fix: keep web-to-build SSO device flow off Cloudflare-strict accounts.x.ai

[heshangcode]

Problem

Converting a Grok Web (SSO) account to a Build account fails with 校验 Grok Web SSO 失败: xAI OAuth HTTP 403 on the first request to accounts.x.ai, regardless of proxy/egress quality.

Root cause

accounts.x.ai runs strict Cloudflare bot management that rejects non-browser clients — including the managed tls-client — with HTTP 403 even when a valid cf_clearance is presented (verified empirically: same exit IP + same clearance → curl_cffi Chrome fingerprint passes, tls-client gets 403). Meanwhile auth.x.ai accepts plain clients without any clearance.

The old flow required three accounts.x.ai round-trips:

1. SSO precheck GET accounts.x.ai — non-essential, only early-detects dead SSO cookies
2. GET verification_uri_complete (accounts.x.ai) — page warm-up only, not required by xAI
3. Following the verify/approve 302 redirects, which land on accounts.x.ai consent/done pages

Fix

Move the entire device flow onto auth.x.ai:

• Ad-hoc clearance for accounts.x.ai via new Manager.SolveClearance (never persisted, so the node's grok.com clearance is untouched); attached to the flow when solving succeeds, graceful fallback otherwise.
• Precheck & verification-page warm-up degrade to warnings when Cloudflare blocks them (403 etc.); credential validity is judged by the verify step instead.
• verify/approve POSTs no longer follow redirects — read the 302 Location directly for the consent/done markers, so accounts.x.ai is never visited.
• Dead SSO cookies still map to ErrUnauthorized (preserving the markSSOCredentialRejected behavior) via the sign-in redirect on the verify step.

Verification

• go test ./... green; 5 new tests cover clearance attach/fallback, cookie-header sanitization, blocked-precheck degradation, dead-SSO → ErrUnauthorized mapping, and no-redirect-follow behavior.
• Live conversion of a Web account: created: 1, linked: 0, skipped: 0, failed: 0, synced: 1.

Known limitation

If xAI moves the consent/done markers from the first 302 Location to a later hop or JS-rendered page, conversion will fail with a readable SSO 自动验证 Device Flow 失败 error instead of silently misbehaving.

🤖 Generated with Claude Code