feat(oauth): 完善账号异常识别并在调度/展示层拦截失效 OAuth 密钥

- 新增 aether-admin provider status 模块，统一解析账号状态（禁用/工作区停用等）
- 调度器 runtime 增加 oauth_invalid 判定，跳过刷新失败或已撤销的 OAuth 密钥（REQUEST_FAILED 保留可选）
- gateway state 在 local oauth 刷新返回 4xx 时持久化失败原因并同步状态快照
- admin pool 列表/详情回填 account 状态与 scheduling 阻塞原因（account_blocked）
- 共享 catalog 的 status_snapshot payload 附加 account 字段

apps/aether-gateway/src/tests/control/admin/pool.rs

@@ -691,6 +691,76 @@ async fn gateway_handles_admin_pool_list_keys_locally_with_trusted_admin_princip
     upstream_handle.abort();
 }
 
+#[tokio::test]
+async fn gateway_marks_account_blocked_pool_key_in_list_keys_response() {
+    let mut provider = sample_provider("provider-codex", "codex", 10).with_transport_fields(
+        true,
+        false,
+        true,
+        None,
+        None,
+        None,
+        None,
+        None,
+        Some(json!({
+            "pool_advanced": {
+                "enabled": true
+            }
+        })),
+    );
+    provider.provider_type = "codex".to_string();
+
+    let mut key = sample_key(
+        "key-codex-blocked",
+        "provider-codex",
+        "openai:cli",
+        "oauth-placeholder",
+    );
+    key.name = "blocked-codex".to_string();
+    key.auth_type = "oauth".to_string();
+    key.oauth_invalid_reason = Some("[ACCOUNT_BLOCK] account has been deactivated".to_string());
+    key.oauth_invalid_at_unix_secs = Some(1_700_000_000);
+
+    let provider_catalog_repository = Arc::new(InMemoryProviderCatalogReadRepository::seed(
+        vec![provider],
+        Vec::new(),
+        vec![key],
+    ));
+    let state = AppState::new()
+        .expect("gateway should build")
+        .with_data_state_for_tests(GatewayDataState::with_provider_catalog_reader_for_tests(
+            provider_catalog_repository,
+        ));
+
+    let response = local_admin_pool_response(
+        &state,
+        http::Method::GET,
+        "/api/admin/pool/provider-codex/keys?page=1&page_size=50&status=all",
+        None,
+    )
+    .await;
+
+    assert_eq!(response.status(), StatusCode::OK);
+    let payload: serde_json::Value = serde_json::from_slice(
+        &to_bytes(response.into_body(), usize::MAX)
+            .await
+            .expect("body should read"),
+    )
+    .expect("json body should parse");
+    let keys = payload["keys"].as_array().expect("keys should be array");
+
+    assert_eq!(keys.len(), 1);
+    assert_eq!(keys[0]["account_status_code"], json!("account_disabled"));
+    assert_eq!(keys[0]["account_status_blocked"], json!(true));
+    assert_eq!(keys[0]["scheduling_status"], json!("blocked"));
+    assert_eq!(keys[0]["scheduling_reason"], json!("account_blocked"));
+    assert_eq!(keys[0]["scheduling_label"], json!("账号停用"));
+    assert_eq!(
+        keys[0]["status_snapshot"]["account"]["source"],
+        json!("oauth_invalid")
+    );
+}
+
 #[tokio::test]
 async fn gateway_handles_admin_pool_list_keys_with_quota_compatibility_fields() {
     let upstream_hits = Arc::new(Mutex::new(0usize));