feat(oauth): 账号封禁前置 OAuth 验证、抽取 provider_context、完善账号状态分类

- 新增 verify_oauth_before_account_block：在标记账号封禁前先尝试刷新 token，
  区分 OAuth 过期与真正的账号级封禁，避免误标
- 抽取 provider_context.py 统一解析 provider_type，解决 ORM detached 访问问题
- account_state 新增 workspace_deactivated 分类和 auto-removable 状态集合，
  补充中文验证关键词匹配
- OAuth refresh 成功后仅清除可恢复的 token 错误，不再自动清除账号级 block
- deploy.sh 依赖指纹改用纯 shell 实现，移除对 Python tomllib 的依赖
- 前端 Pool 管理页面新增筛选和批量操作优化
- 补充对应测试用例

tests/services/test_pool_scheduling_dimensions.py

@@ -83,6 +83,20 @@ def test_account_state_takes_priority_over_manual_disabled() -> None:
     assert summary.reason == "account_forbidden"
 
 
+def test_workspace_deactivated_uses_specific_reason_code() -> None:
+    dimensions = evaluate_pool_scheduling_dimensions(
+        _snapshot(
+            account_blocked=True,
+            account_block_label="工作区停用",
+            account_block_reason="deactivated_workspace",
+        )
+    )
+    summary = summarize_pool_scheduling_dimensions(dimensions)
+
+    assert summary.status == "blocked"
+    assert summary.reason == "workspace_deactivated"
+
+
 def test_summary_degraded_when_cost_reaches_soft_threshold() -> None:
     dimensions = evaluate_pool_scheduling_dimensions(
         _snapshot(cost_window_usage=8200, cost_limit=10000, cost_soft_threshold_percent=80)