refactor(api): split Provider into ProviderGroup and APIKey models

Restructure the provider management system by separating the monolithic
Provider model into two distinct entities:

- ProviderGroup: defines shared upstream configuration (type, base_url,
  google settings, models, status)
- APIKey: represents individual credentials within a group (api_key,
  weight, status, auto_ban, ban settings)

This change also updates:
- Binding model to reference GroupID instead of RouteGroup string
- All CRUD handlers for the new provider-group and api-key endpoints
- Sync service to rebuild provider snapshots from joined tables
- Model registry to aggregate capabilities across group/key pairs
- Access handler to validate namespace existence and subset constraints
- Migration importer to handle the new schema structure
- All related tests to use the new model relationships

BREAKING CHANGE: Provider API endpoints replaced with /provider-groups
and /api-keys endpoints; Binding.RouteGroup replaced with Binding.GroupID

internal/service/sync_test.go

@@ -2,68 +2,76 @@ package service
 
 import (
 	"encoding/json"
-	"reflect"
+	"strconv"
 	"testing"
 
 	"github.com/alicebob/miniredis/v2"
 	"github.com/ez-api/ez-api/internal/model"
-	"github.com/ez-api/foundation/contract"
 	"github.com/redis/go-redis/v9"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
 )
 
-func TestSyncProvider_WritesSnapshotAndRouting(t *testing.T) {
-	goldenRaw := contract.ProviderSnapshotJSON()
-	var golden map[string]any
-	if err := json.Unmarshal(goldenRaw, &golden); err != nil {
-		t.Fatalf("parse golden json: %v", err)
-	}
-
+func TestSyncProviders_WritesSnapshotAndRouting(t *testing.T) {
 	mr := miniredis.RunT(t)
 	rdb := redis.NewClient(&redis.Options{Addr: mr.Addr()})
-
 	svc := NewSyncService(rdb)
 
-	p := &model.Provider{
-		Name:           "p1",
+	db, err := gorm.Open(sqlite.Open("file:"+t.Name()+"?mode=memory&cache=shared"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	if err := db.AutoMigrate(&model.ProviderGroup{}, &model.APIKey{}); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+
+	group := model.ProviderGroup{
+		Name:           "default",
 		Type:           "vertex-express",
-		Group:          "default",
+		BaseURL:        "https://vertex.example",
+		GoogleLocation: "global",
 		Models:         "gemini-3-pro-preview",
 		Status:         "active",
-		AutoBan:        true,
-		GoogleProject:  "",
-		GoogleLocation: "global",
 	}
-	p.ID = 42
-
-	if err := svc.SyncProvider(p); err != nil {
-		t.Fatalf("SyncProvider: %v", err)
+	if err := db.Create(&group).Error; err != nil {
+		t.Fatalf("create group: %v", err)
+	}
+	key := model.APIKey{
+		GroupID: group.ID,
+		APIKey:  "k",
+		Status:  "active",
+		AutoBan: true,
+	}
+	if err := db.Create(&key).Error; err != nil {
+		t.Fatalf("create key: %v", err)
 	}
 
-	raw := mr.HGet("config:providers", "42")
+	if err := svc.SyncProviders(db); err != nil {
+		t.Fatalf("SyncProviders: %v", err)
+	}
+
+	raw := mr.HGet("config:providers", jsonID(key.ID))
 	if raw == "" {
 		t.Fatalf("expected config:providers hash entry")
 	}
-
 	var snap map[string]any
 	if err := json.Unmarshal([]byte(raw), &snap); err != nil {
 		t.Fatalf("invalid snapshot json: %v", err)
 	}
-	for k, v := range golden {
-		if !reflect.DeepEqual(snap[k], v) {
-			t.Fatalf("snapshot mismatch for %q: got=%#v want=%#v", k, snap[k], v)
-		}
+	if snap["group"] != "default" {
+		t.Fatalf("expected group default, got %#v", snap["group"])
 	}
 
 	routeKey := "route:group:default:gemini-3-pro-preview"
 	if !mr.Exists(routeKey) {
 		t.Fatalf("expected routing key %q to exist", routeKey)
 	}
-	ok, err := mr.SIsMember(routeKey, "42")
+	ok, err := mr.SIsMember(routeKey, jsonID(key.ID))
 	if err != nil {
 		t.Fatalf("SIsMember: %v", err)
 	}
 	if !ok {
-		t.Fatalf("expected provider id 42 in routing set %q", routeKey)
+		t.Fatalf("expected provider id in routing set %q", routeKey)
 	}
 }
 
@@ -113,34 +121,6 @@ func TestSyncModelDelete_RemovesMeta(t *testing.T) {
 	}
 }
 
-func TestSyncProviderDelete_RemovesSnapshotAndRouting(t *testing.T) {
-	mr := miniredis.RunT(t)
-	rdb := redis.NewClient(&redis.Options{Addr: mr.Addr()})
-	svc := NewSyncService(rdb)
-
-	p := &model.Provider{
-		Name:   "p1",
-		Type:   "openai",
-		Group:  "default",
-		Models: "gpt-4o-mini,gpt-4o",
-		Status: "active",
-	}
-	p.ID = 7
-
-	if err := svc.SyncProvider(p); err != nil {
-		t.Fatalf("SyncProvider: %v", err)
-	}
-	if err := svc.SyncProviderDelete(p); err != nil {
-		t.Fatalf("SyncProviderDelete: %v", err)
-	}
-
-	if got := mr.HGet("config:providers", "7"); got != "" {
-		t.Fatalf("expected provider snapshot removed, got %q", got)
-	}
-	if ok, _ := mr.SIsMember("route:group:default:gpt-4o-mini", "7"); ok {
-		t.Fatalf("expected provider removed from route set")
-	}
-	if ok, _ := mr.SIsMember("route:group:default:gpt-4o", "7"); ok {
-		t.Fatalf("expected provider removed from route set")
-	}
+func jsonID(id uint) string {
+	return strconv.FormatUint(uint64(id), 10)
 }