copy: second-round copy review across console, settings, agent and server messages

- Trim descriptions, empty states, confirm buttons and toasts to facts
- Unify terms per glossary: 待处理/待识别/整理记录/运行记录/凭证/子会话/Agent 上游
- Subscription-login termsNote states facts only (borrowed client identity, ToS/ban risk)
- Shorter, concrete goal templates for built-in Agent checks
- Human-readable nouns instead of table names in instance CRUD errors
- Audit labels for pi_upstream / schedule / automation_grant actions
- Glossary: add 上游、订阅登录、凭证、定时任务、巡检、运行记录、子会话、停止、持续授权

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/src/http/auth.ts

@@ -177,7 +177,7 @@ export function apiKeyAuth(opts: AuthOptions): MiddlewareHandler<AuthEnv> {
         if (!isPublic && WRITE_METHODS.has(c.req.method)) {
           const provided = c.req.header(CSRF_HEADER);
           if (!provided || !safeEqual(provided, deriveCsrfToken(token))) {
-            throw new ApiException("forbidden", "CSRF 校验失败,请刷新页面后重试");
+            throw new ApiException("forbidden", "CSRF 校验失败,刷新页面后重试");
           }
         }
         setActor(c, { kind: "admin_session", id: s.adminUserId, name: s.username, scopes: ["admin"] }, "admin", {
@@ -191,7 +191,7 @@ export function apiKeyAuth(opts: AuthOptions): MiddlewareHandler<AuthEnv> {
       }
     }
     if (isPublic) return next();
-    throw new ApiException("unauthorized", token ? "会话已过期或已注销,请重新登录" : "需要登录或 Bearer API Key");
+    throw new ApiException("unauthorized", token ? "会话已过期或已注销,重新登录" : "需要登录或 Bearer API Key");
   };
 }
 
@@ -207,7 +207,7 @@ export function hasScope(granted: readonly string[], required: ApiScope): boolea
 export function requireScope(...anyOf: ApiScope[]): MiddlewareHandler<AuthEnv> {
   return async (c, next) => {
     const p = c.get("principal");
-    if (!p) throw new ApiException("unauthorized", "未鉴权");
+    if (!p) throw new ApiException("unauthorized", "未登录");
     if (!anyOf.some((s) => hasScope(p.scopes, s))) {
       throw new ApiException("forbidden", `需要 scope: ${anyOf.join(" | ")}`);
     }
@@ -222,8 +222,8 @@ export function requireScope(...anyOf: ApiScope[]): MiddlewareHandler<AuthEnv> {
 export function requireAdminSession(): MiddlewareHandler<AuthEnv> {
   return async (c, next) => {
     const p = c.get("principal");
-    if (!p) throw new ApiException("unauthorized", "未鉴权");
-    if (p.kind !== "admin_session") throw new ApiException("forbidden", "该操作只能在控制台登录后进行");
+    if (!p) throw new ApiException("unauthorized", "未登录");
+    if (p.kind !== "admin_session") throw new ApiException("forbidden", "这个操作需要在控制台登录后进行");
     return next();
   };
 }