feat(oauth): 账号封禁前置 OAuth 验证、抽取 provider_context、完善账号状态分类

- 新增 verify_oauth_before_account_block：在标记账号封禁前先尝试刷新 token，
  区分 OAuth 过期与真正的账号级封禁，避免误标
- 抽取 provider_context.py 统一解析 provider_type，解决 ORM detached 访问问题
- account_state 新增 workspace_deactivated 分类和 auto-removable 状态集合，
  补充中文验证关键词匹配
- OAuth refresh 成功后仅清除可恢复的 token 错误，不再自动清除账号级 block
- deploy.sh 依赖指纹改用纯 shell 实现，移除对 Python tomllib 的依赖
- 前端 Pool 管理页面新增筛选和批量操作优化
- 补充对应测试用例

tests/services/test_provider_transport_codex.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+import sys
+import types
 from dataclasses import dataclass
 from types import SimpleNamespace
 
@@ -16,6 +18,33 @@ class _DummyEndpoint:
     api_format: str
     custom_path: str | None = None
     provider: object | None = None
+    provider_id: str | None = None
+
+
+class _FakeQuery:
+    def __init__(self, row: object | None) -> None:
+        self._row = row
+
+    def filter(self, *_args: object, **_kwargs: object) -> "_FakeQuery":
+        return self
+
+    def first(self) -> object | None:
+        return self._row
+
+
+class _FakeSessionCtx:
+    def __init__(self, row: object | None) -> None:
+        self._row = row
+
+    def __enter__(self) -> "_FakeSessionCtx":
+        return self
+
+    def __exit__(self, exc_type: object, exc: object, tb: object) -> bool:
+        _ = exc_type, exc, tb
+        return False
+
+    def query(self, _model: object) -> _FakeQuery:
+        return _FakeQuery(self._row)
 
 
 def test_codex_openai_cli_uses_responses_path_without_v1_prefix() -> None:
@@ -56,14 +85,16 @@ def test_codex_openai_cli_uses_compact_suffix_when_context_marked_compact() -> N
         api_format="openai:cli",
         provider=SimpleNamespace(provider_type="codex"),
     )
-    set_codex_request_context(CodexRequestContext(is_compact=True))
-    url = build_provider_url(
-        endpoint,  # type: ignore[arg-type]
-        path_params={"model": "ignored"},
-        is_stream=False,
-    )
-    assert url == "https://chatgpt.com/backend-api/codex/responses/compact"
-    set_codex_request_context(None)
+    try:
+        set_codex_request_context(CodexRequestContext(is_compact=True))
+        url = build_provider_url(
+            endpoint,  # type: ignore[arg-type]
+            path_params={"model": "ignored"},
+            is_stream=False,
+        )
+        assert url == "https://chatgpt.com/backend-api/codex/responses/compact"
+    finally:
+        set_codex_request_context(None)
 
 
 def test_codex_openai_compact_uses_compact_path_without_v1_prefix() -> None:
@@ -78,3 +109,34 @@ def test_codex_openai_compact_uses_compact_path_without_v1_prefix() -> None:
         is_stream=False,
     )
     assert url == "https://chatgpt.com/backend-api/codex/responses/compact"
+
+
+def test_codex_openai_cli_uses_provider_id_lookup_without_touching_endpoint_provider(
+    monkeypatch,
+) -> None:
+    class _DetachedEndpoint:
+        base_url = "https://chatgpt.com/backend-api/codex"
+        api_format = "openai:cli"
+        custom_path = None
+        provider_id = "provider-1"
+
+        @property
+        def provider(self) -> object:
+            raise RuntimeError("detached endpoint provider should not be lazy-loaded")
+
+    fake_provider = SimpleNamespace(id="provider-1", provider_type="codex", proxy=None)
+    fake_database = types.ModuleType("src.database")
+    fake_database.create_session = lambda: _FakeSessionCtx(fake_provider)
+    fake_models = types.ModuleType("src.models.database")
+    fake_models.Provider = type("Provider", (), {"id": "id"})
+
+    monkeypatch.setitem(sys.modules, "src.database", fake_database)
+    monkeypatch.setitem(sys.modules, "src.models.database", fake_models)
+
+    url = build_provider_url(
+        _DetachedEndpoint(),  # type: ignore[arg-type]
+        path_params={"model": "ignored"},
+        is_stream=True,
+    )
+
+    assert url == "https://chatgpt.com/backend-api/codex/responses"