security: external API - only ID+Secret auth, remove legacy key & JWT

- removed x-external-key (single key) auth path + getExternalKey
- removed JWT passthrough in clientAuth (Bearer no longer accepted)
- removed /auth/login (JWT endpoint) and /my-tickets (JWT-only)
- clientAuth now mandatory: missing/invalid/disabled client -> 401
  (closed the 'no config = allow all' authorization bypass)
- moved /auth/register BEHIND clientAuth (was anonymous abuse surface)
- clients mgmt endpoints keep authenticate + role check (admin UI)
- docs + UI copy updated to single auth method
- verified: 30 checks incl. full-tree scan for legacy key refs

docs/API.md

@@ -331,10 +331,7 @@ Base URL: `http://<host>:3100/api`
 
 | 端点 | 认证 | 说明 |
 |------|------|------|
-| POST /external/auth/register | — | 插件注册(邮箱验证链接) |
-| POST /external/auth/login | — | 插件登录,返回 JWT |
-| GET /external/my-tickets | Bearer | 我的工单列表(limit ≤50) |
-| GET /external/my-tickets/:id | Bearer | 我的工单详情 |
+| POST /external/auth/register | client | 插件注册(需客户端凭据;邮箱验证链接) |
 | POST /external/tickets | client | 提交工单(带 `server` 可选;返回 id + tracking_token) |
 | GET /external/tickets/track?token= | client | 按追踪码查工单状态+回复(提交→处理→结束全流程) |
 | GET /external/all-tickets | client | 全部工单(分页 page/limit ≤200,可按 `server`/`status`/`type` 过滤) |
@@ -349,13 +346,11 @@ Base URL: `http://<host>:3100/api`
 | PUT /external/clients/:id | Bearer(owner/admin) | 启用/停用客户端 |
 | DELETE /external/clients/:id | Bearer(owner/admin) | 删除客户端 |
 
-### 外部鉴权(三选一)
+### 外部鉴权(唯一方式)
 
-| 方式 | 请求头 | 适用 |
+| 方式 | 请求头 | 说明 |
 |------|--------|------|
-| 多客户端(推荐) | `x-api-client-id` + `x-api-secret` | QQ机器人等外部系统,后台可创建/停用多个客户端 |
-| 旧版单 key | `x-external-key` | 兼容旧部署(`config.external_api_key`) |
-| 用户 JWT | `Authorization: Bearer <jwt>` | 插件/已登录用户 |
+| ID + Secret(唯一) | `x-api-client-id` + `x-api-secret` | 后台可创建/停用多个客户端;无凭据或凭据错误一律 401 |
 
 ### 子服务器定位(`server` 参数)