fix(errors): 区分平台限流并保留上游状态码

原因：公开错误层将平台并发限流误标为上游限流，并把多种上游 4xx 统一压成 400，影响定位和客户端处理。

影响：新增公开错误 source，平台限流使用 gateway_rate_limited，上游请求按安全分类返回对应状态；数据库与管理端继续保留原始错误码、消息和状态用于审计。

验证：Go 全量测试、pnpm test、pnpm lint、pnpm build、pnpm openapi、gofmt 和 diff 检查均通过。

apps/api/internal/httpapi/compat_protocol_test.go

@@ -84,6 +84,15 @@ func TestProtocolErrorsUseCompatibleShapesWithStandardPublicErrors(t *testing.T)
 				assertNoKeys(t, errorBody, "status", "taskId", "gateway_status")
 			},
 		},
+		{
+			name: "keling", protocol: clients.ProtocolKlingV1Omni, status: http.StatusTooManyRequests,
+			assertBody: func(t *testing.T, body map[string]any) {
+				errorBody := requireObject(t, body["error"])
+				if errorBody["code"] != "gateway_rate_limited" || errorBody["source"] != "gateway" || errorBody["httpStatus"] != float64(http.StatusTooManyRequests) {
+					t.Fatalf("unexpected Kling-compatible error: %+v", body)
+				}
+			},
+		},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
@@ -93,6 +102,8 @@ func TestProtocolErrorsUseCompatibleShapesWithStandardPublicErrors(t *testing.T)
 				code = "rate_limit"
 			} else if test.name == "volces" {
 				code = "upstream_submission_unknown"
+			} else if test.name == "keling" {
+				code = "gateway_rate_limited"
 			}
 			writeProtocolError(recorder, test.protocol, test.status, "failed", nil, code)
 			if recorder.Code != test.status {