feat(skill): inkreach-teable-plugin 按 skill-creator 评估流程迭代优化

- 导入规则精确化:@teable/* 禁运行时值导入(import type 可);
  react 仅在 webpack externals 映射到宿主全局时允许
- 新增效率守则:信任技能文档、知识题不读宿主源码、不上传演示插件验证
- 修复失效引用:hr_admin 死账号、404 测试基地 → 改为一次性沙箱基地模式
- 补充认证提示:管理类路由(如 DELETE /api/plugin)PAT 403 需 session 回退
- deployment.md 部署脚本改用 PAT 鉴权与必填 BASE_ID

评估:6 题 × 2 轮 24 次运行(含真实上传/清理链路);description 经
触发评估循环验证为原版最优,保持不变

skills/inkreach-teable-plugin/dynamic-plugins/deployment.md

@@ -144,16 +144,15 @@ VALUES (gen_random_uuid(), '<userId>', '<email>', '<adminUserId>');
 
 ## Getting a session cookie
 
+Prefer a PAT (upload-bundle accepts `Authorization: Bearer <PAT>`). For a
+session cookie, sign in with any real account created for the purpose
+(`POST /api/auth/signup`), then add its `plugin_developer` row before uploading:
+
 ```bash
-curl -s -c /tmp/cookie_hr.txt http://localhost:3003/api/auth/signin \
+curl -s -c /tmp/cookie.txt http://localhost:3003/api/auth/signin \
   -X POST -H 'Content-Type: application/json' \
-  -d '{"email":"hr_admin@xingchen.tech","password":"Xingchen@2026"}'
-
-
-> Account note (2026-08): `hr_admin@xingchen.tech` no longer exists on the
-> deployed instance. Create a throwaway user via `POST /api/auth/signup`
-> and add a `plugin_developer` row for it before uploading (see SKILL.md).
-SESSION=$(grep auth_session /tmp/cookie_hr.txt | awk '{print $NF}')
+  -d '{"email":"<real-account>","password":"<password>"}'
+SESSION=$(grep auth_session /tmp/cookie.txt | awk '{print $NF}')
 ```
 
 ## Full deploy script (copy-paste)
@@ -163,22 +162,20 @@ SESSION=$(grep auth_session /tmp/cookie_hr.txt | awk '{print $NF}')
 set -e
 DIR="${1:-.}"
 UPLOAD_URL="${UPLOAD_URL:-http://localhost:3003}"
-BASE_ID="${BASE_ID:-bseAi6Hazmw7jPWZbfO}"
+BASE_ID="${BASE_ID:?set to a throwaway sandbox base, never a production base}"
 
 # Read plugin ID from manifest
 PLUGIN_ID=$(python3 -c "import json; print(json.load(open('$DIR/plugin.json'))['id'])")
 
 # Get session
-SESSION=$(grep auth_session /tmp/cookie_hr.txt 2>/dev/null | awk '{print $NF}')
-if [ -z "$SESSION" ]; then
-  curl -s -c /tmp/cookie_hr.txt "$UPLOAD_URL/api/auth/signin" \
-    -X POST -H 'Content-Type: application/json' \
-    -d '{"email":"hr_admin@xingchen.tech","password":"Xingchen@2026"}' > /dev/null
-  SESSION=$(grep auth_session /tmp/cookie_hr.txt | awk '{print $NF}')
-fi
+# PAT preferred (upload-bundle accepts Bearer auth):
+AUTH=(-H "Authorization: Bearer ${PAT:?set PAT env}")
+# ...or session:
+SESSION=$(grep auth_session /tmp/cookie.txt 2>/dev/null | awk '{print $NF}')
+AUTH=(-b "auth_session=$SESSION")
 
 # Upload (URL includes pluginId from manifest)
-curl -s -b "auth_session=$SESSION" \
+curl -s "${AUTH[@]}" \
   -F "js=@$DIR/dist/main.js" \
   -F "css=@$DIR/dist/styles.css" \
   -F "manifest=@$DIR/plugin.json" \
@@ -186,7 +183,7 @@ curl -s -b "auth_session=$SESSION" \
 echo "Uploaded: $PLUGIN_ID"
 
 # Enable
-curl -s -b "auth_session=$SESSION" -X PUT \
+curl -s "${AUTH[@]}" -X PUT \
   "$UPLOAD_URL/api/base/$BASE_ID/plugin-config/$PLUGIN_ID" \
   -H 'Content-Type: application/json' \
   -d '{"enabled":true,"tableIds":[]}' > /dev/null