Rework the multi custom-provider design per maintainer review:
1. Data model: use server-generated uuid4 short id as primary key;
'name' is now a pure display label that can be freely renamed.
2. Routing: drop 'custom_active_provider'; activate a provider by
setting bot_type to 'custom:<id>'. Single source of truth — no
pointer drift between bot_type and a separate active selector.
3. Security: drag_sensitive() now recursively masks api_key/secret in
nested structures (custom_providers list); previously only top-level
string fields were masked.
4. Per-provider model: the provider's 'model' field now takes effect on
the main chat path and agent path (was silently ignored before).
5. XSS fix: replace all inline onclick handlers in custom-provider UI
with data-* attributes + event delegation. Provider names never
appear in executable HTML contexts.
Legacy compatibility: bot_type='custom' (no colon) still reads the flat
custom_api_key/custom_api_base fields byte-for-byte identically.
Closes: consolidates #2876 into this PR as requested.
Ref: #2838
Separate DeepSeek from ChatGPTBot into its own module (models/deepseek/) with dedicated deepseek_api_key and deepseek_api_base config fields, avoiding config conflicts when switching between providers. Backward compatible with old users who configured DeepSeek via open_ai_api_key/open_ai_api_base through automatic fallback.
Made-with: Cursor
- Rename ZHIPU_AI bot type from glm-4 to zhipu to avoid confusion with model names
- Add bot_type persistence in web config to fix provider dropdown resetting on refresh
- Change OpenAI provider key to chatGPT to match bot_factory routing
- Add DEEPSEEK constant and route it to ChatGPTBot (OpenAI-compatible API)
- Keep backward compatibility for legacy bot_type glm-4 in bot_factory
- Fix re.sub bad escape error on Windows paths by using lambda replacement
- Remove unused pydantic import in minimax_bot.py
Made-with: Cursor
