feat: migrate EnvX to the external control plane

[cunoe]

Summary

This is the single EnvX business-migration PR for the LEAPERone external control plane.

• split official API and Dashboard ownership: api.leaper.one for external control APIs, dashboard.leaper.one for browser authorization
• use PKCE S256 with state validation and exchange Device Flow sessions for scoped control tokens
• migrate profile, organization and EnvX traffic to canonical /api/v1 routes with constrained legacy fallback
• bind selected organization context to API origin and authenticated subject, and revalidate membership before push
• revoke the current control token on logout and before re-login; preserve local credentials when remote revocation fails
• add cursor pagination, bounded timeout and retry behavior, including idempotency-keyed POST/PATCH/DELETE retries
• protect EnvX writes with ETag revision preconditions
• keep credential files restrictive and redact secret values from output
• preserve official Node 18 support with compatible commander and better-sqlite3 versions

Validation

• Node 18.20.8 clean install, native SQLite smoke, build, CLI help and 28/28 tests
• current CI: test passed
• typecheck passed
• lint passed with only two pre-existing warnings in src/commands/del.ts
• git diff --check passed
• independent final review: green, no P0/P1/P2

Scope

Business code and business documentation only. No deployment, DNS, infrastructure, tag or package publication changes.

[leaperone-bot]

🤖 Leo

Code Review

⏳ 等待审查...

Build / Deploy

• ✅ 🚀 Deploy 2SOMEone · production · chore(web): release v4.6.28 · @harryisfish [src=da422b729edcf1aaf3913dde3fb51e0ea7cbc762][env=production] (19:22)

✅ 构建通过，可以合并

_{最后更新: 2026-07-11 19:23}