feat(admin): polish badge, OAuth and payment gateway settings UX

- Badge page: rewrite as collapsible sortable category/item cards with
  preset medal icon picker, dirty-tracked save bar and duplicate slug check;
  drop user_badge_* dual-read and legacy name/icon_url fallbacks
- OAuth: provider config groups collapsible, expanded when provider is on;
  clogin visibility moved to group-level dependsOn
- Gateway: expandWhen accepts dependsOn-style rules; select-gated groups no
  longer always expand ('null' was truthy); mark five gateway secrets as
  secret/password in JS and PHP; class-based notice list styling
- Remove unused UserRuntime::parse_badge_dictionary

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/Settings/UserRuntime.php

@@ -282,7 +282,7 @@ class UserRuntime {
             if (!is_array($cat)) {
                 continue;
             }
-            $cat_name = sanitize_text_field((string) ($cat['cat_name'] ?? $cat['name'] ?? ''));
+            $cat_name = sanitize_text_field((string) ($cat['cat_name'] ?? ''));
             if ($cat_name === '') {
                 $cat_name = __('未命名', 'aksrt');
             }
@@ -301,7 +301,7 @@ class UserRuntime {
                 if (!in_array($get_type, $allowed_types, true)) {
                     $get_type = 'manually_add';
                 }
-                $icon = esc_url_raw((string) ($item['icon'] ?? $item['icon_url'] ?? ''));
+                $icon = esc_url_raw((string) ($item['icon'] ?? ''));
                 $row  = [
                     'slug'     => $slug,
                     'name'     => $name,
@@ -358,14 +358,4 @@ class UserRuntime {
         ksort($thresholds, SORT_NUMERIC);
         return $thresholds;
     }
-
-    /**
-     * @deprecated Removed — medal catalog is structured user_medal_args. Method kept empty stub intentionally deleted.
-     * @return array<int,array{slug:string,label:string,tone:string,icon_url:string}>
-     */
-    public static function parse_badge_dictionary(string $raw): array {
-        // Rewrite policy: no dual-read of pipe dictionary. Callers must use parse_medal_catalog / get_user_identity_settings()['medal'].
-        unset($raw);
-        return [];
-    }
 }