feat: block official provider switching during proxy takeover

Prevent users from switching to official providers (Anthropic/OpenAI/Google)
when proxy takeover is active, as using a proxy with official APIs may cause
account bans.

Defense-in-depth across 4 layers:
- Backend: ProviderService::switch(), hot_switch_provider(), switch_proxy_provider command
- Frontend: useProviderActions soft guard with error toast
- UI: ProviderActions button disabled with ShieldAlert icon
- Tray menu: official provider items disabled with ⛔ indicator

Also warns when enabling proxy takeover while current provider is official.

src/components/providers/ProviderActions.tsx

@@ -7,6 +7,7 @@ import {
   Minus,
   Play,
   Plus,
+  ShieldAlert,
   Terminal,
   TestTube2,
   Trash2,
@@ -36,6 +37,7 @@ interface ProviderActionsProps {
   isAutoFailoverEnabled?: boolean;
   isInFailoverQueue?: boolean;
   onToggleFailover?: (enabled: boolean) => void;
+  isOfficialBlockedByProxy?: boolean;
   // OpenClaw: default model
   isDefaultModel?: boolean;
   onSetAsDefault?: () => void;
@@ -60,6 +62,7 @@ export function ProviderActions({
   isAutoFailoverEnabled = false,
   isInFailoverQueue = false,
   onToggleFailover,
+  isOfficialBlockedByProxy = false,
   // OpenClaw: default model
   isDefaultModel = false,
   onSetAsDefault,
@@ -166,6 +169,16 @@ export function ProviderActions({
       };
     }
 
+    if (isOfficialBlockedByProxy) {
+      return {
+        disabled: true,
+        variant: "secondary" as const,
+        className: "opacity-40 cursor-not-allowed",
+        icon: <ShieldAlert className="h-4 w-4" />,
+        text: t("provider.blockedByProxy", { defaultValue: "已拦截" }),
+      };
+    }
+
     if (isCurrent) {
       return {
         disabled: true,