fix(providers): skip reachability probes for official OAuth entries

Do not derive unauthenticated health-check targets from runtime adapter defaults for official providers. Batch checks now skip official entries, and direct base-URL resolution fails explicitly instead of probing first-party endpoints without credentials.

Cover the Codex official provider in the stream-check regression tests so future adapter changes cannot silently reintroduce these probes.

src-tauri/src/commands/stream_check.rs

@@ -72,6 +72,12 @@ pub async fn stream_check_all_providers(
 
     let mut results = Vec::new();
     for (id, provider) in providers {
+        // Official OAuth providers intentionally have no user-configured probe
+        // target. Never turn their runtime adapter defaults into unauthenticated
+        // network probes against first-party endpoints.
+        if provider.category.as_deref() == Some("official") {
+            continue;
+        }
         if let Some(ids) = &allowed_ids {
             if !ids.contains(&id) {
                 continue;

src-tauri/src/services/stream_check.rs

@@ -166,6 +166,12 @@ impl StreamCheckService {
     /// 没有 cc-switch 能可靠探测的目标——这类供应商的连通检测按钮在前端已隐藏
     /// （见 `ProviderCard.tsx`），故此处对其提取失败直接报错即可，不做官方端点回退。
     fn resolve_base_url(app_type: &AppType, provider: &Provider) -> Result<String, AppError> {
+        if provider.category.as_deref() == Some("official") {
+            return Err(AppError::Message(
+                "Official providers do not expose a reachability-check target".to_string(),
+            ));
+        }
+
         match app_type {
             // 累加模式应用的 settings_config 结构与 Claude/Codex/Gemini 不同，
             // 不走 adapter，直接按各自约定提取 base_url。
@@ -510,5 +516,10 @@ mod tests {
         // 不会走到这里；不做官方端点回退（避免给忘填地址的第三方误显绿灯）。
         let empty = make_provider(serde_json::json!({ "env": {} }));
         assert!(StreamCheckService::resolve_base_url(&AppType::Claude, &empty).is_err());
+
+        let mut official = make_provider(serde_json::json!({ "auth": {}, "config": "" }));
+        official.id = crate::database::CODEX_OFFICIAL_PROVIDER_ID.to_string();
+        official.category = Some("official".to_string());
+        assert!(StreamCheckService::resolve_base_url(&AppType::Codex, &official).is_err());
     }
 }