feat: complete device onboarding and mobile binding workflows

internal/httpapi/saas_handlers.go

@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"data-terminal-cloud/internal/concurrency"
+	"data-terminal-cloud/internal/devicebinding"
 	"data-terminal-cloud/internal/identity"
 	"data-terminal-cloud/internal/pagination"
 	"data-terminal-cloud/internal/saas"
@@ -1882,6 +1883,8 @@ func writeETagError(writer http.ResponseWriter, request *http.Request, err error
 
 func writeSaaSError(writer http.ResponseWriter, request *http.Request, err error) {
 	switch {
+	case errors.Is(err, devicebinding.ErrConfirmationRequired):
+		WriteError(writer, request, http.StatusConflict, "DEVICE_CONFIRMATION_REQUIRED", "请先授权解绑，再从设备设置入口申请并按键确认绑定")
 	case errors.Is(err, saas.ErrAccessDenied):
 		WriteError(writer, request, http.StatusForbidden, "RESOURCE_ACCESS_DENIED", "当前账号无权访问该资源")
 	case errors.Is(err, saas.ErrNotFound):