feat: add multi-key auth profile rotation for model providers

src/config/schema.test.ts

@@ -550,6 +550,20 @@ describe('configSchema — models auth_mode', () => {
     });
     expect(moonshot.models.default.provider).toBe('moonshot');
   });
+
+  it('accepts multiple api_keys per model tier', () => {
+    const result = configSchema.parse({
+      ...minimalConfig,
+      models: {
+        default: {
+          provider: 'openai',
+          model: 'gpt-4o',
+          api_keys: ['sk-1', 'sk-2'],
+        },
+      },
+    });
+    expect(result.models.default.api_keys).toEqual(['sk-1', 'sk-2']);
+  });
 });
 
 describe('configSchema — matrix', () => {

src/config/schema.ts

@@ -132,6 +132,7 @@ const modelConfigBaseSchema = z.object({
   model: z.string(),
   endpoint: z.string().optional(),
   api_key: z.string().optional(),
+  api_keys: z.array(z.string().min(1)).optional(),
   auth_token: z.string().optional(),
   /** Credential selection strategy for this tier (provider-specific). */
   auth_mode: z.enum(['auto', 'api_key', 'oauth']).optional(),