feat(core): implement namespace support and routing bindings

Introduce namespace-aware routing capabilities through a new Binding
model and updates to Master/Key entities.

- Add Binding model for configuring model routes per namespace
- Add DefaultNamespace and Namespaces fields to Master and Key models
- Update auto-migration to include Binding table
- Implement Redis synchronization for binding configurations
- Propagate namespace settings during master creation and key issuance

internal/service/sync.go

@@ -39,6 +39,8 @@ func (s *SyncService) SyncKey(key *model.Key) error {
 		"status":          key.Status,
 		"group":           key.Group,
 		"scopes":          key.Scopes,
+		"default_namespace": key.DefaultNamespace,
+		"namespaces":        key.Namespaces,
 	}
 	if err := s.rdb.HSet(ctx, fmt.Sprintf("auth:token:%s", tokenHash), fields).Err(); err != nil {
 		return fmt.Errorf("write auth token: %w", err)
@@ -179,8 +181,13 @@ func (s *SyncService) SyncAll(db *gorm.DB) error {
 		return fmt.Errorf("load models: %w", err)
 	}
 
+	var bindings []model.Binding
+	if err := db.Find(&bindings).Error; err != nil {
+		return fmt.Errorf("load bindings: %w", err)
+	}
+
 	pipe := s.rdb.TxPipeline()
-	pipe.Del(ctx, "config:providers", "config:keys", "meta:models")
+	pipe.Del(ctx, "config:providers", "config:keys", "meta:models", "config:bindings", "meta:bindings_meta")
 	// Also clear master keys
 	var masterKeys []string
 	iter := s.rdb.Scan(ctx, 0, "auth:master:*", 0).Iterator()
@@ -256,6 +263,8 @@ func (s *SyncService) SyncAll(db *gorm.DB) error {
 			"status":          k.Status,
 			"group":           k.Group,
 			"scopes":          k.Scopes,
+			"default_namespace": k.DefaultNamespace,
+			"namespaces":        k.Namespaces,
 		})
 	}
 
@@ -285,6 +294,10 @@ func (s *SyncService) SyncAll(db *gorm.DB) error {
 		pipe.HSet(ctx, "meta:models", snap.Name, payload)
 	}
 
+	if err := s.writeBindingsSnapshot(ctx, pipe, bindings, providers); err != nil {
+		return err
+	}
+
 	if _, err := pipe.Exec(ctx); err != nil {
 		return fmt.Errorf("write snapshots: %w", err)
 	}
@@ -292,6 +305,124 @@ func (s *SyncService) SyncAll(db *gorm.DB) error {
 	return nil
 }
 
+// SyncBindings rebuilds the binding snapshot for DP routing.
+// This is intentionally a rebuild to avoid stale entries on deletes/updates.
+func (s *SyncService) SyncBindings(db *gorm.DB) error {
+	ctx := context.Background()
+
+	var providers []model.Provider
+	if err := db.Find(&providers).Error; err != nil {
+		return fmt.Errorf("load providers: %w", err)
+	}
+	var bindings []model.Binding
+	if err := db.Find(&bindings).Error; err != nil {
+		return fmt.Errorf("load bindings: %w", err)
+	}
+
+	pipe := s.rdb.TxPipeline()
+	pipe.Del(ctx, "config:bindings", "meta:bindings_meta")
+	if err := s.writeBindingsSnapshot(ctx, pipe, bindings, providers); err != nil {
+		return err
+	}
+	if _, err := pipe.Exec(ctx); err != nil {
+		return fmt.Errorf("write bindings snapshot: %w", err)
+	}
+	return nil
+}
+
+func (s *SyncService) writeBindingsSnapshot(ctx context.Context, pipe redis.Pipeliner, bindings []model.Binding, providers []model.Provider) error {
+	// Group providers by route group for selector resolution.
+	type providerLite struct {
+		id     uint
+		group  string
+		models []string
+	}
+	providersByGroup := make(map[string][]providerLite)
+	for _, p := range providers {
+		group := groupx.Normalize(p.Group)
+		models := strings.Split(p.Models, ",")
+		var outModels []string
+		for _, m := range models {
+			m = strings.TrimSpace(m)
+			if m != "" {
+				outModels = append(outModels, m)
+			}
+		}
+		providersByGroup[group] = append(providersByGroup[group], providerLite{
+			id:     p.ID,
+			group:  group,
+			models: outModels,
+		})
+	}
+
+	now := time.Now().Unix()
+	for _, b := range bindings {
+		if strings.TrimSpace(b.Status) != "" && strings.TrimSpace(b.Status) != "active" {
+			continue
+		}
+		ns := strings.TrimSpace(b.Namespace)
+		pm := strings.TrimSpace(b.PublicModel)
+		if ns == "" || pm == "" {
+			continue
+		}
+		rg := groupx.Normalize(b.RouteGroup)
+		if rg == "" {
+			continue
+		}
+
+		snap := struct {
+			Namespace     string            `json:"namespace"`
+			PublicModel   string            `json:"public_model"`
+			RouteGroup    string            `json:"route_group"`
+			SelectorType  string            `json:"selector_type,omitempty"`
+			SelectorValue string            `json:"selector_value,omitempty"`
+			Status        string            `json:"status,omitempty"`
+			UpdatedAt     int64             `json:"updated_at,omitempty"`
+			Upstreams     map[string]string `json:"upstreams"`
+		}{
+			Namespace:     ns,
+			PublicModel:   pm,
+			RouteGroup:    rg,
+			SelectorType:  strings.TrimSpace(b.SelectorType),
+			SelectorValue: strings.TrimSpace(b.SelectorValue),
+			Status:        "active",
+			UpdatedAt:     now,
+			Upstreams:     make(map[string]string),
+		}
+
+		selectorType := strings.TrimSpace(b.SelectorType)
+		selectorValue := strings.TrimSpace(b.SelectorValue)
+
+		for _, p := range providersByGroup[rg] {
+			up, err := routing.ResolveUpstreamModel(routing.SelectorType(selectorType), selectorValue, pm, p.models)
+			if err != nil {
+				continue
+			}
+			snap.Upstreams[fmt.Sprintf("%d", p.id)] = up
+		}
+
+		// Only write bindings that have at least one usable upstream mapping.
+		if len(snap.Upstreams) == 0 {
+			continue
+		}
+
+		key := ns + "." + pm
+		if err := s.hsetJSON(ctx, "config:bindings", key, snap); err != nil {
+			return err
+		}
+	}
+
+	meta := map[string]string{
+		"version":    fmt.Sprintf("%d", now),
+		"updated_at": fmt.Sprintf("%d", now),
+		"source":     "cp_builtin",
+	}
+	if err := pipe.HSet(ctx, "meta:bindings_meta", meta).Err(); err != nil {
+		return fmt.Errorf("write meta:bindings_meta: %w", err)
+	}
+	return nil
+}
+
 func (s *SyncService) hsetJSON(ctx context.Context, key, field string, val interface{}) error {
 	payload, err := jsoncodec.Marshal(val)
 	if err != nil {