修复自动故障转移中的供应商凭证串号

[wplct]

问题

自动故障转移准备阶段会读取 live 配置并生成多个供应商快照，但 live 配置本身没有可靠的供应商归属。旧实现会把 live 中的 token 反向同步到 effective current provider，导致供应商 A 的 OPENAI_API_KEY 永久覆盖供应商 B 的持久化配置。

Codex 快照合并还可能把 live auth 中的 API key 带入其他供应商的 snapshot；升级前已经缓存的 snapshot 也不会自动修复。

修复

• 自动故障转移生成原始 live backup 时不再反向写入 provider 凭证。
• auto_failover_enabled=true 时禁止 live token 同步回 current provider。
• Codex failover snapshot 的 auth.OPENAI_API_KEY 强制来自目标 provider：
  • 目标 provider 有 key 时覆盖 snapshot 中的 key；
  • 目标 provider 无 key 时删除 snapshot 中遗留的 key。
• 缓存命中时同样执行 key 归一化并持久化修复结果。
• 保留 upstream v5.10.1 的 Codex bearer、OAuth、统一会话、model config 刷新，以及 Claude provider-owned env reconcile 行为。
• 自动故障转移关闭时仍保留原有的 live token -> current provider 同步能力。

测试

• live 使用供应商 A key、effective current 为供应商 B 时，两家 provider 配置均不会被改写。
• 每个 failover snapshot 的 key 与目标 provider 一致。
• official OAuth 登录材料会保留，但不会继承 foreign API key。
• 旧缓存 snapshot 会删除不属于目标 provider 的 key，同时继续刷新上游 model/MCP 配置。
• 非自动故障转移且配置多个队列供应商时，手动 takeover 仍会同步 live token。

安全说明

PR 和测试仅使用占位 key，不包含真实凭证。

Problem

Automatic failover reads the live configuration while preparing snapshots for multiple providers, but the live configuration has no reliable provider identity. The previous implementation synchronized the live token back into the effective current provider, allowing provider A's OPENAI_API_KEY to permanently overwrite provider B's stored configuration.

Codex snapshot merging could also carry a live API key into another provider's snapshot, and stale cached snapshots were not repaired after upgrade.

Fix

• Stop synchronizing live credentials while creating the original automatic-failover backup.
• Block live-token-to-current-provider synchronization while auto_failover_enabled=true.
• Force each Codex failover snapshot's auth.OPENAI_API_KEY to come from its target provider:
  • replace the snapshot key when the provider has one;
  • remove a stale snapshot key when the provider has none.
• Apply the same normalization to cached snapshots and persist repaired cache entries.
• Preserve upstream v5.10.1 behavior for Codex bearer auth, OAuth, unified sessions, model-config refresh, and Claude provider-owned environment reconciliation.
• Preserve the existing live-token synchronization behavior for non-automatic/manual takeover mode.

Tests

• With provider A's key in live config and provider B as effective current, neither stored provider is overwritten.
• Every failover snapshot keeps the key of its target provider.
• Official OAuth login material is preserved without inheriting a foreign API key.
• Cached snapshots drop foreign keys while continuing to refresh upstream model and MCP configuration.
• Manual takeover still synchronizes the live token when automatic failover is disabled, even with multiple queued providers.

Security note

The PR and tests use placeholder credentials only. No real key is included.