[Feature] Generic OAuth Provider lacks PKCE support, cannot integrate with X / Apple / Twitch which mandate PKCE

Read This First (Do Not Remove This Section)

• Docs: https://docs.newapi.ai/
• Usage questions first: https://deepwiki.com/QuantumNous/new-api
• Warning: issues with this template removed, section headings deleted, or content cleared may be closed directly. Repeated abusive submissions may result in a block.

Your current newapi version

v0.13.1-patch.1

Submission Checks

• I have confirmed there are no similar issues
• I have thoroughly read the docs at https://docs.newapi.ai/ and the project README, and confirmed the current version cannot meet my needs
• I have not removed any guidance or section headings from this template and will complete it as requested
• I understand that maintainers have limited time and issues that do not follow this template may be ignored or closed directly

Feature Description

通用 OAuth Provider (oauth/generic.go) 的 GenericOAuthProvider.ExchangeToken() 方法 (generic.go:98-116) 仅实现标准 OAuth 2.0 授权码流程，未支持 PKCE (RFC 7636)。

通过 DeepWiki 分析确认：当前实现在授权请求期间既不生成也不存储 code_verifier，也不在令牌交换请求中包含 PKCE 参数。

建议改动：

• 前端 (web/src/helpers/api.js:328-368)：OAuth 发起时生成随机 code_verifier，使用 SHA256 生成 code_challenge，存储 verifier 到 sessionStorage，授权请求带上 code_challenge 和 code_challenge_method=S256
• 后端 (controller/custom_oauth.go + oauth/generic.go)：自定义 OAuth Provider 配置增加"启用 PKCE"开关（默认关闭，向后兼容），启用后 token 交换请求带上 code_verifier 参数

Use Case

以下平台 OAuth 2.0 强制要求 PKCE，当前 new-api 完全无法对接：

• X (Twitter)：官方文档 明确说明 "We only provide authorization code with PKCE and refresh token"
• Apple Sign In：强制 PKCE
• TikTok：强制 PKCE
• Twitch：推荐 PKCE，且其错误响应格式不符合 OAuth 2.0 标准导致 ExchangeToken 解析失败

复现：配置 X OAuth 2.0（Authorization Endpoint: https://twitter.com/i/oauth2/authorize，Token Endpoint: https://api.twitter.com/2/oauth2/token），授权时 X 直接返回 "出错了，你无法获得该应用的访问权限"。

Start by reading oauth/generic.go:98-116, then inspect web/src/helpers/api.js:328-368 and controller/custom_oauth.go to trace the authorization and token-exchange flow. The work is done when the custom provider can optionally complete the PKCE flow for X and similar providers while the default behavior remains backward compatible; verify the X OAuth reproduction described in the issue.