Disable proxy pool by default; add managed proxy lifecycle and Turnstile fixes.

Keep proxy_pool_enabled/managed off for direct registration, while shipping
SSO OAuth CPA export, visible Turnstile click handling, and proxy harvest tooling.

cpa_export.py

@@ -40,7 +40,16 @@ def _record_failure(out_dir: Path, email: str, reason: str) -> None:
 def _resolve_proxy(cfg: dict) -> str | None:
     from oidc_mint import resolve_proxy, set_runtime_proxy
 
+    # 1) 显式 mint_proxy / proxy
     proxy = (cfg.get("mint_proxy") or cfg.get("proxy") or "").strip()
+    # 2) 注册机代理池线程绑定（与浏览器同出口）
+    if not proxy:
+        try:
+            import proxy_pool
+            proxy = (proxy_pool.get_thread_proxy() or "").strip()
+        except Exception:
+            proxy = ""
+    # 3) 环境变量
     if not proxy:
         proxy = (
             os.environ.get("https_proxy")