refactor(cost,perf): 成本字段 Float 改 Numeric 并优化多处查询性能

- 数据库所有 cost/price 字段从 Float 改为 Numeric(20,8)，解决浮点精度问题
- API 响应中 Decimal 值统一用 float() 转换确保 JSON 序列化
- 路由中手动 commit 后标记 tx_committed_by_route 防止中间件重复提交
- 多处查询优化：SQL 聚合替代 Python 遍历、load_only/defer 减少字段加载、
  批量 DELETE 替代逐条 ORM 删除、N+1 查询消除、UNION ALL 合并多表日期查询
- 新增 provider_api_keys (provider_id, is_active) 复合索引
- 候选构建热路径 defer 冷字段，钱包扣费合并解析与加锁查询

src/api/auth/routes.py

@@ -287,6 +287,7 @@ class AuthLoginAdapter(AuthPublicAdapter):
                 error_reason="邮箱或密码错误",
             )
             db.commit()
+            context.request.state.tx_committed_by_route = True
             raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="邮箱或密码错误")
 
         AuditService.log_login_attempt(
@@ -298,6 +299,7 @@ class AuthLoginAdapter(AuthPublicAdapter):
             user_id=user.id,
         )
         db.commit()
+        context.request.state.tx_committed_by_route = True
 
         access_token = AuthService.create_access_token(
             data={
@@ -472,6 +474,7 @@ class AuthRegisterAdapter(AuthPublicAdapter):
                 metadata={"username": register_request.username, "reason": "registration_disabled"},
             )
             db.commit()
+            context.request.state.tx_committed_by_route = True
             raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="系统暂不开放注册")
 
         email = register_request.email
@@ -514,6 +517,7 @@ class AuthRegisterAdapter(AuthPublicAdapter):
                     metadata={"email": email, "reason": "email_suffix_not_allowed"},
                 )
                 db.commit()
+                context.request.state.tx_committed_by_route = True
                 raise HTTPException(
                     status_code=status.HTTP_400_BAD_REQUEST,
                     detail=suffix_error,
@@ -550,6 +554,7 @@ class AuthRegisterAdapter(AuthPublicAdapter):
             )
 
             db.commit()
+            context.request.state.tx_committed_by_route = True
 
             # 注册成功后清除验证状态（在 commit 后清理，即使清理失败也不影响注册结果）
             if require_verification and email:
@@ -565,6 +570,7 @@ class AuthRegisterAdapter(AuthPublicAdapter):
                 message="注册成功",
             ).model_dump()
         except ValueError as exc:
+            db.rollback()
             AuditService.log_event(
                 db=db,
                 event_type=AuditEventType.UNAUTHORIZED_ACCESS,
@@ -574,6 +580,7 @@ class AuthRegisterAdapter(AuthPublicAdapter):
                 metadata={"username": register_request.username, "error": str(exc)},
             )
             db.commit()
+            context.request.state.tx_committed_by_route = True
             raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(exc))
 
 
@@ -611,6 +618,7 @@ class AuthChangePasswordAdapter(AuthenticatedApiAdapter):
             raise InvalidRequestException("密码长度至少6位")
         user.set_password(new_password)
         context.db.commit()
+        context.request.state.tx_committed_by_route = True
         logger.info(f"用户修改密码: {user.email}")
         return {"message": "密码修改成功"}
 
@@ -643,6 +651,7 @@ class AuthLogoutAdapter(AuthenticatedApiAdapter):
                 metadata={"user_id": user.id, "email": user.email},
             )
             context.db.commit()
+            context.request.state.tx_committed_by_route = True
 
             logger.info(f"用户登出成功: {user.email}")