feat(multicloud): 补齐上线前的多云管理缺口（适配器/动作层/DNS/定时同步）

评估发现项目只有台账能力，缺失真正的多云管理链路。本次按缺口逐项补齐：

适配层
- 新增 aws / linode / namesilo 适配器，registry 登记；阿里云、腾讯云补
  list_domains 与 get_account 余额
- NormalizedVPS 补 expiry_date + charge_type：此前云端同步进来的 VPS 拿不到
  到期日，永远进不了续费提醒——而续费提醒正是这套台账存在的理由
- base.py 统一云端错误可读化（http_error_message / cloud_error_text）：各厂商
  把原因放的位置都不同（Linode errors[].reason、Cloudflare errors[].message、
  腾讯 Response.Error.Message、AWS XML），此前直接 str(e) 会把 httpx 的多行文本
  连同 MDN 链接弹给用户

动作层与 DNS
- 新增 /api/actions：实例启停/重启/续费，写操作全部二次确认 + 审计
- 新增 Cloudflare DNS 记录的增删改查

定时同步
- scripts/sync_all_assets.py + /api/sync/assets + vps-sync-assets.timer(08:30)
- 08:30 而非随机时刻：必须早于 09:00 的续费检查，否则提醒读到上一天的旧到期日
- sync_all_assets 修正计数：每一项子同步都失败时不再计为「成功」，否则凭证过期
  会显示「成功 1」，用户以为数据拉到了、实际一条没有

数据一致性
- AssetRead 输出 external_id（只出不进）：前端「云操作」「DNS」按钮靠它渲染，
  缺了则所有按钮永远出不来
- import_assets 落库 external_id：导出带了去重键而导入丢弃，会让迁移后首次同步
  把所有云端资产当新增再建一份
- _align_preset_providers 取代 _backfill_provider_services：库里声明但注册表未
  实现的 sdk_type 清空（声明支持却不支持，比明说不支持更糟），services 只增量
  补标签不覆盖，用户自建平台不动

前端如实展示
- cost 为 0 统一显示「未填」而非「0 USD」：0 既可能是没填、也可能是云端不返回
  价格，而汇总处又把 0 当「无费用」排除，两处口径不一致
- 总览「本年支出」增加 year_cost_missing，把合计的覆盖缺口说出来
- DNS 弹窗补 MX/SRV 优先级与备注；列表请求失败时 provider 用资产自带 slug 兜底，
  否则 Cloudflare 代理勾选框永远不出现

测试：257 -> 309 passed

tests/test_adapters.py

@@ -13,7 +13,13 @@ from app.adapters.ai import DeepSeekAdapter, KimiAdapter, OpenAIAdapter
 from app.adapters.aliyun import AliyunAdapter
 from app.adapters.cloudflare import CloudflareAdapter
 from app.adapters.digitalocean import DigitalOceanAdapter
-from app.adapters.tencent import TencentAdapter
+from app.adapters.tencent import (
+    BILLING_HOST,
+    CVM_HOST,
+    DNSPOD_HOST,
+    TencentAdapter,
+    _service_of,
+)
 from app.adapters.vultr import VultrAdapter
 
 
@@ -132,7 +138,9 @@ def test_aliyun_sign_sensitive_to_secret():
 # --------------------------- 腾讯云签名 --------------------------- #
 def test_tencent_authorization_format():
     adapter = TencentAdapter({"secret_id": "SID", "secret_key": "SKEY"})
-    auth = adapter._build_authorization("DescribeInstances", "{}", 1704067200, "2024-01-01")
+    auth = adapter._build_authorization(
+        "DescribeInstances", "{}", 1704067200, "2024-01-01", CVM_HOST, "cvm"
+    )
     assert auth.startswith("TC3-HMAC-SHA256 Credential=SID/")
     assert "2024-01-01/cvm/tc3_request" in auth
     assert "SignedHeaders=content-type;host;x-tc-action" in auth
@@ -145,11 +153,38 @@ def test_tencent_authorization_format():
 
 def test_tencent_sign_sensitive_to_payload():
     adapter = TencentAdapter({"secret_id": "SID", "secret_key": "SKEY"})
-    a1 = adapter._build_authorization("DescribeInstances", '{"Limit":1}', 1704067200, "2024-01-01")
-    a2 = adapter._build_authorization("DescribeInstances", '{"Limit":2}', 1704067200, "2024-01-01")
+    a1 = adapter._build_authorization(
+        "DescribeInstances", '{"Limit":1}', 1704067200, "2024-01-01", CVM_HOST, "cvm"
+    )
+    a2 = adapter._build_authorization(
+        "DescribeInstances", '{"Limit":2}', 1704067200, "2024-01-01", CVM_HOST, "cvm"
+    )
     assert a1 != a2
 
 
+def test_tencent_credential_scope_follows_service():
+    """多产品复用同一套签名：credential scope 与 host 中的 canonical host 必须随 service 变化
+
+    若 scope 写死成 cvm，调用 billing/domain/dnspod 会全部返回 AuthFailure.SignatureFailure。
+    """
+    adapter = TencentAdapter({"secret_id": "SID", "secret_key": "SKEY"})
+    cvm = adapter._build_authorization(
+        "DescribeInstances", "{}", 1704067200, "2024-01-01", CVM_HOST, "cvm"
+    )
+    billing = adapter._build_authorization(
+        "DescribeAccountBalance", "{}", 1704067200, "2024-01-01", BILLING_HOST, "billing"
+    )
+    assert "2024-01-01/cvm/tc3_request" in cvm
+    assert "2024-01-01/billing/tc3_request" in billing
+    assert cvm != billing
+
+
+def test_tencent_service_of_host():
+    assert _service_of(CVM_HOST) == "cvm"
+    assert _service_of(BILLING_HOST) == "billing"
+    assert _service_of(DNSPOD_HOST) == "dnspod"
+
+
 # --------------------------- 注册表路由 --------------------------- #
 def test_registry_supported_types():
     for t in [