feat(quota): unify OAuth and API balance lookup

[starrylistener]

Overview

Move quota lookup out of the OAuth sub-navigation into a dedicated top-level page immediately after API Access. The page separates OAuth quota usage from API balances and uses the application's existing credential card and category icon styles.

API balance lookup

Support DeepSeek, StepFun, SiliconFlow, OpenRouter, and Novita credentials from the existing API Access configuration. Each OpenAI-compatible API key has its own quota card.

Opening the page loads credential metadata only. Balance requests run when the user refreshes a credential or selects Refresh All, with bounded concurrency.

Custom balance endpoints

Allow an optional balance query URL in both the API Access create/edit dialog and the quota card settings dialog.

• Require HTTPS for remote hosts and allow HTTP only for loopback addresses.
• Reject embedded URL credentials, unsupported endpoints, and conflicting providers.
• Store endpoint metadata in GUI configuration using hashed record identities, without persisting plaintext API keys in that metadata.
• Keep unsupported balance fields out of the core provider configuration.
• Apply a saved endpoint to every credential belonging to the same API Access record.

Request and cache correctness

• Include the effective balance endpoint in each API quota cache key, so changes made from either settings entry point invalidate old balances for every affected key.
• Apply saved endpoint changes immediately and reject responses from obsolete requests.
• Isolate OAuth and API cache generations for both individual and batch refreshes. Reloading authentication files cannot discard unrelated API results or leave those requests loading indefinitely.
• Skip obsolete queued requests and prevent stale source-list responses from overwriting newer state.
• Preserve negative OpenRouter balances, redact direct API keys from upstream errors, and retain existing OAuth quota reset behavior.

Management API loading

Check management access before sequentially reading enriched provider records with runtime auth-index values.

Authentication or authorization failures stop subsequent reads immediately. Ordinary provider failures are reported while healthy API sources and OAuth credentials remain available. Malformed balance metadata is isolated per record, preserving saved endpoints for other records. Provider write operations continue to require complete configuration reads.

Interface and localization

• Separate OAuth accounts and API credentials in a responsive two-column layout.
• Reuse the owning API Access category's icon and show an API Key badge beside the credential name.
• Emphasize remaining balances and provide a compact settings action.
• Provide a balance settings dialog with keyboard handling and focus management.
• Localize balance configuration and management HTTP error labels in Simplified Chinese, Traditional Chinese, English, and Japanese, while retaining server error details.

Verification

• Full frontend suite: 314 passed, 1 browser-only test skipped.
• Regression coverage for shared endpoint invalidation, late responses, cross-namespace batch refreshes, queued requests, partial loading, authentication failures, malformed metadata, and four-locale error messages.
• TypeScript and production frontend build passed.
• Rust balance metadata tests: 3 passed.
• Real-browser checks with mocked IPC verified shared endpoint changes and rejection of late responses.
• git diff --check passed.