feat(routing): support per-client-key strict provider routing and Claude tier model mapping

[mvn-bachhuynh-dn]

Problem

When multiple clients or account profiles share a single CLIProxyAPI instance (for example via claude-swap or background agent gateways), all authenticated proxy keys share the same global model aliases and provider pool. There is no way to pin a specific client API key to a single provider (e.g. antigravity) while mapping different Claude model tiers (opus, sonnet, haiku) to appropriate upstream models so routine/background requests use lighter, higher-quota models and only explicit Opus requests hit flagship models.

Proposed Solution

Add access.api-key-routes to allow pinning an authenticated client key to a strict provider and target model set:

• model: default target model for the key
• opus-model: optional target model for claude-opus-*, claude-fable-*, and claude-mythos-* requests
• sonnet-model: optional target model for claude-sonnet-* requests
• haiku-model: optional target model for claude-haiku-* requests

Policies precede router plugins and registry aliases, fail closed on duplicate/incomplete rules, and never fall back to another provider on quota exhaustion.