feat(plugins): 给 Lua 插件加受限出站 HTTP（__llmsproxy_http）

billing 插件从不主动出站——它报告的一切都随网关转发请求时的 hook payload
一起到达。额度插件是第一个必须自己发请求的东西：套餐余量不主动问就拿不到。

问题在于这恰好是插件模型最锋利的边。插件是 WebUI 文本框里装进来的单个
.lua 文件，跑在网关进程里：给它一个通用 HTTP 客户端，等于让每次安装都成为
一件常备的 SSFP 工具，还顺带打开了读环境变量拿凭据的第二扇门。

所以这个桥刻意做窄：

- 目标必须命中某个「已配置源」已经在通信的主机。那些是运维声明过的，
  不是插件声明的——插件无法靠编一个 URL 扩大自己的触及面，而源的主机
  正是本部署已经愿意交付 API key 的那批上游。
- 非 loopback 主机上拒绝明文 http。凭据只该走 HTTPS。
- loopback 免登记：它出不了本机，而 billing 规则页读网关自己的 API 正是
  这么做的。
- 每请求都有超时、响应体有 4MiB 上限，插件无法占死 worker 或吃光内存。
- 绝不从环境变量读凭据。需要 key 的插件必须被显式给（state 或调用方配置），
  这样授权对运维可见，而不是环境里默默存在的东西。
- 不跟随重定向：白名单是逐跳检查的，跟随就等于绕过它，3xx 原样返回。

能力只装在插件运行时（bootPluginState），不装进 setupGlobals——后者被
adapter 池共用，adapter 是运维的配置而非安装的代码。

判据 8 条钉的是拒绝路径而非快乐路径：未登记主机（含 169.254.169.254、
后缀欺骗 api.example.com.evil.test）、明文 http、空名单必须全拒、不得跟随
重定向、超时与响应体被钳制、超大响应宁可报错也不截断（截断会解析成损坏
JSON，插件会报解析错而不是真因）。

测试当场抓到一个真 bug：loopback 被白名单一起拦了，与代码注释里「loopback
免登记」自相矛盾。变异（把主机检查换成 if false）被 3 条判据抓住。

Co-Authored-By: ModelRouter <noreply@modelrouter.dev>
(cherry picked from commit 0fbb8e5e88)

internal/lua/plugins.go

@@ -231,6 +231,10 @@ type Plugins struct {
 	// stateDirDisabled turns persistence off. Used by tests that assert state
 	// starts empty, and by an embedder that has no writable plugin dir.
 	stateDirDisabled bool
+	// allowHTTP bounds plugin outbound requests to operator-declared hosts.
+	// nil means deny-all: an unconfigured gateway must not silently grant a
+	// plugin unrestricted network access.
+	allowHTTP *httpAllowlist
 	// save coalesces state writes into one background goroutine.
 	//
 	// A hook must NOT write synchronously: the billing plugin mutates state on
@@ -412,6 +416,10 @@ func NewPlugins(vm *VM, dir string) *Plugins {
 		stageFuncs: map[Stage][]hookCall{},
 		hookErr:    newHookErrors(),
 		dir:        dir,
+		// Deny-by-default. NewPlugins is called during wiring, before any
+		// source list is known; SetOutboundHosts replaces this with the real
+		// set. A plugin loaded in that window simply cannot make requests.
+		allowHTTP: newHTTPAllowlist(nil),
 	}
 	// The saver is started even with no dir: a gateway can be given a plugin dir
 	// later, and a saver that only exists when dir != "" would silently never
@@ -429,6 +437,27 @@ func NewPlugins(vm *VM, dir string) *Plugins {
 // DisableStatePersistence turns persistence off (tests/benchmarks only).
 func (ps *Plugins) DisableStatePersistence() { ps.stateDirDisabled = true }
 
+// SetOutboundHosts declares which hosts plugins may contact via
+// __llmsproxy_http. The gateway passes the host of every configured source:
+// those are operator-declared upstreams, and reusing that set keeps a plugin's
+// reach no wider than the deployment already trusts. An empty list means no
+// outbound host is allowed at all — plugins then still load, they just cannot
+// make requests.
+func (ps *Plugins) SetOutboundHosts(hosts []string) {
+	ps.mu.Lock()
+	defer ps.mu.Unlock()
+	ps.allowHTTP = newHTTPAllowlist(hosts)
+}
+
+// outboundAllowlist returns the current allowlist. bootPluginState reads it
+// before any concurrent reload can swap it, and a nil result is treated as
+// "deny everything" rather than "allow everything".
+func (ps *Plugins) outboundAllowlist() *httpAllowlist {
+	ps.mu.RLock()
+	defer ps.mu.RUnlock()
+	return ps.allowHTTP
+}
+
 func (ps *Plugins) Close() {
 	if ps == nil {
 		return
@@ -496,10 +525,17 @@ func (ps *Plugins) SeedBundled() error {
 // bootPluginState compiles one plugin into a fresh Lua state and stores its
 // returned table under pluginGlobal. It is the plugin counterpart of
 // adapterPool.boot, minus the pooling: a plugin keeps exactly one state.
-func bootPluginState(code, name string) (*worker, error) {
+func bootPluginState(code, name string, allow *httpAllowlist) (*worker, error) {
 	L := golua.NewState()
 	L.OpenLibs()
 	setupGlobals(L)
+	// Only plugins get __llmsproxy_http. Adapters are operator-supplied config
+	// and go through setupGlobals too, so installing the bridge here — not in
+	// setupGlobals — is what keeps the capability scoped to installed .lua
+	// files.
+	if allow != nil {
+		registerFn(L, "httpGlobal", luaHTTPFn(L, allow))
+	}
 	if err := L.DoString(code); err != nil {
 		L.Close()
 		return nil, fmt.Errorf("compile plugin %s: %w", name, err)
@@ -537,7 +573,7 @@ func (ps *Plugins) LoadSource(name, code string) error {
 	// One state, held for the plugin's lifetime (see Plugin.state): a hook that
 	// accumulates into plugin.state would otherwise split its totals across
 	// whichever worker it happened to run on.
-	w, err := bootPluginState(code, name)
+	w, err := bootPluginState(code, name, ps.outboundAllowlist())
 	if err != nil {
 		p.LoadError = err.Error()
 		ps.append(p)