fix(registry): recover refresh goroutine, per-provider warm-fill budget, exact-glob model authorization

1. refreshProvider (the plugin's only background goroutine) had no
recover(): a panicking adapter's listModels would crash the whole
Traefik process. Restructured around deferred recover + finishRefresh,
so a panic is turned into a logged error, inFlight always releases, and
the next interval retries. Documented as a scoped exception to
limits.go's no-background-goroutine rule.

2. newGateway wrapped ctx in an outer 5s WithTimeout before warmFill,
but warmFill already derives a fresh 5s budget per provider from
whatever ctx it receives. The outer wrap made that a single budget
shared across every discovery-enabled provider instead of a per-provider
one - providers after the first could get a near-expired context and
fail instantly. Dropped the outer wrapper; construction's worst case is
now N * 5s, accepted.

3. group.allowsModel stripped at any first slash, so a glob like
'deepseek-*' could spuriously match a bare model id that merely
contains a slash (e.g. an upstream's own 'uni/deepseek-v4-flash-0731'
naming) even though the leading segment names no configured provider.
allowsModel is now an exact glob with no internal splitting;
resolveAgainst and listFor generate the provider-prefixed and
bare-suffix candidates themselves, only when a prefix legitimately
names a configured provider. Updated the Task-3 TestIdentify assertion
to match.

4. Annotated the discarded json.Encode error in handleModels.

Gate: go test ./... -count=1, -race, gofmt, vet, fieldalignment,
golangci-lint (incl gosec) all clean.

llmgateway.go

@@ -153,9 +153,15 @@ func newGateway(ctx context.Context, next http.Handler, config *Config, name str
 	if err != nil {
 		return nil, err
 	}
-	warmCtx, warmCancel := context.WithTimeout(ctx, warmFillTimeout)
-	defer warmCancel()
-	registry.warmFill(warmCtx)
+	// ctx is passed through unwrapped, not re-bounded to warmFillTimeout here:
+	// warmFill already gives each discovery-enabled provider its own fresh
+	// warmFillTimeout budget per provider (registry.go). Wrapping ctx to a
+	// single shared warmFillTimeout here would make that per-provider budget
+	// a lie — provider 2..N would inherit whatever is left of the first
+	// provider's deadline instead of a full one. Construction's worst case is
+	// therefore N * warmFillTimeout (N = discovery-enabled providers), which
+	// is accepted.
+	registry.warmFill(ctx)
 	g.registry = registry
 
 	setPricingWarnFn(func(msg string) {