[mylukin]

OpenAI Chat and Responses providers can now share an encrypted API key pool. Independent requests rotate evenly across eligible accounts; explicit quota errors pause the affected account while other accounts continue serving. Providers includes account import, replacement, model restrictions, pause/recovery controls, strategy selection, and gateway-observed usage.

Quota recovery uses the first eligible business request after the monthly boundary (Asia/Shanghai by default), with an atomic reservation shared across instances. A successful request confirms recovery; unsuccessful recovery waits at least 24 hours. Invalid credentials require replacement. Streaming output and stateful continuations retain the existing no-replay and credential-isolation boundaries, including a fresh model-permission check before sending.

Credentials and lifecycle state reuse the encrypted single-row config store with SQLite/Postgres compare-and-set, without migrations. Existing environment credentials remain available until the pool is first configured; an emptied pool cannot silently reactivate them. Admin keys and balance queries are excluded. Rotation fairness is per gateway/protocol pool, and displayed costs are estimates for Helm traffic.

Validation:

• 293 focused tests passed across 11 files, including OAuth regression, gateway integration, encrypted SQLite/Postgres persistence, quota recovery, and admin behavior.
• Playwright account import, pause, edit, strategy change, and deletion passed against the actual admin UI and private gateway.
• pnpm typecheck, pnpm lint, pnpm build, and admin Svelte diagnostics passed (lint retains existing warnings).
• Six real OpenAI calls using the two user-authorized project keys succeeded, three per key; rotation, returned text, and streaming termination were checked. Temporary encrypted test databases were removed. No real credentials are included in this PR.
• Exhaustion and monthly recovery were verified with synthetic errors and controlled time; the real accounts were not deliberately exhausted.

Release preparation: pnpm release:prepare 0.30.60 confirmed the latest stable snapshots (Grok 1.0.70, Claude Code 2.1.312, Codex 0.165.0 and its tagged catalog); no snapshot changes were needed. All seven admin locales are now aligned, fixing the first full-CI failure. The i18n and release-preparation suites pass (25 tests).