feat(routing): 完善平台满载避让与故障轮转

为未配置并发上限的平台增加基于运行和等待任务数的软负载，并按非满载、有效优先级、缓存亲和与负载稳定排序。\n\n平台模型 RPM、TPM 和并发额度竞争失败时只轮转候选，不触发冷却、禁用或降级；用户组额度保持不可绕过。补齐异步冷却排队恢复、满载原因、选择原因与低基数指标。\n\n验证：go test ./...；go vet ./...；PostgreSQL 原子额度、准入队列、Worker 容量回收及故障策略 HTTP acceptance。

apps/api/internal/runner/limits.go

@@ -50,21 +50,18 @@ func isLocalRateLimitError(err error) bool {
 	return errors.As(err, &limitErr)
 }
 
+func platformModelRateLimitError(err error) (*store.RateLimitExceededError, bool) {
+	var limitErr *store.RateLimitExceededError
+	if !errors.As(err, &limitErr) || limitErr.ScopeType != "platform_model" {
+		return nil, false
+	}
+	return limitErr, true
+}
+
 func (s *Service) rateLimitReservations(ctx context.Context, user *auth.User, candidate store.RuntimeModelCandidate, body map[string]any) []store.RateLimitReservation {
 	out := make([]store.RateLimitReservation, 0)
-	out = append(out, reservationsFromPolicy(
-		"platform_model",
-		candidate.PlatformModelID,
-		firstNonEmptyString(candidate.DisplayName, candidate.ModelAlias, candidate.ModelName),
-		map[string]any{
-			"platformId":   candidate.PlatformID,
-			"platformName": candidate.PlatformName,
-			"modelAlias":   candidate.ModelAlias,
-			"modelName":    candidate.ModelName,
-		},
-		effectiveRateLimitPolicy(candidate),
-		body,
-	)...)
+	// Cross-platform scopes must be evaluated first so a user-group limit can
+	// never be bypassed by rotating to another platform model.
 	if group, err := s.store.ResolveUserGroupPolicy(ctx, user); err == nil && group.ID != "" {
 		out = append(out, reservationsFromPolicy(
 			"user_group",
@@ -78,6 +75,19 @@ func (s *Service) rateLimitReservations(ctx context.Context, user *auth.User, ca
 			body,
 		)...)
 	}
+	out = append(out, reservationsFromPolicy(
+		"platform_model",
+		candidate.PlatformModelID,
+		firstNonEmptyString(candidate.DisplayName, candidate.ModelAlias, candidate.ModelName),
+		map[string]any{
+			"platformId":   candidate.PlatformID,
+			"platformName": candidate.PlatformName,
+			"modelAlias":   candidate.ModelAlias,
+			"modelName":    candidate.ModelName,
+		},
+		effectiveRateLimitPolicy(candidate),
+		body,
+	)...)
 	return out
 }