refactor(api): split Provider into ProviderGroup and APIKey models

Restructure the provider management system by separating the monolithic
Provider model into two distinct entities:

- ProviderGroup: defines shared upstream configuration (type, base_url,
  google settings, models, status)
- APIKey: represents individual credentials within a group (api_key,
  weight, status, auto_ban, ban settings)

This change also updates:
- Binding model to reference GroupID instead of RouteGroup string
- All CRUD handlers for the new provider-group and api-key endpoints
- Sync service to rebuild provider snapshots from joined tables
- Model registry to aggregate capabilities across group/key pairs
- Access handler to validate namespace existence and subset constraints
- Migration importer to handle the new schema structure
- All related tests to use the new model relationships

BREAKING CHANGE: Provider API endpoints replaced with /provider-groups
and /api-keys endpoints; Binding.RouteGroup replaced with Binding.GroupID

internal/dto/binding.go

@@ -1,11 +1,12 @@
 package dto
 
 // BindingDTO defines inbound payload for binding creation/update.
-// It maps "(namespace, public_model)" to a RouteGroup and an upstream selector.
+// It maps "(namespace, public_model)" to a ProviderGroup and an upstream selector.
 type BindingDTO struct {
 	Namespace     string `json:"namespace"`
 	PublicModel   string `json:"public_model"`
-	RouteGroup    string `json:"route_group"`
+	GroupID       uint   `json:"group_id"`
+	Weight        int    `json:"weight"`
 	SelectorType  string `json:"selector_type"`
 	SelectorValue string `json:"selector_value"`
 	Status        string `json:"status"`