GitLab

- Use TxPipeline (MULTI/EXEC) instead of Pipeline for atomic INCR+EXPIRE
- Filter negative values in GetBaseRPM(), update test expectation
- Add RPM batch query (GetRPMBatch) to account List API
- Add warn logs for RPM increment failures in gateway handler
- Reset enableRpmLimit on BulkEditAccountModal close
- Use union type 'tiered' | 'sticky_exempt' for rpmStrategy refs
- Add design decision comments for rdb.Time() RTT trade-off

Previously 2K images used the same base price as 1K ($0.134).
Now 2K uses 1.5x multiplier ($0.201), consistent with 4K using 2x ($0.268).

- Backend: add 2K size branch in getDefaultImagePrice
- Frontend: update 2K placeholder from 0.134 to 0.201
- Tests: update assertions for new 2K default price

- Add migration 060 to update model_mapping for all antigravity accounts
- Remove gemini-3-pro-image and gemini-3-pro-image-preview mappings
- Add gemini-3.1-flash-image and gemini-3.1-flash-image-preview mappings
- Update frontend usage window to show GImage for new model
- Update isImageGenerationModel to support new model

PR #635 returned HTTP 200 with {"input_tokens": 0} when upstream doesn't
support count_tokens (404). This caused Claude Code CLI to trust the zero
value, believing context uses 0 tokens, so auto-compression never triggers.

Fix: return 404 with proper error body so CLI falls back to its local
tokenizer for accurate estimation. Return nil (not error) to avoid
polluting ops error metrics with expected 404s.

Affected paths:
- Passthrough APIKey accounts: upstream 404 now passed through as 404
- Antigravity accounts: same fix (was also returning fake 200)

FetchGoogleOneTier 原先在方法内部直接创建 DriveClient 实例，
导致单元测试中对 googleapis.com 发起真实 HTTP 请求，在 CI 环境
产生 401 错误。

将 DriveClient 作为依赖注入到 GeminiOAuthService，遵循项目
端口与适配器架构规范：
- 新增 repository/gemini_drive_client.go 作为 Provider
- 注册到 repository Wire ProviderSet
- 测试中使用 mockDriveClient 替代真实调用

第三方 Anthropic 中转站通常不支持 /v1/messages/count_tokens 端点，
上游返回 404 时降级返回 {input_tokens: 0}，客户端 fallback 到本地估算。

- 仅匹配 404 状态码，语义明确：端点不存在
- 其他错误 (400/429/500) 保留原始处理链和 ops 遥测
- 无需解析错误消息内容，不依赖字符串匹配
- 新增 table-driven 测试覆盖 fallback 和 non-fallback 路径

使用安全的 comma-ok 模式替代裸类型断言，避免 golangci-lint errcheck 报错。
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

新增 jsonMarshalRaw 使用 SetEscapeHTML(false) 替代 json.Marshal，
避免 HTML 字符转义导致客户端无法直接使用返回的 URL。
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

使用 go-sora2api v1.1.0 SDK 替代原有 ~2000 行自建 HTTP/PoW/TLS 指纹代码，
SDK 提供高并发性能优化（实例级 rand、PoW 缓冲区复用、context.Context 支持）。

- 新增 SoraSDKClient 适配器实现 SoraClient 接口
- 精简 sora_client.go 为仅保留接口和类型定义
- 更新 Wire 绑定使用 SoraSDKClient
- 删除 SoraDirectClient、sora_curl_cffi_sidecar、sora_request_guard 等旧代码
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Add claude-sonnet-4-6 to default Antigravity model mapping
- Add antigravity_extra_retries default value in config
- Add cache-dependency-path to CI setup-go for faster builds
- Simplify vitest config to avoid vite plugin compatibility issues

Remove the special case that bypassed model-supported checks for Gemini
API Key accounts, allowing model_mapping to filter requests properly.
Add tests for multiplatform model filtering behavior.

- Use mapped model (billingModel) instead of original request model for billing
- Use resolveFinalAntigravityModelKey for 429 rate limit model key,
  ensuring rate limit records match the actual upstream model
- Add regression tests for both fixes

Add a dedicated CheckMixedChannel endpoint that allows the frontend
to pre-validate mixed channel risk before submitting create/update
requests. This improves UX by showing warnings earlier in the flow
instead of only after form submission.

Backend changes:
- Add CheckMixedChannelRequest struct and CheckMixedChannel handler
- Register POST /check-mixed-channel route
- Expose CheckMixedChannelRisk as public method on AdminService
- Simplify Create/Update 409 responses (remove details/require_confirmation)
- Add comprehensive handler tests and stub methods

Frontend changes:
- Add checkMixedChannelRisk API function and TypeScript types
- Refactor CreateAccountModal to precheck before step transition and submission
- Refactor EditAccountModal to precheck before update submission
- Replace pendingPayload pattern with action-based dialog flow

Extract applyInterceptWarmup utility to unify all credential building
call sites:
- Fix upstream account creation missing intercept_warmup_requests write
- Fix apikey edit mode missing else-branch to clear the setting
- Add backend unit test for IsInterceptWarmupEnabled
- Add frontend unit test for credentialsBuilder

Before this change, when a client disconnected mid-request, the error
message was "Upstream request failed after retries", which is misleading
and pollutes error logs. Now we check context.Err() to return a more
accurate "Client disconnected" message for both Claude and Gemini
forward paths.

- oauth.go: GetUserAgent() 缺少闭合大括号导致语法错误
- client_test.go/oauth_test.go: UserAgent 变量已重构为 GetUserAgent()，更新测试引用
- model_rate_limit_test.go: gemini-3-pro-preview 映射目标已更新为 gemini-3.1-pro-high，同步测试

- 将媒体写入和删除切换为 os.Root 沙箱 API
- 移除旧的路径拼接校验辅助函数并收敛删除逻辑
- 调整并新增相关单元测试覆盖删除行为
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- 新增安全路径拼接校验，确保目标文件仍在下载目录内
- 清理失败下载文件时复用安全校验，避免不安全删除路径
- 增加扩展名白名单归一化与相关单元测试
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- 后端新增绝对重置时间字段计算（codex_5h_reset_at/codex_7d_reset_at）

- 前端统一窗口解析逻辑：绝对时间优先，updated_at+seconds 回退，过期自动归零

- 新增后端与前端单元测试，覆盖关键边界与异常场景

- 将 jwt.access_token_expire_minutes 默认值改为 0，未显式配置时回退 expire_hour

- 调整配置校验为允许 0，仅拒绝负数并补充优先级注释

- 新增配置与认证服务单元测试，覆盖分钟优先与小时回退场景

- 更新示例配置文档，明确分钟/小时优先级与默认行为

- ClearRateLimit 增加清理 temp_unschedulable 与缓存\n- 新增 ClearRateLimit 相关单元测试覆盖成功与失败分支