refactor(custom): id-based routing, single source of truth, security fixes

Rework the multi custom-provider design per maintainer review:

1. Data model: use server-generated uuid4 short id as primary key;
   'name' is now a pure display label that can be freely renamed.

2. Routing: drop 'custom_active_provider'; activate a provider by
   setting bot_type to 'custom:<id>'. Single source of truth — no
   pointer drift between bot_type and a separate active selector.

3. Security: drag_sensitive() now recursively masks api_key/secret in
   nested structures (custom_providers list); previously only top-level
   string fields were masked.

4. Per-provider model: the provider's 'model' field now takes effect on
   the main chat path and agent path (was silently ignored before).

5. XSS fix: replace all inline onclick handlers in custom-provider UI
   with data-* attributes + event delegation. Provider names never
   appear in executable HTML contexts.

Legacy compatibility: bot_type='custom' (no colon) still reads the flat
custom_api_key/custom_api_base fields byte-for-byte identically.

Closes: consolidates #2876 into this PR as requested.
Ref: #2838

models/chatgpt/chat_gpt_bot.py

@@ -17,7 +17,7 @@ from common import const
 from common.i18n import t as _t
 from models.bot import Bot
 from models.openai_compatible_bot import OpenAICompatibleBot
-from models.custom_provider import resolve_custom_credentials
+from models.custom_provider import resolve_custom_credentials, parse_custom_bot_type
 from models.chatgpt.chat_gpt_session import ChatGPTSession
 from models.openai.open_ai_image import OpenAIImage
 from models.session_manager import SessionManager
@@ -33,10 +33,12 @@ class ChatGPTBot(Bot, OpenAIImage, OpenAICompatibleBot):
     def __init__(self):
         super().__init__()
         # Resolve api key / base from config (no global SDK state anymore).
-        if conf().get("bot_type") == "custom":
-            # Supports multiple custom providers (custom_providers) with
-            # automatic fallback to the legacy custom_api_key/base fields.
-            self._api_key, self._api_base, _ = resolve_custom_credentials()
+        is_custom, _ = parse_custom_bot_type(conf().get("bot_type", ""))
+        custom_model = None
+        if is_custom:
+            # Supports multiple custom providers via bot_type "custom:<id>"
+            # with automatic fallback to the legacy custom_api_key/base fields.
+            self._api_key, self._api_base, custom_model = resolve_custom_credentials()
         else:
             self._api_key = conf().get("open_ai_api_key")
             self._api_base = conf().get("open_ai_api_base") or None
@@ -48,8 +50,9 @@ class ChatGPTBot(Bot, OpenAIImage, OpenAICompatibleBot):
         )
         if conf().get("rate_limit_chatgpt"):
             self.tb4chatgpt = TokenBucket(conf().get("rate_limit_chatgpt", 20))
-        conf_model = conf().get("model") or "gpt-3.5-turbo"
-        self.sessions = SessionManager(ChatGPTSession, model=conf().get("model") or "gpt-3.5-turbo")
+        # Per-provider model takes precedence over global model.
+        conf_model = custom_model or conf().get("model") or "gpt-3.5-turbo"
+        self.sessions = SessionManager(ChatGPTSession, model=conf_model)
         # o1相关模型不支持system prompt，暂时用文心模型的session
 
         self.args = {
@@ -72,7 +75,7 @@ class ChatGPTBot(Bot, OpenAIImage, OpenAICompatibleBot):
 
     def get_api_config(self):
         """Get API configuration for OpenAI-compatible base class"""
-        is_custom = conf().get("bot_type") == "custom"
+        is_custom, _ = parse_custom_bot_type(conf().get("bot_type", ""))
         if is_custom:
             custom_key, custom_base, custom_model = resolve_custom_credentials()
             api_key = custom_key
@@ -196,7 +199,7 @@ class ChatGPTBot(Bot, OpenAIImage, OpenAICompatibleBot):
             mime_type = mime_type_map.get(extension, "image/jpeg")
             
             # Get model and API config
-            is_custom = conf().get("bot_type") == "custom"
+            is_custom, _ = parse_custom_bot_type(conf().get("bot_type", ""))
             if is_custom:
                 custom_key, custom_base, custom_model = resolve_custom_credentials()
                 model = context.get("gpt_model") or custom_model or conf().get("model", "gpt-4o")