refactor: v2.2.0 移除本地 sim 模式,Cloudflare OAuth 只走真实授权

- 删除 SimCFApi / WMAILHUB_SIM_CF / isRealOAuth / POST /api/oauth/cloudflare/sim/approve
- 删除前端 OAuthSim 模拟授权页与 /oauth/sim/authorize 路由;账号页「添加账号」整页跳 Cloudflare
- 迁移 0005 删除 cf_sim_resources 表
- 未配置 CF_OAUTH_CLIENT_ID/SECRET 时 start/callback 一律 503(不再降级出假账号假资源)
- 修 OAuth 回调端点:跨站重定向不携带 SameSite=Strict 会话 cookie,改为由一次性 state 承担 CSRF 防护
- 测试改用 tests/cf-mock.ts 在 fetch 层拦截 Cloudflare API,断言真实 HTTP 调用(72/72 通过)
- 本地 dev 无账号时只拉起 Console 并提示人工授权,不再自动造账号

console/src/services/provision.ts

@@ -109,7 +109,7 @@ export interface ProvisionInput {
  * 部署账号级 Email Worker + 签发 Worker credential。幂等,可重复调用;返回是否全部成功。
  */
 export async function provisionAccount(env: Env, input: ProvisionInput): Promise<{ ok: boolean; error?: string }> {
-  const cf: CFApi = getCFApi(env, env.DB);
+  const cf: CFApi = getCFApi(env);
   const account = await env.DB.prepare("SELECT id, name, status FROM cloudflare_accounts WHERE id = ?")
     .bind(input.accountId)
     .first<{ id: string; name: string; status: string }>();
@@ -249,7 +249,7 @@ async function putWorkerScript(
   workerId: string,
   workerSecret: string,
 ): Promise<void> {
-  const cf: CFApi = getCFApi(env, env.DB);
+  const cf: CFApi = getCFApi(env);
   const consoleUrl = env.PUBLIC_BASE_URL ?? "";
   if (!consoleUrl) throw new Error("console public url unknown (PUBLIC_BASE_URL)");
   await cf.putEmailWorker({ accessToken, accountId: cfAccountId, scriptName: workerId, consoleUrl, workerId, workerSecret });
@@ -278,7 +278,7 @@ export async function setupDomainEmail(env: Env, domainId: string): Promise<{ ok
   const accessToken = await decryptConnectionToken(env);
   if (!accessToken) return { ok: false, error: "no active Cloudflare OAuth connection" };
 
-  const cf: CFApi = getCFApi(env, env.DB);
+  const cf: CFApi = getCFApi(env);
   try {
     const workerId = await deployAccountWorker(env, account.id, accessToken);
     await cf.enableEmailRouting({ accessToken, zoneId: domain.zone_id });