fix(discovery): 错误分类 + 去掉重复请求 URL

演练错误路径时发现两个真问题。

**① 密钥错误被报成 502（上游故障）。** 这是最常见的失败，却和「厂商挂了」
给出完全相同的错误。两者需要的动作正好相反：重新输 key vs 去查厂商状态页。
操作员只能猜。现在 401/403 会得到 401 并在信息里点名 api key；
DNS 不解析、TLS 失败、连接被拒也各自带一句可执行的说明。

**② 错误信息里的 tried 列表有重复。** base "https://h/v1" + path "/models"
和 base "https://h" + path "/v1/models" 请求的是同一个地址，但候选去重只按
(base, path) 对，于是同一条 URL 在错误信息里出现两次——读起来像「试了两个
地方」，其实只试了一个。改成按最终 URL 去重。

去重后候选从 3 个变成 2 个，两个判据的期望值需要跟着改：
TestDiscoveryCandidates_DedupesAndPrefersTyped 和变异测试的
「fallback search」原本断言 >= 3，那是在测量 bug 而不是覆盖度。覆盖没有丢失：
剩下的两条是 https://h/v1/models 和 https://h/models，两个不同地址。

新增判据：
  TestDiscoverModels_WrongKeyIsUnauthorizedNotBadGateway
  TestDiscoverModels_UnreachableStaysBadGateway（防止过度纠正）
  TestDiscoveryCandidates_NoDuplicateRequests
  TestDiscoverModels_FailureListsEachURLOnce（对操作员真正读到的文本断言）

internal/gateway/discover_api_test.go

@@ -3,6 +3,7 @@ package gateway
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -168,6 +169,100 @@ func TestDiscoverModels_SendsAuthorizationHeader(t *testing.T) {
 	}
 }
 
+// TestDiscoverModels_WrongKeyIsUnauthorizedNotBadGateway pins the distinction
+// that decides whether the operator knows what to do next.
+//
+// A rejected key and an unreachable vendor are the two most common discovery
+// failures, and they need opposite actions: re-type the key, versus go check the
+// vendor's status page. Both used to surface as one generic error, so the
+// operator had to guess.
+func TestDiscoverModels_WrongKeyIsUnauthorizedNotBadGateway(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusUnauthorized)
+		_, _ = w.Write([]byte(`{"error":{"message":"invalid api key","code":"invalid_api_key"}}`))
+	}))
+	defer srv.Close()
+
+	_, err := DiscoverModels(context.Background(), srv.URL+"/v1", "sk-wrong")
+	if err == nil {
+		t.Fatal("expected a failure against a 401 endpoint")
+	}
+	var f *discoveryFailure
+	if !errors.As(err, &f) {
+		t.Fatalf("error should be classified, got %T: %v", err, err)
+	}
+	if got := f.StatusOrDefault(); got != http.StatusUnauthorized {
+		t.Errorf("status = %d, want %d — a wrong key must not read as an upstream outage",
+			got, http.StatusUnauthorized)
+	}
+	// The message has to name which credential is at fault, or the status code
+	// alone still sends the operator to the wrong place.
+	if !strings.Contains(strings.ToLower(f.Error()), "api key") {
+		t.Errorf("message %q should name the api key as the cause", f.Error())
+	}
+	if !strings.Contains(f.Error(), "/v1/models") {
+		t.Errorf("message %q should list what was tried", f.Error())
+	}
+}
+
+// TestDiscoverModels_UnreachableStaysBadGateway: the classification must not
+// over-correct — an unresolvable host is still the vendor's or the network's
+// problem, not the key's.
+func TestDiscoverModels_UnreachableStaysBadGateway(t *testing.T) {
+	_, err := DiscoverModels(context.Background(), "https://no-such-host-xyz.invalid/v1", "k")
+	if err == nil {
+		t.Fatal("expected a failure for an unresolvable host")
+	}
+	var f *discoveryFailure
+	if !errors.As(err, &f) {
+		t.Fatalf("error should be classified, got %T", err)
+	}
+	if got := f.StatusOrDefault(); got != http.StatusBadGateway {
+		t.Errorf("status = %d, want %d", got, http.StatusBadGateway)
+	}
+	if !strings.Contains(strings.ToLower(f.Error()), "resolve") {
+		t.Errorf("message %q should say the hostname does not resolve", f.Error())
+	}
+}
+
+// TestDiscoveryCandidates_NoDuplicateRequests: base "https://h/v1" with path
+// "/models" and base "https://h" with path "/v1/models" request the SAME URL.
+// Listing it twice in a failure message reads as "two things were tried" when
+// only one was.
+func TestDiscoveryCandidates_NoDuplicateRequests(t *testing.T) {
+	seen := map[string]bool{}
+	for _, c := range discoveryCandidates("https://h/v1") {
+		url := c.baseURL + c.modelsPath
+		if seen[url] {
+			t.Errorf("candidate %q would be requested twice", url)
+		}
+		seen[url] = true
+	}
+	if len(seen) < 2 {
+		t.Errorf("only %d distinct URLs; the search collapsed", len(seen))
+	}
+}
+
+// TestDiscoverModels_FailureListsEachURLOnce is the end-to-end form of the same
+// rule, on the error text an operator actually reads.
+func TestDiscoverModels_FailureListsEachURLOnce(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	defer srv.Close()
+
+	_, err := DiscoverModels(context.Background(), srv.URL+"/v1", "k")
+	if err == nil {
+		t.Fatal("expected failure")
+	}
+	msg := err.Error()
+	needle := srv.URL + "/v1/models"
+	if n := strings.Count(msg, needle); n > 1 {
+		t.Errorf("URL %s appears %d times in %q", needle, n, msg)
+	}
+}
+
 func TestDiscoverModels_EmptyKeyOmitsHeader(t *testing.T) {
 	var present bool
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {