feat(oauth): 完善账号异常识别并在调度/展示层拦截失效 OAuth 密钥

- 新增 aether-admin provider status 模块，统一解析账号状态（禁用/工作区停用等）
- 调度器 runtime 增加 oauth_invalid 判定，跳过刷新失败或已撤销的 OAuth 密钥（REQUEST_FAILED 保留可选）
- gateway state 在 local oauth 刷新返回 4xx 时持久化失败原因并同步状态快照
- admin pool 列表/详情回填 account 状态与 scheduling 阻塞原因（account_blocked）
- 共享 catalog 的 status_snapshot payload 附加 account 字段

crates/aether-scheduler-core/src/candidate.rs

@@ -373,6 +373,7 @@ pub struct CandidateRuntimeSelectabilityInput<'a> {
     pub cached_affinity_target: Option<&'a crate::SchedulerAffinityTarget>,
     pub provider_quota_blocks_requests: bool,
     pub account_quota_exhausted: bool,
+    pub oauth_invalid: bool,
     pub rpm_reset_at: Option<u64>,
 }
 
@@ -394,6 +395,7 @@ pub fn candidate_runtime_skip_reason_with_state(
         cached_affinity_target,
         provider_quota_blocks_requests,
         account_quota_exhausted,
+        oauth_invalid,
         rpm_reset_at,
     } = input;
 
@@ -403,6 +405,9 @@ pub fn candidate_runtime_skip_reason_with_state(
     if account_quota_exhausted {
         return Some("account_quota_exhausted");
     }
+    if oauth_invalid {
+        return Some("oauth_invalid");
+    }
     if crate::is_candidate_in_recent_failure_cooldown(
         recent_candidates,
         candidate.provider_id.as_str(),
@@ -816,6 +821,7 @@ mod tests {
                 cached_affinity_target: None,
                 provider_quota_blocks_requests: false,
                 account_quota_exhausted: false,
+                oauth_invalid: false,
                 rpm_reset_at: None,
             },
         ));
@@ -835,6 +841,7 @@ mod tests {
                 cached_affinity_target: None,
                 provider_quota_blocks_requests: false,
                 account_quota_exhausted: false,
+                oauth_invalid: false,
                 rpm_reset_at: None,
             },
         ));
@@ -848,6 +855,7 @@ mod tests {
                 cached_affinity_target: None,
                 provider_quota_blocks_requests: true,
                 account_quota_exhausted: false,
+                oauth_invalid: false,
                 rpm_reset_at: None,
             },
         ));
@@ -865,6 +873,25 @@ mod tests {
                 cached_affinity_target: None,
                 provider_quota_blocks_requests: false,
                 account_quota_exhausted: true,
+                oauth_invalid: false,
+                rpm_reset_at: None,
+            },
+        ));
+    }
+
+    #[test]
+    fn candidate_selectability_rejects_oauth_invalid_keys() {
+        assert!(!candidate_is_selectable_with_runtime_state(
+            CandidateRuntimeSelectabilityInput {
+                candidate: &sample_candidate("1", None),
+                recent_candidates: &[],
+                provider_concurrent_limits: &BTreeMap::new(),
+                provider_key_rpm_states: &BTreeMap::new(),
+                now_unix_secs: 100,
+                cached_affinity_target: None,
+                provider_quota_blocks_requests: false,
+                account_quota_exhausted: false,
+                oauth_invalid: true,
                 rpm_reset_at: None,
             },
         ));