feat(tests): add comprehensive tests for TokenRouter and related components

- Implement tests for TokenRouter downstream policy, covering allowedRouteIds and site weight multipliers.
- Add tests for TokenRouter patterns and model mapping, including regex pattern matching and model mapping precedence.
- Create tests for BrandIcon component to verify brand detection logic.
- Develop tests for Accounts page, focusing on rebind panel behavior and refresh action on error.
- Introduce fuzzy search utility tests to validate substring and subsequence matching.
- Implement navigation focus helpers tests for building and parsing focus paths.
- Add progressive render tests to ensure correct initial and next visible counts.
- Create route model candidates index tests to validate route candidate indexing and matching logic.

src/server/routes/proxy/downstreamPolicy.ts

@@ -0,0 +1,35 @@
+import type { FastifyReply, FastifyRequest } from 'fastify';
+import { getProxyAuthContext } from '../../middleware/auth.js';
+import { isModelAllowedByPolicyOrAllowedRoutes, recordManagedKeyCostUsage } from '../../services/downstreamApiKeyService.js';
+import { EMPTY_DOWNSTREAM_ROUTING_POLICY, type DownstreamRoutingPolicy } from '../../services/downstreamPolicyTypes.js';
+
+export function getDownstreamRoutingPolicy(request: FastifyRequest): DownstreamRoutingPolicy {
+  return getProxyAuthContext(request)?.policy || EMPTY_DOWNSTREAM_ROUTING_POLICY;
+}
+
+export function ensureModelAllowedForDownstreamKey(
+  request: FastifyRequest,
+  reply: FastifyReply,
+  requestedModel: string,
+): boolean {
+  const authContext = getProxyAuthContext(request);
+  if (!authContext) return true;
+
+  if (isModelAllowedByPolicyOrAllowedRoutes(requestedModel, authContext.policy)) {
+    return true;
+  }
+
+  reply.code(403).send({
+    error: {
+      message: `Model not allowed for this API key: ${requestedModel}`,
+      type: 'permission_error',
+    },
+  });
+  return false;
+}
+
+export function recordDownstreamCostUsage(request: FastifyRequest, estimatedCost: number): void {
+  const authContext = getProxyAuthContext(request);
+  if (!authContext || authContext.keyId === null) return;
+  recordManagedKeyCostUsage(authContext.keyId, estimatedCost);
+}