统一外部 access_token 存储与轻应用 URL 拼接，修复嵌入会话鉴权隔离。

将 access_token 纳入 scoped storage 迁移，yUserId 登录优先并独立持久化 token；轻应用/按钮管理默认改用 access_token 参数名，支持 hash 路由占位符替换与自动追加。

frontend-web/src/pages/LightAppManagementPage.tsx

@@ -89,9 +89,9 @@ const emptyForm = (): FormState => ({
 });
 
 const newParam = (): LightAppRouteParam => ({
-  key: "",
+  key: "access_token",
   paramType: "login",
-  source: "accessToken",
+  source: "access_token",
   customValue: "",
   themeValue: "red=red;blue=blue;dark-blue=dark-blue",
 });
@@ -107,7 +107,7 @@ function formFromApp(app: LightApp): FormState {
     routeParams: app.routeParams.map((p) => ({
       key: p.key,
       paramType: p.paramType,
-      source: p.source ?? "accessToken",
+      source: p.source ?? "access_token",
       customValue: p.customValue ?? "",
       themeValue: p.themeValue ?? "",
     })),
@@ -118,7 +118,7 @@ function getParamSourceLabel(param: LightAppRouteParam): string {
   if (param.paramType === "theme") {
     return `主题参数: ${param.themeValue || ""}`;
   }
-  const source = param.source || "accessToken";
+  const source = param.source || "access_token";
   const option = LOGIN_SOURCE_OPTIONS.find((o) => o.value === source);
   if (source === "other") {
     return `登录参数: ${param.customValue || ""}`;
@@ -977,7 +977,7 @@ export default function LightAppManagementPage() {
                               onChange={(v) =>
                                 patchParam(idx, {
                                   paramType: v as "login" | "theme",
-                                  source: v === "login" ? (p.source || "accessToken") : undefined,
+                                  source: v === "login" ? (p.source || "access_token") : undefined,
                                 })
                               }
                             />
@@ -988,7 +988,7 @@ export default function LightAppManagementPage() {
                               <Select
                                 className="w-full"
                                 size="small"
-                                value={p.source || "accessToken"}
+                                value={p.source || "access_token"}
                                 options={LOGIN_SOURCE_OPTIONS}
                                 popupProps={DIALOG_SELECT_POPUP}
                                 onChange={(v) => patchParam(idx, { source: v as string })}
@@ -1112,7 +1112,7 @@ function cleanParams(params: LightAppRouteParam[]): LightAppRouteParam[] {
     .map((p) => {
       const base: LightAppRouteParam = { key: p.key.trim(), paramType: p.paramType };
       if (p.paramType === "login") {
-        base.source = p.source || "accessToken";
+        base.source = p.source || "access_token";
         if (base.source === "other") {
           base.customValue = (p.customValue ?? "").trim();
         }

frontend-web/src/pages/LoginPage.tsx

@@ -179,10 +179,10 @@ export default function LoginPage() {
           auth = await loginByToken(authToken);
         } else {
           let deerflowUsername = resolvedUsername;
-          if (onlineTicket) {
-            deerflowUsername = await resolveUsernameByOnlineTicket(onlineTicket);
-          } else if (yUserId) {
+          if (yUserId) {
             await loginByYUserId(yUserId, toolToken || null, access_token || null);
+          } else if (onlineTicket) {
+            deerflowUsername = await resolveUsernameByOnlineTicket(onlineTicket);
           } else if (toolToken) {
             persistToolsToken(toolToken);
           }

frontend-web/src/pages/TaskButtonsPage.tsx

@@ -124,7 +124,7 @@ export default function TaskButtonsPage() {
     );
 
   const addLoginParam = (id: string) =>
-    updateLoginParams(id, (ps) => [...ps, { key: "", source: "accessToken", customValue: "" }]);
+    updateLoginParams(id, (ps) => [...ps, { key: "access_token", source: "access_token", customValue: "" }]);
 
   const patchLoginParam = (id: string, idx: number, patch: Partial<TaskButtonLoginParam>) =>
     updateLoginParams(id, (ps) => ps.map((p, i) => (i === idx ? { ...p, ...patch } : p)));