feat(plugins): ccquota 多账户额度插件 + 页面→Lua 调用通道

A quota plugin cannot work on billing's model. Billing reports what the gateway
already measured, delivered on hooks during request forwarding. A plan balance
has no such arrival path: it exists only on the vendor's side, and the only way
to learn it is to ask — at the moment the operator clicks Refresh. No hook fires
on a click, and pluginAPI offered only state read/write.

So this adds the missing piece: POST /api/plugins/{name}/call/{fn}, plus
pluginAPI.call on the page side.

## Why the gate is an explicit export list

That endpoint is an HTTP surface into a Lua state. Without a declared allowlist
it would let any caller invoke the plugin's private helpers with crafted
arguments and read whatever it can see — for a plugin holding an API key, that
is handing the key to anyone who can POST. So a function is callable only if the
plugin listed it in plugin.exports. A plugin with no exports has no callable
surface; reading the missing list as "allow all" is exactly the failure mode
worth designing against. The endpoint is also admin-only.

## ccquota

One account per configured source on api.commandcode.ai, keyed by that source's
own key — two keys on one host are two seats, and both are shown. Reads
/alpha/whoami, /alpha/billing/credits, /alpha/billing/subscriptions and
/alpha/usage/summary. Each endpoint degrades independently: a vendor retiring
one route must not blank the others, and a key out of quota still reads credits
fine while inference 401s, so the report records WHICH part failed rather than
rendering a zero that reads as "no quota left".

The 401-is-everything trap: those endpoints need a bearer token plus three
headers. The token lives in the table now, per request. Passing the shared
header table straight through — my first version — yields 401 on every
endpoint, which is indistinguishable from a revoked key and sent me auditing the
account instead of the plugin.

## Also fixed: three real defects found by going live

- The bridge was registered as `httpGlobal` (the Go const's IDENTIFIER) instead
  of `__llmsproxy_http` (its VALUE). Green unit tests, "attempt to call global
  '__llmsproxy_http' (a nil value)" on first real request. Now a test boots a
  real plugin and calls it the way a plugin does.
- The call router kept `call/` in the function name, so every call 502'd with
  `does not export "call/collect_account"` while the exports list looked fine.
- readPluginExports used luaToJSON, which needs the `json` global — not yet
  installed while a plugin is registering — so it silently returned an empty
  list and every export looked undeclared. It uses luaTableToGoValue now.

Two tests hardcoded counts ("1 bundled plugin", "4 pages") and turned red the
moment a second bundled plugin existed. They now assert what they mean: billing
is among the bundled plugins, and the pages this test contributed all merged in
order. A count assertion is a changelog detector.

## Verified on production

  commandcode    2198972886@qq.com  active  $0.0811  5h 0/14  wk 0.803/35  44,921 req
  commmandcode2  jianf3112@gmail.com active  $0.0700  5h 0/14  wk 0/35      43,827 req

Co-Authored-By: ModelRouter <noreply@modelrouter.dev>
(cherry picked from commit 111dc6d53f)
(cherry picked from commit 22c9215b02)

internal/lua/billing_test.go

@@ -2,12 +2,25 @@ package lua
 
 import (
 	"encoding/json"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 )
 
+// pluginLoaded reports whether a plugin with this name is present, ignoring any
+// LoadError: a plugin that is present but broken still counts as "loaded here",
+// and the caller decides whether the error matters.
+func pluginLoaded(ps *Plugins, name string) bool {
+	for _, p := range ps.List() {
+		if fmt.Sprint(p["name"]) == name {
+			return true
+		}
+	}
+	return false
+}
+
 // The billing plugin ships with the gateway, so its arithmetic is a contract:
 // a wrong price silently produces wrong money. These tests drive it through the
 // real hook path and check the NUMBERS, not merely that it loads.
@@ -447,8 +460,16 @@ return plugin`)
 	}
 
 	// Order must be honoured so the sidebar is predictable.
-	if len(ui.Pages) != 4 {
-		t.Fatalf("expected all 4 pages to merge, got %d: %v", len(ui.Pages), got)
+	//
+	// The page COUNT is not asserted: it used to be 4, and it grew every time a
+	// bundled plugin added a page. A hard count here reads as "the merge is
+	// broken" whenever the product gains a feature, which trains the reader to
+	// bump a number instead of reading the failure. What matters is that all
+	// three pages this test contributed merged, and that they came out sorted.
+	for _, want := range []string{"third-a", "third-b", "other-page"} {
+		if !got[want] {
+			t.Errorf("page %s did not merge: %v", want, got)
+		}
 	}
 	for i := 1; i < len(ui.Pages); i++ {
 		if ui.Pages[i].Order < ui.Pages[i-1].Order {
@@ -462,8 +483,15 @@ return plugin`)
 // configuration, since seeding only happens on a fresh plugin dir.
 func TestBillingPluginLoadedByDefault(t *testing.T) {
 	ps, pdir := billingVM(t)
-	if ps.Count() != 1 {
-		t.Fatalf("expected 1 bundled plugin, got %d", ps.Count())
+	// billing must be among the bundled plugins, not the only one. The count
+	// grows with every shipped plugin and asserting it makes this test a
+	// changelog detector.
+	if !pluginLoaded(ps, "billing") {
+		var names []string
+		for _, p := range ps.List() {
+			names = append(names, fmt.Sprint(p["name"]))
+		}
+		t.Fatalf("billing is not loaded; bundled plugins are %v", names)
 	}
 	if _, err := os.Stat(filepath.Join(pdir, "billing.lua")); err != nil {
 		t.Errorf("billing.lua was not written to the plugin dir: %v", err)