fix: reconcile upstream keys on list/generate/import to prevent stale key imports

- Extract reconcile_upstream_keys() to website_sync.py (shared scheduler + on-demand)
- Add reconcile_upstream_keys_full() for on-demand reconciliation at three entry points:
  list_generated_keys, generate_keys_by_groups, import_upstream_keys_as_accounts
- Safe on failure: active_group_ids=None / remote_key_ids=None skip cleanup
- Support custom managed_prefix via _fetch_remote_managed_key_ids() helper
- Exclude orphaned keys from frontend importable list
- Remove hardcoded search='SmartUp' from scheduler path

backend/app/routers/upstreams.py

@@ -127,6 +127,11 @@ def list_upstreams(db: Session = Depends(get_db), _=Depends(get_current_user)):
 def list_generated_keys(uid: int, db: Session = Depends(get_db), _=Depends(get_current_user)):
     if not db.query(Upstream.id).filter(Upstream.id == uid).first():
         raise HTTPException(404, "upstream not found")
+    # 返回前强制对账，清理远端已删除的 Key
+    try:
+        website_sync.reconcile_upstream_keys_full(db, uid)
+    except Exception as exc:
+        logger.warning("list_generated_keys reconcile failed for %s: %s", uid, exc)
     rows = (
         db.query(UpstreamGeneratedKey)
         .filter(UpstreamGeneratedKey.upstream_id == uid)
@@ -293,6 +298,12 @@ def generate_keys_by_groups(
     if u.api_prefix.strip("/") != "api/v1":
         raise HTTPException(400, "首版仅支持 Sub2API 上游（API Prefix 应为 /api/v1）")
 
+    # 生成前先对账，清理远端已删除的旧 Key
+    try:
+        website_sync.reconcile_upstream_keys_full(db, uid)
+    except Exception as exc:
+        logger.warning("generate_keys_by_groups reconcile failed for %s: %s", uid, exc)
+
     auth_config = json.loads(u.auth_config_json or "{}")
     selected = set(body.group_ids)
     prefix = body.name_prefix