feat(keys): 每个密钥可配独立 AUTO 链，管理员代配

此前 AUTO 链是全局单值（cfg.Auto + Core.AutoChain()），所有用户共用一条链。
管理员无法为某个用户单独指定调度链。

按 per-key 覆盖 + 全局兜底实现：

- config.GWKey 增加 Auto 字段与 HasOwnAuto()。未配置即继承全局链，
  存量部署零改动，新密钥天然继承全局链。
- Core 把 buildAutoChain 的归一化逻辑抽成 chainForRules，全局链、
  生图链、per-key 链共用同一套编译，避免两处漂移。
- Core 增加 keyAutoChains 缓存 + AutoChainFor(key)。请求路径读缓存不
  加锁，与全局链查询一致。缓存整表原子替换，不会看到半成品。
- 请求侧 chat.go 改用 AutoChainFor(reqKey)。冷却仍在 Provider 上按
  model+source 共享：两条链指向同一个 slot 时共用冷却，与今天单链行为
  相同，也避免为 per-key 维度重构冷却而改变现有可观测语义。
- API：GET/PUT/DELETE /api/keys/{key}/auto（admin），GET
  /api/keys/me/auto（任意角色，只能读自己的）。空 PUT 与 DELETE 等价于
  "恢复继承"，无法持久化一条会 503 的空链。写入时回报解析出的槽位数，
  让管理员当场看到模型名写错，而不是等用户下次请求 503。
- 源变更时一并重编译 per-key 链，加源后无需重启即可生效。

判据 18 条，5 个变异全部被抓住：AutoChainFor 忽略 key、清空后不重建
缓存、源变更不重建、空 PUT 落盘成空链、me/auto 误要求 admin。

UI 判据做变异时发现漏放：只查函数定义存在，删掉按钮后仍通过。已改为
断言 keyCanvasHtml 内的调用点。

端到端实测（真实 HTTP + 两个 mock 上游）：admin 与 bob 初始同为 m-fast，
给 bob 配 m-cheap 后两者分流，重启后仍分流，DELETE 后 bob 回到 m-fast。

Co-Authored-By: ModelRouter <noreply@modelrouter.dev>

internal/core/core.go

@@ -37,6 +37,12 @@ type Core struct {
 	registry       *provider.Registry
 	autoChain      atomic.Pointer[scheduler.Chain] // chat AUTO chain
 	autoImageChain atomic.Pointer[scheduler.Chain] // image-generation AUTO chain
+
+	// keyAutoChains caches per-key AUTO chains, keyed by the gateway key.
+	// Entries are rebuilt by rebuildKeyAutoChains whenever sources or key
+	// config change; AutoChainFor reads them without taking c.mu so request
+	// handling stays lock-free like the global chain lookup.
+	keyAutoChains atomic.Pointer[map[string]*scheduler.Chain]
 }
 
 // New builds the core from a config file plus runtime overlay.
@@ -257,6 +263,68 @@ func (c *Core) Registry() *provider.Registry { return c.registry }
 // AutoChain returns the current AUTO scheduling chain.
 func (c *Core) AutoChain() *scheduler.Chain { return c.autoChain.Load() }
 
+// AutoChainFor returns the AUTO chain to use for a request authenticated with
+// key. A key that declares its own chain gets that chain; every other key
+// inherits the global chain, so keys created before per-key chains existed
+// keep their current behaviour with no configuration change.
+//
+// It returns (chain, ok). ok is false only when the key has its own chain but
+// it compiled to nothing usable (e.g. every slot names a model that no longer
+// exists) — the caller must surface that rather than silently downgrading the
+// user to the global chain, which would be a confusing, invisible switch.
+func (c *Core) AutoChainFor(key string) (*scheduler.Chain, bool) {
+	if m := c.keyAutoChains.Load(); m != nil {
+		if ch, ok := (*m)[key]; ok {
+			return ch, true
+		}
+	}
+	return c.autoChain.Load(), true
+}
+
+// rebuildKeyAutoChains recompiles every per-key AUTO chain from the current
+// config and provider registry, then swaps the cache in one shot so requests
+// never observe a half-built map. Keys without their own chain are absent
+// from the map and fall back to the global chain.
+func (c *Core) rebuildKeyAutoChains() {
+	m := make(map[string]*scheduler.Chain)
+	for _, k := range c.cfg.Keys {
+		if !k.HasOwnAuto() {
+			continue
+		}
+		m[k.Key] = c.chainForRules(k.Auto, false)
+	}
+	c.keyAutoChains.Store(&m)
+}
+
+// SaveKeyAuto persists one key's own AUTO chain and recompiles the per-key
+// chain cache. Passing an empty list clears the override so the key inherits
+// the global chain again.
+func (c *Core) SaveKeyAuto(key string, entries []config.ModelScope) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	idx := -1
+	for i, k := range c.cfg.Keys {
+		if k.Key == key {
+			idx = i
+			break
+		}
+	}
+	if idx < 0 {
+		return fmt.Errorf("key not found")
+	}
+	if err := ValidateScopeQuotas(entries); err != nil {
+		return err
+	}
+	c.cfg.Keys[idx].Auto = cleanScopes(entries)
+	if err := c.saveConfig(); err != nil {
+		return err
+	}
+	// Rebuild the whole cache so a cleared override stops shadowing the
+	// global chain for this key.
+	c.rebuildKeyAutoChains()
+	return nil
+}
+
 // AutoImageChain returns the persisted image-generation AUTO chain snapshot.
 func (c *Core) AutoImageChain() *scheduler.Chain { return c.autoImageChain.Load() }
 
@@ -546,6 +614,7 @@ func (c *Core) rebuildRegistry() error {
 	}
 	c.buildAutoChain()
 	c.buildAutoImageChain()
+	c.rebuildKeyAutoChains()
 	return nil
 }
 
@@ -555,17 +624,28 @@ func (c *Core) rebuildRegistry() error {
 // back to the source's best chat model and cooldown/quota bookkeeping would
 // key on a name that never matches.
 func (c *Core) buildAutoChain() {
+	c.autoChain.Store(c.chainForRules(c.cfg.Auto, false))
+}
+
+// chainForRules compiles a chat AUTO chain from a rule list. kindFilter is
+// false for the chat chain (image models are skipped) and true for the image
+// chain (only image models participate). Per-key chains always compile as
+// chat chains: a user's key configures the models *they* talk to.
+func (c *Core) chainForRules(rules []config.ModelScope, imageOnly bool) *scheduler.Chain {
 	prov := func(model, source string) scheduler.Provider {
 		p := c.registry.ProviderForSlot(model, source)
 		if p == nil {
 			return nil
 		}
-		if m := p.ModelByID(model); m != nil && m.Kind == "image" {
+		m := p.ModelByID(model)
+		if imageOnly && (m == nil || m.Kind != "image") {
+			return nil
+		}
+		if !imageOnly && m != nil && m.Kind == "image" {
 			return nil
 		}
 		return p
 	}
-	rules := c.cfg.Auto
 	sr := make([]scheduler.Rule, 0, len(rules))
 	for _, e := range rules {
 		model, source := e.Model, e.Source
@@ -574,7 +654,11 @@ func (c *Core) buildAutoChain() {
 				model = exact
 			}
 			if m := p.ModelByID(model); m != nil && m.Kind == "image" {
-				continue // image-kind models never join the chat AUTO chain
+				if !imageOnly {
+					continue // image-kind models never join the chat AUTO chain
+				}
+			} else if imageOnly {
+				continue
 			}
 			if source == "" {
 				source = p.Name()
@@ -589,7 +673,7 @@ func (c *Core) buildAutoChain() {
 			Hours:  e.Hours,
 		})
 	}
-	c.autoChain.Store(scheduler.BuildChain(sr, prov))
+	return scheduler.BuildChain(sr, prov)
 }
 
 // buildAutoImageChain rebuilds the image-generation AUTO chain snapshot.

internal/core/key_auto_test.go

@@ -0,0 +1,221 @@
+package core
+
+import (
+	"path/filepath"
+	"testing"
+
+	"llmsproxy/internal/config"
+	"llmsproxy/internal/scheduler"
+)
+
+// Per-key AUTO chains let an admin give one user their own scheduling chain
+// while every other key keeps the global one. These tests pin the three
+// properties that make that safe:
+//
+//  1. a key WITH its own chain gets it;
+//  2. a key WITHOUT one inherits the global chain (backward compatible);
+//  3. the override is actually persisted, so it survives a restart.
+//
+// A test that only checked (1) would pass even if AutoChainFor ignored the key
+// and always returned the global chain whenever the two happened to be equal,
+// so (2) uses deliberately *different* chains.
+
+func perKeyTestConfig(t *testing.T) *config.Config {
+	t.Helper()
+	dir := t.TempDir()
+	return &config.Config{
+		Path:         filepath.Join(dir, "config.yaml"),
+		AdapterDir:   filepath.Join(dir, "adapters"),
+		RuntimeFile:  filepath.Join(dir, "runtime.json"),
+		Listen:       "127.0.0.1:0",
+		DefaultModel: "AUTO",
+		GatewayKeys:  []string{"sk-gw-admin"},
+		Sources: []config.Source{
+			{Name: "s1", BaseURL: "http://127.0.0.1:1/v1", Adapter: "openai",
+				Models: []config.Model{{ID: "gpt-4o", Priority: 10}, {ID: "gpt-4o-mini", Priority: 5}}},
+		},
+		// Global chain points at gpt-4o.
+		Auto: []config.ModelScope{{Model: "gpt-4o", Source: "s1", Tier: 1}},
+		Keys: []config.GWKey{
+			{Key: "sk-gw-admin", Role: "admin"},
+			{Key: "sk-gw-inherits", Role: "user", Name: "inherits"},
+			// This key's own chain points at a DIFFERENT model, so returning
+			// the global chain by mistake is detectable.
+			{Key: "sk-gw-own", Role: "user", Name: "own",
+				Auto: []config.ModelScope{{Model: "gpt-4o-mini", Source: "s1", Tier: 1}}},
+		},
+	}
+}
+
+func firstSlotModel(t *testing.T, c *Core, key string) string {
+	t.Helper()
+	ch, _ := c.AutoChainFor(key)
+	if ch == nil || len(ch.Tiers) == 0 {
+		t.Fatalf("key %s: no chain tiers", key)
+	}
+	slots := ch.Tiers[0].Slots
+	if len(slots) == 0 {
+		t.Fatalf("key %s: tier 1 has no slots", key)
+	}
+	return slots[0].Model
+}
+
+// A key that declares its own chain must be scheduled by it, not the global.
+func TestAutoChainForUsesKeyOwnChain(t *testing.T) {
+	c := newTestCore(t, perKeyTestConfig(t))
+
+	if got := firstSlotModel(t, c, "sk-gw-own"); got != "gpt-4o-mini" {
+		t.Fatalf("key with own chain must use it, got %q (want gpt-4o-mini)", got)
+	}
+	// Sanity: the global chain really is different, so the assertion above
+	// cannot pass by accident.
+	if got := firstSlotModel(t, c, "sk-gw-admin"); got != "gpt-4o" {
+		t.Fatalf("admin must use global chain, got %q (want gpt-4o)", got)
+	}
+}
+
+// A key with no own chain inherits the global one. This is what keeps every
+// pre-existing deployment working with no config change.
+func TestAutoChainForInheritsGlobalWhenUnset(t *testing.T) {
+	c := newTestCore(t, perKeyTestConfig(t))
+
+	if got := firstSlotModel(t, c, "sk-gw-inherits"); got != "gpt-4o" {
+		t.Fatalf("key without own chain must inherit global, got %q (want gpt-4o)", got)
+	}
+}
+
+// A key that is not in the key table at all (e.g. a seed key) must also
+// inherit the global chain rather than erroring or returning nil.
+func TestAutoChainForUnknownKeyInheritsGlobal(t *testing.T) {
+	c := newTestCore(t, perKeyTestConfig(t))
+
+	ch, ok := c.AutoChainFor("sk-gw-never-configured")
+	if !ok || ch == nil || len(ch.Tiers) == 0 {
+		t.Fatalf("unknown key must fall back to global chain, got ok=%v chain=%v", ok, ch)
+	}
+}
+
+// The per-key chain must survive a save/reload round trip: an admin configuring
+// a chain in the WebUI and restarting the gateway must not silently lose it.
+func TestSaveKeyAutoPersistsAndApplies(t *testing.T) {
+	cfg := perKeyTestConfig(t)
+	c := newTestCore(t, cfg)
+
+	if err := c.SaveKeyAuto("sk-gw-inherits", []config.ModelScope{
+		{Model: "gpt-4o-mini", Source: "s1", Tier: 1},
+	}); err != nil {
+		t.Fatalf("SaveKeyAuto: %v", err)
+	}
+	if got := firstSlotModel(t, c, "sk-gw-inherits"); got != "gpt-4o-mini" {
+		t.Fatalf("saved chain must apply immediately, got %q", got)
+	}
+
+	// Reload from disk exactly like a restart does.
+	reloaded, err := config.Load(cfg.Path)
+	if err != nil {
+		t.Fatalf("reload config: %v", err)
+	}
+	c2 := newTestCore(t, reloaded)
+	if got := firstSlotModel(t, c2, "sk-gw-inherits"); got != "gpt-4o-mini" {
+		t.Fatalf("per-key chain must survive restart, got %q", got)
+	}
+	// The other key must be unaffected by its neighbour's override.
+	if got := firstSlotModel(t, c2, "sk-gw-admin"); got != "gpt-4o" {
+		t.Fatalf("override must not leak to other keys, got %q", got)
+	}
+}
+
+// Clearing the override must return the key to the global chain, both in
+// memory and after a restart. This is what the WebUI's "use global" toggle
+// does, so a stale shadowing entry would silently pin the user to their old
+// chain forever.
+func TestSaveKeyAutoClearRestoresGlobal(t *testing.T) {
+	cfg := perKeyTestConfig(t)
+	c := newTestCore(t, cfg)
+
+	if err := c.SaveKeyAuto("sk-gw-own", nil); err != nil {
+		t.Fatalf("clear: %v", err)
+	}
+	if got := firstSlotModel(t, c, "sk-gw-own"); got != "gpt-4o" {
+		t.Fatalf("cleared key must inherit global again, got %q", got)
+	}
+
+	reloaded, err := config.Load(cfg.Path)
+	if err != nil {
+		t.Fatalf("reload: %v", err)
+	}
+	c2 := newTestCore(t, reloaded)
+	if got := firstSlotModel(t, c2, "sk-gw-own"); got != "gpt-4o" {
+		t.Fatalf("clear must survive restart, got %q", got)
+	}
+}
+
+// Saving an unknown key must fail loudly rather than creating a shadow entry
+// that no request can ever match.
+func TestSaveKeyAutoUnknownKeyFails(t *testing.T) {
+	c := newTestCore(t, perKeyTestConfig(t))
+
+	if err := c.SaveKeyAuto("sk-gw-nope", []config.ModelScope{{Model: "gpt-4o", Source: "s1"}}); err == nil {
+		t.Fatal("SaveKeyAuto on unknown key must return an error")
+	}
+}
+
+// Per-key quota validation must run, exactly like the model scope path: an
+// override is another place an operator can write a bad budget.
+func TestSaveKeyAutoRejectsBadQuota(t *testing.T) {
+	c := newTestCore(t, perKeyTestConfig(t))
+
+	err := c.SaveKeyAuto("sk-gw-inherits", []config.ModelScope{
+		{Model: "gpt-4o", Source: "s1", TokenQuota: -5},
+	})
+	if err == nil {
+		t.Fatal("negative token quota in a per-key auto chain must be rejected")
+	}
+}
+
+// Source changes must recompile per-key chains. A key whose chain names a
+// model that does not exist yet compiles to an empty chain (BuildChain drops
+// slots it cannot resolve — sending the request into a black hole would be
+// worse), and must start working as soon as the source appears.
+func TestKeyAutoChainsRebuildOnSourceChange(t *testing.T) {
+	cfg := perKeyTestConfig(t)
+	cfg.Keys = append(cfg.Keys, config.GWKey{
+		Key: "sk-gw-late", Role: "user", Name: "late",
+		Auto: []config.ModelScope{{Model: "new-model", Source: "s2", Tier: 1}},
+	})
+	c := newTestCore(t, cfg)
+
+	// s2 does not exist yet, so the chain has no usable slot.
+	if ch, _ := c.AutoChainFor("sk-gw-late"); chainSlotsOf(ch) != 0 {
+		t.Fatalf("chain naming an unknown model must compile empty, got %d slots",
+			chainSlotsOf(ch))
+	}
+	// The other keys are unaffected by the broken one.
+	if got := firstSlotModel(t, c, "sk-gw-admin"); got != "gpt-4o" {
+		t.Fatalf("broken per-key chain must not affect others, got %q", got)
+	}
+
+	// Add the source; the per-key chain must pick it up without a restart.
+	cfg.Sources = append(cfg.Sources, config.Source{
+		Name: "s2", BaseURL: "http://127.0.0.1:2/v1", Adapter: "openai",
+		Models: []config.Model{{ID: "new-model", Priority: 10}},
+	})
+	if err := c.Reload(); err != nil {
+		t.Fatalf("Reload: %v", err)
+	}
+	if got := firstSlotModel(t, c, "sk-gw-late"); got != "new-model" {
+		t.Fatalf("per-key chain must resolve after the source is added, got %q", got)
+	}
+}
+
+// chainSlotsOf counts usable slots, tolerating a nil chain.
+func chainSlotsOf(ch *scheduler.Chain) int {
+	if ch == nil {
+		return 0
+	}
+	n := 0
+	for _, tn := range ch.Tiers {
+		n += len(tn.Slots)
+	}
+	return n
+}