feat(routing): 完善平台满载避让与故障轮转

为未配置并发上限的平台增加基于运行和等待任务数的软负载，并按非满载、有效优先级、缓存亲和与负载稳定排序。\n\n平台模型 RPM、TPM 和并发额度竞争失败时只轮转候选，不触发冷却、禁用或降级；用户组额度保持不可绕过。补齐异步冷却排队恢复、满载原因、选择原因与低基数指标。\n\n验证：go test ./...；go vet ./...；PostgreSQL 原子额度、准入队列、Worker 容量回收及故障策略 HTTP acceptance。

apps/api/internal/httpapi/handlers.go

@@ -1202,14 +1202,18 @@ func (s *Server) createTask(kind string, compatible bool) http.Handler {
 			return
 		}
 		if err := s.runner.ValidateModelAccess(r.Context(), kind, model, prepared.Body, user); err != nil {
-			if errors.Is(err, store.ErrNoModelCandidate) {
+			if responsePlan.asyncMode && store.ModelCandidateRetryAfter(err) > 0 {
+				// Persist recoverable asynchronous requests so the shared queue can
+				// wake them when the earliest candidate cooldown expires.
+			} else if errors.Is(err, store.ErrNoModelCandidate) {
 				applyRunErrorHeaders(w, err)
 				writeTaskError(statusFromRunError(err), runErrorMessage(err), runErrorDetails(err), runErrorCode(err))
 				return
+			} else {
+				s.logger.Error("validate model access failed", "kind", kind, "error_category", "model_access_validation_failed", "error", err)
+				writeTaskError(http.StatusInternalServerError, "validate model access failed", nil, "model_access_validation_failed")
+				return
 			}
-			s.logger.Error("validate model access failed", "kind", kind, "error_category", "model_access_validation_failed", "error", err)
-			writeTaskError(http.StatusInternalServerError, "validate model access failed", nil, "model_access_validation_failed")
-			return
 		}
 
 		runMode, err := s.admittedTaskRunMode(admission, prepared.Body)