refactor(api): split Provider into ProviderGroup and APIKey models

Restructure the provider management system by separating the monolithic
Provider model into two distinct entities:

- ProviderGroup: defines shared upstream configuration (type, base_url,
  google settings, models, status)
- APIKey: represents individual credentials within a group (api_key,
  weight, status, auto_ban, ban settings)

This change also updates:
- Binding model to reference GroupID instead of RouteGroup string
- All CRUD handlers for the new provider-group and api-key endpoints
- Sync service to rebuild provider snapshots from joined tables
- Model registry to aggregate capabilities across group/key pairs
- Access handler to validate namespace existence and subset constraints
- Migration importer to handle the new schema structure
- All related tests to use the new model relationships

BREAKING CHANGE: Provider API endpoints replaced with /provider-groups
and /api-keys endpoints; Binding.RouteGroup replaced with Binding.GroupID

internal/dto/api_key.go

@@ -0,0 +1,14 @@
+package dto
+
+import "time"
+
+// APIKeyDTO defines inbound payload for API key creation/update.
+type APIKeyDTO struct {
+	GroupID   uint      `json:"group_id"`
+	APIKey    string    `json:"api_key"`
+	Weight    int       `json:"weight,omitempty"`
+	Status    string    `json:"status"`
+	AutoBan   *bool     `json:"auto_ban,omitempty"`
+	BanReason string    `json:"ban_reason,omitempty"`
+	BanUntil  time.Time `json:"ban_until,omitempty"`
+}