fix(grok): 三轮评审 — 流式 Search 去重与调度/计费加固

- P0: 直播 SSE SearchCount 跨事件 call_id 去重，避免 ~2× 附加费
- SearchCount/Audio/WebSearchCalls 走 mandatory usage task
- web_search:uuid 等 forced request_id 优先于 client/local
- Sanitize 始终剥离 cookie；ApplyOAuth 清 grok_needs_reauth_at
- free 判定：paid 证据压过陈旧 free 凭据
- Gateway 列表应用 free soft-gate；token/body-read 可 failover
- web_search 重试支持 WaitPlan 获取；周 PeriodEnd 不再回填月 end

backend/internal/handler/admin/account_handler.go

@@ -1450,6 +1450,7 @@ func (h *AccountHandler) ApplyOAuthCredentials(c *gin.Context) {
 		if clearErr := h.adminService.UpdateAccountExtra(ctx, accountID, map[string]any{
 			"grok_needs_reauth":        false,
 			"grok_needs_reauth_reason": "",
+			"grok_needs_reauth_at":     "",
 		}); clearErr != nil {
 			slog.Warn("apply_oauth_credentials.clear_grok_reauth_failed",
 				"account_id", accountID,