fix(openai): Mobile RT 账号隐私设置失败

1. CreateAccount 补齐 OpenAI OAuth 隐私入口（与 BatchCreate 对齐）
2. disableOpenAITraining 请求头修正：覆盖 ImpersonateChrome() 的
   浏览器导航默认头（accept: text/html, sec-fetch-mode: navigate），
   改为 API 请求语义（Accept: application/json, sec-fetch-mode: cors），
   避免 Cloudflare 将 PATCH API 请求误判为异常导航流量而拦截
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/internal/service/admin_service.go

@@ -1642,8 +1642,20 @@ func (s *adminServiceImpl) CreateAccount(ctx context.Context, input *CreateAccou
 		}
 	}
 
-	// Antigravity OAuth 账号：创建后异步设置隐私
-	if account.Platform == PlatformAntigravity && account.Type == AccountTypeOAuth {
+	// OAuth 账号：创建后异步设置隐私。
+	// 使用 Ensure（幂等）而非 Force：新建账号 Extra 为空时效果相同，但更安全。
+	if account.Type == AccountTypeOAuth {
+		switch account.Platform {
+		case PlatformOpenAI:
+			go func() {
+				defer func() {
+					if r := recover(); r != nil {
+						slog.Error("create_account_openai_privacy_panic", "account_id", account.ID, "recover", r)
+					}
+				}()
+				s.EnsureOpenAIPrivacy(context.Background(), account)
+			}()
+		case PlatformAntigravity:
 			go func() {
 				defer func() {
 					if r := recover(); r != nil {
@@ -1653,6 +1665,7 @@ func (s *adminServiceImpl) CreateAccount(ctx context.Context, input *CreateAccou
 				s.EnsureAntigravityPrivacy(context.Background(), account)
 			}()
 		}
+	}
 
 	return account, nil
 }

backend/internal/service/openai_privacy_service.go

@@ -56,6 +56,10 @@ func disableOpenAITraining(ctx context.Context, clientFactory PrivacyClientFacto
 		SetHeader("Authorization", "Bearer "+accessToken).
 		SetHeader("Origin", "https://chatgpt.com").
 		SetHeader("Referer", "https://chatgpt.com/").
+		SetHeader("Accept", "application/json").
+		SetHeader("sec-fetch-mode", "cors").
+		SetHeader("sec-fetch-site", "same-origin").
+		SetHeader("sec-fetch-dest", "empty").
 		SetQueryParam("feature", "training_allowed").
 		SetQueryParam("value", "false").
 		Patch(openAISettingsURL)