refactor: session-based external auth, dynamic sources, drop netease UID

Auth (external API):
- ID: 16-digit random (non-sequential); Secret: SeaReport- + 32 hex
- POST /auth/session: ID+Secret -> Bearer SESSION (24h, single-session,
  old session invalidated on re-issue, disabled client invalidates)
- clientAuth now validates Bearer SESSION via api_sessions JOIN api_clients

Sources (dynamic, no default, open-source friendly):
- sources table + CRUD route (/api/sources, owner; delete guarded by usage)
- users/user_identities.source ENUM -> VARCHAR, seeded netease/skin
- register/admin create/identity bind: validate against enabled sources
- UI: 来源管理 page; source dropdowns loaded dynamically everywhere
  (register, dashboard identity, users admin, bans), labels dynamic

UID removal:
- game_uid/reporter_game_uid no longer required (db default '', validations
  dropped, frontend fields optional)

Docs: EXTERNAL-API.md session flow + new credential format; API.md updated
Verified: 37 checks (syntax, session logic, source CRUD, UID removal, docs)

backend/routes/sources.js

@@ -0,0 +1,54 @@
+const express = require('express');
+const { query, getRow } = require('../db');
+const { authenticate, requireRole } = require('../middleware/auth');
+const { logSystem } = require('../logger');
+
+const router = express.Router();
+
+// ---- 来源列表(公开: 注册页/绑定身份页需要) ----
+router.get('/', async (req, res) => {
+  try {
+    const rows = await query('SELECT code, label, sort_order FROM sources WHERE enabled = 1 ORDER BY sort_order, id');
+    res.json(rows);
+  } catch (e) { res.status(500).json({ error: e.message }); }
+});
+
+// ---- 管理(owner) ----
+router.post('/', authenticate, requireRole('owner'), async (req, res) => {
+  try {
+    const { code, label, sort_order } = req.body;
+    if (!code || !label) return res.status(400).json({ error: 'code 和 label 必填' });
+    if (!/^[a-z0-9_]{1,20}$/.test(code)) return res.status(400).json({ error: 'code 仅允许小写字母数字下划线(≤20)' });
+    const dup = await getRow('SELECT id FROM sources WHERE code = ?', [code]);
+    if (dup) return res.status(400).json({ error: '该来源已存在' });
+    const r = await query('INSERT INTO sources(code, label, sort_order) VALUES (?,?,?)', [code, label, parseInt(sort_order) || 0]);
+    await logSystem('info', 'source', `新增来源: ${code}(${label})`);
+    res.status(201).json({ id: r.insertId, message: '已添加' });
+  } catch (e) { res.status(500).json({ error: e.message }); }
+});
+
+router.put('/:code', authenticate, requireRole('owner'), async (req, res) => {
+  try {
+    const { label, enabled, sort_order } = req.body;
+    const row = await getRow('SELECT id FROM sources WHERE code = ?', [req.params.code]);
+    if (!row) return res.status(404).json({ error: '来源不存在' });
+    await query('UPDATE sources SET label = ?, enabled = ?, sort_order = ? WHERE code = ?',
+      [label || req.params.code, enabled ? 1 : 0, parseInt(sort_order) || 0, req.params.code]);
+    await logSystem('info', 'source', `更新来源: ${req.params.code}`, { label, enabled: !!enabled });
+    res.json({ message: '已更新' });
+  } catch (e) { res.status(500).json({ error: e.message }); }
+});
+
+router.delete('/:code', authenticate, requireRole('owner'), async (req, res) => {
+  try {
+    // 有关联数据时禁止删除(防误删)
+    const usedUsers = await getRow('SELECT COUNT(*) as c FROM users WHERE source = ?', [req.params.code]);
+    const usedIdent = await getRow('SELECT COUNT(*) as c FROM user_identities WHERE source = ?', [req.params.code]);
+    if (usedUsers.c > 0 || usedIdent.c > 0) return res.status(400).json({ error: `该来源已被 ${usedUsers.c + usedIdent.c} 条身份数据使用, 请先停用` });
+    await query('DELETE FROM sources WHERE code = ?', [req.params.code]);
+    await logSystem('info', 'source', `删除来源: ${req.params.code}`);
+    res.json({ message: '已删除' });
+  } catch (e) { res.status(500).json({ error: e.message }); }
+});
+
+module.exports = router;