fix(organize,identity,sites,pi): W10-pre backend fixes from v0.2 visual QA

- slot: new manual_verify event (attention -> verifying, with reason); a
  successful organize of a download whose slot is in attention goes back
  through verifying and lands by verify_passed on the actually imported
  assets; the download's organize_blocked decision is resolved with
  resolution {key: manual_organize | organize_retry, organizationRecordId} (U1)
- acquisition: plan purpose is upgrade only when the slot already has a
  current asset; a movie slot gap is a fill (U7)
- identity: entities created from TMDB details get metadata fields projected
  in the same transaction; TMDB aliases deduped by normalized text, site-title
  aliases skipped when the text already exists (U9)
- pi: auth-mode test of a custom Base URL no longer marks the upstream ok, and
  says to use the minimal completion to probe the endpoint (U2)
- sites: PUT /sites/{id}/credentials replaces same-kind secrets in place and
  names new secrets with site id + random suffix (secret.name is unique; was a
  500 on update); M-Team user data uses config/definition apiBaseUrl instead
  of deriving api.<domain> from the site URL (Invalid URL on IP/local bases)
- copy: setup error says 初始化口令; backup job points at umt backup
- tests: schema expected tables add site_user_data; migration round-trip
  timeout 60s; fake secrets honor label as name; vertical/resolve/pi/slot/
  site-center tests for the above
- docs: 09-visual-qa W10-pre status table (U3 root cause: outbox events are
  never mirrored to SSE)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/src/modules/pi/routes.ts

@@ -104,14 +104,14 @@ export function registerPiRoutes(
         if (!r.ok) throw new UpstreamError(r.kind as UpstreamError["kind"], r.message);
       }
       const t = await clientFor(ctx, row, deps.client).test({ mode, ...(req.model ? { model: req.model } : {}) });
-      out = {
-        ok: true,
-        source: t.source,
-        model: t.model,
-        errorKind: null,
-        message: t.inCatalog ? null : `模型 ${t.model} 不在内置模型目录中,按手填 id 调用`,
-      };
-      await setStatus(ctx, row.id, { status: "ok", verified: true });
+      // 自定义 Base URL 的凭证检查不连端点:不据此改写可用状态,提示用最小补全确认可达(QA U2)
+      const unprobed = mode === "auth" && !!row.base_url && row.auth_kind !== "oauth";
+      const notes = [
+        t.inCatalog ? null : `模型 ${t.model} 不在内置模型目录中,按手填 id 调用`,
+        unprobed ? "只核对了凭证与模型,没有连接 Base URL;用「最小补全」确认端点可达" : null,
+      ].filter(Boolean);
+      out = { ok: true, source: t.source, model: t.model, errorKind: null, message: notes.join(";") || null };
+      if (!unprobed) await setStatus(ctx, row.id, { status: "ok", verified: true });
     } catch (err) {
       const e = err instanceof UpstreamError ? err : new UpstreamError("other", (err as Error).message);
       out = { ok: false, source: null, model: req.model ?? row.default_model, errorKind: e.kind, message: e.message };