Add CPA auth maintenance queue and harden high-concurrency auth scheduling

[BenjaminAaron196]

Summary

• add CPA auth maintenance config and background queue so 401/429 and repeated quota-strike auths are scanned and deleted gradually
• make auth file deletion idempotent when the file is already missing, and keep token-record cleanup plus auth disable in place
• harden scheduler/auth concurrency by returning detached auth snapshots and fixing the request context race found by package-level race tests
• add stress and maintenance tests covering long TPM / high RPM and mixed-load background deletion

Testing

• go test ./sdk/api/handlers/openai ./sdk/cliproxy ./sdk/cliproxy/auth ./internal/config ./internal/api/handlers/management
• go test -race ./sdk/api/handlers/openai
• go test -race ./sdk/cliproxy/auth
• go test -race -v ./sdk/cliproxy -run TestAuthMaintenanceBackgroundQueue_MixedLoadGraduallyRemoves401And429

[Copilot]

Pull request overview

This PR introduces an optional background “auth maintenance” queue to gradually remove invalid/quota-exhausted auth files, and hardens high-concurrency auth scheduling by returning detached auth snapshots and fixing a request-context cancellation race.

Changes:

• Add AuthMaintenanceConfig to config and implement a background scan/delete loop that disables auths and cleans up token records.
• Make auth scheduling safer under concurrency by cloning scheduler picks and decoupling scheduler snapshots from manager state.
• Add stress/maintenance tests (mixed-load maintenance deletion, long-TPM/high-RPM handler stress) plus management API tests for idempotent deletion.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
sdk/config/config.go	Exposes AuthMaintenanceConfig via SDK config type alias.
sdk/cliproxy/service.go	Implements auth maintenance worker/queue and candidate scanning/deletion helpers.
sdk/cliproxy/service_auth_maintenance_test.go	Adds coverage for scan grouping, delete behavior, and mixed-load background maintenance.
sdk/cliproxy/auth/types.go	Adds quota StrikeCount field for repeated-429 tracking.
sdk/cliproxy/auth/scheduler.go	Returns cloned auth snapshots from scheduler picks to avoid shared mutable state.
sdk/cliproxy/auth/scheduler_test.go	Verifies scheduler returns detached clones and manager snapshots don’t mutate scheduler state.
sdk/cliproxy/auth/conductor.go	Adds retry safety cap, strike count propagation, and detaches scheduler upserts from manager state.
sdk/cliproxy/auth/conductor_overrides_test.go	Extends retry-limit tests and covers new safety cap behavior.
sdk/api/handlers/handlers.go	Fixes a context cancellation goroutine race by avoiding capturing a mutable ctx variable.
sdk/api/handlers/openai/openai_responses_stress_test.go	Adds high-concurrency/large-payload stress test for OpenAI responses handler.
internal/config/config.go	Adds auth-maintenance config block, defaults, and status-code normalization.
internal/config/auth_maintenance_test.go	Tests status code normalization (preserves 429, dedupes, filters invalid).
internal/api/handlers/management/auth_files.go	Uses manager lookup helpers and makes delete idempotent when auth exists but file is missing.
internal/api/handlers/management/auth_files_delete_test.go	Adds tests for idempotent delete and concurrent delete storms.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.