M0+M1: 基建 + 用户/密钥/核心代理

后端 (Go/Gin/GORM):
- 配置(viper+env)、SQLite/Postgres 迁移、argon2id、AES-GCM 渠道密钥、JWT+refresh cookie
- 用户注册/登录/刷新/登出、API Key CRUD(仅存哈希、明文一次展示)
- 代理网关: /v1/chat/completions、/v1/responses、/v1/models 直通 OpenAI 渠道
  非流式+流式(SSE 零缓冲转发), 用量捕获(chat 末块/responses completed 嵌套),
  OpenAI 错误格式(401/402/404/502), 余额检查
- 异步批量记账 + 余额流水 + 日聚合, admin 用户/余额/配置 API
- 单测: crypto/jwt/apikey/流式 usage 提取

前端 (Vue3+TS+Vite+Tailwind v4):
- taste-skill 设计 tokens: 深色仪表盘, 石墨+信号铜色, Outfit+JetBrains Mono
- Landing/登录/注册, 控制台(仪表盘图表/密钥管理/用量明细)
- 基础组件 Button/Input/Badge/Modal, ECharts 用量图

部署: docker-compose(nginx+api+postgres), 双 Dockerfile, nginx SSE 反代
联调: scripts/mockupstream 本地 mock 上游, 端到端验证通过

server/internal/proxy/handlers.go

@@ -0,0 +1,115 @@
+package proxy
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/openteam/server/internal/store"
+)
+
+// chatCompletions POST /v1/chat/completions
+func (g *Gateway) chatCompletions(c *gin.Context) {
+	u, ok := g.resolveUser(c)
+	if !ok {
+		return
+	}
+	if !g.checkBalance(c, u) {
+		return
+	}
+
+	br, body, err := parseBody(c)
+	if err != nil {
+		openAIError(c, http.StatusBadRequest, "invalid_request_error", "failed to read request body")
+		return
+	}
+	c.Set("protocol", "chat")
+	c.Set("model_name", br.Model)
+
+	ch, err := g.ch.Select()
+	if err != nil {
+		openAIError(c, http.StatusServiceUnavailable, "no_channel", "No available upstream channel")
+		g.recordError(c, nil, nil, now(), "no_channel")
+		return
+	}
+
+	sink := &usageSink{}
+	c.Set("usage_raw", &sinkHolder{sink: sink})
+	g.doPassthrough(c, ch, "/v1/chat/completions", body, br.Stream, func(raw json.RawMessage) {
+		sink.push(raw)
+	})
+}
+
+// responses POST /v1/responses（OpenAI Responses API）
+func (g *Gateway) responses(c *gin.Context) {
+	u, ok := g.resolveUser(c)
+	if !ok {
+		return
+	}
+	if !g.checkBalance(c, u) {
+		return
+	}
+
+	br, body, err := parseBody(c)
+	if err != nil {
+		openAIError(c, http.StatusBadRequest, "invalid_request_error", "failed to read request body")
+		return
+	}
+	c.Set("protocol", "responses")
+	c.Set("model_name", br.Model)
+
+	ch, err := g.ch.Select()
+	if err != nil {
+		openAIError(c, http.StatusServiceUnavailable, "no_channel", "No available upstream channel")
+		g.recordError(c, nil, nil, now(), "no_channel")
+		return
+	}
+	// M1 仅支持 OpenAI 原生渠道直通；Anthropic 渠道的转换在 M3
+	if ch.Provider != store.ChannelProviderOpenAI {
+		openAIError(c, http.StatusNotImplemented, "conversion_pending",
+			"Responses protocol on this channel requires format conversion (planned in M3)")
+		return
+	}
+
+	sink := &usageSink{}
+	c.Set("usage_raw", &sinkHolder{sink: sink})
+	g.doPassthrough(c, ch, "/v1/responses", body, br.Stream, func(raw json.RawMessage) {
+		sink.push(raw)
+	})
+}
+
+// usageSinkHolder 桥接：gin context 里保存 sink 引用，供 finishUsage 读取最终 usage。
+type sinkHolder struct {
+	sink *usageSink
+}
+
+// openAIError 按 OpenAI 错误格式返回（PLANNING §4.1.4）。
+func openAIError(c *gin.Context, status int, code, message string) {
+	c.AbortWithStatusJSON(status, gin.H{
+		"error": gin.H{
+			"message": message,
+			"type":    errorTypeFor(status),
+			"param":   nil,
+			"code":    code,
+		},
+	})
+}
+
+func errorTypeFor(status int) string {
+	switch status {
+	case http.StatusUnauthorized:
+		return "authentication_error"
+	case http.StatusForbidden:
+		return "permission_error"
+	case http.StatusNotFound:
+		return "invalid_request_error"
+	case http.StatusBadRequest:
+		return "invalid_request_error"
+	case http.StatusPaymentRequired:
+		return "insufficient_quota"
+	case http.StatusTooManyRequests:
+		return "rate_limit_error"
+	default:
+		return "api_error"
+	}
+}