feat(proxy,oauth,pool): H2 头过滤、OAuth 过期分级标记与批量操作进度条

- proxy: 屏蔽 host/content-length 头转发，避免 H2 PROTOCOL_ERROR
- oauth: 区分 [REFRESH_FAILED] 与 [OAUTH_EXPIRED] 标记，token 过期
  自动阻止调度但不停用账号，便于管理员恢复
- pool/account_state: 识别新增的 OAUTH_EXPIRED/REFRESH_FAILED 前缀
- 前端: 批量操作显示实时进度条，倍率编辑 Escape/blur 竞态修复，
  OAuth 刷新失败后自动刷新列表

aether-proxy/src/tunnel/stream_handler.rs

@@ -34,8 +34,18 @@ const MIN_TIMEOUT_SECS: u64 = 5;
 const MAX_TIMEOUT_SECS: u64 = 300;
 
 /// Headers that must not be forwarded to upstream (hop-by-hop or security-sensitive).
+///
+/// `host` and `content-length` are managed by the HTTP client (reqwest/hyper):
+/// - `host` → translated to `:authority` pseudo-header in HTTP/2; forwarding
+///   the original `host` alongside `:authority` triggers PROTOCOL_ERROR on
+///   strict H2 implementations (e.g. Google APIs).
+/// - `content-length` → recalculated by hyper from the actual body; a stale
+///   value from the tunnel (body may have been re-compressed) causes H2
+///   PROTOCOL_ERROR when it mismatches the real frame length.
 const BLOCKED_HEADERS: &[&str] = &[
     "connection",
+    "content-length",
+    "host",
     "keep-alive",
     "proxy-authenticate",
     "proxy-authorization",