refactor: v2.2.0 移除本地 sim 模式,Cloudflare OAuth 只走真实授权

- 删除 SimCFApi / WMAILHUB_SIM_CF / isRealOAuth / POST /api/oauth/cloudflare/sim/approve
- 删除前端 OAuthSim 模拟授权页与 /oauth/sim/authorize 路由;账号页「添加账号」整页跳 Cloudflare
- 迁移 0005 删除 cf_sim_resources 表
- 未配置 CF_OAUTH_CLIENT_ID/SECRET 时 start/callback 一律 503(不再降级出假账号假资源)
- 修 OAuth 回调端点:跨站重定向不携带 SameSite=Strict 会话 cookie,改为由一次性 state 承担 CSRF 防护
- 测试改用 tests/cf-mock.ts 在 fetch 层拦截 Cloudflare API,断言真实 HTTP 调用(72/72 通过)
- 本地 dev 无账号时只拉起 Console 并提示人工授权,不再自动造账号

console/frontend/src/api.ts

@@ -153,14 +153,13 @@ export const getAccountWorkerSecret = (id: string) =>
 
 /* ---- OAuth ---- */
 
-export const oauthMode = () => api<{ mode: "cloudflare" | "sim" }>("/api/oauth/mode");
+/** OAuth 是否已配置(cloudflare = 可用;unconfigured = 缺少 client id/secret) */
+export const oauthMode = () =>
+  api<{ mode: "cloudflare" | "unconfigured"; authorize_url_base: string | null }>("/api/oauth/mode");
 
 /** 开始授权(自动创建账号记录;授权后自动接入) */
 export const oauthStart = () => api<{ url: string; state: string }>("/api/oauth/cloudflare/start");
 
-export const oauthSimApprove = (state: string) =>
-  api<{ ok: boolean; error?: string; account_id: string }>("/api/oauth/cloudflare/sim/approve", "POST", { state });
-
 /* ---- 域名 ---- */
 
 export interface DomainRow {