feat(grok): 支持 Web SSO 批量导入并转换为 Build OAuth

新增 Grok Web SSO → xAI Device Flow → Grok Build OAuth 导入链路，
支持管理员批量粘贴 SSO key 创建 OAuth 账号。

- 后端：ConvertSSOToBuild、ConvertFromSSO、POST /admin/grok/sso-to-oauth
- 批量：3 worker 并发，失败跳过并汇总 created/failed，worker panic recover
- 无 refresh_token 时写入 expires_at 并强制 auto_pause_on_expired
- 前端：SSO Cookie 导入入口、动态超时、中英文案、部分成功不关弹窗
- 测试：pkg/service/handler/前端超时单测；本地 Docker 真实 SSO e2e 通过

frontend/src/api/__tests__/admin.grok.spec.ts

@@ -0,0 +1,37 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { post } = vi.hoisted(() => ({
+  post: vi.fn(),
+}))
+
+vi.mock('@/api/client', () => ({
+  apiClient: { post },
+}))
+
+import { createFromSSO, getGrokSSOImportTimeout } from '@/api/admin/grok'
+
+describe('admin Grok SSO import API', () => {
+  beforeEach(() => {
+    post.mockReset()
+    post.mockResolvedValue({ data: { created: [], failed: [] } })
+  })
+
+  it.each([
+    [1, 180_000],
+    [3, 180_000],
+    [4, 270_000],
+    [7, 360_000],
+  ])('uses a timeout sized for %i keys', async (keyCount, expectedTimeout) => {
+    expect(getGrokSSOImportTimeout(keyCount)).toBe(expectedTimeout)
+
+    await createFromSSO({
+      sso_tokens: Array.from({ length: keyCount }, (_, index) => `sso-${index + 1}`),
+    })
+
+    expect(post).toHaveBeenCalledWith(
+      '/admin/grok/sso-to-oauth',
+      expect.objectContaining({ sso_tokens: expect.any(Array) }),
+      { timeout: expectedTimeout },
+    )
+  })
+})