refactor(api): LLM 提供商管理端点收敛为通用 manage 接口，端点层零特色

- schemas 新增 LlmProviderAction 公共动作词汇表
- LLMProviderManager 新增 provider_manage 统一入口，默认值填充、
  API Key 豁免判断、密钥脱敏与错误归因改写全部下沉封闭，
  不再硬编码 chatgpt/github-copilot 等产品名
- endpoint 收敛为 POST /llm/manage（ManageRequest 透传）；
  OAuth 回跳地址由端点按具名回调路由统一构造后注入动作参数，
  /provider-auth/callback/{provider_id} 因浏览器回跳协议约束保留具名路由
- 新增 14 项 provider_manage 契约守护测试，
  替换原针对端点函数的两个旧测试文件

docs/rules/05-architecture.md

@@ -230,6 +230,15 @@ common `schemas.ManageRequest` body (`target` + `action` + `params`) and must
 never define target-specific names, parameters or response fields — the
 frontend supplies them and the endpoint passes them through untouched.
 
+LLM providers follow the same contract: `LLMProviderManager.provider_manage`
+dispatches actions from the shared `schemas.types.LlmProviderAction`
+vocabulary, seals default-value filling, key sanitization and error rewriting
+inside, and the endpoint layer exposes a single `POST /api/v1/llm/manage` with
+the same `ManageRequest` body. The only exception is the named OAuth callback
+route (`GET /api/v1/llm/provider-auth/callback/{provider_id}`), which stays
+named because external browsers redirect to that URL; the endpoint builds the
+callback URL from that route name and injects it as an action parameter.
+
 ### DB / Oper layer
 
 SQLAlchemy models stay under `app/db/models/`; the data access classes live in