refactor(api): split Provider into ProviderGroup and APIKey models

Restructure the provider management system by separating the monolithic
Provider model into two distinct entities:

- ProviderGroup: defines shared upstream configuration (type, base_url,
  google settings, models, status)
- APIKey: represents individual credentials within a group (api_key,
  weight, status, auto_ban, ban settings)

This change also updates:
- Binding model to reference GroupID instead of RouteGroup string
- All CRUD handlers for the new provider-group and api-key endpoints
- Sync service to rebuild provider snapshots from joined tables
- Model registry to aggregate capabilities across group/key pairs
- Access handler to validate namespace existence and subset constraints
- Migration importer to handle the new schema structure
- All related tests to use the new model relationships

BREAKING CHANGE: Provider API endpoints replaced with /provider-groups
and /api-keys endpoints; Binding.RouteGroup replaced with Binding.GroupID

internal/api/namespace_handler_test.go

@@ -26,7 +26,7 @@ func newTestHandlerWithNamespace(t *testing.T) (*Handler, *gorm.DB, *miniredis.M
 	if err != nil {
 		t.Fatalf("open sqlite: %v", err)
 	}
-	if err := db.AutoMigrate(&model.Provider{}, &model.Binding{}, &model.Namespace{}); err != nil {
+	if err := db.AutoMigrate(&model.ProviderGroup{}, &model.APIKey{}, &model.Binding{}, &model.Namespace{}); err != nil {
 		t.Fatalf("migrate: %v", err)
 	}
 
@@ -39,10 +39,23 @@ func newTestHandlerWithNamespace(t *testing.T) (*Handler, *gorm.DB, *miniredis.M
 func TestNamespaceCRUD_DeleteCleansBindings(t *testing.T) {
 	h, db, _ := newTestHandlerWithNamespace(t)
 
+	group := model.ProviderGroup{Name: "g1", Type: "openai", BaseURL: "https://api.openai.com/v1", Models: "m1", Status: "active"}
+	if err := db.Create(&group).Error; err != nil {
+		t.Fatalf("create group: %v", err)
+	}
+	if err := db.Create(&model.APIKey{
+		GroupID: group.ID,
+		APIKey:  "k1",
+		Status:  "active",
+	}).Error; err != nil {
+		t.Fatalf("create api key: %v", err)
+	}
+
 	if err := db.Create(&model.Binding{
 		Namespace:     "ns1",
 		PublicModel:   "m1",
-		RouteGroup:    "default",
+		GroupID:       group.ID,
+		Weight:        1,
 		SelectorType:  "exact",
 		SelectorValue: "m1",
 		Status:        "active",