refactor(api): split Provider into ProviderGroup and APIKey models

Restructure the provider management system by separating the monolithic
Provider model into two distinct entities:

- ProviderGroup: defines shared upstream configuration (type, base_url,
  google settings, models, status)
- APIKey: represents individual credentials within a group (api_key,
  weight, status, auto_ban, ban settings)

This change also updates:
- Binding model to reference GroupID instead of RouteGroup string
- All CRUD handlers for the new provider-group and api-key endpoints
- Sync service to rebuild provider snapshots from joined tables
- Model registry to aggregate capabilities across group/key pairs
- Access handler to validate namespace existence and subset constraints
- Migration importer to handle the new schema structure
- All related tests to use the new model relationships

BREAKING CHANGE: Provider API endpoints replaced with /provider-groups
and /api-keys endpoints; Binding.RouteGroup replaced with Binding.GroupID

internal/dto/provider_group.go

@@ -0,0 +1,12 @@
+package dto
+
+// ProviderGroupDTO defines inbound payload for provider group creation/update.
+type ProviderGroupDTO struct {
+	Name           string   `json:"name"`
+	Type           string   `json:"type"`
+	BaseURL        string   `json:"base_url"`
+	GoogleProject  string   `json:"google_project,omitempty"`
+	GoogleLocation string   `json:"google_location,omitempty"`
+	Models         []string `json:"models"`
+	Status         string   `json:"status"`
+}