Centralize optional API key capability checks so dashboard forms and
provider schemas share the same rules, including keyless Pollinations
support and cloud-agent batch testing mode.
Also align auto-combo config on `routerStrategy`, keep legacy combo
reads compatible, preserve MCP routes as management APIs, narrow
`require-login` public access to readonly/bootstrap flows, and make
cloud-agent CORS reflect the request origin for credentialed requests.
Protect cloud agent task routes and model cooldown management endpoints
with management-session auth and consistent CORS handling.
Also align cloud agent API serialization with the dashboard, reuse the
provider connection schema for CLI key storage, and accept active OAuth
tokens when building virtual auto-combo candidates.
Integrated into release/v3.8.0 — cloud agent provider exports and logger import fixes were already present in the release branch. Thank you for the quick response to the crash report!
- Fix OAuth expiry handling for ISO strings in virtualFactory.ts
- Move AutoRoutingBanner test from src/ to tests/unit/shared/components/
- Remove mock metrics from analytics endpoint, return only real data
- Fix error handling for bare 'auto' prefix in chat.ts (check isAutoRouting)
- Update vitest.config.ts to include tests/unit/**/*.test.tsx pattern
