feat(test,export,headers): 模型测试复用统一运行时、实时进度展示、导出增强与请求头大小写保留

- 模型测试 failover 从手动 FailoverEngine 改为 TaskService.execute_sync_candidates 统一运行时
- 前端新增实时 trace 轮询进度展示（候选状态、测试账号、进度条）
- 用户导出/导入支持明文 Key 优先（版本升至 1.2），新增 email_verified 字段
- SENSITIVE_CREDENTIAL_FIELDS 统一到 provider_ops/types.py，补充 refresh_token
- 请求头大小写保留机制（resolve_header_name_case + HeaderBuilder.add 语义修改）
- Codex envelope 移除合成头部，保留客户端原始请求头
- endpoint_checker 支持自定义超时透传
- 新增 x-forwarded-scheme 到上游丢弃头部列表

tests/unit/test_admin_system_key_formats.py

@@ -1,4 +1,5 @@
 from src.api.admin.system import AdminExportConfigAdapter, AdminImportConfigAdapter
+from src.services.provider_ops.types import SENSITIVE_CREDENTIAL_FIELDS
 
 
 def test_export_key_api_formats_falls_back_to_provider_endpoints_when_none() -> None:
@@ -59,3 +60,57 @@ def test_import_key_api_formats_keeps_explicit_empty_list() -> None:
     )
 
     assert result == []
+
+
+class _FakeCrypto:
+    def encrypt(self, value: str) -> str:
+        return f"enc:{value}"
+
+    def decrypt(self, value: str) -> str:
+        return value.removeprefix("enc:")
+
+
+def test_provider_ops_sensitive_fields_include_refresh_token() -> None:
+    assert "refresh_token" in SENSITIVE_CREDENTIAL_FIELDS
+
+
+def test_export_provider_config_decrypts_refresh_token() -> None:
+    adapter = AdminExportConfigAdapter()
+
+    config = {
+        "provider_ops": {
+            "connector": {
+                "credentials": {
+                    "refresh_token": "enc:rt-1",
+                    "api_key": "enc:key-1",
+                }
+            }
+        }
+    }
+
+    result = adapter._decrypt_provider_config(config, _FakeCrypto())
+
+    assert result["provider_ops"]["connector"]["credentials"]["refresh_token"] == "rt-1"
+    assert result["provider_ops"]["connector"]["credentials"]["api_key"] == "key-1"
+    assert config["provider_ops"]["connector"]["credentials"]["refresh_token"] == "enc:rt-1"
+
+
+def test_import_provider_config_encrypts_refresh_token() -> None:
+    adapter = AdminImportConfigAdapter()
+
+    config = {
+        "provider_ops": {
+            "connector": {
+                "credentials": {
+                    "refresh_token": "rt-1",
+                    "api_key": "key-1",
+                }
+            }
+        }
+    }
+
+    result = adapter._encrypt_provider_config(config, _FakeCrypto())
+
+    assert result["provider_ops"]["connector"]["credentials"]["refresh_token"] == "enc:rt-1"
+    assert result["provider_ops"]["connector"]["credentials"]["api_key"] == "enc:key-1"
+    assert config["provider_ops"]["connector"]["credentials"]["refresh_token"] == "rt-1"