+    service = ErrorHandlerService(db=cast(Any, db))
+    key = _build_key()
+    provider = SimpleNamespace(
+        provider_type="codex",
+        config={"pool_advanced": {"auto_remove_banned_keys": True}},
+    )
+
+    monkeypatch.setattr(
+        ErrorHandlerService,
+        "_schedule_auto_cleanup_after_delete",
+        staticmethod(lambda **kwargs: None),
+    )
+
+    service._mark_oauth_key_blocked(
+        cast(Any, key),
+        "req-1",
+        reason="account has been deactivated",
+        provider=cast(Any, provider),
+    )
+
+    assert db.commit_count == 1
+    assert db.deleted == [key]
+    assert key.is_active is True
+    assert key.oauth_invalid_reason == "[ACCOUNT_BLOCK] account has been deactivated"
+
+
+@pytest.mark.asyncio
+async def test_verify_oauth_before_account_block_skips_when_refresh_marks_token_expired(
+    monkeypatch: Any,
+) -> None:
+    db = _FakeDB()
+    service = ErrorHandlerService(db=cast(Any, db))
+    key = _build_key()
+    endpoint = SimpleNamespace()
+
+    fake_module = types.ModuleType("src.services.provider.auth")
+
+    async def _fake_get_provider_auth(*_args: Any, **_kwargs: Any) -> None:
+        key.oauth_invalid_reason = "[OAUTH_EXPIRED] token expired"
+
+    fake_module.get_provider_auth = _fake_get_provider_auth
+    monkeypatch.setitem(sys.modules, "src.services.provider.auth", fake_module)
+
+    should_mark = await service._verify_oauth_before_account_block(
+        endpoint=cast(Any, endpoint),
+        key=cast(Any, key),
+        request_id="req-1",
+        candidate_reason="Google 要求验证账号",
+    )
+
+    assert should_mark is False