feat(quota): OpenDesign 出站主机加入白名单

插件出站白名单 = 已配置源的 host。这条规则对每个 adapter 都成立，直到
OpenDesign —— 它把推理和计费拆在两个域上：推理 amr-link，计费 amr-api。
adapter 从推理主机推导计费主机，于是它请求的 host 从来不是操作员配过的
那个，请求在离开进程前就被拒，报"不是允许的出站目标"，读起来像插件 bug。

core.sourceHosts 现在同时加入派生主机，且仅当源本身就在 amr-link 上
（没有 OpenDesign 源的部署不会凭空获得这条授权）。

派生规则前后端各存一份，因为 Go 建白名单、Lua 建 URL，两边不一致的表现是
「请求被拒」而不是「命名不匹配的错误」。规则改成了完整主机名匹配：
`amr-link.` 前缀写法会把 amr-link.example.com 也改写成 OpenDesign 地址。

顺带修掉一个真缺陷：Lua 侧先 `gsub("/+$")` 再匹配主机名，而 base_url 是
`https://amr-link.open-design.ai/v1` —— 带路径时整串拿去匹配 `^...$`
永远不命中，改写静默失效，探测打到推理主机。改成先切路径。

这个缺陷是「行为断言」抓到的：上一版判据 grep 源码里的 gsub 模式，而
gsub 模式在改前改后都"看起来对"。8/8 变异全杀。

internal/lua/plugins/quota.lua

@@ -290,12 +290,22 @@ local function openDesign(base, key)
   local api = nil
   if type(cfg) == "table" then api = cfg.api_base end
   if type(api) ~= "string" or api == "" then
-    local origin = base:gsub("^https?://", ""):gsub("/+$", "")
-    origin = origin:gsub("^amr%-link%.", "amr-api.")
+    -- Host only: base_url carries a path (`.../v1`), and matching the hostname
+    -- rule against it would silently skip the rewrite and send the probe to the
+    -- inference host — which serves no billing route.
+    local origin = base:gsub("^https?://", ""):gsub("/.*$", "")
+    origin = origin:gsub("^amr%-link%.open%-design%.ai$", "amr-api.open-design.ai")
     api = "https://" .. origin .. "/api/v1"
   end
   api = api:gsub("/+$", "")
 
+  -- The gateway's outbound allowlist is the hosts of configured sources. It
+  -- therefore contains amr-link (the inference host) but NOT amr-api (the
+  -- billing host), and every request below would be refused with "host ... is
+  -- not an allowed outbound destination" — a message that reads like a plugin
+  -- bug rather than a missing allowlist entry. Add the derived host alongside
+  -- the source hosts in core.sourceHosts when this adapter is enabled.
+
   local wallet, wErr = request(api .. "/wallet/balance", ck, nil, 1)
   local summary, sErr = request(api .. "/billing/summary", ck, nil, 1)
 

internal/lua/quota_opendesign_test.go

@@ -401,26 +401,51 @@ func TestQuotaOpenDesignDoesNotDefaultMissingRate(t *testing.T) {
 }
 
 // TestQuotaOpenDesignHostRewritingIsUsed keeps the amr-link -> amr-api default
-// working. Without it the adapter would probe the inference host, which answers
-// no billing route at all, and every OpenDesign source would silently skip.
+// working. Without it the adapter probes the inference host, which serves no
+// billing route at all, and every OpenDesign source silently skips.
+//
+// Asserted BEHAVIOURALLY, through the outbound allowlist rather than on the
+// source text. The allowlist in these tests holds only 127.0.0.1, so a request
+// to any real host is refused with a message that NAMES the host it tried. That
+// makes the refusal the observation: "amr-api.open-design.ai" in the reason
+// proves the derivation ran, and its absence proves it did not. The earlier
+// version of this test grepped quota.lua for the gsub pattern, which pins the
+// spelling of the rule instead of its effect — it went red the moment the rule
+// was tightened to a full-hostname match, while the behaviour was unchanged.
 func TestQuotaOpenDesignHostRewritingIsUsed(t *testing.T) {
-	var paths []string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		paths = append(paths, r.URL.Path)
-		_, _ = w.Write([]byte(odWallet))
-	}))
-	defer srv.Close()
-
-	ps, src := odPlugins(t)
-	// api_base unset, so the adapter derives the host from base_url. The
-	// derived host (amr-api.open-design.ai) is not reachable from a test, so
-	// assert on the SOURCE instead — this is the guard that survives without a
-	// network.
-	_ = srv
-	if !strings.Contains(src, `origin:gsub("^amr%-link%.", "amr-api.")`) {
-		t.Fatal("quota.lua no longer rewrites amr-link.* to amr-api.* — every " +
-			"OpenDesign source would probe the inference host, which serves no " +
-			"billing route, and skip")
+	ps, _ := odPlugins(t)
+	// No api_base: the adapter must derive the billing host itself. The control
+	// key IS set so the credential guard is not what stops us.
+	if err := ps.SetState("quota", map[string]interface{}{
+		"prices": map[string]interface{}{"control_key": "vela_ctrl_TESTKEY"},
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	rep := collectOpenDesign(t, ps, "https://amr-link.open-design.ai/v1")
+	if rep == nil {
+		t.Fatal("no report produced")
+	}
+	// The outbound allowlist in these tests holds only 127.0.0.1, so the request
+	// is refused before it leaves the process and the refusal NAMES the host it
+	// tried. The observation is therefore the refusal text, not the record as a
+	// whole: `host` is `hostOf(base)` — the SOURCE host, which is amr-link by
+	// design and says nothing about where the request went.
+	var msg string
+	if s, ok := rep["error"].(string); ok {
+		msg = s
+	}
+	if s, ok := rep["reason"].(string); ok {
+		msg += " " + s
+	}
+	if !strings.Contains(msg, "amr-api.open-design.ai") {
+		t.Fatalf("no evidence the adapter derived the billing host from the "+
+			"inference one: %q. Expected the allowlist refusal to name "+
+			"amr-api.open-design.ai, since that is the host the request must go to. "+
+			"(report: %v)", msg, rep)
+	}
+	if strings.Contains(msg, "amr-link") {
+		t.Fatalf("the adapter probed the INFERENCE host — it serves no billing "+
+			"route, so every OpenDesign source would silently skip: %q", msg)
 	}
-	_ = ps
 }