GitLab

测试数据使用的 session ID "abc-123" 不符合 ParseMetadataUserID
要求的 36 字符 UUID 格式，替换为合法 UUID。

feat(admin): 分组管理列表新增用量、账号分类与容量列

feat(subscriptions): 订阅管理页面添加教程指南弹窗

Claude Code v2.1.78 起将 metadata.user_id 从拼接字符串改为 JSON：
旧: user_{hex}_account_{uuid}_session_{uuid}
新: {"device_id":"...","account_uuid":"...","session_id":"..."}

新增集中解析/格式化模块 metadata_userid.go：
- ParseMetadataUserID: 自动识别两种格式，提取 DeviceID/AccountUUID/SessionID
- FormatMetadataUserID: 根据 UA 版本输出对应格式（>= 2.1.78 输出 JSON）
- ExtractCLIVersion: 从 UA 提取版本号，消除与 ClaudeCodeValidator.ExtractVersion 的重复

修改消费者统一使用新模块：
- claude_code_validator: 用 ParseMetadataUserID 替代只匹配旧格式的 userIDPattern
- identity_service: RewriteUserID/WithMasking 增加 fingerprintUA 参数，
  解析用 ParseMetadataUserID，输出用 FormatMetadataUserID（版本感知）
- gateway_service: GenerateSessionHash 用 ParseMetadataUserID 提取 session_id，
  buildOAuthMetadataUserID 用 FormatMetadataUserID 输出版本匹配格式，
  两处 RewriteUserIDWithMasking 调用传入 fp.UserAgent
- account_test_service: generateSessionString 改用 FormatMetadataUserID，
  自动跟随 DefaultHeaders UA 版本

删除三个旧正则: userIDPattern, userIDRegex, sessionIDRegex
统一 hex 匹配为 [a-fA-F0-9]，修复旧 userIDRegex 只匹配小写的不一致

在订阅管理页面工具栏添加教程指南按钮（? 图标），点击弹出模态框，
引导管理员完成订阅功能的完整使用流程：

- 步骤一：创建订阅分组（含跳转分组管理链接）
- 步骤二：分配订阅给用户（搜索用户、选择分组、设置有效期）
- 步骤三：管理已有订阅（调整/重置配额/撤销操作说明表格）
- 底部提示：说明下拉列表为空时的解决方案

弹窗样式参照 BackupView 的 R2 Guide 模态框实现，保持 UI 一致性。
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

在 en.ts 中为订阅管理页面新增 guide 相关翻译词条，
与中文翻译保持结构一致，支持中英文切换。
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

在 zh.ts 中为订阅管理页面新增 guide 相关翻译词条，包括：
- 教程弹窗标题与副标题
- 三步操作引导文案（创建分组、分配订阅、管理订阅）
- 操作说明表格（调整/重置配额/撤销）
- 底部提示信息
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

复用 GroupCapacityService，在 admin 分组列表中添加容量列，
显示每个分组的实时并发/会话/RPM 使用量和上限。
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

分组管理列表增强：

1. 今日/累计用量列：
   - 新增独立端点 GET /admin/groups/usage-summary
   - 一次查询返回所有分组的今日费用和累计费用（actual_cost）
   - 前端异步加载后合并显示在分组列表中

2. 账号数区分可用/限流/总量：
   - 将账号数列从单一总量改为 badge 内多行展示
   - 可用: active + schedulable 的账号数（绿色）
   - 限流: rate_limit/overload/temp_unschedulable 的账号数（橙色，无限流时隐藏）
   - 总量: 全部关联账号数
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

 fix(settings): remove pattern attribute blocking Claude Code version save fix issue #1081

feat: 个人资料弹窗 GitHub 链接仅对管理员可见

  fix(usage): use real reset header for 5h session window countdown fix issue #1064 #1065

目前作者已有商业站信息，面向管理可提供赞助渠道，面向普通用户请考虑提供信息隐藏措施

The `pattern="\d+\.\d+\.\d+"` on the min_claude_code_version input caused
the browser's native HTML5 form validation to silently block form submission
when the value was invalid or when the hidden gateway tab was active. This
resulted in no network request being sent when clicking Save on any tab.

Backend already validates semver format and returns a proper 400 error,
so the frontend pattern attribute is redundant.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Add compile-time interface assertion for sessionWindowMockRepo
- Fix flaky fallback test by capturing time.Now() before calling UpdateSessionWindow
- Replace stale hardcoded timestamps with dynamic future values
- Add millisecond detection and bounds validation for reset header timestamp
- Use pause/resume pattern for interval in UsageProgressBar to avoid idle timers on large lists
- Fix gofmt comment alignment
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix(proxy): encode special chars in proxy credentials

fix(auto setup): 修复初始测试连接硬编码问题导致使用自定义数据库测试失败无法执行 auto setup流程

refactor(antigravity): unify TestConnection with dispatch retry loop

feat(dashboard): add per-user drill-down for distribution charts

fix(oauth): extract system-role input items into instructions field fix issue #1066

fix(openai): use /usage as single source and zero expired codex windows

feat(frontend): set last 24h as default range in Usage and Dashboard

feat(backup): 备份/恢复异步化，解决 504 超时

TestConnection now reuses antigravityRetryLoop instead of a standalone
HTTP loop, gaining credits overages, smart retry, and 429/503 backoff
for free. AccountSwitchError is caught and surfaced as a friendly
message. Also populates RateLimitedModel in TempUnscheduled switch error.

Test fixes:
- Use RATE_LIMIT_EXCEEDED in 503 short-delay test to avoid 60x1s timeout
- Clamp waitDuration=0 instead of 999s to avoid 15s max-wait timeout
- Enhance mockSmartRetryUpstream with repeatLast and body caching

The expanded user breakdown rows already align with the parent table
columns (Requests, Token, Actual, Standard), so the repeated sub-header
wastes vertical space. Remove the <thead> from UserBreakdownSubTable.

Handler tests (9 cases): group_id/model/endpoint filters, default
endpoint_type, custom limit, limit clamping, response format,
empty result, no-filter pass-through.

Repository test: resolveEndpointColumn mapping for inbound/upstream/path.

Click on a group name, model name, or endpoint name in the distribution
tables to expand and show per-user usage breakdown (requests, tokens,
actual cost, standard cost).

Backend: new GET /admin/dashboard/user-breakdown API with group_id,
model, endpoint, endpoint_type filters.
Frontend: clickable rows with expand/collapse sub-table in all three
distribution charts.

The 5h window reset time displayed for Setup Token accounts was inaccurate
because UpdateSessionWindow predicted the window end as "current hour + 5h"
instead of reading the actual `anthropic-ratelimit-unified-5h-reset` response
header. This caused the countdown to differ from the official Claude page.

Backend: parse the reset header (Unix timestamp) and use it as the real
window end, falling back to the hour-truncated prediction only when the
header is absent. Also correct stale predictions when a subsequent request
provides the real reset time.

Frontend: add a reactive 60s timer so the reset countdown in
UsageProgressBar ticks down in real-time instead of freezing at the
initial value.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

OAuth upstreams (ChatGPT) reject requests containing role:"system" in
the input array with HTTP 400 "System messages are not allowed". Extract
such items before forwarding and merge their content into the top-level
instructions field, prepending to any existing value.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

POST /backups 和 POST /backups/:id/restore 改为异步：立即返回 HTTP 202，
后台 goroutine 独立执行 pg_dump → gzip → S3 上传，前端每 2s 轮询状态。

后端:
- 新增 StartBackup/StartRestore 方法，后台 goroutine 不依赖 HTTP 连接
- Graceful shutdown 等待活跃操作完成，启动时清理孤立 running 记录
- BackupRecord 新增 progress/restore_status 字段支持进度和恢复状态追踪

前端:
- 创建备份/恢复后轮询 GET /backups/:id 直到完成或失败
- 标签页切换暂停/恢复轮询，组件卸载清理定时器
- 正确处理 409（备份进行中）和轮询超时
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix(antigravity): add stream keepalive to prevent connection drops

Docker named volumes and host bind-mounts may be owned by root,
causing "open data/model_pricing.sha256: permission denied" when
the container runs as the non-root sub2api user.

Add an entrypoint script that fixes /app/data ownership before
dropping to sub2api via su-exec. Replace USER directive with the
entrypoint approach across all three Dockerfiles and update both
GoReleaser configs to include the script in Docker build contexts.

fix(i18n): correct usage label from "Total" to "Last 30d"

The usage stats query defaults to a 30-day rolling window, but the
UI label said "Total"/"累计" implying lifetime aggregation. Rename
to "Last 30d"/"近30天" so the label matches the actual query semantics.

Closes #1060