feat(cli): M3 resource management — combo, provider-node, provider-models, provider/key/pool extensions, models registry

[quangdang46]

Summary

Implements PLAN v3 mục 4 + 10 (M3 Resource Management) as 1 PR đầy đủ. Adds ~47 subcommands across 7 command groups so an agent can manage every resource through CLI alone. OAuth deferred to M4 per the chốt decision.

New / extended command groups

Group	Subcommands
openproxy combo	list / get / create / edit / delete / enable / disable / test / apply
openproxy provider node	list / get / add / edit / delete / validate
openproxy provider models	list / test / alias set / alias list / alias unset / disable / enable / custom add / custom remove / custom list
openproxy provider … (extended)	get / edit / delete / enable / disable / test / validate / client-info / apply
openproxy key … (extended)	get / rotate / delete / enable / disable / apply
openproxy pool … (extended)	get / edit / enable / disable / test / stats / apply
openproxy models (top-level)	list / info / test / pricing

Robot envelopes & idempotency

• Every command supports --robot. Schemas use openproxy.v1.<resource>.<verb>.
• apply semantics per PLAN mục 6.3: default = upsert; --prune adds deleted.
• delete exits 0 when missing unless --strict.
• Exit codes per PLAN mục 6.2: 0 ok, 3 not_found, 4 conflict, 6 network, 7 validation.

Plumbing

• src/cli/apply.rs: shared load_document / into_items / ApplyDiff for combo/provider/key/pool apply.
• src/server/api/providers.rs::test_provider_api made pub(crate).
• src/cli/schema.rs registers custom-model + model-alias resources.
• Cargo.toml: added serde_yml = "0.0.12".

Tests (local)

• cargo fmt --all --check clean
• cargo test --lib → 375 passed, 0 failed (added unit tests in provider_models, apply, combo)
• cargo test --tests → all integration suites green

Review & Testing Checklist for Human

Risk: yellow — additive only, but broad surface (~3.5k LoC, ~47 subcommands).

• Skim src/cli/apply.rs and confirm upsert + prune envelope matches PLAN mục 6.3.
• Spot-check 2–3 --robot envelopes against schema names (combo.list, provider.get, pool.stats).
• End-to-end on your box:

cargo build --bin openproxy
export DATA_DIR=$(mktemp -d)
./target/debug/openproxy --robot combo create --name fb1 --models openai/gpt-4o,anthropic/claude-3-haiku
./target/debug/openproxy --robot provider models alias set openai gpt-4o-mini fast
./target/debug/openproxy --robot models list --provider openai

• Verify the server still auto-reloads db.json after CLI apply/edit/delete.
• Confirm OAuth is intended to land in M4 (not this PR).

Notes

• provider node validate probes /models (or /embeddings) with no auth header.
• provider test reuses the dashboard's test_provider_api so behavior stays in sync with the UI.
• pool test defaults to https://httpbin.org/get; override with --target.
• Pre-existing whoami::hostname deprecation + a couple of unused imports remain — not touched.