修复 Router 分组与账号凭据契约

- 固定 Router 用户为 taonier、Token 为 default 并确保订阅

- 复用本地账号 Key，禁止无管理员令牌绕过订阅校验

- LLM 转发只读取服务端已验证的 Router 凭据并保持请求流式参数

server-rs/crates/api-server/src/llm/mod.rs

@@ -717,7 +717,14 @@ async fn resolve_llm_router_credentials(
 
     // No fixture means the request must follow the same provisioning/read path
     // as production. In particular, a missing external_api_key row must never
-    // be replaced by a process-wide test key.
+    // be replaced by a process-wide test key. An already-provisioned row is
+    // read locally on the hot path; Router account repair and subscription
+    // checks run from the authentication/key-preparation anchor instead.
+    if let Some(credentials) =
+        crate::external_api_keys::read_active_llm_router_credentials(state, owner_user_id).await?
+    {
+        return Ok(credentials);
+    }
     let record = crate::external_api_keys::ensure_llm_router_account(state, owner_user_id).await?;
     let ciphertext = record
         .secret_ciphertext