feat: external API for QQ bot - client id+secret auth, ticket tracking, bans, per-server data

- db: api_clients table + server_groups.alias + tickets/bans server_name (auto-migrate)
- external.js: client_id+secret auth (multi-client, bcrypt, show-once secret),
  legacy x-external-key compat, JWT pass-through
  - POST /tickets (optional server), GET /tickets/track?token= (full lifecycle)
  - GET/POST /bans, reported-players/stats/all-tickets with server filter
  - GET /servers (alias list), client CRUD (owner/admin, audit logged)
  - resolveServer: alias | 分组/子服 | server_name
- polls.js: server_groups CRUD with alias (add/edit, dup check)
- servers page: alias display + edit; new 外部API page: client mgmt + quick docs
- API.md: full external API section (auth matrix, server param syntax)
- verified: 37 checks incl. resolveServer sandbox (alias/group/fallback)

public/index.html

@@ -69,6 +69,7 @@
   <script src="js/pages/users.js"></script>
   <script src="js/pages/templates.js"></script>
   <script src="js/pages/notifications.js"></script>
+  <script src="js/pages/external-api.js"></script>
   <script src="js/pages/settings-page.js"></script>
   <script src="js/pages/export-page.js"></script>
   <script src="js/pages/polls.js"></script>