phsl / new-api

* fix: support SMTP STARTTLS mode and NTLM auth

Add explicit SMTP STARTTLS configuration for 587-style connections and keep SSL/TLS as the implicit TLS mode.

Prefer PLAIN when advertised, keep LOGIN compatibility, and add NTLM as a fallback for Exchange SMTP servers that require it after STARTTLS.

* fix: respect explicit SMTP encryption mode

* fix: preserve SMTP TLS compatibility

Replace the per-batch ClickHouse mutation loop with a single
ALTER TABLE ... DELETE, since ClickHouse DELETE is a heavy mutation
that rewrites data parts and per-batch mutations are pathologically
slow. Add deterministic unit tests covering ClickHouse DSN handling,
main-database rejection, TTL DDL generation, log ordering, request_id
backfill, and display id assignment.

* feat: support ClickHouse log database

* feat(log): optimize log deletion process for ClickHouse

Fall back to the OS hostname when NODE_NAME is not configured, so node
identity in audit/usage logs is populated automatically. In container and
Kubernetes deployments the hostname equals the container ID or Pod name,
which stays unique under autoscaling without any manual per-instance config.

* feat: add passive channel monitoring mode

* fix: clarify passive monitor mode copy

resolveModelProvider in model-badge.tsx only covered mainstream providers
(OpenAI/Claude/Gemini/Grok/DeepSeek/Qwen/Doubao/Moonshot/Mistral/Meta/Cohere).
Models from Zhipu (glm-), MiniMax, Xiaomi MiMo, Baidu (ernie), iFlyTek
(spark), Tencent (hunyuan), Baichuan, InternLM, StepFun, and Yi rendered
as grey dots instead of their brand icons in the usage logs table.

Add keyword mappings for these providers, aligning coverage with the
classic frontend's getModelCategories. Icons resolved via @lobehub/icons.

Add an eye toggle in the flow section header that masks sensitive node
labels (users, tokens, nodes, groups, channels) in the Sankey while keeping
model names visible. Masking only rewrites display text; nodes stay distinct
via their key so graph structure, links, and highlighting are unaffected.

- Highlight full paths through a clicked node or link in the flow Sankey,
  dimming unrelated nodes/links instead of removing them
- Disable VChart built-in emphasis to avoid crash, use custom highlight sets
- Initialize models filter dialog from currently applied filters so manual
  time ranges are not overridden by preferences; auto-pick granularity by range
- Lift user charts time range/granularity/limit to dashboard as controlled state

删除时已从草稿中移除模型，但列表为 saved∪draft 并集且优先取 saved，
导致行不消失（isDraftDeleted 计算后未被使用），表现为无法删除。改为过滤
掉已暂存删除的行；并在删除当前正在编辑的行时关闭编辑器，避免从残留面板
保存又把模型写回。

base-ui 的 ScrollArea 仅靠 max-height 无法约束高度：其 Viewport 用
height:100%，当 Root 只有 max-height 而无确定高度时会回退为 auto，
内容撑满并溢出到 Root 之外，盖住下方分页。改用原生 max-h + overflow-y-auto
的 div，列表正确内部滚动，分页作为同级元素干净地排在下方。

路由 search 校验枚举 logTypeValues 漏了 '7'(登录),
选「登录」时 type=['7'] 校验失败被 .catch([]) 兜底成空数组,
最终请求丢掉 type 参数。补上 '7' 与 LOG_TYPE_ENUM.LOGIN 对齐。

* feat(dashboard): add traffic flow sankey chart

Add dashboard flow APIs and a Sankey-based flow view with user, optional API key, model, and channel layers.\n\nReuse the dashboard VChart palette, add precise link/node tooltips and interactions, and cover filtering, layer ordering, color stability, and error states with tests.

* feat: build flow chart from quota data

---------

Co-authored-by: CaIon <i@caion.me>

- Show 3-column card grid from xl breakpoint instead of 2xl
- Cap inline priority/weight width to avoid huge values stretching cards
- Collapse right-column grid to content-sized columns, removing wasted space
- Memoize channel columns, context value, upstream-update result, and ChannelCard
  to avoid rebuilding/re-rendering all cards on unrelated state changes

Group #id/name and balance on the left and priority/weight plus
response/last-tested on the right. Simplify field labels by dropping
the CJK-unfriendly uppercase/letter-spacing, left-align the right
column, and shorten the "Last Tested" zh label.

Add an opt-in card view to the shared data-table stack (DataTablePage),
toggled via a segmented control in the toolbar with per-table localStorage
persistence. Cards render generically from column meta by default, with an
optional renderCard slot. Defaults to table-only so existing pages are
unchanged.

Wire it into the channels page with a bespoke ChannelCard that reuses every
column's cell renderer, preserving all table information and interactions
(selection, inline priority/weight, balance refresh, status, actions, tag
expand).

* refactor: codex usage ui

* feat: show Codex reset credit details

* feat: add Codex usage reset flow

- add oxlint and oxfmt configuration for web/default quality checks

- replace ESLint and Prettier scripts with protected-header Oxc formatting

- update frontend workspace dependencies for oxlint and oxfmt