feat: add Yuheng ticket bind, trial SMS off, shared bindings

Ship ticket-exchange and bind/policy for Z13, keep trial binds SMS-free, allow shared company bindings, and align SyncPage plus sync docs.

Co-authored-by: Cursor <cursoragent@cursor.com>

web/src/api.ts

@@ -1143,6 +1143,7 @@ export async function ensureSyncBinding(
     display_name?: string;
     note?: string;
     user_id?: number;
+    shared?: boolean;
   }
 ) {
   const res = await apiFetch(`/api/v1/admin/sync/bindings`, {
@@ -1167,11 +1168,70 @@ export type SyncBinding = {
   channel_id?: string;
   database_name?: string;
   display_name?: string;
+  shared?: boolean;
   note?: string;
   created_at?: string;
   updated_at?: string;
 };
 
+export type BindCode = {
+  code: string;
+  tenant_id: number;
+  channel_id?: string;
+  online_db_id?: string;
+  database_name?: string;
+  max_uses: number;
+  used_count: number;
+  revoked?: boolean;
+  expires_at?: string;
+  created_by?: number;
+  created_at?: string;
+  note?: string;
+};
+
+export async function listBindCodes(session: Session) {
+  const res = await apiFetch(`/api/v1/admin/bind-codes`, {
+    headers: { Authorization: `Bearer ${session.accessToken}` },
+  });
+  const data = await readJson(res);
+  throwIfBad(res, data, "list bind codes failed");
+  return data as { items: BindCode[] };
+}
+
+export async function createBindCode(
+  session: Session,
+  body?: {
+    channel_id?: string;
+    online_db_id?: string;
+    database_name?: string;
+    max_uses?: number;
+    expires_hours?: number;
+    note?: string;
+  }
+) {
+  const res = await apiFetch(`/api/v1/admin/bind-codes`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${session.accessToken}`,
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify(body || {}),
+  });
+  const data = await readJson(res);
+  throwIfBad(res, data, "create bind code failed");
+  return data as BindCode;
+}
+
+export async function revokeBindCode(session: Session, code: string) {
+  const res = await apiFetch(`/api/v1/admin/bind-codes/${encodeURIComponent(code)}`, {
+    method: "DELETE",
+    headers: { Authorization: `Bearer ${session.accessToken}` },
+  });
+  const data = await readJson(res);
+  throwIfBad(res, data, "revoke bind code failed");
+  return data as { ok: boolean };
+}
+
 export async function listSyncBindings(session: Session, localDatabaseId?: string) {
   const q = localDatabaseId
     ? `?local_database_id=${encodeURIComponent(localDatabaseId)}`