refactor(api): split Provider into ProviderGroup and APIKey models

Restructure the provider management system by separating the monolithic
Provider model into two distinct entities:

- ProviderGroup: defines shared upstream configuration (type, base_url,
  google settings, models, status)
- APIKey: represents individual credentials within a group (api_key,
  weight, status, auto_ban, ban settings)

This change also updates:
- Binding model to reference GroupID instead of RouteGroup string
- All CRUD handlers for the new provider-group and api-key endpoints
- Sync service to rebuild provider snapshots from joined tables
- Model registry to aggregate capabilities across group/key pairs
- Access handler to validate namespace existence and subset constraints
- Migration importer to handle the new schema structure
- All related tests to use the new model relationships

BREAKING CHANGE: Provider API endpoints replaced with /provider-groups
and /api-keys endpoints; Binding.RouteGroup replaced with Binding.GroupID

internal/migrate/schema.go

@@ -92,7 +92,7 @@ type Key struct {
 // Binding represents an EZ-API binding (optional, from abilities).
 type Binding struct {
 	Namespace  string `json:"namespace"`
-	RouteGroup string `json:"route_group"`
+	RouteGroup string `json:"route_group"` // provider group name
 	Model      string `json:"model"`
 	Status     string `json:"status"`
 }