feat(auth): introduce auth.providers for flexible authentication configuration

- Replaced legacy `api-keys` field with `auth.providers` in configuration, supporting multiple authentication providers including `config-api-key`.
- Added synchronization to maintain compatibility with legacy `api-keys`.
- Updated core components like request handling and middleware to use the new provider system.
- Enhanced management API endpoints for seamless integration with `auth.providers`.

internal/config/config.go

@@ -29,6 +29,9 @@ type Config struct {
 	// APIKeys is a list of keys for authenticating clients to this proxy server.
 	APIKeys []string `yaml:"api-keys" json:"api-keys"`
 
+	// Access holds request authentication provider configuration.
+	Access AccessConfig `yaml:"auth" json:"auth"`
+
 	// QuotaExceeded defines the behavior when a quota is exceeded.
 	QuotaExceeded QuotaExceeded `yaml:"quota-exceeded" json:"quota-exceeded"`
 
@@ -63,6 +66,38 @@ type Config struct {
 	GeminiWeb GeminiWebConfig `yaml:"gemini-web" json:"gemini-web"`
 }
 
+// AccessConfig groups request authentication providers.
+type AccessConfig struct {
+	// Providers lists configured authentication providers.
+	Providers []AccessProvider `yaml:"providers" json:"providers"`
+}
+
+// AccessProvider describes a request authentication provider entry.
+type AccessProvider struct {
+	// Name is the instance identifier for the provider.
+	Name string `yaml:"name" json:"name"`
+
+	// Type selects the provider implementation registered via the SDK.
+	Type string `yaml:"type" json:"type"`
+
+	// SDK optionally names a third-party SDK module providing this provider.
+	SDK string `yaml:"sdk,omitempty" json:"sdk,omitempty"`
+
+	// APIKeys lists inline keys for providers that require them.
+	APIKeys []string `yaml:"api-keys,omitempty" json:"api-keys,omitempty"`
+
+	// Config passes provider-specific options to the implementation.
+	Config map[string]any `yaml:"config,omitempty" json:"config,omitempty"`
+}
+
+const (
+	// AccessProviderTypeConfigAPIKey is the built-in provider validating inline API keys.
+	AccessProviderTypeConfigAPIKey = "config-api-key"
+
+	// DefaultAccessProviderName is applied when no provider name is supplied.
+	DefaultAccessProviderName = "config-inline"
+)
+
 // GeminiWebConfig nests Gemini Web related options under 'gemini-web'.
 type GeminiWebConfig struct {
 	// Context enables JSON-based conversation reuse.
@@ -196,10 +231,83 @@ func LoadConfig(configFile string) (*Config, error) {
 		_ = SaveConfigPreserveCommentsUpdateNestedScalar(configFile, []string{"remote-management", "secret-key"}, hashed)
 	}
 
+	// Sync request authentication providers with inline API keys for backwards compatibility.
+	syncInlineAccessProvider(&config)
+
 	// Return the populated configuration struct.
 	return &config, nil
 }
 
+// SyncInlineAPIKeys updates the inline API key provider and top-level APIKeys field.
+func SyncInlineAPIKeys(cfg *Config, keys []string) {
+	if cfg == nil {
+		return
+	}
+	cloned := append([]string(nil), keys...)
+	cfg.APIKeys = cloned
+	if provider := cfg.ConfigAPIKeyProvider(); provider != nil {
+		if provider.Name == "" {
+			provider.Name = DefaultAccessProviderName
+		}
+		provider.APIKeys = cloned
+		return
+	}
+	cfg.Access.Providers = append(cfg.Access.Providers, AccessProvider{
+		Name:    DefaultAccessProviderName,
+		Type:    AccessProviderTypeConfigAPIKey,
+		APIKeys: cloned,
+	})
+}
+
+// ConfigAPIKeyProvider returns the first inline API key provider if present.
+func (c *Config) ConfigAPIKeyProvider() *AccessProvider {
+	if c == nil {
+		return nil
+	}
+	for i := range c.Access.Providers {
+		if c.Access.Providers[i].Type == AccessProviderTypeConfigAPIKey {
+			if c.Access.Providers[i].Name == "" {
+				c.Access.Providers[i].Name = DefaultAccessProviderName
+			}
+			return &c.Access.Providers[i]
+		}
+	}
+	return nil
+}
+
+func syncInlineAccessProvider(cfg *Config) {
+	if cfg == nil {
+		return
+	}
+	if len(cfg.Access.Providers) == 0 {
+		if len(cfg.APIKeys) == 0 {
+			return
+		}
+		cfg.Access.Providers = append(cfg.Access.Providers, AccessProvider{
+			Name:    DefaultAccessProviderName,
+			Type:    AccessProviderTypeConfigAPIKey,
+			APIKeys: append([]string(nil), cfg.APIKeys...),
+		})
+		return
+	}
+	provider := cfg.ConfigAPIKeyProvider()
+	if provider == nil {
+		if len(cfg.APIKeys) == 0 {
+			return
+		}
+		cfg.Access.Providers = append(cfg.Access.Providers, AccessProvider{
+			Name:    DefaultAccessProviderName,
+			Type:    AccessProviderTypeConfigAPIKey,
+			APIKeys: append([]string(nil), cfg.APIKeys...),
+		})
+		return
+	}
+	if len(provider.APIKeys) == 0 && len(cfg.APIKeys) > 0 {
+		provider.APIKeys = append([]string(nil), cfg.APIKeys...)
+	}
+	cfg.APIKeys = append([]string(nil), provider.APIKeys...)
+}
+
 // looksLikeBcrypt returns true if the provided string appears to be a bcrypt hash.
 func looksLikeBcrypt(s string) bool {
 	return len(s) > 4 && (s[:4] == "$2a$" || s[:4] == "$2b$" || s[:4] == "$2y$")