fix: show scheduled accounts in ops and threshold temp unscheduling

[zjarlin]

Summary

• show the scheduled account separately from the logged-in sub2api user in ops error logs, error details, and request details
• include scheduled account names in request detail queries and upstream error events so the ops UI can always render the dispatched account column
• add trigger_count support for temp unschedulable rules and apply a built-in OpenAI 503 burst safeguard that temp-unschedules accounts after 3 hits within 10 minutes for 30 minutes
• preserve OpenAI selection failure phase/cause/details in ops diagnostics so no available accounts and context canceled no longer hide the real failure step
• append the scheduled account name to service-unavailable responses and upstream error records when available, and use a stable placeholder when selection fails before an account is chosen
• disable OpenAI accounts immediately when upstream returns unsupported responses tool type \custom`` instead of only marking them temporarily unschedulable
• keep load-batch fallback wait plans intact while still surfacing structured selection diagnostics for true failures
• reset temp-unsched counters after successful usage and cover the new behavior with unit tests

Testing

• go test -tags unit ./internal/service
• go test -tags unit ./internal/handler -run 'TestAnnotateOpenAISelectionFailure|TestOpsErrorContext|TestOpenAIRecoverResponsesPanic|TestOpenAIEnsureResponsesDependencies|TestOpenAIResponses_MissingDependencies_ReturnsServiceUnavailable'
• go test -tags unit ./internal/repository
• pnpm build

[github-actions]

All contributors have signed the CLA. ✅
_{Posted by the CLA Assistant Lite bot.}

[zjarlin]

补充一组与本 PR 同主题的修正：

• scheduled account 现在按权限显示：管理员默认可见；非管理员仅在所属分组开启 expose_scheduled_account_in_logs 时可见。
• 分组创建/编辑已支持该开关，并补了迁移 136_add_group_scheduled_account_log_visibility.sql。
• 用户管理补上了 admin 角色的创建与编辑，同时保护“至少保留一个活跃管理员”。
• 运维明细里去掉了从 account_id / account_name 回退成调度账号的错误展示，避免把登录用户账号和账号池调度账号混为一谈。

已验证：

• go test -tags unit ./internal/service -run 'TestAdminService_(CreateGroup_|UpdateGroup_|CreateUser|UpdateUser_)'
• go test ./internal/handler/admin -run 'Test(OpsHandler_.*ScheduledAccount.*|UserHandlerCreateAndUpdateRoleMapping)'
• go test ./internal/repository -run '^$'
• go test ./cmd/server -run '^$'
• pnpm exec vue-tsc -b
• pnpm exec vite build

[zjarlin]

I have read the CLA Document and I hereby sign the CLA

[zjarlin]

Thank you for your contribution! Before we can merge this PR, we need you to sign our Contributor License Agreement (CLA).感谢你的贡献！在合并此 PR 之前，我们需要您签署我们的贡献者许可协议（CLA）。

To sign, please reply with the following comment:签名请回复以下评论：

I have read the CLA Document and I hereby sign the CLA我已阅读 CLA 文件，特此签署 CLA

You only need to sign once — it will be valid for all your future contributions to this project.您只需签一次字——这将适用于您未来对本项目的所有贡献。

I have read the CLA Document and I hereby sign the CLA我已阅读 CLA 文件，特此签署 CLA

You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.

I have read the CLA Document and I hereby sign the CLA