feat(core): implement sync outbox mechanism and refactor provider validation

- Introduce `SyncOutboxService` and model to retry failed CP-to-Redis sync operations
- Update `SyncService` to handle sync failures by enqueuing tasks to the outbox
- Centralize provider group and API key validation logic into `ProviderGroupManager`
- Refactor API handlers to utilize the new manager and robust sync methods
- Add configuration options for sync outbox (interval, batch size, retries)

internal/service/provider_group_manager_test.go

@@ -0,0 +1,56 @@
+package service
+
+import (
+	"testing"
+
+	"github.com/ez-api/ez-api/internal/model"
+)
+
+func TestProviderGroupManager_NormalizeGroupDefaults(t *testing.T) {
+	mgr := NewProviderGroupManager()
+
+	group := model.ProviderGroup{
+		Name: "g1",
+		Type: "openai",
+	}
+	got, err := mgr.NormalizeGroup(group)
+	if err != nil {
+		t.Fatalf("NormalizeGroup: %v", err)
+	}
+	if got.BaseURL != "https://api.openai.com/v1" {
+		t.Fatalf("expected openai base_url default, got %q", got.BaseURL)
+	}
+
+	group = model.ProviderGroup{
+		Name: "g2",
+		Type: "vertex",
+	}
+	got, err = mgr.NormalizeGroup(group)
+	if err != nil {
+		t.Fatalf("NormalizeGroup vertex: %v", err)
+	}
+	if got.GoogleLocation == "" {
+		t.Fatalf("expected default google_location for vertex")
+	}
+}
+
+func TestProviderGroupManager_CompatibleRequiresBaseURL(t *testing.T) {
+	mgr := NewProviderGroupManager()
+
+	_, err := mgr.NormalizeGroup(model.ProviderGroup{Name: "g3", Type: "compatible"})
+	if err == nil {
+		t.Fatalf("expected error for compatible without base_url")
+	}
+}
+
+func TestProviderGroupManager_ValidateAPIKey(t *testing.T) {
+	mgr := NewProviderGroupManager()
+
+	group := model.ProviderGroup{Name: "g", Type: "gemini"}
+	if _, err := mgr.NormalizeGroup(group); err != nil {
+		t.Fatalf("NormalizeGroup gemini: %v", err)
+	}
+	if err := mgr.ValidateAPIKey(group, model.APIKey{}); err == nil {
+		t.Fatalf("expected api_key required for gemini")
+	}
+}