模型限制: 系统配置全局开放/禁止 + 用户级限制 + 网关拦截

- User 新增 allowed_models/denied_models(用户级模型限制)
- 系统配置 model_allowlist/model_denylist 全局策略, 保存即时失效网关缓存
- 网关 checkModelAllowed: 用户级 > 全局(禁止命中→403, 白名单非空→仅白名单)
- 三个协议处理器均校验, 错误按客户端协议格式返回
- 配置页"模型限制"卡片(全局允许/禁止多选); 用户编辑支持允许/禁止模型

Co-Authored-By: Claude <noreply@anthropic.com>

server/internal/proxy/handlers.go

@@ -23,6 +23,10 @@ func (g *Gateway) chatCompletions(c *gin.Context) {
 	}
 	c.Set("protocol", convert.ProtoChat)
 	c.Set("model_name", br.Model)
+	if !g.checkModelAllowed(u, br.Model) {
+		apiError(c, http.StatusForbidden, "model_not_allowed", "模型未对你开放，请联系管理员")
+		return
+	}
 
 	cands := g.candidateChannels(br.Model)
 	if len(cands) == 0 {
@@ -51,6 +55,10 @@ func (g *Gateway) responses(c *gin.Context) {
 	}
 	c.Set("protocol", convert.ProtoResponses)
 	c.Set("model_name", br.Model)
+	if !g.checkModelAllowed(u, br.Model) {
+		apiError(c, http.StatusForbidden, "model_not_allowed", "模型未对你开放，请联系管理员")
+		return
+	}
 
 	cands := g.candidateChannels(br.Model)
 	if len(cands) == 0 {
@@ -79,6 +87,10 @@ func (g *Gateway) messages(c *gin.Context) {
 	}
 	c.Set("protocol", convert.ProtoMessages)
 	c.Set("model_name", br.Model)
+	if !g.checkModelAllowed(u, br.Model) {
+		apiError(c, http.StatusForbidden, "model_not_allowed", "模型未对你开放，请联系管理员")
+		return
+	}
 
 	cands := g.candidateChannels(br.Model)
 	if len(cands) == 0 {