[codex] add domain claim endpoint

[ZeroPointSix]

Summary

• add POST /api/external/pool/claim-domain as the explicit domain-filtered claim endpoint
• reuse the existing pool claim path, lease handling, audit logging, and completion/release state machine
• keep claim-random backward compatible while documenting its optional email_domain filter
• update Chinese and English API docs to clarify the minimal product scope

Scope

This intentionally does not add specific mailbox claiming, retry history, one-click retry, failed-first scheduling, or additional resource guarantee logic. The endpoint only makes domain-filtered claiming a clear API contract.

Refs #104.

Validation

• Created isolated venv on do-us-002
• Installed requirements.txt
• Ran python -m unittest tests.test_pool_flow_suite tests.test_pool_temp_mailbox tests.test_pool
• Result: 66 tests passed

[linear-code]

ZER-49

[ZeroPointSix]

审查结论：当前不建议合并，需先修复 CI 阻塞。

阻塞点：新增 api_external_pool_claim_domain handler 后，没有同步更新既有的 CSRF 豁免覆盖测试 tests/test_external_pool.py::ExternalPoolApiTests.test_external_pool_blueprint_applies_csrf_exempt_to_all_handlers。当前测试期望的 handler 集合仍只有 claim-random / claim-release / claim-complete / stats，因此完整 CI 在 Python 3.11/3.12/3.13 全部失败，SonarCloud 也因覆盖率测试步骤失败而跳过扫描。

我在 MCP 远程沙箱复现了同一问题：

• tests.test_pool_flow_suite.PoolFlowSuiteTests.test_claim_domain_requires_email_domain 通过
• tests.test_pool_flow_suite.PoolFlowSuiteTests.test_claim_domain_filters_to_requested_domain 通过
• tests.test_external_pool.ExternalPoolApiTests.test_external_pool_blueprint_applies_csrf_exempt_to_all_handlers 失败，报错为 Items in the first set but not the second: 'api_external_pool_claim_domain'

建议修复：把 api_external_pool_claim_domain 加入该测试的 expected handler 集合，然后重新跑完整 Python Tests。实现方向本身符合本期最小化范围：显式 claim-domain 入口复用现有 claim 流程，并要求 email_domain 必填，没有引入指定完整邮箱、重试历史或额外调度逻辑。

备注：原本尝试提交 REQUEST_CHANGES，但 GitHub 返回“Can not request changes on your own pull request”，所以这里改以普通 review comment 留痕。

[ZeroPointSix]

Migration note: the applicable changes from this PR have been ported into #112, targeting the #109 SPA migration branch.

#112 includes the token tool / verification fallback related pieces and matching test coverage. Full validation details are in the new PR body.