Add token usage stats and consolidate credentials in SQLite

- New internal/stats (types) and internal/store (SQLite owner: requests + credentials tables, WAL); store implements stats.Recorder.
- Stream (SSE tee) and non-stream chat paths parse upstream usage incl. cached_tokens and record per-request; add /api/stats, /api/stats/reset, /admin/stats HTML with cache hit rate.
- Drop credentials.json: remove auth file I/O and ZHANLU_CREDENTIALS_FILE; credential precedence is env vars > db row.

internal/config/config.go

@@ -2,7 +2,6 @@ package config
 
 import (
 	"os"
-	"path/filepath"
 	"strings"
 	"time"
 
@@ -14,7 +13,8 @@ type Config struct {
 	MobileLoginBaseURL string
 	MobileModelBaseURL string
 	UpstreamPath       string
-	CredentialsPath    string
+	DBPath             string
+	StatsDisabled      bool
 	SSOExchangeURL     string
 	SSOBaseURL         string
 	TokenDecryptKey    string
@@ -36,7 +36,8 @@ func Load() (Config, error) {
 		MobileLoginBaseURL: firstNonEmpty(os.Getenv("ZHANLU_MOBILE_LOGIN_BASE_URL"), getenv("ZHANLU_SERVER_BASE_URL", "https://ecloud.10086.cn")),
 		MobileModelBaseURL: getenv("ZHANLU_MOBILE_MODEL_BASE_URL", "https://ecloud.10086.cn/api/query/aigateway"),
 		UpstreamPath:       getenv("ZHANLU_UPSTREAM_PATH", "/chat/completions"),
-		CredentialsPath:    getenv("ZHANLU_CREDENTIALS_FILE", defaultCredentialsPath()),
+		DBPath:             getenv("ZHANLU_DB_FILE", "zhanlu.db"),
+		StatsDisabled:      strings.EqualFold(os.Getenv("ZHANLU_STATS_DISABLED"), "true"),
 		SSOBaseURL:         getenv("ZHANLU_SSO_BASE_URL", "http://4c.hq.cmcc"),
 		SSOExchangeURL:     getenv("ZHANLU_SSO_EXCHANGE_URL", "http://rdcloud.4c.hq.cmcc/cmdevops-aiplus-agent-gateway/api/acepilot/zhanlu/authToken"),
 		TokenDecryptKey:    getenv("ZHANLU_TOKEN_DECRYPT_KEY", "3jw7woww2rvhla6k"),
@@ -56,12 +57,8 @@ func Load() (Config, error) {
 		Token:     os.Getenv("ZHANLU_TOKEN"),
 		APIKey:    os.Getenv("ZHANLU_API_KEY"),
 	}
-	if cfg.Credentials.Validate() == nil || cfg.Credentials.HasAPIKey() {
-		return cfg, nil
-	}
-	if creds, err := auth.LoadCredentials(cfg.CredentialsPath); err == nil {
-		cfg.Credentials = creds
-	}
+	// Credentials from the environment were incomplete; the store serves the
+	// persisted row at runtime.
 	return cfg, nil
 }
 
@@ -93,10 +90,6 @@ func firstNonEmpty(values ...string) string {
 	return ""
 }
 
-func defaultCredentialsPath() string {
-	return filepath.Join(".", "credentials.json")
-}
-
 const defaultPublicKeyPEM = `-----BEGIN PUBLIC KEY-----
 MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAhxudxTewPgljUHEZHkusP7m3I+zA4/RGvuUMt6TtII/m4zwUOm/Y31zHBTmkCCt8k5vj9y+AmO0TsGmHooNQuMebakdmEWdcA5h7YAHHFbF2w5LcxIXjib08vgVpA+m3R5xPbLK+vfHe2aAX36b5nHReDNncY5vAl3U4CgIEBGPqyG67vJytRWqP+sfEdw5+m192Rf4SCGyiBzRmjiVlH3zeEBjdbOrkAnzKOVz6AHBl2q7LPLJKIzxjoAyhEp5qnDjHUFo5VZUgFwUOt83A/jbGMyzmjRoxBuvKcs9tBuorZyUwIsZN6E+rtQk2YqMPj4RkDsZ7LRmj6on8sN2rHQIDAQAB
 -----END PUBLIC KEY-----`