feat(pool): runtime account pause and reset-priority sort

[jesusvillota]

Summary

Two complementary runtime controls on top of the account pool, both operable from the admin dashboard or admin API with no shunt.toml edit or restart:

• Pause — a provider-scoped runtime pause excludes one physical account identity from that provider's select_order without signing it out or touching config. GET /admin/api/pool returns an opaque account_ref for each row; write-tier callers toggle it via PATCH /admin/api/pool/{provider}/accounts/{account_ref}. Using the opaque identity rather than the display name keeps distinct same-name credentials independently controllable.
• Reset-priority sort — [server.pool] sort_by_reset (default false) ranks available accounts by soonest relevant quota reset instead of burn-rate headroom. Since [server.pool] is process-wide, PATCH /admin/api/pool provides the matching runtime override; {"sort_by_reset": null} clears that override back to config-following behavior.
• Dashboard — "Managed pool health" gets a Pause/Resume action per row and a "rank by soonest reset" checkbox, both write-tier only.

Pause state is memory-only and provider-scoped: quota/cooldown health remains shared by the existing physical-account identity, while pausing one provider lane does not pause another provider that resolves to the same identity. disabled remains the persistent config-side exclusion.

Review follow-ups

This head incorporates the earlier review fixes and is updated onto current main:

• preserves current main's per-model Codex cooldown selection while layering pause/reset ranking on top;
• uses the request-relevant weekly/Fable reset when sorting, so stale Fable-only state cannot reorder ordinary traffic;
• correctly re-ranks remaining candidates when the sticky account is paused;
• distinguishes omitted sort_by_reset, explicit null, and boolean runtime overrides;
• computes pause state under the existing account-health lock rather than locking once per account;
• addresses pause mutations by account_ref rather than display name;
• scopes pauses by provider even when two providers share the same physical account identity;
• keeps needs_relogin as the dashboard's higher-priority status when a paused credential is permanently dead.

Test plan

• Fresh GitHub CI on the updated/amended head
• Fresh CodSpeed run on the updated/amended head
• Unit coverage for pause exclusion/snapshot/unpause, provider-scoped pause state, reset-priority ordering, Fable-aware reset selection, runtime override behavior, and account_ref disambiguation
• Integration coverage for write/read authorization, unknown refs, account_ref targeting, snapshot/selection effects, and the process-wide reset-sort toggle
• UI regression coverage proving duplicate display names target the selected row's account_ref
• Documentation updated in en/ko/ja/zh-cn for the runtime controls and identity-safe pause endpoint

[gemini-code-assist]

Code Review

This pull request introduces runtime pool account controls to the gateway, allowing operators to pause individual accounts and rank available accounts by their soonest quota reset directly from the admin dashboard or via new admin API endpoints without modifying shunt.toml or restarting. These changes are supported by updated multilingual documentation, UI updates, and new integration tests. The code review identified a performance improvement opportunity in src/accounts.rs where a mutex lock is repeatedly acquired and released inside a loop, which can be optimized by locking it once outside the loop.

[greptile-apps]

Confidence Score: 5/5

[Medium risk] Adds runtime account pause and quota-reset sorting to the pool.

The account-control changes appear safe to merge; no outstanding finding was identified.

Summary

The PR adds memory-only, provider-scoped account pausing and a process-wide reset-priority sorting override, exposed through authenticated admin APIs and dashboard controls.

• Pool responses provide account references so mutations do not depend on display names.
• Configuration, tests, and translated documentation cover the controls and their runtime lifecycle.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Operator[Admin dashboard or API] --> Auth[Write-tier and CSRF checks]
  Auth --> Pause[Provider-scoped account pause]
  Auth --> Sort[Process-wide sort override]
  Pause --> Pool[Account pool selection]
  Sort --> Pool
  Pool --> Snapshot[Admin pool snapshot]

Loading

_{Reviews (11) · Last reviewed commit: "Merge remote-tracking branch 'origin/mai..."}

[codspeed]

Merging this PR will not alter performance

✅ 120 untouched benchmarks

---

_{Comparing jesusvillota:feat/pool-pause-and-reset-rank (81c80a5) with main (376bb5c)}

[codecov]

Codecov Report

❌ Patch coverage is 92.52874% with 39 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/admin/mod.rs	67.54%	37 Missing ⚠️
src/accounts.rs	99.50%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!

[jesusvillota]

@codspeedbot explain why gated_terminal_scan and value_parse[307200] are reported as regressions on the current head, especially given that CodSpeed reports different runtime environments and this PR does not modify those benchmark definitions. Please analyze only; do not create or modify code.