refactor(quota): 配额改为按模型，删除整钥总配额

用户明确要求：配额应当是密钥对应的**每个模型的单独配额**，而非整体配额。

## 语义变更

删除 GWKey.TokenQuota / ReqQuota / Period / Hours（整钥总额）。
ModelScope 新增 ReqQuota —— 请求数配额下沉到每条模型范围。

现在：每条 models[] 各自带 token 配额 + 请求数配额 + 重置周期，
彼此独立。一个模型用满只影响该模型。

★ 为什么不保留整钥总额：它会让「把 A 模型的额度挪给 B」变成一次全局
重分配；按模型独立计费则每个模型各自可控，运维能直接看出哪个模型在吃预算。

## 连带改动

- checkQuota 合并 key 级与 scope 级判定；checkKeyQuotaRetry 整体删除
  （顺带修掉上轮遗留的双重判定：入口不再先判空再重算）
- core：CreateKeyWithQuota / UpdateKeyWithQuota / ApplyQuota 全部删除，
  改由 ValidateScopeQuotas 校验每条 scope 的配额
- admin key：scope 上的配额不强制（admin 的 scope 仍限制模型范围，
  但不强制配额）—— 否则管理员会把自己锁在门外
- /api/v1/keys 不再回显 key 级配额字段（scope 里已含）
- WebUI：删除整钥配额徽标 / 「配额」按钮 / 创建表单的配额组 /
  putScope 的整钥回传；模型砖块与范围编辑器新增「请求数配额」输入，
  徽标显示 `1.0K 77×·1h`（未设配额显示 ∞）

## 判据

- TestOneModelsQuotaDoesNotBlockAnother 是本次核心保证。
  ★ 它第一版是**假判据**：m2 从不消耗，key-wide 计数器与 m1 自己的计数器
  读数恰好相同，退回 key-wide 仍通过。变异测试抓到后改为「先用 m2 花掉
  远超 m1 配额的量，再验证 m1 仍可用」—— 这样两种设计才可区分。
- TestUncappedModelNeverBlocked / TestAdminKeyScopesAreNotEnforced 新增
- UI 契约判据重写：整钥配额界面必须彻底消失（13 个符号）、
  scope 编辑器必须往返 req_quota、putScope 只发 scope 列表
- 错误消息点名具体模型（TestKeyAPIRejectionNamesTheModel）
- 3/3 变异全被抓

实测（真实进程 + 浏览器）：m2 配额 500000 连打 25 次全成功，
m1 配额 1000 立即 429「token quota exceeded for "m1" (4315/1000)」，
此后 m2/m3 仍 200。UI：整钥配额元素全为 0，砖块各显配额，
编辑器预填/保存正确，零 JS 异常。

(cherry picked from commit c51066f0b6)

internal/core/core.go

@@ -249,20 +249,17 @@ func (c *Core) FindKey(key string) (config.GWKey, bool) {
 }
 
 // CreateKey builds a new random gateway key and persists it to config.yaml.
+// Quotas live on the model scope entries, so a new key's budget is whatever
+// its scopes carry.
 func (c *Core) CreateKey(name, role string, models []config.ModelScope, note string) (config.GWKey, error) {
-	return c.CreateKeyWithQuota(name, role, models, note, config.KeyQuota{})
-}
-
-// CreateKeyWithQuota is CreateKey plus the key-wide token/request caps.
-func (c *Core) CreateKeyWithQuota(name, role string, models []config.ModelScope, note string, q config.KeyQuota) (config.GWKey, error) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	models = cleanScopes(models)
-	key := make([]byte, 16)
-	if _, err := rand.Read(key); err != nil {
+	if err := ValidateScopeQuotas(models); err != nil {
 		return config.GWKey{}, err
 	}
-	if err := q.Validate(); err != nil {
+	key := make([]byte, 16)
+	if _, err := rand.Read(key); err != nil {
 		return config.GWKey{}, err
 	}
 	rec := config.GWKey{
@@ -274,7 +271,6 @@ func (c *Core) CreateKeyWithQuota(name, role string, models []config.ModelScope,
 		CreatedAt: time.Now().Unix(),
 	}
 	rec.Role = config.NormalizeRole(rec.Role)
-	rec.ApplyQuota(q)
 	c.cfg.Keys = append(c.cfg.Keys, rec)
 	if err := c.saveConfig(); err != nil {
 		return config.GWKey{}, err
@@ -282,19 +278,13 @@ func (c *Core) CreateKeyWithQuota(name, role string, models []config.ModelScope,
 	return rec, nil
 }
 
-// UpdateKey mutates a key's name/role/model scope and persists it.
+// UpdateKey mutates a key's name/role/model scope and persists it. The scope
+// entries carry their own quotas, so replacing the scope replaces the budgets.
 func (c *Core) UpdateKey(key, name, role string, models []config.ModelScope, note string) (config.GWKey, error) {
-	return c.UpdateKeyWithQuota(key, name, role, models, note, nil)
-}
-
-// UpdateKeyWithQuota is UpdateKey plus the key-wide caps. quota == nil leaves
-// the existing caps untouched, so a caller that only edits the model scope
-// does not silently clear a key's budget.
-func (c *Core) UpdateKeyWithQuota(key, name, role string, models []config.ModelScope, note string, quota *config.KeyQuota) (config.GWKey, error) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
-	if quota != nil {
-		if err := quota.Validate(); err != nil {
+	if models != nil {
+		if err := ValidateScopeQuotas(models); err != nil {
 			return config.GWKey{}, err
 		}
 	}
@@ -312,9 +302,6 @@ func (c *Core) UpdateKeyWithQuota(key, name, role string, models []config.ModelS
 				c.cfg.Keys[i].Models = cleanScopes(models)
 			}
 			c.cfg.Keys[i].Note = note
-			if quota != nil {
-				c.cfg.Keys[i].ApplyQuota(*quota)
-			}
 			if err := c.saveConfig(); err != nil {
 				return config.GWKey{}, err
 			}
@@ -798,3 +785,20 @@ func (c *Core) Close() {
 		c.vm.Stop()
 	}
 }
+
+// ValidateScopeQuotas checks every scope entry's caps before they are stored.
+// A typo in a period must be rejected at write time rather than silently
+// becoming a never-resetting budget — the opposite of what was typed.
+func ValidateScopeQuotas(entries []config.ModelScope) error {
+	for _, e := range entries {
+		if err := (config.KeyQuota{
+			TokenQuota: e.TokenQuota,
+			ReqQuota:   e.ReqQuota,
+			Period:     e.Period,
+			Hours:      e.Hours,
+		}).Validate(); err != nil {
+			return fmt.Errorf("model %q: %w", e.Model, err)
+		}
+	}
+	return nil
+}