sync: update to latest upstream and preserve LangBot contracts

[dadachann]

Summary

• replace the stale fork snapshot with current QuantumNous/new-api upstream
• preserve LangBot Space model metadata and /api/pricing fields
• preserve AdminAuth-protected cross-user token management without weakening normal token masking
• preserve long email credential compatibility and atomic non-negative quota accounting
• add deploy/prod-only GHCR production image workflow

Validation

• go test ./controller ./router passes on Go 1.25.1
• focused admin-token tests pass
• focused LangBot model tests pass individually; the upstream model package has shared-global SQLite tests and is not safe as a single parallel package run
• backend compilation succeeds; repository-wide go build ./... requires generated web/dist, supplied by Dockerfile frontend build

Rollout

After merge, create/update deploy/prod from main; production image is ghcr.io/langbot-app/langbot-new-api:prod-amd64.