feat(dashboard): per-key model restrictions, pin header routing, combo side-panel picker

- Endpoint: per-API-key model allowlist (schema v3) enforced on chat (403)
  and /v1/models; Full-access toggle + multi-select picker in Keys UI.
- Providers: honor x-connection-id in /v1/chat/completions — pinned requests
  no longer rotate to another account on failure.
- Providers: strategy saves merge into stored enabled:false override;
  Test All groups match grid sections; 1-by-1 skips disabled connections.
- Dashboard: provider-card toggle syncs from server on failure; grid toggles
  always visible; connection rows get clear-✕ for stale error banners.
- Combo editor: on desktop (xl+) the Add-Model picker opens as a floating
  side panel beside the untouched combo popup instead of stacking on top;
  mobile keeps the full-screen overlay.
- Long API-key overflow fixed in key rows + provider model sections.

open-sse/config/errorConfig.js

@@ -73,6 +73,17 @@ export const ERROR_RULES = [
   { status: 403, cooldownMs: COOLDOWN.long },
   { status: 404, cooldownMs: COOLDOWN.long },
   { status: 429, backoff: true },
+  // --- Request-scoped errors: the request itself is broken — retrying the same
+  // body on another account/model can never succeed, and locking the account
+  // would punish a healthy credential for our own bad request. Callers use this
+  // to fail fast (no account rotation, no model lock).
+  { text: "context_length_exceeded", requestScoped: true },
+  { text: "context window",          requestScoped: true },
+  { text: "maximum context length",  requestScoped: true },
+  { text: "prompt is too long",      requestScoped: true },
+  { text: "input is too long",       requestScoped: true },
+  { text: "max_tokens exceed",       requestScoped: true },
+  { text: "reduce the length",       requestScoped: true },
 ];
 
 // Backward compat: COOLDOWN_MS object (used by index.js re-export)