refactor: session-based external auth, dynamic sources, drop netease UID

Auth (external API):
- ID: 16-digit random (non-sequential); Secret: SeaReport- + 32 hex
- POST /auth/session: ID+Secret -> Bearer SESSION (24h, single-session,
  old session invalidated on re-issue, disabled client invalidates)
- clientAuth now validates Bearer SESSION via api_sessions JOIN api_clients

Sources (dynamic, no default, open-source friendly):
- sources table + CRUD route (/api/sources, owner; delete guarded by usage)
- users/user_identities.source ENUM -> VARCHAR, seeded netease/skin
- register/admin create/identity bind: validate against enabled sources
- UI: 来源管理 page; source dropdowns loaded dynamically everywhere
  (register, dashboard identity, users admin, bans), labels dynamic

UID removal:
- game_uid/reporter_game_uid no longer required (db default '', validations
  dropped, frontend fields optional)

Docs: EXTERNAL-API.md session flow + new credential format; API.md updated
Verified: 37 checks (syntax, session logic, source CRUD, UID removal, docs)

backend/routes/tickets.js

@@ -116,7 +116,7 @@ router.post('/', ticketAnonLimiter, optionalAuth, upload.array('files', 5), fina
     }
     if (!rgn) { rgn = req.user.game_name; rgu = req.user.game_uid; }
   }
-  if (!rgn || !rgu) return res.status(400).json({ error: '请填写游戏名称和UID' });
+  if (!rgn) return res.status(400).json({ error: '请填写游戏名称' });
   if (type === 'report') { if (!target_game_name && !target_game_uid) return res.status(400).json({ error: '举报需至少填写对方游戏名或UID之一' }); if (!reason) return res.status(400).json({ error: '请填写举报原因' }); }
   if (type === 'suggestion' && !description) return res.status(400).json({ error: '建议内容不能为空' });
   if (type === 'appeal') { if (!reason) return res.status(400).json({ error: '请填写申诉理由' }); if (!description) return res.status(400).json({ error: '请填写详细申诉内容' }); }
@@ -143,7 +143,7 @@ router.post('/', ticketAnonLimiter, optionalAuth, upload.array('files', 5), fina
     await conn.beginTransaction();
     const [r] = await conn.execute(`INSERT INTO tickets(type,title,user_id,reporter_game_name,reporter_game_uid,
       target_game_name,target_game_uid,reason,description,tracking_token,is_admin_complaint,parent_ticket_id) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)`,
-      [type, title, req.user?.id||null, rgn, rgu,
+      [type, title, req.user?.id||null, rgn, rgu||'',
         type==='report'?(target_game_name||''):null, type==='report'?(target_game_uid||''):null,
         (type==='report'||type==='appeal'||type==='result_appeal')?reason:null,
         (type==='suggestion'||type==='appeal'||type==='result_appeal')?description:'',