feat(proxy): wrap platform adapter calls with account proxy override

Use withAccountProxyOverride to propagate account-level proxy URL
through AsyncLocalStorage for checkin, balance refresh, model
discovery, token sync, rebind-session verify, and token CRUD
operations. Also accept proxyUrl field in PUT /api/accounts/:id
with validation via parseSiteProxyUrlInput.

src/server/services/balanceService.ts

@@ -6,6 +6,7 @@ import { reportTokenExpired } from './alertService.js';
 import {
   getAutoReloginConfig,
   getCredentialModeFromExtraConfig,
+  getProxyUrlFromExtraConfig,
   getSub2ApiAuthFromExtraConfig,
   mergeAccountExtraConfig,
   resolvePlatformUserId,
@@ -14,7 +15,7 @@ import { decryptAccountPassword } from './accountCredentialService.js';
 import { extractRuntimeHealth, setAccountRuntimeHealth } from './accountHealthService.js';
 import { updateTodayIncomeSnapshot } from './todayIncomeRewardService.js';
 import type { BalanceInfo } from './platforms/base.js';
-import { withSiteProxyRequestInit, withSiteRecordProxyRequestInit } from './siteProxy.js';
+import { withAccountProxyOverride, withSiteProxyRequestInit, withSiteRecordProxyRequestInit } from './siteProxy.js';
 
 function isSiteDisabled(status?: string | null): boolean {
   return (status || 'active') === 'disabled';
@@ -316,7 +317,10 @@ async function tryAutoRelogin(account: any, site: any): Promise<string | null> {
   const password = decryptAccountPassword(relogin.passwordCipher);
   if (!password) return null;
 
-  const loginResult = await adapter.login(site.url, relogin.username, password);
+  const loginResult = await withAccountProxyOverride(
+    getProxyUrlFromExtraConfig(account.extraConfig),
+    () => adapter.login(site.url, relogin.username, password),
+  );
   if (!loginResult.success || !loginResult.accessToken) return null;
 
   await db.update(schema.accounts)
@@ -393,7 +397,9 @@ export async function refreshBalance(accountId: number) {
     }
   }
 
-  const readBalance = async (token: string) => adapter.getBalance(site.url, token, platformUserId);
+  const accountProxyUrl = getProxyUrlFromExtraConfig(account.extraConfig);
+  const readBalance = async (token: string) => withAccountProxyOverride(accountProxyUrl,
+    () => adapter.getBalance(site.url, token, platformUserId));
   const handleBalanceError = async (err: any) => {
     const message = appendSessionTokenRebindHint(err?.message || 'unknown error');
     setAccountRuntimeHealth(account.id, {

src/server/services/checkinService.ts

@@ -8,6 +8,7 @@ import { refreshBalance } from './balanceService.js';
 import { parseCheckinRewardAmount } from './checkinRewardParser.js';
 import {
   getAutoReloginConfig,
+  getProxyUrlFromExtraConfig,
   getPlatformUserIdFromExtraConfig,
   guessPlatformUserIdFromUsername,
   mergeAccountExtraConfig,
@@ -16,6 +17,7 @@ import {
 import { decryptAccountPassword } from './accountCredentialService.js';
 import { setAccountRuntimeHealth } from './accountHealthService.js';
 import { formatUtcSqlDateTime } from './localTimeService.js';
+import { withAccountProxyOverride } from './siteProxy.js';
 
 type CheckinExecutionStatus = 'success' | 'failed' | 'skipped';
 
@@ -100,7 +102,10 @@ async function tryAutoRelogin(account: any, site: any): Promise<string | null> {
   const password = decryptAccountPassword(relogin.passwordCipher);
   if (!password) return null;
 
-  const result = await adapter.login(site.url, relogin.username, password);
+  const result = await withAccountProxyOverride(
+    getProxyUrlFromExtraConfig(account.extraConfig),
+    () => adapter.login(site.url, relogin.username, password),
+  );
   if (!result.success || !result.accessToken) return null;
 
   await db.update(schema.accounts)
@@ -172,14 +177,17 @@ export async function checkinAccount(accountId: number, options?: { skipEvent?:
     : guessPlatformUserIdFromUsername(account.username);
   const platformUserId = resolvePlatformUserId(account.extraConfig, account.username);
 
+  const accountProxyUrl = getProxyUrlFromExtraConfig(account.extraConfig);
   let activeAccessToken = account.accessToken;
-  let result = await adapter.checkin(site.url, activeAccessToken, platformUserId);
+  let result = await withAccountProxyOverride(accountProxyUrl,
+    () => adapter.checkin(site.url, activeAccessToken, platformUserId));
 
   if (!result.success && shouldAttemptAutoRelogin(result.message)) {
     const refreshedAccessToken = await tryAutoRelogin(account, site);
     if (refreshedAccessToken) {
       activeAccessToken = refreshedAccessToken;
-      result = await adapter.checkin(site.url, activeAccessToken, platformUserId);
+      result = await withAccountProxyOverride(accountProxyUrl,
+        () => adapter.checkin(site.url, activeAccessToken, platformUserId));
     }
   }
 

src/server/services/modelService.ts

@@ -2,10 +2,11 @@ import { and, eq } from 'drizzle-orm';
 import { db, schema } from '../db/index.js';
 import { getAdapter } from './platforms/index.js';
 import { ensureDefaultTokenForAccount, getPreferredAccountToken } from './accountTokenService.js';
-import { getCredentialModeFromExtraConfig, resolvePlatformUserId } from './accountExtraConfig.js';
+import { getCredentialModeFromExtraConfig, getProxyUrlFromExtraConfig, resolvePlatformUserId } from './accountExtraConfig.js';
 import { invalidateTokenRouterCache } from './tokenRouter.js';
 import { setAccountRuntimeHealth } from './accountHealthService.js';
 import { clearAllRouteDecisionSnapshots } from './routeDecisionSnapshotStore.js';
+import { withAccountProxyOverride } from './siteProxy.js';
 
 const API_TOKEN_DISCOVERY_TIMEOUT_MS = 8_000;
 const MODEL_DISCOVERY_TIMEOUT_MS = 12_000;
@@ -129,12 +130,14 @@ export async function refreshModelsForAccount(accountId: number) {
   }
 
   const platformUserId = resolvePlatformUserId(account.extraConfig, account.username);
+  const accountProxyUrl = getProxyUrlFromExtraConfig(account.extraConfig);
   let discoveredApiToken: string | null = null;
 
   if (!account.apiToken && account.accessToken) {
     try {
       discoveredApiToken = await withTimeout(
-        () => adapter.getApiToken(site.url, account.accessToken, platformUserId),
+        () => withAccountProxyOverride(accountProxyUrl,
+          () => adapter.getApiToken(site.url, account.accessToken, platformUserId)),
         API_TOKEN_DISCOVERY_TIMEOUT_MS,
         `api token discovery timeout (${Math.round(API_TOKEN_DISCOVERY_TIMEOUT_MS / 1000)}s)`,
       );
@@ -200,7 +203,8 @@ export async function refreshModelsForAccount(accountId: number) {
     try {
       models = normalizeModels(
         await withTimeout(
-          () => adapter.getModels(site.url, credential, platformUserId),
+          () => withAccountProxyOverride(accountProxyUrl,
+            () => adapter.getModels(site.url, credential, platformUserId)),
           MODEL_DISCOVERY_TIMEOUT_MS,
           `model discovery timeout (${Math.round(MODEL_DISCOVERY_TIMEOUT_MS / 1000)}s)`,
         ),
@@ -227,7 +231,8 @@ export async function refreshModelsForAccount(accountId: number) {
     try {
       models = normalizeModels(
         await withTimeout(
-          () => adapter.getModels(site.url, token.token, platformUserId),
+          () => withAccountProxyOverride(accountProxyUrl,
+            () => adapter.getModels(site.url, token.token, platformUserId)),
           MODEL_DISCOVERY_TIMEOUT_MS,
           `model discovery timeout (${Math.round(MODEL_DISCOVERY_TIMEOUT_MS / 1000)}s)`,
         ),