fix gateway loopback validation chains

apps/api/internal/runner/limits.go

@@ -18,15 +18,36 @@ func (s *Service) rateLimitReservations(ctx context.Context, user *auth.User, ca
 }
 
 func effectiveRateLimitPolicy(candidate store.RuntimeModelCandidate) map[string]any {
-	if hasRules(candidate.ModelRateLimitPolicy) {
-		return candidate.ModelRateLimitPolicy
+	policy := candidate.PlatformRateLimitPolicy
+	if hasRules(candidate.RuntimeRateLimitPolicy) {
+		policy = mergeMap(policy, candidate.RuntimeRateLimitPolicy)
 	}
-	if hasRules(candidate.PlatformRateLimitPolicy) {
-		return candidate.PlatformRateLimitPolicy
+	if nested, ok := candidate.RuntimePolicyOverride["rateLimitPolicy"].(map[string]any); ok && len(nested) > 0 {
+		policy = mergeMap(policy, nested)
+	}
+	if hasRules(candidate.ModelRateLimitPolicy) {
+		policy = mergeMap(policy, candidate.ModelRateLimitPolicy)
+	}
+	if hasRules(policy) {
+		return policy
 	}
 	return nil
 }
 
+func effectiveRetryPolicy(candidate store.RuntimeModelCandidate) map[string]any {
+	policy := candidate.PlatformRetryPolicy
+	if len(candidate.RuntimeRetryPolicy) > 0 {
+		policy = mergeMap(policy, candidate.RuntimeRetryPolicy)
+	}
+	if nested, ok := candidate.RuntimePolicyOverride["retryPolicy"].(map[string]any); ok && len(nested) > 0 {
+		policy = mergeMap(policy, nested)
+	}
+	if len(candidate.ModelRetryPolicy) > 0 {
+		policy = mergeMap(policy, candidate.ModelRetryPolicy)
+	}
+	return policy
+}
+
 func reservationsFromPolicy(scopeType string, scopeKey string, policy map[string]any, body map[string]any) []store.RateLimitReservation {
 	if scopeKey == "" || !hasRules(policy) {
 		return nil