feat(core): Model, ApiKey, RateLimit entities + JSON Schema validators

[moonming]

Summary

Adds the three entities from spec §3 that the admin plane writes and
the data plane reads on every request, alongside their Draft 2020-12
JSON Schemas and the composite `AisixSnapshot`.

• Model — `/` routing target. `Provider` enum
  (openai/anthropic/gemini/deepseek) with default base URLs;
  `ProviderConfig` supports an `api_base` override.
• ApiKey — bearer credential with `allowed_models` whitelist.
  Empty array denies all per spec §3 authz rule.
• RateLimit — tpm / tpd / rpm / rpd / concurrency, all optional.
• schema.rs — validators compiled once via `Lazy<Arc>`,
  reused on admin write and etcd watch read paths. `SchemaError`
  collapses to the first failing JSON pointer.
• AisixSnapshot — `ResourceTable` + `ResourceTable`;
  the atomic-swap target for the future watch supervisor.

Reuses the generic `ResourceTable` / `SnapshotHandle` primitives that
landed in #2.

Test plan

• `cargo test -p aisix-core` — 42 tests pass
• `cargo clippy -p aisix-core --all-targets -- -D warnings` clean
• `cargo fmt --check` clean
• CI green across all 6 jobs

[Copilot]

Pull request overview

Adds the first concrete etcd-backed domain entities to aisix-core (Model, ApiKey, RateLimit) along with JSON Schema validation helpers and a composite AisixSnapshot that will be atomically swapped by a future watch supervisor.

Changes:

• Introduces Model, ApiKey, RateLimit entities implementing the Resource trait (with snapshot-ready runtime ids).
• Adds Draft 2020-12 JSON Schema validators compiled once and reused across admin write + watch read paths.
• Defines AisixSnapshot as the concrete snapshot shape (tables for Model and ApiKey) and re-exports the new APIs from aisix-core.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
crates/aisix-core/src/models/snapshot.rs	Adds AisixSnapshot composite snapshot + basic tests
crates/aisix-core/src/models/schema.rs	Adds compiled JSON Schema validators + tests
crates/aisix-core/src/models/rate_limit.rs	Adds shared RateLimit struct + tests
crates/aisix-core/src/models/model.rs	Adds Model/Provider/ProviderConfig + helper methods + tests
crates/aisix-core/src/models/apikey.rs	Adds ApiKey + authz helper + tests
crates/aisix-core/src/models/mod.rs	Wires up the new models module and re-exports
crates/aisix-core/src/lib.rs	Exposes models module and re-exports public types/helpers
crates/aisix-core/Cargo.toml	Adds dependencies needed for schema/regex validation
Cargo.lock	Locks new transitive dependencies introduced by jsonschema/regex/etc.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The field docs say “0 or absent = no timeout”, but with timeout: Option<u64> deserializing "timeout": 0 results in Some(0), not None. If callers forget the special-case, this can be misinterpreted as an immediate timeout. Consider encoding the spec rule in the type (e.g., Option<NonZeroU64> with custom serde mapping 0→None) or providing a helper like effective_timeout() that returns None when the value is 0.

[Copilot]

Adding jsonschema to aisix-core pulls in reqwest transitively (visible in Cargo.lock under jsonschema dependencies). That conflicts with the crate-level intent documented in crates/aisix-core/src/lib.rs (“no … reqwest”) and increases the core crate’s dependency surface (TLS/HTTP client, tokio, etc.). Consider either (a) configuring the jsonschema dependency to avoid HTTP-resolution/client features if possible, (b) gating schema validation behind a feature, or (c) moving schema validation to a higher-level crate so aisix-core stays framework-agnostic as documented.

Suggested change

	jsonschema.workspace = true
	jsonschema = { workspace = true, default-features = false }

[Copilot]

ProviderConfig contains an upstream api_key secret but derives Debug. Any logging/panic that prints this struct (or a parent Model) will leak credentials into logs. Consider using a secret wrapper type (e.g., secrecy::SecretString) and/or implementing a custom Debug that redacts the key.

[Copilot]

ApiKey holds the bearer secret in key but derives Debug. This makes it easy to accidentally leak API keys into logs (including via Debug on ResourceEntry<ApiKey> / snapshots). Consider wrapping the key in a redacting secret type and/or implementing a custom Debug impl that omits/redacts the secret.

[Copilot]

AisixSnapshot derives Debug but will contain Model / ApiKey values (including secrets like upstream api_key and bearer keys). If a snapshot is ever logged with {:?}, it can leak credentials. Consider removing Debug here or providing a redacted debug representation for snapshot/table contents.

[Copilot]

The model-id validation regex is duplicated: Model uses MODEL_ID_RE while the JSON Schema hard-codes the same pattern string. Keeping these in sync over time is error-prone (e.g., adding a provider would require updating both). Consider defining a single shared constant for the pattern (or deriving the schema pattern from the Provider enum) so both runtime checks and schema validation stay consistent.