fix(email): 开启 Email Routing 改用 PUT,并补上 zone-settings.write 权限

POST /zones/{id}/email/routing 不是有效路由,Cloudflare 返回
10405 Method not allowed for this authentication scheme。正确接口是
PUT /zones/{id}/email/routing(Apply Email Routing settings);
POST .../email/routing/enable 能用但官方已标 Deprecated。

该接口的 Accepted Permission 是 Zone Settings Write,而不是 Email Routing 权限族
—— 权限名和接口所属资源组对不上,Email Routing 四个权限全勾也不够。

- CF_OAUTH_SCOPES_DEFAULT / 探测候选集加 zone-settings.write;设置页文案同步
- cfapi 的 API 错误带上 Cloudflare 错误码(如 10405),便于区分路径错与权限错
- cf-mock 对非 PUT 的 /email/routing 返回 10405,旧写法会被打回
- 88/88 测试

console/src/services/cfapi.ts

@@ -36,6 +36,9 @@ export const CF_OAUTH_CALLBACK_PATH = "/api/oauth/cloudflare/callback";
  *    该接口只要求 Zone Read,所以本应用完全用不到 Account Settings Read。
  *  - Email Routing 在选择器里是 **四个独立权限**,其中改 catch-all 规则对应
  *    `email-routing-rule.write`(选择器里叫 Email Routing Rules Edit)。
+ *  - **「开启 Email Routing」不归 Email Routing 权限管**:PUT /zones/{id}/email/routing
+ *    的 Accepted Permission 是 Zone Settings Write => `zone-settings.write`。
+ *    权限名和接口所属的资源组对不上是这里最大的坑,配少了会在「设置 Email Workers」时才报出来。
  *  - 客户端注册的 scope 是「上限」而不是「默认值」:请求里没写的 scope 不会自动生效。
  *  以上名称可用 /cloudflare/preflight 的 scope 探测功能现场核对(见 discoverAllowedScopes)。
  **/
@@ -43,6 +46,7 @@ export const CF_OAUTH_SCOPES_DEFAULT = [
   "zone.read",
   "workers-scripts.write",
   "email-routing-rule.write",
+  "zone-settings.write",
 ].join(" ");
 
 /** # 成员变量: scope 探测候选集(本应用所需 + 常见备选)
@@ -51,6 +55,7 @@ export const CF_OAUTH_SCOPE_CANDIDATES = [
   "zone.read",
   "workers-scripts.write",
   "email-routing-rule.write",
+  "zone-settings.write",
   "email-routing-account-rule.read",
   "email-routing-address.write",
   "email-routing-suppression.write",
@@ -478,8 +483,18 @@ export class RealCFApi implements CFApi {
         ...(init?.headers ?? {}),
       },
     });
-    const data = (await resp.json()) as { success: boolean; errors?: { message: string }[]; result: T };
-    if (!data.success) throw new Error(`cloudflare api ${path}: ${data.errors?.[0]?.message ?? resp.status}`);
+    const data = (await resp.json()) as {
+      success: boolean;
+      errors?: { code?: number; message: string }[];
+      result: T;
+    };
+    if (!data.success) {
+      const first = data.errors?.[0];
+      // 带上 Cloudflare 的错误码(如 10405),只看 message 经常分不清是路径错还是权限错
+      throw new Error(
+        `cloudflare api ${path}: ${first?.code ? `[${first.code}] ` : ""}${first?.message ?? resp.status}`,
+      );
+    }
     return data.result;
   }
 
@@ -539,12 +554,19 @@ export class RealCFApi implements CFApi {
     return { id: opts.scriptName };
   }
 
+  /** 开启 Zone 的 Email Routing(加并锁定 MX/SPF 记录)
+   *  注意:走 `PUT /zones/{id}/email/routing`(Apply Email Routing settings)。
+   *  - `POST /zones/{id}/email/routing` 不是有效路由,Cloudflare 返回
+   *    `10405 Method not allowed for this authentication scheme`(2026-09-30 线上踩过)
+   *  - `POST .../email/routing/enable` 虽然能用,但官方已标 Deprecated
+   *  该接口的 Accepted Permission 是 **Zone Settings Write**(不是 Email Routing 那一类权限)。 */
   async enableEmailRouting(opts: { accessToken: string; zoneId: string }) {
-    await this.api(opts.accessToken, `/zones/${opts.zoneId}/email/routing`, {
-      method: "POST",
-      body: JSON.stringify({ enabled: true, skip_wizard: true }),
-    });
-    return { enabled: true };
+    const settings = await this.api<{ enabled?: boolean; status?: string }>(
+      opts.accessToken,
+      `/zones/${opts.zoneId}/email/routing`,
+      { method: "PUT", body: JSON.stringify({ enabled: true, skip_wizard: true }) },
+    );
+    return { enabled: settings?.enabled ?? true };
   }
 
   async setCatchAllRule(opts: { accessToken: string; zoneId: string; workerName: string }) {