fix(email): 开启 Email Routing 改用 PUT,并补上 zone-settings.write 权限

POST /zones/{id}/email/routing 不是有效路由,Cloudflare 返回
10405 Method not allowed for this authentication scheme。正确接口是
PUT /zones/{id}/email/routing(Apply Email Routing settings);
POST .../email/routing/enable 能用但官方已标 Deprecated。

该接口的 Accepted Permission 是 Zone Settings Write,而不是 Email Routing 权限族
—— 权限名和接口所属资源组对不上,Email Routing 四个权限全勾也不够。

- CF_OAUTH_SCOPES_DEFAULT / 探测候选集加 zone-settings.write;设置页文案同步
- cfapi 的 API 错误带上 Cloudflare 错误码(如 10405),便于区分路径错与权限错
- cf-mock 对非 PUT 的 /email/routing 返回 10405,旧写法会被打回
- 88/88 测试

tests/cf-mock.ts

@@ -147,6 +147,17 @@ export function installCloudflareMock(opts: CfMockOptions = {}): CfMock {
     }
     if (url.startsWith(`${API_BASE}/zones`)) {
       if (url.includes("/email/routing/rules/catch_all")) return json({ id: "catch-all-rule" });
+      if (url.endsWith("/email/routing")) {
+        // 开启 Email Routing 的正确方法是 PUT;POST 到同一路径不是有效路由,
+        // 真实 Cloudflare 返回 10405(2026-09-30 线上踩过),这里照抄以便锁住修复。
+        if (method !== "PUT") {
+          return json(
+            { success: false, errors: [{ code: 10405, message: "Method not allowed for this authentication scheme" }], result: null },
+            405,
+          );
+        }
+        return json({ id: url.split("/").at(-2), enabled: true, skip_wizard: true, status: "ready" });
+      }
       if (url.includes("/email/routing")) return json({ enabled: true });
       return json(zones);
     }