chore(main): 回流 release/v2.0.x（v2.0.12）—— 内容对齐，main 无独有内容

按发布纪律回流。**注意这是内容对齐而非 merge**，理由与依据：

1. 纪律禁止 merge 回主干，因为 merge 会把发布分支的**版本号变更**带进 main。
   本项目版本号**只由 `git describe --tags` 推导**（Makefile VERSION），
   仓库里没有任何文件存放版本号 ⇒ 回流不存在版本污染风险。
2. 逐项核对确认 **main 是 release 的内容严格子集**：
   - `main` 独有的**文件**：0 个；
   - `internal/lua/plugins.go` / `internal/core/kernel_actions.go` 等内核文件
     main 独有行数：0；
   - `deploy.sh` 那 14 行只是 emoji 清理（release 刻意去掉了 emoji）；
   - `channels.lua` 那 333 行是**旧版内容**（旧 exports 表、旧模型名单）。
   - main 独有的 9 个提交按 patch-id **全部已在 release 中等效存在**
     （`git cherry` 逐条列出均为 `-`，即已合入）。
3. 故回流 = 把 release 的内容带到 main，等价于"只捡拾修复、不带版本号"，
   且不会丢任何 main 独有的修复。

本次带回 v2.0.12 的全部内容（37 个提交）：
- 源串行 + 按模型节流（照 model-gate）
- 已失效模型存储 + 远端目录闸门
- 余额分档选号
- 模型能力元数据（models.dev，isFree 权威判定）
- **凭据续期修复**（此前恒报 ok:true 却一个请求都不发）
- 通用件 TTL 缓存 + 串行锁；account_test/account_adopt/account_delete 修正
- 内核级：出站授权持久化重启后不生效、`__llmsproxy_plugin_dir` ground truth

校验：`git diff release/v2.0.x` = 0 行；`go build -tags luajit ./...` 通过。

internal/gateway/billing_rules_api_test.go

@@ -67,7 +67,7 @@ func TestBillingRulesCRUD(t *testing.T) {
 		t.Fatal(err)
 	}
 	if n := len(got.DSL.Profiles[0].Rules); n != 2 {
-		t.Fatalf("★ re-adding an existing url appended instead of replacing: %d rules", n)
+		t.Fatalf("re-adding an existing url appended instead of replacing: %d rules", n)
 	}
 	var mode string
 	for _, r := range got.DSL.Profiles[0].Rules {
@@ -105,7 +105,7 @@ func TestBillingRulesRejectUnknownURLWithWarning(t *testing.T) {
 		t.Fatal(err)
 	}
 	if len(got.Warnings) == 0 {
-		t.Fatal("★ a rule matching no configured source was accepted with no warning — " +
+		t.Fatal("a rule matching no configured source was accepted with no warning — " +
 			"it will price nothing and every request will be recorded as unpriced")
 	}
 	if !strings.Contains(got.Warnings[0], "typo.example.com") {
@@ -136,7 +136,7 @@ func TestBillingRulesInvalidIsRejectedNotPersisted(t *testing.T) {
 		t.Fatal(err)
 	}
 	if len(got.DSL.Profiles[0].Rules) != 1 {
-		t.Errorf("★ a rejected rule was persisted anyway: %d rules", len(got.DSL.Profiles[0].Rules))
+		t.Errorf("a rejected rule was persisted anyway: %d rules", len(got.DSL.Profiles[0].Rules))
 	}
 	// An unparseable price must be refused too, not silently priced at zero.
 	if rr := rulesDo(t, g, http.MethodPost, `{"profile":"p","rule":{"url":"https://y/v1","mode":"token",
@@ -175,7 +175,7 @@ func TestBillingRulesPersistAndReachThePlugin(t *testing.T) {
 		t.Fatalf("read config: %v", err)
 	}
 	if !strings.Contains(string(raw), "commandcode.ai") {
-		t.Errorf("★ the rule is not in config.yaml on disk — an edit that does not "+
+		t.Errorf("the rule is not in config.yaml on disk — an edit that does not "+
 			"survive a restart:\n%s", raw)
 	}
 	reloaded, err := config.Load(cfg.Path)
@@ -226,7 +226,7 @@ func TestBillingRulesPersistAndReachThePlugin(t *testing.T) {
 	}
 	cc, ok := sources["commandcode"]
 	if !ok {
-		t.Fatalf("★ the rule was saved but never injected: prices has %v, "+
+		t.Fatalf("the rule was saved but never injected: prices has %v, "+
 			"no commandcode entry. Every request on it stays unpriced.", keysOf(sources))
 	}
 	if cc == nil {

internal/gateway/mutation_guard_test.go

@@ -0,0 +1,71 @@
+package gateway
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// 变异测试会**改写生产源码** `discover.go`（discover_mutate_test.go），
+// 靠 defer 把原文件写回。这在进程被强杀时不成立：
+//
+//   - `go test -timeout` 超时 → 测试进程被杀
+//   - Ctrl-C / 后台任务被 kill
+//   - 跑测试的 shell 被误杀（本仓真实踩过：`pkill -f` 匹配到执行它的那条命令行）
+//
+// 后果不是"这次测试没跑完"，而是**变异体被留在工作区里**：下一次运行会把
+// 它当成"原始源码"捕获，于是基线本身就是变异体，所有裁决静默失效；更糟的是
+// 开发者可能把它当成自己的改动提交上去（真实踩过两次：`b == b && b != b`
+// 这种恒假的变异体出现在 `git status` 里）。
+//
+// 兜底：每次进入本包的测试都先把已知变异体的痕迹清掉（回滚到提交版本），
+// 这样即使上一次被强杀，本次运行也不会建立在污染之上。TestRealMutants 自己
+// 也会在脏树上拒绝运行，但那是"拒绝"，这里是"自愈"。
+func TestMain(m *testing.M) {
+	restoreLeakedMutants()
+	os.Exit(m.Run())
+}
+
+// leakedMutants 列出「变异体特征 → 它对应的正确原文」。
+// 只处理能**确定判定**的形态：出现特征即说明上一次没回滚干净。
+var leakedMutants = []struct {
+	file string
+	bad  string
+	good string
+}{
+	{
+		file: "discover.go",
+		bad:  "\tif b := trimVersionSuffix(persistedBase); b == b && b != b {",
+		good: "\tif b := trimVersionSuffix(persistedBase); b != persistedBase {",
+	},
+	{
+		file: "discover.go",
+		bad:  "\t\tif len(pair) > 0 && (seenPair[pair] || seenURL[base+path]) && false {",
+		good: "\t\tif seenPair[pair] || seenURL[base+path] {",
+	},
+}
+
+func restoreLeakedMutants() {
+	wd, err := os.Getwd()
+	if err != nil {
+		return
+	}
+	for _, m := range leakedMutants {
+		p := filepath.Join(wd, m.file)
+		b, err := os.ReadFile(p)
+		if err != nil {
+			continue
+		}
+		s := string(b)
+		if !strings.Contains(s, m.bad) {
+			continue
+		}
+		// 只替换回原文，不猜别的差异 —— 保守，避免把开发中的改动一起冲掉。
+		fixed := strings.Replace(s, m.bad, m.good, 1)
+		if fixed == s {
+			continue
+		}
+		_ = os.WriteFile(p, []byte(fixed), 0o644)
+	}
+}

internal/gateway/stats_period_test.go

@@ -241,7 +241,7 @@ func TestPeriodEmptyWindowFlagsTruncated(t *testing.T) {
 		t.Errorf("empty window reqs = %d, want 0", got.Total.Reqs)
 	}
 	if !got.Truncated {
-		t.Error("★ an empty bounded window must be flagged truncated — otherwise a " +
+		t.Error("an empty bounded window must be flagged truncated — otherwise a " +
 			"rotated-away week reads as 'no traffic that week'")
 	}
 }

internal/gateway/ui/index.html

@@ -992,7 +992,7 @@
           adPoolPeak: "峰值",
           adPoolSteps: "步长 (扩/缩)",
           cModel: "模型",
-          cImageModels: "🖼 图像模型（不可选，请到「生图」页测试）",
+          cImageModels: "图像模型（不可选，请到「生图」页测试）",
           urlHint: "填主机地址，通常不带 /v1 —— 网关会自动拼接路径。但各家约定不同：若填 https://x.com/v1，对话路径会正确，而图像生成会变成 /v1/v1/… 而 404。不确定就用上方「自动探测模型」，它会探测并填好正确形式。",
           navImage: "生图",
           imgWelcome: "输入提示词开始生成",
@@ -1326,7 +1326,7 @@
           adPoolPeak: "Peak",
           adPoolSteps: "Steps (grow/shrink)",
           cModel: "Model",
-          cImageModels: "🖼 Image models (not selectable — use the Image tab)",
+          cImageModels: "Image models (not selectable — use the Image tab)",
           urlHint: "Host address, usually WITHOUT /v1 — the gateway appends the path. Vendors differ: with https://x.com/v1 chat works but image generation becomes /v1/v1/… and 404s. If unsure use Auto-discover above; it probes and fills in the correct form.",
           navImage: "Image",
           imgWelcome: "Describe an image to generate it",

internal/gateway/ui_plugin_test.go

@@ -344,7 +344,7 @@ func TestPluginPagesAreReachableByGoTab(t *testing.T) {
 	body := ui[goTab : goTab+end]
 
 	if !strings.Contains(body, "PLUGIN_PAGES.forEach") {
-		t.Error("★ goTab() does not toggle plugin pages — a plugin page keeps its " +
+		t.Error("goTab() does not toggle plugin pages — a plugin page keeps its " +
 			"`hidden` class forever, so the sidebar entry does nothing")
 	}