fix: site name in top logo + server-list public + external API docs page

- app.js: set #logo-text (top bar) from window.__SITE_NAME__ - the
  top-right site name stayed default because only #site-title and
  #sidebar-title were set
- security.js: apiKeyGuard whitelist /api/polls/server-list so the
  ticket create page can load sub-servers (was 401 without api key)
- external-api.js: management page now only creates/manages clients,
  removed inline endpoint table
- new external-api-docs.js: full API doc page (auth flow, all 11
  endpoints, request/response examples, Node sample) at
  #/external-api-docs, linked from the management page
- index.html: load external-api-docs.js

public/js/pages/external-api.js

@@ -22,7 +22,9 @@ const ExternalApiPage = {
 
   async mount() {
     document.getElementById('page-title').textContent = '外部API';
-    document.getElementById('page-actions').innerHTML = '<button class="btn btn-p btn-sm" onclick="ExternalApiPage.showCreate()"><i class="fas fa-plus"></i> 创建客户端</button>';
+    document.getElementById('page-actions').innerHTML = `
+      <button class="btn btn-o btn-sm" onclick="App.navigate('external-api-docs')"><i class="fas fa-book"></i> 接口文档</button>
+      <button class="btn btn-p btn-sm" onclick="ExternalApiPage.showCreate()"><i class="fas fa-plus"></i> 创建客户端</button>`;
     await this.load();
   },
 
@@ -44,24 +46,8 @@ const ExternalApiPage = {
                 <button class="btn btn-d btn-sm" onclick="ExternalApiPage.del(${c.id})"><i class="fas fa-trash"></i></button>
               </td>
             </tr>`).join('')}</tbody></table></div>`}
-          <div class="alert alert-i" style="margin-top:12px"><b>鉴权流程:</b> 先调 <code>POST /api/external/auth/session</code> 用 <code>x-api-client-id</code> + <code>x-api-secret</code> 换取 SESSION(24小时有效), 之后所有接口请求头用 <code>Authorization: Bearer &lt;SESSION&gt;</code>。secret 仅创建时显示一次,请立即保存。</div>
+          <div class="alert alert-i" style="margin-top:12px"><b>使用流程:</b> 创建客户端后, 用 <code>Client ID</code> + <code>Secret</code> 调 <code>POST /api/external/auth/session</code> 换取 SESSION, 之后所有接口用 <code>Authorization: Bearer &lt;SESSION&gt;</code>。完整说明见右上角「接口文档」。</div>
         </div></div>
-
-        <div class="card"><div class="card-h"><i class="fas fa-book"></i> 接口速览(除换取SESSION外, 均需 Bearer SESSION)</div><div class="card-b"><div class="table-wrap"><table><thead><tr><th>方法</th><th>路径</th><th>说明</th></tr></thead><tbody>
-          <tr><td>POST</td><td><code>/api/external/auth/session</code></td><td>ID+Secret 换取 SESSION(唯一使用 ID+Secret 的接口)</td></tr>
-          <tr><td>POST</td><td><code>/api/external/auth/register</code></td><td>插件注册账号(需 SESSION)</td></tr>
-          <tr><td>POST</td><td><code>/api/external/tickets</code></td><td>提交工单(举报/建议/申诉),返回 id + tracking_token;可带 <code>server</code>(别名或「分组/子服」)</td></tr>
-          <tr><td>GET</td><td><code>/api/external/tickets/track?token=xxx</code></td><td>按追踪码查工单状态 + 回复,从提交到结束全程可查</td></tr>
-          <tr><td>GET</td><td><code>/api/external/all-tickets?server=&status=&type=&page=&limit=</code></td><td>工单列表(可按子服过滤)</td></tr>
-          <tr><td>GET</td><td><code>/api/external/all-tickets/:id</code></td><td>工单详情(含回复/附件)</td></tr>
-          <tr><td>GET</td><td><code>/api/external/bans?server=&status=&player=</code></td><td>拉取封禁列表</td></tr>
-          <tr><td>POST</td><td><code>/api/external/bans</code></td><td>新增封禁(可带 server)</td></tr>
-          <tr><td>GET</td><td><code>/api/external/reported-players?server=</code></td><td>被举报人统计</td></tr>
-          <tr><td>GET</td><td><code>/api/external/servers</code></td><td>服务器列表(含别名)</td></tr>
-          <tr><td>GET</td><td><code>/api/external/stats?server=</code></td><td>工单统计</td></tr>
-          <tr><td>POST</td><td><code>/api/external/clients</code></td><td>创建客户端(需登录态, 本页操作)</td></tr>
-        </tbody></table></div>
-        <p class="help" style="margin-top:8px">完整请求/响应示例见 <code>docs/API.md</code> 外部API章节。</p></div></div>
       `;
     } catch (e) { ct.innerHTML = `<div class="alert alert-e">${e.message}</div>`; }
   },