fix(kiro,pool,model): 对齐 Kiro 管理链路并修复全局模型删除行为 (#305)

* feat(pool): 号池支持跳过额度耗尽账号

- 新增 pool_advanced.skip_exhausted_accounts 开关及高级设置 UI, 默认关闭并兼容旧配置
- 为 Codex/Kiro 增加额度耗尽判定, 接入请求侧候选跳过并新增 account_quota_exhausted skip reason
- 号池列表将额度耗尽账号标记为 blocked/额度耗尽, 并补充前后端相关测试

* fix(kiro): 对齐账号管理与 provider-query 的 Rust 行为

- 修复 Kiro 单条导入误走 import-refresh-token 的前端分流, 并为误用路径返回明确错误提示
- 为 Kiro 导入与本地请求链补齐 bearer 兼容, 同步放开账号启停等 Key 更新操作的 auth_type 校验
- 实现 Kiro provider-query 本地模型测试与 failover 执行链, 并修复结果弹窗在无 trace 时无法展示 attempts/响应体的问题

* fix(model): 删除全局模型时级联清理关联提供商模型

- 对齐 Python 版本删除逻辑, GlobalModel 删除前先在事务内清理关联的 Provider Model 记录
- 修复已绑定 Provider 的模型在 Rust SQL 仓库下会被外键约束拦住、无法正常删除的问题
- 增加管理端回归测试, 覆盖绑定 Provider Model 的 GlobalModel 删除场景

* fix(kiro,ci): 恢复 Kiro OAuth 持久化并修复 Rust CI

* Fix oauth-managed provider key semantics

---------

Co-authored-by: fawney19 <elky0401@gmail.com>

apps/aether-gateway/src/handlers/shared/catalog.rs

@@ -1,4 +1,5 @@
 use crate::handlers::shared::{json_string_list, unix_secs_to_rfc3339};
+use crate::provider_key_auth::provider_key_auth_semantics;
 use crate::AppState;
 #[cfg(test)]
 use aether_crypto::DEVELOPMENT_ENCRYPTION_KEY;
@@ -273,7 +274,7 @@ fn derive_catalog_oauth_plan_type(
     provider_type: &str,
     auth_config: Option<&serde_json::Map<String, serde_json::Value>>,
 ) -> Option<String> {
-    if !key.auth_type.trim().eq_ignore_ascii_case("oauth") {
+    if !provider_key_auth_semantics(key, provider_type).oauth_managed() {
         return None;
     }
 
@@ -339,13 +340,18 @@ pub(crate) fn build_admin_provider_key_response(
     } else {
         0.0
     };
+    let auth_semantics = provider_key_auth_semantics(key, provider_type);
     let auth_config = parse_catalog_auth_config_json(state, key);
-    let oauth_organizations = auth_config
-        .as_ref()
-        .and_then(|config| config.get("organizations"))
-        .and_then(serde_json::Value::as_array)
-        .cloned()
-        .unwrap_or_default();
+    let oauth_organizations = if auth_semantics.can_show_oauth_metadata() {
+        auth_config
+            .as_ref()
+            .and_then(|config| config.get("organizations"))
+            .and_then(serde_json::Value::as_array)
+            .cloned()
+            .unwrap_or_default()
+    } else {
+        Vec::new()
+    };
     let oauth_plan_type = derive_catalog_oauth_plan_type(key, provider_type, auth_config.as_ref());
     let (
         health_score,
@@ -387,6 +393,30 @@ pub(crate) fn build_admin_provider_key_response(
     );
     payload.insert("api_key_plain".to_string(), serde_json::Value::Null);
     payload.insert("auth_type".to_string(), json!(key.auth_type));
+    payload.insert(
+        "credential_kind".to_string(),
+        json!(auth_semantics.credential_kind().as_str()),
+    );
+    payload.insert(
+        "runtime_auth_kind".to_string(),
+        json!(auth_semantics.runtime_auth_kind().as_str()),
+    );
+    payload.insert(
+        "oauth_managed".to_string(),
+        json!(auth_semantics.oauth_managed()),
+    );
+    payload.insert(
+        "can_refresh_oauth".to_string(),
+        json!(auth_semantics.can_refresh_oauth()),
+    );
+    payload.insert(
+        "can_export_oauth".to_string(),
+        json!(auth_semantics.can_export_oauth()),
+    );
+    payload.insert(
+        "can_edit_oauth".to_string(),
+        json!(auth_semantics.can_edit_oauth()),
+    );
     payload.insert("name".to_string(), json!(key.name));
     payload.insert("rate_multipliers".to_string(), json!(key.rate_multipliers));
     payload.insert(
@@ -410,40 +440,59 @@ pub(crate) fn build_admin_provider_key_response(
     payload.insert("capabilities".to_string(), json!(key.capabilities));
     payload.insert(
         "oauth_expires_at".to_string(),
-        json!(key.expires_at_unix_secs),
+        json!(auth_semantics
+            .can_show_oauth_metadata()
+            .then_some(key.expires_at_unix_secs)
+            .flatten()),
     );
     payload.insert(
         "oauth_email".to_string(),
-        auth_config
-            .as_ref()
-            .and_then(|config| config.get("email"))
-            .cloned()
-            .unwrap_or(serde_json::Value::Null),
+        if auth_semantics.can_show_oauth_metadata() {
+            auth_config
+                .as_ref()
+                .and_then(|config| config.get("email"))
+                .cloned()
+                .unwrap_or(serde_json::Value::Null)
+        } else {
+            serde_json::Value::Null
+        },
     );
     payload.insert("oauth_plan_type".to_string(), json!(oauth_plan_type));
     payload.insert(
         "oauth_account_id".to_string(),
-        auth_config
-            .as_ref()
-            .and_then(|config| config.get("account_id"))
-            .cloned()
-            .unwrap_or(serde_json::Value::Null),
+        if auth_semantics.can_show_oauth_metadata() {
+            auth_config
+                .as_ref()
+                .and_then(|config| config.get("account_id"))
+                .cloned()
+                .unwrap_or(serde_json::Value::Null)
+        } else {
+            serde_json::Value::Null
+        },
     );
     payload.insert(
         "oauth_account_name".to_string(),
-        auth_config
-            .as_ref()
-            .and_then(|config| config.get("account_name"))
-            .cloned()
-            .unwrap_or(serde_json::Value::Null),
+        if auth_semantics.can_show_oauth_metadata() {
+            auth_config
+                .as_ref()
+                .and_then(|config| config.get("account_name"))
+                .cloned()
+                .unwrap_or(serde_json::Value::Null)
+        } else {
+            serde_json::Value::Null
+        },
     );
     payload.insert(
         "oauth_account_user_id".to_string(),
-        auth_config
-            .as_ref()
-            .and_then(|config| config.get("account_user_id"))
-            .cloned()
-            .unwrap_or(serde_json::Value::Null),
+        if auth_semantics.can_show_oauth_metadata() {
+            auth_config
+                .as_ref()
+                .and_then(|config| config.get("account_user_id"))
+                .cloned()
+                .unwrap_or(serde_json::Value::Null)
+        } else {
+            serde_json::Value::Null
+        },
     );
     payload.insert(
         "oauth_organizations".to_string(),
@@ -451,11 +500,17 @@ pub(crate) fn build_admin_provider_key_response(
     );
     payload.insert(
         "oauth_invalid_at".to_string(),
-        json!(key.oauth_invalid_at_unix_secs),
+        json!(auth_semantics
+            .can_show_oauth_metadata()
+            .then_some(key.oauth_invalid_at_unix_secs)
+            .flatten()),
     );
     payload.insert(
         "oauth_invalid_reason".to_string(),
-        json!(key.oauth_invalid_reason),
+        json!(auth_semantics
+            .can_show_oauth_metadata()
+            .then_some(key.oauth_invalid_reason.clone())
+            .flatten()),
     );
     payload.insert(
         "status_snapshot".to_string(),