fix(migrations): resolve version collisions and add batch deletion API (#2294)

- Rename 056_provider_connection_quota_window_thresholds.sql to 057
- Add LEGACY_VERSION_SLOT_MIGRATIONS entries for backward compatibility
- Add deleteBatch/deleteCompletedBatches to batches.ts
- Add DELETE routes for batches (single + bulk)
- Add batch deletion buttons to dashboard
- Broaden dashboard session auth to all client API routes
- Add quota_window_thresholds_json column repair

Authored-by: Markus Hartung <hartmark@users.noreply.github.com>

src/server/authz/policies/clientApi.ts

@@ -1,4 +1,4 @@
-import { isDashboardSessionAuthenticated } from "../../../shared/utils/apiAuth";
+import { isDashboardSessionAuthenticated } from "@/shared/utils/apiAuth.ts";
 import type { AuthOutcome, PolicyContext, RoutePolicy } from "../context";
 import { allow, reject } from "../context";
 
@@ -15,24 +15,12 @@ function maskKeyId(apiKey: string): string {
   return `key_${tail}`;
 }
 
-function isDashboardModelCatalogRead(ctx: PolicyContext): boolean {
-  const method = ctx.request.method.toUpperCase();
-  if (method !== "GET" && method !== "HEAD") return false;
-  return (
-    ctx.classification.normalizedPath === "/api/v1/models" ||
-    ctx.classification.normalizedPath === "/api/v1"
-  );
-}
-
 export const clientApiPolicy: RoutePolicy = {
   routeClass: "CLIENT_API",
   async evaluate(ctx: PolicyContext): Promise<AuthOutcome> {
     const bearer = extractBearer(ctx.request.headers);
     if (!bearer) {
-      if (
-        isDashboardModelCatalogRead(ctx) &&
-        (await isDashboardSessionAuthenticated(ctx.request))
-      ) {
+      if (await isDashboardSessionAuthenticated(ctx.request)) {
         return allow({ kind: "dashboard_session", id: "dashboard" });
       }