perf(store): 消除同步复制下的鉴权与心跳锁阻塞

将 Worker 心跳与容量分配事务设为本地异步提交，避免同步副本延迟期间长期持有全局分配锁。API Key 使用时间改为异步提交并按分钟合并，消除高并发请求对同一热行的锁排队。业务任务、钱包、结算、并发租约等关键数据仍保持同步复制。验证通过完整 Go 测试、go vet、竞态测试、迁移安全检查及 PostgreSQL 18 集成测试。

apps/api/internal/store/api_key_auth_test.go

@@ -3,6 +3,7 @@ package store
 import (
 	"context"
 	"errors"
+	"strings"
 	"testing"
 
 	"github.com/easyai/easyai-ai-gateway/apps/api/internal/auth"
@@ -50,6 +51,12 @@ func TestVerifyLocalAPIKeyClosesCandidateRowsBeforeUpdatingUsage(t *testing.T) {
 	if database.updatedAPIKeyID != "matching-key" {
 		t.Fatalf("updated API key = %q, want matching-key", database.updatedAPIKeyID)
 	}
+	if !strings.Contains(database.updateSQL, "set_config('synchronous_commit', 'off', true)") {
+		t.Fatalf("API key usage update did not disable synchronous commit: %s", database.updateSQL)
+	}
+	if !strings.Contains(database.updateSQL, "interval '1 minute'") {
+		t.Fatalf("API key usage update did not coalesce hot-key writes: %s", database.updateSQL)
+	}
 	if user.APIKeyID != "matching-key" || user.GatewayUserID != "user-id" {
 		t.Fatalf("verified user = %+v", user)
 	}
@@ -82,16 +89,18 @@ func TestVerifyLocalAPIKeyReturnsUnauthorizedAfterClosingCandidateRows(t *testin
 type fakeLocalAPIKeyDatabase struct {
 	rows            *fakeLocalAPIKeyRows
 	updatedAPIKeyID string
+	updateSQL       string
 }
 
 func (database *fakeLocalAPIKeyDatabase) Query(context.Context, string, ...any) (pgx.Rows, error) {
 	return database.rows, nil
 }
 
-func (database *fakeLocalAPIKeyDatabase) Exec(_ context.Context, _ string, arguments ...any) (pgconn.CommandTag, error) {
+func (database *fakeLocalAPIKeyDatabase) Exec(_ context.Context, sql string, arguments ...any) (pgconn.CommandTag, error) {
 	if !database.rows.closed {
 		return pgconn.CommandTag{}, errors.New("API key usage update started before candidate rows closed")
 	}
+	database.updateSQL = sql
 	database.updatedAPIKeyID, _ = arguments[0].(string)
 	return pgconn.NewCommandTag("UPDATE 1"), nil
 }