refactor(api): split Provider into ProviderGroup and APIKey models

Restructure the provider management system by separating the monolithic
Provider model into two distinct entities:

- ProviderGroup: defines shared upstream configuration (type, base_url,
  google settings, models, status)
- APIKey: represents individual credentials within a group (api_key,
  weight, status, auto_ban, ban settings)

This change also updates:
- Binding model to reference GroupID instead of RouteGroup string
- All CRUD handlers for the new provider-group and api-key endpoints
- Sync service to rebuild provider snapshots from joined tables
- Model registry to aggregate capabilities across group/key pairs
- Access handler to validate namespace existence and subset constraints
- Migration importer to handle the new schema structure
- All related tests to use the new model relationships

BREAKING CHANGE: Provider API endpoints replaced with /provider-groups
and /api-keys endpoints; Binding.RouteGroup replaced with Binding.GroupID

internal/model/models.go

@@ -1,10 +1,6 @@
 package model
 
-import (
-	"time"
-
-	"gorm.io/gorm"
-)
+import "gorm.io/gorm"
 
 // Admin is not a database model. It's configured via environment variables.
 
@@ -50,24 +46,6 @@ type Key struct {
 	QuotaResetType     string     `gorm:"size:20" json:"quota_reset_type"`
 }
 
-// Provider remains the same.
-type Provider struct {
-	gorm.Model
-	Name           string     `gorm:"not null" json:"name"`
-	Type           string     `gorm:"not null" json:"type"` // openai, anthropic, etc.
-	BaseURL        string     `json:"base_url"`
-	APIKey         string     `json:"api_key"`
-	GoogleProject  string     `gorm:"size:128" json:"google_project,omitempty"`
-	GoogleLocation string     `gorm:"size:64" json:"google_location,omitempty"`
-	Group          string     `gorm:"default:'default'" json:"group"`         // routing group/tier
-	Models         string     `json:"models"`                                 // comma-separated list of supported models (e.g. "gpt-4,gpt-3.5-turbo")
-	Weight         int        `gorm:"default:1" json:"weight"`                // routing weight inside route_group
-	Status         string     `gorm:"size:50;default:'active'" json:"status"` // active, auto_disabled, manual_disabled
-	AutoBan        bool       `gorm:"default:true" json:"auto_ban"`           // whether DP-triggered disable is allowed
-	BanReason      string     `gorm:"size:255" json:"ban_reason"`             // reason for current disable
-	BanUntil       *time.Time `json:"ban_until"`                              // optional TTL for disable
-}
-
 // Model remains the same.
 type Model struct {
 	gorm.Model
@@ -82,13 +60,13 @@ type Model struct {
 	MaxOutputTokens    int     `json:"max_output_tokens"`
 }
 
-// Binding defines a stable "namespace.public_model" routing key and its target RouteGroup + selector.
-// RouteGroup currently reuses Provider.Group.
+// Binding defines a stable "namespace.public_model" routing key and its target ProviderGroup + selector.
 type Binding struct {
 	gorm.Model
 	Namespace     string `gorm:"size:100;not null;index:idx_binding_key,unique" json:"namespace"`
 	PublicModel   string `gorm:"size:255;not null;index:idx_binding_key,unique" json:"public_model"`
-	RouteGroup    string `gorm:"size:100;not null" json:"route_group"`
+	GroupID       uint   `gorm:"not null;index:idx_binding_key,unique" json:"group_id"`
+	Weight        int    `gorm:"default:1" json:"weight"`
 	SelectorType  string `gorm:"size:50;default:'exact'" json:"selector_type"`
 	SelectorValue string `gorm:"size:255" json:"selector_value"`
 	Status        string `gorm:"size:50;default:'active'" json:"status"`

internal/model/provider_group.go

@@ -0,0 +1,31 @@
+package model
+
+import (
+	"time"
+
+	"gorm.io/gorm"
+)
+
+// ProviderGroup represents a shared upstream definition.
+type ProviderGroup struct {
+	gorm.Model
+	Name           string `gorm:"size:255;uniqueIndex;not null" json:"name"`
+	Type           string `gorm:"size:50;not null" json:"type"` // openai, anthropic, gemini
+	BaseURL        string `gorm:"size:512;not null" json:"base_url"`
+	GoogleProject  string `gorm:"size:128" json:"google_project,omitempty"`
+	GoogleLocation string `gorm:"size:64" json:"google_location,omitempty"`
+	Models         string `json:"models"` // comma-separated list of supported models
+	Status         string `gorm:"size:50;default:'active'" json:"status"`
+}
+
+// APIKey represents a credential within a provider group.
+type APIKey struct {
+	gorm.Model
+	GroupID   uint       `gorm:"not null;index" json:"group_id"`
+	APIKey    string     `gorm:"not null" json:"api_key"`
+	Weight    int        `gorm:"default:1" json:"weight"`
+	Status    string     `gorm:"size:50;default:'active'" json:"status"`
+	AutoBan   bool       `gorm:"default:true" json:"auto_ban"`
+	BanReason string     `gorm:"size:255" json:"ban_reason"`
+	BanUntil  *time.Time `json:"ban_until"`
+}