feat: block official provider switching during proxy takeover

Prevent users from switching to official providers (Anthropic/OpenAI/Google)
when proxy takeover is active, as using a proxy with official APIs may cause
account bans.

Defense-in-depth across 4 layers:
- Backend: ProviderService::switch(), hot_switch_provider(), switch_proxy_provider command
- Frontend: useProviderActions soft guard with error toast
- UI: ProviderActions button disabled with ShieldAlert icon
- Tray menu: official provider items disabled with ⛔ indicator

Also warns when enabling proxy takeover while current provider is official.

src-tauri/src/commands/proxy.rs

@@ -253,6 +253,19 @@ pub async fn switch_proxy_provider(
     app_type: String,
     provider_id: String,
 ) -> Result<(), String> {
+    // Block official providers during proxy takeover
+    let provider = state
+        .db
+        .get_provider_by_id(&provider_id, &app_type)
+        .map_err(|e| format!("读取供应商失败: {e}"))?
+        .ok_or_else(|| format!("供应商不存在: {provider_id}"))?;
+    if provider.category.as_deref() == Some("official") {
+        return Err(
+            "代理接管模式下不能切换到官方供应商 (Cannot switch to official provider during proxy takeover)"
+                .to_string(),
+        );
+    }
+
     state
         .proxy_service
         .switch_proxy_target(&app_type, &provider_id)

src-tauri/src/services/provider/mod.rs

@@ -1407,6 +1407,16 @@ impl ProviderService {
         // Hot-switch only when BOTH: this app is taken over AND proxy server is actually running
         let should_hot_switch = (is_app_taken_over || live_taken_over) && is_proxy_running;
 
+        // Block switching to official providers when proxy takeover is active.
+        // Using a proxy with official APIs (Anthropic/OpenAI/Google) may cause account bans.
+        if should_hot_switch && _provider.category.as_deref() == Some("official") {
+            return Err(AppError::localized(
+                "switch.official_blocked_by_proxy",
+                "代理接管模式下不能切换到官方供应商，使用代理访问官方 API 可能导致账号被封禁。请先关闭代理接管，或选择第三方供应商。",
+                "Cannot switch to official provider while proxy takeover is active. Using proxy with official APIs may cause account bans.",
+            ));
+        }
+
         if should_hot_switch {
             // Proxy takeover mode: hot-switch only, don't write Live config
             log::info!(

src-tauri/src/services/proxy.rs

@@ -15,6 +15,7 @@ use crate::services::provider::{
 use serde_json::{json, Value};
 use std::str::FromStr;
 use std::sync::Arc;
+use tauri::Emitter;
 use tokio::sync::RwLock;
 
 /// 用于接管 Live 配置时的占位符（避免客户端提示缺少 key，同时不泄露真实 Token）
@@ -375,6 +376,26 @@ impl ProxyService {
 
             // 7) 兼容旧逻辑：写入 any-of 标志（失败不影响功能）
             let _ = self.db.set_live_takeover_active(true).await;
+
+            // 8) Warn if the current provider is official (risk of account ban via proxy)
+            if let Ok(Some(current_id)) =
+                crate::settings::get_effective_current_provider(&self.db, &app)
+            {
+                if let Ok(Some(provider)) = self.db.get_provider_by_id(&current_id, app_type_str) {
+                    if provider.category.as_deref() == Some("official") {
+                        if let Some(handle) = self.app_handle.read().await.as_ref() {
+                            let _ = handle.emit(
+                                "proxy-official-warning",
+                                serde_json::json!({
+                                    "appType": app_type_str,
+                                    "providerName": provider.name,
+                                }),
+                            );
+                        }
+                    }
+                }
+            }
+
             return Ok(());
         }
 
@@ -1548,6 +1569,14 @@ impl ProxyService {
             .map_err(|e| format!("读取供应商失败: {e}"))?
             .ok_or_else(|| format!("供应商不存在: {provider_id}"))?;
 
+        // Defense-in-depth: block official providers during proxy takeover
+        if provider.category.as_deref() == Some("official") {
+            return Err(
+                "代理接管模式下不能切换到官方供应商 (Cannot switch to official provider during proxy takeover)"
+                    .to_string(),
+            );
+        }
+
         let logical_target_changed =
             crate::settings::get_effective_current_provider(&self.db, &app_type_enum)
                 .map_err(|e| format!("读取当前供应商失败: {e}"))?

src-tauri/src/tray.rs

@@ -297,6 +297,9 @@ pub fn create_tray_menu(
             .map_err(|e| AppError::Message(format!("创建打开主界面菜单失败: {e}")))?;
     menu_builder = menu_builder.item(&show_main_item).separator();
 
+    // Pre-compute proxy running state (used to disable official providers in tray menu)
+    let is_proxy_running = futures::executor::block_on(app_state.proxy_service.is_running());
+
     // 每个应用类型折叠为子菜单，避免供应商过多时菜单过长
     for section in TRAY_SECTIONS.iter() {
         if !visible_apps.is_visible(&section.app_type) {
@@ -327,15 +330,32 @@ pub fn create_tray_menu(
             };
             let submenu_id = format!("submenu_{}", app_type_str);
 
+            // Check if this app is under proxy takeover (for disabling official providers)
+            let is_app_taken_over = is_proxy_running
+                && (futures::executor::block_on(app_state.db.get_live_backup(app_type_str))
+                    .ok()
+                    .flatten()
+                    .is_some()
+                    || app_state
+                        .proxy_service
+                        .detect_takeover_in_live_config_for_app(&section.app_type));
+
             let mut submenu_builder = SubmenuBuilder::with_id(app, &submenu_id, &submenu_label);
 
             for (id, provider) in sort_providers(&providers) {
                 let is_current = current_id == *id;
+                let is_official_blocked =
+                    is_app_taken_over && provider.category.as_deref() == Some("official");
+                let label = if is_official_blocked {
+                    format!("{} \u{26D4}", &provider.name) // ⛔ emoji
+                } else {
+                    provider.name.clone()
+                };
                 let item = CheckMenuItem::with_id(
                     app,
                     format!("{}{}", section.prefix, id),
-                    &provider.name,
-                    true,
+                    &label,
+                    !is_official_blocked, // disabled when blocked
                     is_current,
                     None::<&str>,
                 )