Add codex2api as a protocol-first OAuth source

This keeps the existing CPA, SUB2API, and contribution flows intact
while introducing codex2api as a separate source that plugs into
Step 7 and Step 10 through backend APIs instead of page DOM.

The sidepanel now exposes codex2api settings, preserves the built-in
local default through placeholder-only UI, and accepts user-provided
public admin URLs. Step 7 now treats missing or invalid management
secrets as terminal config errors so the flow stops instead of retrying
needlessly.

Constraint: New source must be additive and must not break existing CPA/SUB2API/contribution paths
Rejected: Drive codex2api through admin page button clicks | too brittle against frontend DOM changes
Rejected: Reuse contribution mode as a source surface | violates existing panelMode/runtime-mode boundary
Confidence: high
Scope-risk: moderate
Reversibility: clean
Directive: Keep codex2api on the protocol path unless its API becomes insufficient; do not add a panel content script without proving the protocol path cannot work
Tested: npm test; targeted codex2api/auth retry loops repeated 40 times; full suite repeated 5 times
Not-tested: Real browser run against a live codex2api instance with a real Admin Secret and OpenAI authorization

background/steps/oauth-login.js

@@ -23,6 +23,20 @@
       throwIfStopped,
     } = deps;
 
+    function isManagementSecretConfigError(error) {
+      const message = String(typeof error === 'string' ? error : error?.message || '').trim();
+      if (!message) {
+        return false;
+      }
+
+      const mentionsSecret = /管理密钥|Admin Secret|X-Admin-Key|CPA Key/i.test(message);
+      if (!mentionsSecret) {
+        return false;
+      }
+
+      return /缺少|未配置|请输入|无效|错误|失败|401|认证失败|未授权|unauthorized|invalid/i.test(message);
+    }
+
     async function executeStep7(state) {
       if (!state.email) {
         throw new Error('缺少邮箱地址，请先完成步骤 3。');
@@ -99,6 +113,13 @@
           if (isAddPhoneAuthFailure(err)) {
             throw err;
           }
+          if (isManagementSecretConfigError(err)) {
+            await addLog(
+              `步骤 7：检测到来源后台管理密钥缺失或错误，不再重试，当前流程停止。原因：${getErrorMessage(err)}`,
+              'error'
+            );
+            throw err;
+          }
           lastError = err;
           if (attempt >= STEP6_MAX_ATTEMPTS) {
             break;