fix(frontend): replace browser confirm dialogs with AlertDialog

统一删除、撤销与未保存离开等确认操作为 shadcn AlertDialog，避免
window.confirm/alert 打断界面风格；同步更新 WAF 编辑器相关单测与 changelog。

frontend/components/common/settings/security-tab.tsx

@@ -40,6 +40,16 @@ import {
   SelectTrigger,
   SelectValue,
 } from '@/components/ui/select';
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from '@/components/ui/alert-dialog';
 import { AuthSourceModal } from '@/components/common/settings/auth-source-modal';
 import services from '@/lib/services';
 import type { AuthSource, SystemConfig } from '@/lib/services/admin';
@@ -94,6 +104,7 @@ export function SecurityTab({ configs, systemConfigsQuery }: SecurityTabProps) {
   const queryClient = useQueryClient();
   const [authSourceModalOpen, setAuthSourceModalOpen] = useState(false);
   const [selectedSource, setSelectedSource] = useState<AuthSource | null>(null);
+  const [deleteTarget, setDeleteTarget] = useState<AuthSource | null>(null);
 
   const [capCount, setCapCount] = useState('');
   const [capDifficulty, setCapDifficulty] = useState('');
@@ -232,6 +243,7 @@ export function SecurityTab({ configs, systemConfigsQuery }: SecurityTabProps) {
       await services.adminAuthSource.deleteAuthSource(sourceId);
     },
     onSuccess: async () => {
+      setDeleteTarget(null);
       await queryClient.invalidateQueries({ queryKey: ['auth', 'sources'] });
       await queryClient.invalidateQueries({
         queryKey: ['auth', 'public-sources'],
@@ -486,15 +498,7 @@ export function SecurityTab({ configs, systemConfigsQuery }: SecurityTabProps) {
                       size='icon'
                       className='size-8 text-muted-foreground hover:text-rose-500 hover:bg-rose-500/10 rounded-lg transition-colors'
                       disabled={deleteSourceMutation.isPending}
-                      onClick={() => {
-                        if (
-                          window.confirm(
-                            `确定删除认证源「${source.display_name || source.name}」吗？`,
-                          )
-                        ) {
-                          deleteSourceMutation.mutate(source.id);
-                        }
-                      }}
+                      onClick={() => setDeleteTarget(source)}
                     >
                       <Trash2 className='size-4' />
                     </Button>
@@ -702,6 +706,35 @@ export function SecurityTab({ configs, systemConfigsQuery }: SecurityTabProps) {
           await authSourcesQuery.refetch();
         }}
       />
+
+      <AlertDialog
+        open={Boolean(deleteTarget)}
+        onOpenChange={(open) => !open && setDeleteTarget(null)}
+      >
+        <AlertDialogContent>
+          <AlertDialogHeader>
+            <AlertDialogTitle>确认删除认证源</AlertDialogTitle>
+            <AlertDialogDescription>
+              确定删除认证源「
+              {deleteTarget?.display_name || deleteTarget?.name}
+              」吗？删除后无法恢复。
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel disabled={deleteSourceMutation.isPending}>
+              取消
+            </AlertDialogCancel>
+            <AlertDialogAction
+              disabled={deleteSourceMutation.isPending}
+              onClick={() =>
+                deleteTarget && deleteSourceMutation.mutate(deleteTarget.id)
+              }
+            >
+              {deleteSourceMutation.isPending ? '删除中...' : '确认删除'}
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
     </div>
   );
 }