fix: close P10 audit items — P10-1 sources API admin guard, P10-2 scope prefix strip, P10-3 runtime source timeout w/ stream-safe clients

- api.go: handleSourcesAPI now requires admin role (GET leaks upstream api_keys, POST/DELETE mutate routing)
- chat.go: hasScopeModel made a Gateway method that strips source-model/:// prefix strictly via Registry.EffectiveModel (only when the prefix names a real source serving the bare model) so dash-bearing ids like deepseek-v4-flash-free are never corrupted; +TestHasScopeModelWithSourcePrefix
- config.go: DefaultSourceTimeout/QueueTimeout/Concurrency constants shared by YAML ApplyDefaults and runtime sources
- core.go: mergedSources applies the same defaults to runtime sources (JSON never persisted timeout fields); a dead upstream can no longer hold a concurrency slot forever
- provider.go: split non-streaming client{Timeout} vs stream client{} sharing a Transport with ResponseHeaderTimeout, so long SSE bodies are not cut by client.Timeout; ChatStream uses doRawStream
- plan.md: mark P4-4/5/6 done, record P4-7/8 (tier-order, audit export, UI key view, zen upstream diagnosis)
- online verified: user key -> /api/sources 403 (GET+POST), admin 200, AUTO stream/non-stream healthy

internal/gateway/api.go

@@ -75,6 +75,10 @@ type sourcePayload struct {
 }
 
 func (g *Gateway) handleSourcesAPI(w http.ResponseWriter, r *http.Request) {
+	if reqRole(r.Context()) != "admin" {
+		writeError(w, http.StatusForbidden, "forbidden", "admin role required")
+		return
+	}
 	path := strings.TrimPrefix(r.URL.Path, "/api/sources")
 	path = strings.Trim(path, "/")
 
@@ -121,6 +125,7 @@ func (g *Gateway) handleSourcesAPI(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "")
 	}
 }
+
 // handleStatsAPI returns per-key / per-model / per-source usage aggregates and
 // the recent request audit trail.
 func (g *Gateway) handleStatsAPI(w http.ResponseWriter, r *http.Request) {
@@ -173,7 +178,7 @@ func (g *Gateway) handleStatsAPI(w http.ResponseWriter, r *http.Request) {
 		cw.Flush()
 		return
 	}
-if r.URL.Query().Get("export") == "keys-csv" {
+	if r.URL.Query().Get("export") == "keys-csv" {
 		w.Header().Set("Content-Type", "text/csv; charset=utf-8")
 		w.Header().Set("Content-Disposition", "attachment; filename=llmsproxy-keys.csv")
 		cw := csv.NewWriter(w)

internal/gateway/chat.go

@@ -216,7 +216,16 @@ func (g *Gateway) scopeTokens(ctx context.Context, sc config.ModelScope) int64 {
 	return g.stats.WindowTokens(sc.Model, sc.Source, win)
 }
 
-func hasScopeModel(list []config.ModelScope, s string) bool {
+// hasScopeModel reports whether a model (possibly with a "source-model" /
+// "source:model" / "source/model" pinning prefix) is allowed by a key's model
+// scope. The prefix is stripped strictly: only when the prefix names a real
+// source that actually serves the bare model (via Registry.EffectiveModel), so
+// model ids that themselves contain separators (e.g. "deepseek-v4-flash-free")
+// are never corrupted (P10-2).
+func (g *Gateway) hasScopeModel(list []config.ModelScope, s string) bool {
+	if r := g.core.Registry(); r != nil {
+		s = r.EffectiveModel(s)
+	}
 	for _, x := range list {
 		if x.Model == s || (x.Model != "" && strings.EqualFold(x.Model, "AUTO")) {
 			return true
@@ -325,7 +334,7 @@ func (g *Gateway) handleChat(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if !isAuto(model) {
-		if allow := g.allowedModels(r.Context()); allow != nil && !hasScopeModel(allow, model) {
+		if allow := g.allowedModels(r.Context()); allow != nil && !g.hasScopeModel(allow, model) {
 			writeError(w, http.StatusForbidden, "model_not_allowed", fmt.Sprintf("model %q is not allowed for this key", model))
 			return
 		}
@@ -811,7 +820,7 @@ func (g *Gateway) handleImage(w http.ResponseWriter, r *http.Request) {
 		model = g.core.DefaultModel()
 	}
 	if !isAuto(model) {
-		if allow := g.allowedModels(r.Context()); allow != nil && !hasScopeModel(allow, model) {
+		if allow := g.allowedModels(r.Context()); allow != nil && !g.hasScopeModel(allow, model) {
 			writeError(w, http.StatusForbidden, "model_not_allowed", fmt.Sprintf("model %q is not allowed for this key", model))
 			return
 		}

internal/gateway/gateway_test.go

@@ -195,7 +195,7 @@ func TestAutoStatesReportChainHealth(t *testing.T) {
 			t.Fatalf("get auto status=%d body=%s", rr.Code, rr.Body.String())
 		}
 		var body struct {
-			Rules  []config.ModelScope `json:"rules"`
+			Rules  []config.ModelScope  `json:"rules"`
 			States []core.AutoSlotState `json:"states"`
 		}
 		if err := json.Unmarshal(rr.Body.Bytes(), &body); err != nil {
@@ -634,3 +634,36 @@ func TestAPIChatInternal(t *testing.T) {
 		t.Fatalf("api chat body=%s", rr.Body.String())
 	}
 }
+
+func TestHasScopeModelWithSourcePrefix(t *testing.T) {
+	// zen serves deepseek-v4-flash-free, so the pinning prefix strips; deepseek
+	// serves deepseek-v4-pro but NOT v4-flash-free, so a model id like
+	// "deepseek-v4-flash-free" (source deepseek + model id with dashes) must NOT
+	// be corrupted by prefix stripping.
+	g := newTestGateway(t,
+		config.Source{Name: "deepseek", BaseURL: "http://d", Adapter: "openai",
+			Models: []config.Model{{ID: "deepseek-v4-pro"}}},
+		config.Source{Name: "zen", BaseURL: "http://z", Adapter: "openai",
+			Models: []config.Model{{ID: "deepseek-v4-flash-free"}}},
+	)
+	scope := []config.ModelScope{{Model: "deepseek-v4-flash-free"}, {Model: "gpt-5.6-sol"}}
+	for _, prefixed := range []string{"zen:deepseek-v4-flash-free", "zen/deepseek-v4-flash-free"} {
+		if !g.hasScopeModel(scope, prefixed) {
+			t.Errorf("hasScopeModel(scope, %q)=false, want true (prefix must be stripped)", prefixed)
+		}
+	}
+	for _, bare := range []string{"deepseek-v4-flash-free", "gpt-5.6-sol"} {
+		if !g.hasScopeModel(scope, bare) {
+			t.Errorf("hasScopeModel(scope, %q)=false, want true", bare)
+		}
+	}
+	if g.hasScopeModel(scope, "deepseek-v4-pro") {
+		t.Error("hasScopeModel returned true for model outside scope")
+	}
+	if g.hasScopeModel(scope, "deepseek-v4-flash-free-extra") {
+		t.Error("hasScopeModel returned true for unrelated model")
+	}
+	if !g.hasScopeModel([]config.ModelScope{{Model: "AUTO"}}, "zen:anything") {
+		t.Error("AUTO scope should allow any prefixed model")
+	}
+}