feat: 动态 block 索引分配、OAuth 自动启停联动与 Antigravity 签名注入增强

- Gemini/OpenAI normalizer 改为按实际出现顺序延迟分配 thinking/text block 索引
- OAuth 失效标记时自动停用 Key，清除/刷新成功时自动启用
- Antigravity thought signature 注入支持 tool-specific 签名优先，再回退 session 级签名
- Claude normalizer 对非字符串 thinking block 降级为 UnknownBlock
- Gemini normalizer 反序列化时为 Antigravity 目标补充 signature
- signature_cache _prune 增加超限驱逐
- model/provider 包 __init__ 改为惰性导入避免循环依赖
- build_antigravity_url 复制 query_params 防止修改调用方原始字典
- upstream_fetcher build_all_format_configs 兼容非 EndpointFetchConfig 对象
- Antigravity HTTP 状态判定扩展与 Gemini endpoint check 支持 v1internal
- 新增 thought signature 注入与 signature cache 驱逐测试

Closes #165

Co-authored-by: AAEE86 <ppk0227@hotmail.com>

src/api/admin/endpoints/keys.py

@@ -199,11 +199,12 @@ async def clear_oauth_invalid(
     old_reason = key.oauth_invalid_reason
     key.oauth_invalid_at = None
     key.oauth_invalid_reason = None
+    key.is_active = True
     db.commit()
 
-    logger.info("[OK] 手动清除 Key {}... 的 OAuth 失效标记 (原因: {})", key_id[:8], old_reason)
+    logger.info("[OK] 手动清除 Key {}... 的 OAuth 失效标记并自动启用 (原因: {})", key_id[:8], old_reason)
 
-    return {"message": "已清除 OAuth 失效标记"}
+    return {"message": "已清除 OAuth 失效标记，Key 已自动启用"}
 
 
 # ========== Provider Keys API ==========
@@ -1575,8 +1576,9 @@ class AdminRefreshProviderQuotaAdapter(AdminApiAdapter):
                         if "401" in error_msg or "认证失败" in error_msg:
                             key.oauth_invalid_at = datetime.now(timezone.utc)
                             key.oauth_invalid_reason = "Kiro Token 无效或已过期"
+                            key.is_active = False
                             db.commit()
-                            logger.warning("[KIRO_QUOTA] Key {} Token 无效，已标记为异常", key.id)
+                            logger.warning("[KIRO_QUOTA] Key {} Token 无效，已标记为异常并自动停用", key.id)
                         return {
                             "key_id": key.id,
                             "key_name": key.name,

src/api/admin/provider_oauth.py

@@ -690,8 +690,9 @@ async def refresh_oauth(
             # 标记为失效
             key.oauth_invalid_at = datetime.now(timezone.utc)
             key.oauth_invalid_reason = str(e)
+            key.is_active = False
             db.commit()
-            logger.warning("Kiro Key {} token 刷新失败，已标记为失效: {}", key_id, e)
+            logger.warning("Kiro Key {} token 刷新失败，已标记为失效并自动停用: {}", key_id, e)
             raise InvalidRequestException("Kiro token refresh 失败，请检查凭据是否有效")
 
         # 更新 key
@@ -699,6 +700,7 @@ async def refresh_oauth(
         key.auth_config = crypto_service.encrypt(json.dumps(new_cfg.to_dict()))
         key.oauth_invalid_at = None
         key.oauth_invalid_reason = None
+        key.is_active = True
         db.commit()
 
         return CompleteOAuthResponse(
@@ -787,8 +789,9 @@ async def refresh_oauth(
 
             key.oauth_invalid_at = datetime.now(timezone.utc)
             key.oauth_invalid_reason = error_reason
+            key.is_active = False
             db.commit()
-            logger.warning("Key {} OAuth token 刷新失败，已标记为失效: {}", key_id, error_reason)
+            logger.warning("Key {} OAuth token 刷新失败，已标记为失效并自动停用: {}", key_id, error_reason)
 
         raise InvalidRequestException(f"token refresh 失败: {error_reason}")
 
@@ -841,6 +844,7 @@ async def refresh_oauth(
     if not is_account_level_block(getattr(key, "oauth_invalid_reason", None)):
         key.oauth_invalid_at = None
         key.oauth_invalid_reason = None
+        key.is_active = True
     db.commit()
 
     return CompleteOAuthResponse(

src/api/admin/provider_query.py

@@ -886,6 +886,7 @@ async def test_model(
                         api_key.oauth_invalid_reason = (
                             f"{OAUTH_ACCOUNT_BLOCK_PREFIX}Google 要求验证账号"
                         )
+                        api_key.is_active = False
                         db.commit()
                         oauth_email = None
                         if getattr(api_key, "auth_config", None):