refactor: session-based external auth, dynamic sources, drop netease UID

Auth (external API):
- ID: 16-digit random (non-sequential); Secret: SeaReport- + 32 hex
- POST /auth/session: ID+Secret -> Bearer SESSION (24h, single-session,
  old session invalidated on re-issue, disabled client invalidates)
- clientAuth now validates Bearer SESSION via api_sessions JOIN api_clients

Sources (dynamic, no default, open-source friendly):
- sources table + CRUD route (/api/sources, owner; delete guarded by usage)
- users/user_identities.source ENUM -> VARCHAR, seeded netease/skin
- register/admin create/identity bind: validate against enabled sources
- UI: 来源管理 page; source dropdowns loaded dynamically everywhere
  (register, dashboard identity, users admin, bans), labels dynamic

UID removal:
- game_uid/reporter_game_uid no longer required (db default '', validations
  dropped, frontend fields optional)

Docs: EXTERNAL-API.md session flow + new credential format; API.md updated
Verified: 37 checks (syntax, session logic, source CRUD, UID removal, docs)

public/js/app.js

@@ -10,6 +10,7 @@ const App = {
     { id: 'features', label: '更新内容', icon: 'fa-lightbulb', roles: ['owner'] },
     { id: 'notifications', label: '通知配置', icon: 'fa-bell', roles: ['owner'] },
     { id: 'external-api', label: '外部API', icon: 'fa-key', roles: ['owner'] },
+    { id: 'sources', label: '来源管理', icon: 'fa-tags', roles: ['owner'] },
     { id: 'templates', label: '邮件模板', icon: 'fa-envelope', roles: ['owner'] },
     { id: 'settings', label: '系统设置', icon: 'fa-cog', roles: ['owner'] },
     { id: 'logs', label: '系统日志', icon: 'fa-clipboard-list', roles: ['owner','admin'] },
@@ -94,6 +95,7 @@ const App = {
       case 'users': this.renderMain('用户管理', UsersPage, param); break;
       case 'notifications': this.renderMain('通知配置', NotificationsPage, param); break;
       case 'external-api': this.renderMain('外部API', ExternalApiPage, param); break;
+      case 'sources': this.renderMain('来源管理', SourcesPage, param); break;
       case 'templates': this.renderMain('邮件模板', TemplatesPage, param); break;
       case 'settings': this.renderMain('系统设置', SettingsPage, param); break;
       case 'export': this.renderMain('数据导出', ExportPage, param); break;
@@ -176,6 +178,7 @@ window.UsersPage = UsersPage;
 window.TemplatesPage = TemplatesPage;
 window.NotificationsPage = NotificationsPage;
 window.ExternalApiPage = ExternalApiPage;
+window.SourcesPage = SourcesPage;
 window.SettingsPage = SettingsPage;
 window.ExportPage = ExportPage;
 window.PollsPage = PollsPage;