fix(admin): 修复 Key 自动获取模型时 allowed_models 同步逻辑

- 关闭自动获取上游模型时清空 allowed_models
- 开启自动获取上游模型时立即拉取并覆盖 allowed_models
- 增加模型覆盖提示并补充相关回归测试

apps/aether-gateway/src/handlers/admin/provider/endpoint_keys/mutations/update.rs

@@ -1,7 +1,7 @@
 use crate::handlers::admin::provider::shared::paths::admin_update_key_id;
 use crate::handlers::admin::provider::shared::payloads::AdminProviderKeyUpdatePatch;
 use crate::handlers::admin::request::{AdminAppState, AdminRequestContext};
-use crate::GatewayError;
+use crate::{model_fetch::perform_model_fetch_for_key, GatewayError};
 use axum::{
     body::{Body, Bytes},
     http,
@@ -81,6 +81,33 @@ pub(super) async fn maybe_handle(
     let Some(updated) = state.update_provider_catalog_key(&updated_record).await? else {
         return Ok(None);
     };
+    let should_overwrite_allowed_models_immediately =
+        !existing_key.auto_fetch_models && updated.auto_fetch_models;
+    let updated = if should_overwrite_allowed_models_immediately {
+        let summary =
+            perform_model_fetch_for_key(state.as_ref(), &provider.id, &updated.id).await?;
+        if summary.succeeded == 0 {
+            let detail = state
+                .read_provider_catalog_keys_by_ids(std::slice::from_ref(&key_id))
+                .await?
+                .into_iter()
+                .next()
+                .and_then(|key| key.last_models_fetch_error)
+                .unwrap_or_else(|| "未获取到可用上游模型".to_string());
+            return Err(GatewayError::Internal(format!(
+                "开启自动获取模型后同步上游模型失败: {detail}"
+            )));
+        }
+
+        state
+            .read_provider_catalog_keys_by_ids(std::slice::from_ref(&key_id))
+            .await?
+            .into_iter()
+            .next()
+            .unwrap_or(updated)
+    } else {
+        updated
+    };
     let now_unix_secs = SystemTime::now()
         .duration_since(UNIX_EPOCH)
         .ok()

apps/aether-gateway/src/handlers/admin/provider/write/keys/update.rs

@@ -22,6 +22,8 @@ pub(crate) async fn build_admin_update_provider_key_record(
     let state = state.as_ref();
     let mut updated = existing.clone();
     let (fields, payload) = patch.into_parts();
+    let auto_fetch_disabled =
+        existing.auto_fetch_models && matches!(payload.auto_fetch_models, Some(false));
     let current_auth_type = normalize_auth_type(Some(&existing.auth_type))?;
     let target_auth_type = payload
         .auth_type
@@ -245,6 +247,9 @@ pub(crate) async fn build_admin_update_provider_key_record(
     if let Some(auto_fetch_models) = payload.auto_fetch_models {
         updated.auto_fetch_models = auto_fetch_models;
     }
+    if auto_fetch_disabled {
+        updated.allowed_models = None;
+    }
     if fields.contains("locked_models") {
         updated.locked_models =
             normalize_string_list(payload.locked_models).map(|value| json!(value));