fix(kiro,pool,model): 对齐 Kiro 管理链路并修复全局模型删除行为 (#305)

* feat(pool): 号池支持跳过额度耗尽账号

- 新增 pool_advanced.skip_exhausted_accounts 开关及高级设置 UI, 默认关闭并兼容旧配置
- 为 Codex/Kiro 增加额度耗尽判定, 接入请求侧候选跳过并新增 account_quota_exhausted skip reason
- 号池列表将额度耗尽账号标记为 blocked/额度耗尽, 并补充前后端相关测试

* fix(kiro): 对齐账号管理与 provider-query 的 Rust 行为

- 修复 Kiro 单条导入误走 import-refresh-token 的前端分流, 并为误用路径返回明确错误提示
- 为 Kiro 导入与本地请求链补齐 bearer 兼容, 同步放开账号启停等 Key 更新操作的 auth_type 校验
- 实现 Kiro provider-query 本地模型测试与 failover 执行链, 并修复结果弹窗在无 trace 时无法展示 attempts/响应体的问题

* fix(model): 删除全局模型时级联清理关联提供商模型

- 对齐 Python 版本删除逻辑, GlobalModel 删除前先在事务内清理关联的 Provider Model 记录
- 修复已绑定 Provider 的模型在 Rust SQL 仓库下会被外键约束拦住、无法正常删除的问题
- 增加管理端回归测试, 覆盖绑定 Provider Model 的 GlobalModel 删除场景

* fix(kiro,ci): 恢复 Kiro OAuth 持久化并修复 Rust CI

* Fix oauth-managed provider key semantics

---------

Co-authored-by: fawney19 <[email protected]>

apps/aether-gateway/src/tests/control/admin/oauth.rs

@@ -1792,6 +1792,51 @@ async fn gateway_imports_admin_provider_oauth_refresh_token_locally_with_trusted
     upstream_handle.abort();
 }
 
+#[tokio::test]
+async fn gateway_rejects_kiro_single_refresh_token_import_with_clear_error() {
+    let provider_catalog_repository = Arc::new(InMemoryProviderCatalogReadRepository::seed(
+        vec![{
+            let mut provider = sample_provider("provider-kiro", "kiro", 10);
+            provider.provider_type = "kiro".to_string();
+            provider
+        }],
+        vec![sample_endpoint(
+            "endpoint-kiro-chat",
+            "provider-kiro",
+            "kiro:generateAssistantResponse",
+            "https://service.kiro.dev",
+        )],
+        Vec::new(),
+    ));
+    let state = AppState::new()
+        .expect("gateway should build")
+        .with_data_state_for_tests(GatewayDataState::with_provider_catalog_reader_for_tests(
+            provider_catalog_repository,
+        ));
+
+    let response = local_admin_provider_oauth_response(
+        &state,
+        http::Method::POST,
+        "/api/admin/provider-oauth/providers/provider-kiro/import-refresh-token",
+        Some(json!({
+            "refresh_token": "kiro-refresh-token"
+        })),
+    )
+    .await;
+
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+    let payload: serde_json::Value = serde_json::from_slice(
+        &to_bytes(response.into_body(), usize::MAX)
+            .await
+            .expect("body should read"),
+    )
+    .expect("json body should parse");
+    assert_eq!(
+        payload["detail"],
+        json!("Kiro 不支持单条 Refresh Token 导入，请使用批量导入或设备授权。")
+    );
+}
+
 #[tokio::test]
 async fn gateway_imports_admin_provider_oauth_refresh_token_via_execution_runtime_proxy_node() {
     let execution_plans = Arc::new(Mutex::new(Vec::<ExecutionPlan>::new()));
@@ -2382,20 +2427,37 @@ async fn gateway_batch_imports_admin_provider_oauth_kiro_via_execution_runtime_p
                     .lock()
                     .expect("mutex should lock")
                     .push(plan.clone());
-                assert_eq!(plan.request_id, "kiro_batch_refresh:social");
-                assert_eq!(plan.url, "https://oauth.example/refreshToken");
                 assert_eq!(
                     plan.proxy
                         .as_ref()
                         .and_then(|proxy| proxy.node_id.as_deref()),
                     Some("proxy-node-kiro-batch-runtime")
                 );
-                assert_eq!(
-                    plan.headers
-                        .get(EXECUTION_REQUEST_FOLLOW_REDIRECTS_HEADER)
-                        .map(String::as_str),
-                    Some("true")
-                );
+                if plan.request_id == "kiro_batch_refresh:social" {
+                    assert_eq!(plan.url, "https://oauth.example/refreshToken");
+                    assert_eq!(
+                        plan.headers
+                            .get(EXECUTION_REQUEST_FOLLOW_REDIRECTS_HEADER)
+                            .map(String::as_str),
+                        Some("true")
+                    );
+                    return Json(json!({
+                        "request_id": plan.request_id,
+                        "status_code": 200,
+                        "headers": {
+                            "content-type": "application/json"
+                        },
+                        "body": {
+                            "json_body": {
+                                "accessToken": sample_kiro_device_access_token("[email protected]"),
+                                "refreshToken": "kiro-runtime-refresh-token-new",
+                                "expiresIn": 1800,
+                            }
+                        }
+                    }));
+                }
+
+                assert_eq!(plan.request_id, "kiro-quota:key-kiro-batch-runtime");
                 Json(json!({
                     "request_id": plan.request_id,
                     "status_code": 200,
@@ -2404,9 +2466,17 @@ async fn gateway_batch_imports_admin_provider_oauth_kiro_via_execution_runtime_p
                     },
                     "body": {
                         "json_body": {
-                            "accessToken": sample_kiro_device_access_token("[email protected]"),
-                            "refreshToken": "kiro-runtime-refresh-token-new",
-                            "expiresIn": 1800,
+                            "subscriptionInfo": {
+                                "subscriptionTitle": "KIRO PRO+"
+                            },
+                            "usageBreakdownList": [{
+                                "currentUsageWithPrecision": 5.0,
+                                "usageLimitWithPrecision": 20.0,
+                                "nextDateReset": 1_900_000_000u64
+                            }],
+                            "desktopUserInfo": {
+                                "email": "[email protected]"
+                            }
                         }
                     }
                 }))
@@ -2496,7 +2566,7 @@ async fn gateway_batch_imports_admin_provider_oauth_kiro_via_execution_runtime_p
 
     {
         let plans = execution_plans.lock().expect("mutex should lock");
-        assert_eq!(plans.len(), 1);
+        assert_eq!(plans.len(), 2);
     }
 
     let stored_key = provider_catalog_repository