refactor: complete backend rewrite for multi-protocol proxy

Major rewrite of the Go backend to support:
- Three API format imports: openai, anthropic, compatible
- Three protocol conversions: Chat Completions, Responses, Messages
- Hub-and-spoke architecture with Chat as intermediate format

Deleted:
- opencat.go (old entry)
- store/, team/, pkg/team/, pkg/store/ (old data layer)
- internal/model/, internal/consts/ (old types)
- internal/service/team/, internal/controller/team/ (old handlers)
- llm/ (removed LLM client library, pure proxy mode)
- dist/, assets/ (old build artifacts)

Added:
- internal/store/ — 9 GORM models + multi-DB support
- internal/pkg/ — crypto (AES-GCM), apikey, jwt, ratelimit, resp, tokenizer
- internal/channel/ — channel selection, weighted LB, health checks
- internal/proxy/convert/ — 6 protocol conversion functions + SSE streaming
- internal/proxy/ — gateway with request dispatch and upstream selection
- internal/usage/ — async usage recorder with batch writes
- internal/api/ — management API (auth, users, keys, channels, models)
- Makefile for build/test/deploy

Fixed API to match frontend expectations:
- Login response wraps token in { data: { token } }
- GET /api/profile route added
- Profile response wraps user in { code, data }
- Role returned as number (10=admin, 1=user)

middleware/auth_llm.go

@@ -0,0 +1,67 @@
+package middleware
+
+import (
+	"net/http"
+	"opencatd-open/internal/store"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+)
+
+func AuthLLM(db *gorm.DB) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		authToken := c.GetHeader("Authorization")
+		if authToken == "" {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
+				"error": map[string]interface{}{
+					"message": "未提供认证信息",
+					"type":    "invalid_request_error",
+				},
+			})
+			return
+		}
+
+		// Extract API key from Bearer token
+		if len(authToken) > 7 {
+			authToken = authToken[7:]
+		}
+
+		// Find API key by prefix
+		var apiKey store.APIKey
+		if err := db.Where("key_prefix = ? AND status = ?", authToken[:8], store.KeyStatusActive).First(&apiKey).Error; err != nil {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
+				"error": map[string]interface{}{
+					"message": "无效的API密钥",
+					"type":    "invalid_request_error",
+				},
+			})
+			return
+		}
+
+		// Verify full key hash
+		keyHash := store.HashAPIKey(authToken)
+		if apiKey.KeyHash != keyHash {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
+				"error": map[string]interface{}{
+					"message": "无效的API密钥",
+					"type":    "invalid_request_error",
+				},
+			})
+			return
+		}
+
+		c.Set("api_key", &apiKey)
+		c.Set("user_id", apiKey.UserID)
+		c.Next()
+	}
+}
+
+// extractAPIKey extracts the API key from the Authorization header
+func extractAPIKey(c *gin.Context) string {
+	auth := c.GetHeader("Authorization")
+	if strings.HasPrefix(auth, "Bearer ") {
+		return auth[7:]
+	}
+	return auth
+}