feat: complete commercial control plane, billing, auth, and model catalog

- add PostgreSQL control-plane persistence with Redis-degraded hot reload
- implement prepaid balance, usage ledger, Stripe top-up and reconciliation
- add registration, email verification, password reset, invitations and RBAC
- support TOTP, Passkey MFA, device sessions, quotas and rate limits
- add tenant billing profiles, audit logs and operational readiness checks
- build authenticated admin console, Quickstart, Playground and usage analytics
- add public model catalog with pricing, filtering and cost estimation
- support OpenAI Responses providers and provider health failover
- validate real upstream usage reporting and balance settlement

1 files changed, 34 insertions, 6 deletions

diff --git a/internal/domain/types.go b/internal/domain/types.go
index 94e56c1..81da8f2 100644
--- a/internal/domain/types.go
+++ b/internal/domain/types.go
@@ -5,24 +5,47 @@ import "time"
 type Protocol string
 
 const (
-	ProtocolOpenAI    Protocol = "openai"
-	ProtocolAnthropic Protocol = "anthropic"
+	ProtocolOpenAI          Protocol = "openai"
+	ProtocolOpenAIResponses Protocol = "openai_responses"
+	ProtocolAnthropic       Protocol = "anthropic"
 )
 
 type Principal struct {
-	KeyID     string
-	TenantID  string
-	ProjectID string
-	Scopes    []string
+	KeyID              string
+	TenantID           string
+	ProjectID          string
+	Scopes             []string
+	AllowedModels      map[string]struct{}
+	MonthlySpendMicros int64
+	ExpiresAt          *time.Time
 }
 
 type Provider struct {
 	ID       string
+	Slug     string
 	Protocol Protocol
+	WireAPI  string
 	BaseURL  string
 	APIKey   string
 }
 
+func (p Provider) EffectiveSlug() string {
+	if p.Slug != "" {
+		return p.Slug
+	}
+	return p.ID
+}
+
+func (p Provider) EffectiveWireAPI() string {
+	if p.WireAPI != "" {
+		return p.WireAPI
+	}
+	if p.Protocol == ProtocolAnthropic {
+		return "messages"
+	}
+	return "chat_completions"
+}
+
 type Route struct {
 	Provider      Provider
 	UpstreamModel string
@@ -61,6 +84,11 @@ type Model struct {
 }
 
 func (m Model) Allows(principal Principal) bool {
+	if len(principal.AllowedModels) > 0 {
+		if _, ok := principal.AllowedModels[m.ID]; !ok {
+			return false
+		}
+	}
 	if len(m.AllowedTenantIDs) > 0 {
 		if _, ok := m.AllowedTenantIDs[principal.TenantID]; !ok {
 			return false