feat(oauth): 账号封禁前置 OAuth 验证、抽取 provider_context、完善账号状态分类

- 新增 verify_oauth_before_account_block：在标记账号封禁前先尝试刷新 token，
  区分 OAuth 过期与真正的账号级封禁，避免误标
- 抽取 provider_context.py 统一解析 provider_type，解决 ORM detached 访问问题
- account_state 新增 workspace_deactivated 分类和 auto-removable 状态集合，
  补充中文验证关键词匹配
- OAuth refresh 成功后仅清除可恢复的 token 错误，不再自动清除账号级 block
- deploy.sh 依赖指纹改用纯 shell 实现，移除对 Python tomllib 的依赖
- 前端 Pool 管理页面新增筛选和批量操作优化
- 补充对应测试用例

tests/services/test_pool_account_state.py

@@ -2,7 +2,10 @@
 
 from __future__ import annotations
 
-from src.services.provider.pool.account_state import resolve_pool_account_state
+from src.services.provider.pool.account_state import (
+    resolve_pool_account_state,
+    should_auto_remove_account_state,
+)
 
 
 def test_resolve_from_kiro_banned_metadata() -> None:
@@ -41,6 +44,18 @@ def test_resolve_from_structured_oauth_reason_verification() -> None:
     assert state.reason == "Google requires verification"
 
 
+def test_resolve_from_structured_oauth_reason_verification_chinese() -> None:
+    state = resolve_pool_account_state(
+        provider_type="codex",
+        upstream_metadata=None,
+        oauth_invalid_reason="[ACCOUNT_BLOCK] Google 要求验证账号",
+    )
+    assert state.blocked is True
+    assert state.code == "account_verification"
+    assert state.label == "需要验证"
+    assert state.reason == "Google 要求验证账号"
+
+
 def test_resolve_from_structured_oauth_reason_suspended() -> None:
     state = resolve_pool_account_state(
         provider_type="codex",
@@ -155,3 +170,25 @@ def test_request_failed_prefix_does_not_block() -> None:
         oauth_invalid_reason="[REQUEST_FAILED] Codex 账户访问受限 (403)",
     )
     assert state.blocked is False
+
+
+def test_auto_remove_state_excludes_token_expired_and_verification() -> None:
+    expired = resolve_pool_account_state(
+        provider_type="codex",
+        upstream_metadata=None,
+        oauth_invalid_reason="[OAUTH_EXPIRED] token invalidated",
+    )
+    verification = resolve_pool_account_state(
+        provider_type="codex",
+        upstream_metadata=None,
+        oauth_invalid_reason="[ACCOUNT_BLOCK] Google 要求验证账号",
+    )
+    disabled = resolve_pool_account_state(
+        provider_type="codex",
+        upstream_metadata=None,
+        oauth_invalid_reason="[ACCOUNT_BLOCK] account has been deactivated",
+    )
+
+    assert should_auto_remove_account_state(expired) is False
+    assert should_auto_remove_account_state(verification) is False
+    assert should_auto_remove_account_state(disabled) is True