phsl / new-api

* fix(oauth): align custom binding response fields in frontend

* fix(oauth): restore custom access policy guidance

Bumps [electron](https://github.com/electron/electron) from 39.8.5 to 39.8.10.
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](https://github.com/electron/electron/compare/v39.8.5...v39.8.10)

---
updated-dependencies:
- dependency-name: electron
  dependency-version: 39.8.10
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 4.3.1.
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/4.3.0...4.3.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix(topup): reject uncreditable orders before payment

* fix(topup): align zero-ratio Stripe validation

* fix(topup): mirror settlement conversions in validation

Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.16 to 7.5.22.
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](https://github.com/isaacs/node-tar/compare/v7.5.16...v7.5.22)

---
updated-dependencies:
- dependency-name: tar
  dependency-version: 7.5.22
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.4 to 3.1.5.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.4...v3.1.5)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.11 to 3.4.13.
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](https://github.com/cure53/DOMPurify/compare/3.4.11...3.4.13)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-version: 3.4.13
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [builder-util-runtime](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/builder-util-runtime) to 9.7.0 and updates ancestor dependency [electron-builder](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-builder). These dependencies need to be updated together.


Updates `builder-util-runtime` from 9.5.1 to 9.7.0
- [Release notes](https://github.com/electron-userland/electron-builder/releases)
- [Changelog](https://github.com/electron-userland/electron-builder/blob/master/packages/builder-util-runtime/CHANGELOG.md)
- [Commits](https://github.com/electron-userland/electron-builder/commits/HEAD/packages/builder-util-runtime)

Updates `electron-builder` from 26.7.0 to 26.15.3
- [Release notes](https://github.com/electron-userland/electron-builder/releases)
- [Changelog](https://github.com/electron-userland/electron-builder/blob/master/packages/electron-builder/CHANGELOG.md)
- [Commits](https://github.com/electron-userland/electron-builder/commits/electron-builder@26.15.3/packages/electron-builder)

---
updated-dependencies:
- dependency-name: builder-util-runtime
  dependency-version: 9.7.0
  dependency-type: indirect
- dependency-name: electron-builder
  dependency-version: 26.15.3
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat(ali): support Qwen Image 3 requests

* refactor(ali): narrow Qwen Image 3 support

* fix(ali): focus image model mapping fix

* fix(web): keep fetched model selection in sync with form

* refactor(web): reuse parsed channel models

* fix(billing): 异步任务退款时同步减少 used_quota
退款时仅恢复了 quota（剩余额度），但未同步减少 used_quota（已用额度），
导致"总额度"（quota + used_quota）随退款次数持续虚增，超出用户实际充值金额。

修复三处退款路径：
- RefundTaskQuota：任务失败完整退款
- RecalculateTaskQuota：差额结算退款分支
- controller/midjourney.go：Midjourney 任务失败退款

新增 model.UpdateUserUsedQuota 公开函数，仅调整 used_quota 不影响 request_count。

* fix(billing): 任务退款时同步扣减渠道 used_quota

* fix(billing): complete async task refund accounting

* style(model): group internal Midjourney fields

---------

Co-authored-by: CaIon <i@caion.me>

* fix: support Gemini model listing on v1 route

* test: cover Gemini query key model listing

Co-authored-by: multica-agent <github@multica.ai>

* fix: mobile sidebar

* fix(web): prevent iOS sidebar taps from being swallowed

* feat(billing): highlight matched conditional multipliers in usage logs

* fix(billing): make request rule tracing stable and type-safe

* fix: 修复兑换码额度精度损失(#6680)

* fix(redemption): guard update data integrity

* feat(channels): refine fetched model categorization

* fix: channel category

* fix: hy3 category