feat: 同步管理端、用户端与后端业务，并接通线上 Web 接口

补齐平台订阅、外部登录、CRM 同步与用户端页面；Nginx 转发用户端接口，登录页使用 Google 与 Apple 标志。

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/test/modules/team/domain.test.ts

@@ -1,3 +1,4 @@
+import * as dns from 'dns';
 import { getMetadataArgsStorage } from 'typeorm';
 import { CoolCommException } from '@cool-midway/core';
 import { BaseEntity } from '../../../src/comm/entity/base';
@@ -171,13 +172,39 @@ describe('Point 22: 独立企业二级域名绑定向导与 SSL 证书检测 单
       expect(res.message).toContain('不匹配');
     });
 
-    it('模拟或真实解析发生空记录或错误时友好降级为 verified=false', async () => {
+    it('显式传入空模拟记录时 verified=false 且不假装已核验', async () => {
       const res = await service.verifyDnsRecord('card.mycompany.com', 'cname.omnicard.ai', {
         mockRecords: [],
       });
 
       expect(res.verified).toBe(false);
       expect(res.records).toEqual([]);
+      expect(res.message).toMatch(/未找到/);
+    });
+
+    it('不传模拟记录且 DNS 解析失败时 verified 为 false', async () => {
+      const spy = jest
+        .spyOn(dns.promises, 'resolveCname')
+        .mockRejectedValue(
+          Object.assign(new Error('queryCname ENOTFOUND card.mycompany.com'), {
+            code: 'ENOTFOUND',
+          })
+        );
+
+      try {
+        const res = await service.verifyDnsRecord(
+          'card.mycompany.com',
+          'cname.omnicard.ai'
+        );
+
+        expect(spy).toHaveBeenCalledWith('card.mycompany.com');
+        expect(res.verified).toBe(false);
+        expect(res.records).toEqual([]);
+        expect(res.message).toMatch(/解析失败/);
+        expect(res.message).toMatch(/ENOTFOUND/);
+      } finally {
+        spy.mockRestore();
+      }
     });
   });