Make SUB2API proxy defaults available across panel flows

Expose a configurable default proxy for SUB2API, resolve the proxy once,
persist the proxy_id in state, and reuse it across auth URL generation,
code exchange, and account creation so one OAuth flow stays on one proxy.

Constraint: Upstream GitHub permission is READ, so publication must use a fork PR
Rejected: Push to origin | current GitHub viewer permission does not allow upstream branch publication
Rejected: Resolve proxy independently in later steps | could drift from the proxy chosen at auth URL generation
Confidence: high
Scope-risk: moderate
Reversibility: clean
Tested: npm test passed 183/183
Not-tested: Manual browser extension flow against a live SUB2API deployment

README.md

@@ -150,6 +150,17 @@ http(s)://<your-host>/management.html#/oauth
 
 Step 1 和 Step 10 都依赖这个地址。
 
+### `SUB2API`
+
+当 `来源 = SUB2API` 时，需要配置：
+
+- `SUB2API`：后台账号管理页地址
+- `账号 / 密码`：SUB2API 管理员登录信息
+- `分组`：目标 OpenAI 分组，留空时默认 `codex`
+- `默认代理`：创建账号时必须绑定的代理名称或代理 ID，默认 `shadowrocket`
+
+插件会在 Step 1 和 Step 10 自动从 `/api/v1/admin/proxies/all` 解析这个代理，并分别把 `proxy_id` 传给 OAuth 链接生成、授权码交换和账号创建请求。如果名称匹配到多个代理，请改填代理 ID。
+
 ### `Mail`
 
 支持五种验证码来源：