feat: 统一 SSL 证书配置并支持用户创建时设置访问权限

- 新增 ssl_utils.py 模块，统一使用 certifi 证书
- 将所有 httpx 客户端的 verify 参数改为使用 get_ssl_context()
- 管理员创建用户时支持设置 allowed_providers/api_formats/models
- 修复 provider_ops 敏感字段列表缺失 session_cookie

src/api/public/system_catalog.py

@@ -20,6 +20,7 @@ from src.database.database import get_pool_status
 from src.models.database import Model, Provider
 from src.services.orchestration.fallback_orchestrator import FallbackOrchestrator
 from src.services.provider.transport import build_provider_url
+from src.utils.ssl_utils import get_ssl_context
 
 router = APIRouter(tags=["System Catalog"])
 
@@ -281,7 +282,7 @@ async def test_connection(
             is_stream=False,
         )
 
-        async with httpx.AsyncClient(timeout=30.0) as client:
+        async with httpx.AsyncClient(timeout=30.0, verify=get_ssl_context()) as client:
             resp = await client.post(url, json=provider_payload, headers=provider_headers)
             resp.raise_for_status()
             return resp.json()