feat: 同步管理端、用户端与后端业务，并接通线上 Web 接口

补齐平台订阅、外部登录、CRM 同步与用户端页面；Nginx 转发用户端接口，登录页使用 Google 与 Apple 标志。

Co-authored-by: Cursor <cursoragent@cursor.com>

admin/tests/settings-tenant.test.ts

@@ -96,7 +96,7 @@ test('2. settings/tenant 必须拉取 size=1、按 id 分流保存，并展示 T
   assert.ok(!/\bany\b/.test(content), '禁止使用 any');
 });
 
-test('3. settings/tenant locale 必须包含 menu.settings.tenant 与中英文案', () => {
+test('3. settings/tenant locale 必须包含 menu.settings.tenant 与中英阿文案', () => {
   assert.ok(fs.existsSync(tenantLocalePath), '租户域名语言包必须存在');
   const content = fs.readFileSync(tenantLocalePath, 'utf-8');
 
@@ -106,12 +106,28 @@ test('3. settings/tenant locale 必须包含 menu.settings.tenant 与中英文
   );
   assert.ok(content.includes("'en-US'"), '必须包含英文案');
   assert.ok(content.includes("'zh-CN'"), '必须包含中文案');
+  assert.ok(content.includes("'ar-SA'"), '必须包含阿语文案');
   assert.ok(content.includes('settingsTenant.request.fail'), '必须包含失败提示文案');
   assert.ok(content.includes('settingsTenant.form.save'), '必须包含保存主 CTA 文案');
   assert.ok(content.includes('customDomain'), '必须包含 customDomain 文案');
   assert.ok(content.includes('sslStatus') || content.includes('settingsTenant.ssl'), '必须包含 ssl 状态文案');
   assert.ok(content.includes('settingsTenant.ssl.alert'), '必须包含证书检测 Alert 文案');
+  assert.ok(content.includes('settingsTenant.ssl.unverified'), '必须包含 SSL 未核验文案');
+  assert.ok(content.includes('settingsTenant.ssl.issued'), '必须包含证书已签发文案');
+  assert.ok(content.includes('settingsTenant.verify.true'), '必须包含已核验文案');
+  assert.ok(content.includes('settingsTenant.verify.false'), '必须包含未核验文案');
+  assert.ok(content.includes('settingsTenant.cdn.notConfigured'), '必须包含 CDN 未配置文案');
+  assert.ok(
+    content.includes('settingsTenant.form.cdnStatus') ||
+      content.includes('settingsTenant.cdn.status'),
+    '必须包含 CDN 状态标签文案'
+  );
   assert.ok(content.includes('pending'), '必须包含 pending 状态文案');
+  assert.ok(!content.includes("'已启用'"), 'locale 禁止写死 SSL 已启用');
+  assert.ok(
+    !content.includes("'已加速'") && !content.includes("'已开通全球 CDN'"),
+    'locale 禁止写死 CDN 已加速'
+  );
   assert.ok(!/\bany\b/.test(content), 'locale 禁止使用 any');
   assert.ok(
     !/[\u{1F300}-\u{1F9FF}\u{2600}-\u{26FF}\u{2700}-\u{27BF}]/u.test(content),
@@ -121,3 +137,112 @@ test('3. settings/tenant locale 必须包含 menu.settings.tenant 与中英文
   assert.equal(defaultI18n['en-US']['menu.settings.tenant'], 'Domain & SSL');
   assert.equal(defaultI18n['zh-CN']['menu.settings.tenant'], '域名与证书');
 });
+
+test('4. settings/tenant 必须按 verify-dns 的 verified/ssl 展示，未核验不得显示已签发', () => {
+  const content = readPage();
+
+  assert.ok(
+    content.includes('admin/team/domain/verify-dns'),
+    '必须请求 POST /api/admin/team/domain/verify-dns'
+  );
+  assert.ok(content.includes('verified'), '必须读取核验接口 verified 字段');
+  assert.ok(
+    content.includes("settingsTenant.ssl.issued") ||
+      content.includes('settingsTenant.ssl.issued'),
+    '证书已签发必须走 locale key'
+  );
+  assert.ok(
+    content.includes('settingsTenant.ssl.unverified'),
+    '无 ssl 或未核验时必须走 未核验 locale'
+  );
+  assert.ok(
+    content.includes('settingsTenant.verify.true') &&
+      content.includes('settingsTenant.verify.false'),
+    '核验状态必须走 locale'
+  );
+  assert.ok(
+    content.includes('verified === true') ||
+      content.includes('verified===true') ||
+      content.includes('verified !== true') ||
+      content.includes('verified!==true'),
+    '必须用 verified === true 门控，禁止未核验时显示已签发'
+  );
+  assert.ok(
+    content.includes("'ssl'") ||
+      content.includes('"ssl"') ||
+      content.includes('.ssl'),
+    '必须检查接口是否返回 ssl 字段'
+  );
+  assert.ok(
+    !content.includes('已启用') &&
+      !/\bsslStatus:\s*['"]active['"]/.test(content) &&
+      !/\bsslDisplay\s*=\s*['"]issued['"]/.test(content),
+    '禁止写死 SSL 开启/已签发态'
+  );
+  assert.ok(
+    !/证书已签发/.test(content),
+    '页面源码禁止硬编码「证书已签发」，须走 locale'
+  );
+  assert.ok(!/\bany\b/.test(content), '禁止使用 any');
+});
+
+test('5. settings/tenant CDN：无接口或未返回已启用时必须显示未配置，禁止假加速', () => {
+  const content = readPage();
+  const localeContent = fs.readFileSync(tenantLocalePath, 'utf-8');
+
+  assert.ok(
+    content.includes('settingsTenant.cdn.status') ||
+      content.includes('settingsTenant.form.cdnStatus'),
+    '必须展示 CDN 状态标签文案 key'
+  );
+  assert.ok(
+    content.includes('settingsTenant.cdn.notConfigured'),
+    '无 CDN 接口或未启用时必须走 未配置 locale'
+  );
+  assert.ok(
+    content.includes('resolveCdnDisplay') ||
+      content.includes('cdnDisplay'),
+    '必须有 CDN 展示态解析，禁止写死已加速'
+  );
+  assert.ok(
+    content.includes("enabled === true") ||
+      content.includes('enabled===true') ||
+      content.includes("enabled !== true") ||
+      content.includes('enabled!==true'),
+    'CDN 仅在 enabled === true 时才可显示已启用'
+  );
+  assert.ok(
+    !content.includes('已加速') &&
+      !content.includes('已开通全球 CDN') &&
+      !content.includes('全球 CDN 已开通'),
+    '页面禁止提示已加速/已开通全球 CDN'
+  );
+  assert.ok(
+    !/cdn\.(omnicard|cloudflare|akamai|fastly)\./i.test(content) &&
+      !/cname\.cdn\./i.test(content) &&
+      !content.includes('cdn.omnicard.ai'),
+    '禁止造假 CDN 域名'
+  );
+  assert.ok(
+    localeContent.includes('settingsTenant.cdn.notConfigured'),
+    'locale 必须包含 CDN 未配置文案'
+  );
+  assert.ok(
+    localeContent.includes('settingsTenant.cdn.status') ||
+      localeContent.includes('settingsTenant.form.cdnStatus'),
+    'locale 必须包含 CDN 状态标签'
+  );
+  assert.ok(
+    !localeContent.includes("'已加速'") &&
+      !localeContent.includes('"已加速"') &&
+      !localeContent.includes("'已开通全球 CDN'") &&
+      !localeContent.includes('"已开通全球 CDN"'),
+    'locale 禁止写死已加速/已开通全球 CDN'
+  );
+  assert.ok(
+    /未配置/.test(localeContent) ||
+      /Not configured/i.test(localeContent),
+    'locale 未配置文案须存在'
+  );
+  assert.ok(!/\bany\b/.test(content), '禁止使用 any');
+});