feat: add embeddings support for runtime API keys

[icebear0828]

Summary

• add API key capabilities and preserve legacy keys as chat-only
• add OpenAI-compatible /v1/embeddings proxy for OpenAI/OpenRouter/custom runtime keys
• keep runtime upstream router active when keys are added after startup and require proxy API key auth for chat direct upstreams
• add API Keys UI capability selection plus manual model input

Verification

• npx vitest run tests/unit/routes/upstream-auth-bypass.test.ts tests/unit/proxy/upstream-router-bootstrap.test.ts tests/unit/auth/api-key-pool.test.ts tests/unit/routes/api-keys.test.ts tests/unit/routes/embeddings.test.ts
• cd web && npx vitest run src/components/ApiKeyManager.test.tsx
• npm test
• npm run build
• git diff --check
• real OpenRouter embeddings route-level E2E: 3 consecutive 200 responses with 1536-d vectors

[icebear0828]

功能实现扎实、测试覆盖到位，两点建议先处理：

[S1, breaking] src/routes/chat.ts:170-201 改变了 kind=api-key/kind=adapter 直连路径的鉴权——原来绕过 proxy_api_key，现在强制校验（test 名翻转可证）。这对当前依赖 bypass 的客户端是 401 breaking。建议 CHANGELOG 加显式 BREAKING 段，并在 release notes 强调。

[M3] src/routes/embeddings.ts resolveEmbeddingEntry 调 acquireByModelAndCapability 会 mutate lastUsedAt，但之后才判定 provider 是否支持（anthropic/gemini 返回 400）。400 路径也污染轮转。调成先 validate provider 再 acquire。

非阻塞 follow-up：

• M1: return new Response(await upstream.text(), ...) 全 buffer 再重包，批量 embeddings 浪费，能直接 pipe upstream.body 更好
• M2: fetch() 上游没 try/catch，DNS/TLS/connect 错落到默认 500 而非 OpenAI-shaped error