refactor: v2.2.0 移除本地 sim 模式,Cloudflare OAuth 只走真实授权

- 删除 SimCFApi / WMAILHUB_SIM_CF / isRealOAuth / POST /api/oauth/cloudflare/sim/approve
- 删除前端 OAuthSim 模拟授权页与 /oauth/sim/authorize 路由;账号页「添加账号」整页跳 Cloudflare
- 迁移 0005 删除 cf_sim_resources 表
- 未配置 CF_OAUTH_CLIENT_ID/SECRET 时 start/callback 一律 503(不再降级出假账号假资源)
- 修 OAuth 回调端点:跨站重定向不携带 SameSite=Strict 会话 cookie,改为由一次性 state 承担 CSRF 防护
- 测试改用 tests/cf-mock.ts 在 fetch 层拦截 Cloudflare API,断言真实 HTTP 调用(72/72 通过)
- 本地 dev 无账号时只拉起 Console 并提示人工授权,不再自动造账号

console/frontend/src/pages/Accounts.tsx

@@ -1,6 +1,6 @@
 /** 账号页:添加账号直达 Cloudflare OAuth,授权后自动接入并同步域名;搜索、详情、Worker 凭据管理 */
 import { useCallback, useEffect, useMemo, useState } from "react";
-import { useNavigate, useSearchParams } from "react-router-dom";
+import { useSearchParams } from "react-router-dom";
 import {
   Button,
   Card,
@@ -18,7 +18,6 @@ import {
   deleteAccount,
   getAccount,
   listAccounts,
-  oauthMode,
   oauthStart,
   rotateAccount,
   updateAccount,
@@ -47,7 +46,6 @@ const STEP_LABEL: Record<string, string> = {
  */
 export function AccountsPage() {
   const { message, modal } = App.useApp();
-  const navigate = useNavigate();
   const [params] = useSearchParams();
   const [items, setItems] = useState<AccountRow[]>([]);
   const [loading, setLoading] = useState(false);
@@ -90,13 +88,11 @@ export function AccountsPage() {
     [items, q],
   );
 
-  /** 发起 OAuth:real 模式跳 Cloudflare;sim 模式跳本地模拟授权页 */
+  /** 发起 OAuth:整页跳转到 Cloudflare 授权页(授权完成后浏览器重定向回 Console 回调端点) */
   const startOAuth = async () => {
     try {
-      const mode = (await oauthMode()).mode;
       const { url } = await oauthStart();
-      if (mode === "cloudflare") window.location.href = url;
-      else navigate(url); // /oauth/sim/authorize?state=...
+      window.location.href = url;
     } catch (err) {
       message.error(err instanceof Error ? err.message : "发起授权失败");
     }