feat(oauth): 账号封禁前置 OAuth 验证、抽取 provider_context、完善账号状态分类

- 新增 verify_oauth_before_account_block：在标记账号封禁前先尝试刷新 token，
  区分 OAuth 过期与真正的账号级封禁，避免误标
- 抽取 provider_context.py 统一解析 provider_type，解决 ORM detached 访问问题
- account_state 新增 workspace_deactivated 分类和 auto-removable 状态集合，
  补充中文验证关键词匹配
- OAuth refresh 成功后仅清除可恢复的 token 错误，不再自动清除账号级 block
- deploy.sh 依赖指纹改用纯 shell 实现，移除对 Python tomllib 的依赖
- 前端 Pool 管理页面新增筛选和批量操作优化
- 补充对应测试用例

tests/services/test_provider_auth_detached.py

@@ -47,9 +47,7 @@ class _FakeSessionCtx:
         return False
 
 
-def _install_module(
-    monkeypatch: pytest.MonkeyPatch, name: str, attrs: dict[str, Any]
-) -> None:
+def _install_module(monkeypatch: pytest.MonkeyPatch, name: str, attrs: dict[str, Any]) -> None:
     fake_module = types.ModuleType(name)
     for key, value in attrs.items():
         setattr(fake_module, key, value)
@@ -110,9 +108,7 @@ def test_mark_refresh_token_invalid_persists_detached_key(
     assert fake_db.committed is True
     assert key.oauth_invalid_at is not None
     assert row.oauth_invalid_at is not None
-    assert str(key.oauth_invalid_reason).startswith(
-        "[REFRESH_FAILED] Token 续期失败 (401)"
-    )
+    assert str(key.oauth_invalid_reason).startswith("[REFRESH_FAILED] Token 续期失败 (401)")
     assert "refresh_token_reused" in str(row.oauth_invalid_reason)
 
 
@@ -153,6 +149,30 @@ def test_persist_refreshed_token_clears_legacy_token_invalidated_account_block(
     assert key.oauth_invalid_reason is None
 
 
+def test_persist_refreshed_token_preserves_true_account_block(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    key = SimpleNamespace(
+        id="key-1",
+        api_key="old-api",
+        auth_config="old-config",
+        oauth_invalid_at=datetime.now(timezone.utc),
+        oauth_invalid_reason="[ACCOUNT_BLOCK] Google requires verification",
+    )
+
+    monkeypatch.setattr(
+        module, "object_session", lambda _key: (_ for _ in ()).throw(RuntimeError())
+    )
+    monkeypatch.setattr(module.crypto_service, "encrypt", lambda value: f"enc:{value}")
+
+    module._persist_refreshed_token(key, "new-token", {"refresh_token": "rt-2"})
+
+    assert key.api_key == "enc:new-token"
+    assert key.auth_config == 'enc:{"refresh_token": "rt-2"}'
+    assert key.oauth_invalid_at is not None
+    assert key.oauth_invalid_reason == "[ACCOUNT_BLOCK] Google requires verification"
+
+
 @pytest.mark.asyncio
 async def test_refresh_generic_oauth_token_persists_enriched_account_name(
     monkeypatch: pytest.MonkeyPatch,