feat(credentials): 增加 API Key 手动测试

[tbphp]

关联 Issue / Related Issue

无 / None

变更内容 / Change Content

• Bug 修复 / Bug fix

• 新功能 / New feature

• 其他改动 / Other changes

• 在 API Key 行操作菜单首项增加“测试连接”，打开弹窗后立即发送一次最小真实上游请求。

• 抽取并复用自动验活的 OperationProbe 执行链路，沿用模型、协议、代理、Header 和超时配置，不重复构造探测请求。

• 手动测试只返回通过、失败或无法判断及模型、协议、耗时、原因、时间，不写入调度、健康统计、黑名单、请求日志或用量。

• 已拉黑密钥测试通过后提供确认恢复；恢复凭证绑定当次 credential、probe target 与 cooldown 快照，状态变化时返回冲突并要求重新测试。

• 订阅账号不提供入口，服务端也明确拒绝测试。

自查清单 / Checklist

• 我已运行 make check，或在说明中写明无法运行的原因和未验证范围。 / I ran make check, or documented why it could not run and what remains unverified.
• 本 PR 范围聚焦，未包含无关改动。 / This PR is focused and contains no unrelated changes.
• 我已更新必要的公开文档或发布说明。 / I updated any required public documentation or release notes.
• 我已确认提交、日志和测试数据不包含敏感信息。 / I confirmed that commits, logs, and fixtures contain no sensitive data.
• 如适用，我已说明兼容性或数据迁移影响。 / Where applicable, I documented compatibility or data-migration impact.

验证：make check

兼容性：新增两个管理 API；无数据库迁移，不改变原有自动验活与手动恢复接口。

Summary by CodeRabbit

• 新功能
  • 新增组凭据连接测试，可查看测试结果、模型、协议、延迟及失败原因。
  • 支持对测试通过且符合条件的凭据执行恢复操作，并提供冲突与失败提示。
  • 凭据操作菜单新增“测试”，仅适用于 API Key 连接。
  • 新增英文、日文和简体中文界面文案。

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-29T13:50:45.626956Z	c0a1cb9	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

📝 Walkthrough

Walkthrough

新增组凭据连接测试功能。控制服务会解密凭据、执行探测并返回稳定的结果分类。测试通过且凭据被拉黑时，服务会生成恢复证明。恢复请求会校验证明、目标签名、凭据版本和冷却时间。新增 HTTP 路由、审计处理器、运行时状态恢复接口及完整测试。管理界面新增测试菜单、结果对话框、恢复操作、请求状态管理和中英文日文文案。

Merge Risk: 🟡 Moderate · up to c0a1c

The PR adds manual upstream testing and proof-bound restoration for blacklisted credentials. Restoration can activate a credential before the response is fully produced, so a late failure may report an error even though the credential is already active, leaving retry and operator recovery ambiguous; this should be fixed or explicitly accepted before merge.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 32 functions across 14 files. (3 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	标题“feat(credentials): 增加 API Key 手动测试”准确概括了本次新增 API Key 手动连接测试功能，内容清晰且具体。
Description check	✅ Passed	描述包含关联 Issue、变更类型、核心实现、兼容性影响和验证结果。自查清单已完成，内容与变更范围一致。未关联 Issue 已明确说明为“无 / None”。
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 32 functions across 14 files. (3 skipped: 3 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch tbphp/manual-credential-test

Warning

Some tools did not complete. Review the errors below.

🔧 golangci-lint (2.12.2)

Error: can't load config: the Go language version (go1.26) used to build golangci-lint is lower than the targeted Go version (1.27.0)
The command is terminated due to an error: can't load config: the Go language version (go1.26) used to build golangci-lint is lower than the targeted Go version (1.27.0)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

internal/state/weights_test.go (1)

298-300: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

建议补充 RecoverIfMatch 在非零 cooldown 下的用例。

新测试覆盖了指针非空分支。指针为空分支的关键差异是：条目带非零 CooldownUntil 时，RecoverIfMatch 仍须成功，且必须保留 CooldownUntil。现有 RecoverIfMatch 用例的条目 cooldown 均为零值，无法区分这一行为。自动校验路径 internal/control/validation.go 依赖该语义。

♻️ 建议新增的测试

func TestKeyRegistryRecoverIfMatchKeepsCooldown(t *testing.T) {
	registry := NewCredentialRegistry()
	cooldownUntil := time.Now().UTC().Add(time.Hour)
	mustReplaceKeyEntries(t, registry, []CredentialEntry{{
		ID: 1, GroupID: 10, Status: CredentialStatusActive, Blacklisted: true,
		FailureCount: 3, CooldownUntil: cooldownUntil, WeightAuto: 17,
		Version: 1, IdentityGeneration: 1,
		Fingerprint: "test-fingerprint", EncryptedValue: "cipher-one",
	}})
	ref := CredentialRef{
		ID: 1, GroupID: 10, Version: 1, IdentityGeneration: 1,
		Fingerprint: "test-fingerprint", EncryptedValue: "cipher-one",
	}

	if !registry.RecoverIfMatch(ref, DefaultWeight) {
		t.Fatal("RecoverIfMatch() = false, want true")
	}
	got := registryEntry(t, registry, 1)
	if got.Blacklisted || !got.CooldownUntil.Equal(cooldownUntil) {
		t.Fatalf("entry after RecoverIfMatch() = %#v, want cooldown preserved", got)
	}
}

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: QUIET

Plan: Pro Plus

Run ID: 8cb1bba8-0859-4617-bd88-6f3892ae2219

📥 Commits

Reviewing files that changed from the base of the PR and between eb7e54c and c0a1cb9.

📒 Files selected for processing (17)

• internal/control/credential_api_foundation_test.go
• internal/control/credential_mutations.go
• internal/control/credential_probe.go
• internal/control/credential_probe_test.go
• internal/control/http_routes.go
• internal/control/server.go
• internal/control/validation.go
• internal/state/registry.go
• internal/state/weights_test.go
• web/src/api/control/types.ts
• web/src/app/resources/credentials.ts
• web/src/features/groups/credentials/CredentialTestDialog.vue
• web/src/features/groups/credentials/GroupCredentialRecord.vue
• web/src/features/groups/credentials/GroupCredentialsTab.vue
• web/src/i18n/locales/en-US/group.ts
• web/src/i18n/locales/ja-JP/group.ts
• web/src/i18n/locales/zh-CN/group.ts

Included review availability: Your plan provides up to 8 included reviews per hour; 4 remain after this review.