- Add fallback pricing for 10 Chinese AI providers (DeepSeek, Qwen, GLM,
Moonshot, Doubao, MiniMax, ERNIE, Spark, Hunyuan, Yi) with 38 test cases
- Add 32 Chinese model entries to pricing JSON (qwen-long, qwq-32b,
glm-4-air, spark-max/pro/lite, hunyuan-pro/standard/lite, etc.)
- Add 6 Chinese API domains to SSRF allowlist
- Fix XSS vulnerability in HomeView.vue with DOMPurify sanitization
- Change DB SSL default from 'disable' to 'prefer' with security comment
- Replace hardcoded admin password in config.example.yaml
- Enable @typescript-eslint/no-explicit-any as warning
- Add vite-plugin-compression for gzip production builds
- Add Prettier and EditorConfig configurations
- Fix missing context import in sticky_session_test.go
P0 fixes:
- ModelError.Is(): use exact matching instead of substring contains()
- shouldClearStickySession: add context param for cancellation/tracing
P1 fixes:
- TODO stubs: return 501 Not Implemented errors
- validateInstanceSignature: deduplicate to shared validateCodeSignature()
- Error messages: standardize to English only
- http.go: remove pseudo if-else with duplicate branches
