fix: harden provider endpoint - remove broken completions mode, add validation

- Remove `completions` option (path-only change without body conversion causes 400)
- Add server-side enum validation for providerEndpoint in create/update
- Use exact path matching instead of broad `.includes()` in relay service
- Fix test endpoint to respect providerEndpoint config and /v1 dedup
- Improve /v1 dedup with null-safe baseApi access

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/services/account/openaiResponsesAccountService.js

@@ -52,7 +52,7 @@ class OpenAIResponsesAccountService {
       quotaResetTime = '00:00', // 额度重置时间（HH:mm格式）
       rateLimitDuration = 60, // 限流时间（分钟）
       disableAutoProtection = false, // 是否关闭自动防护（429/401/400/529 不自动禁用）
-      providerEndpoint = 'responses' // Provider 端点类型：responses | completions | auto
+      providerEndpoint = 'responses' // Provider 端点类型：responses | auto
     } = options
 
     // 验证必填字段
@@ -60,6 +60,14 @@ class OpenAIResponsesAccountService {
       throw new Error('Base API URL and API Key are required for OpenAI-Responses account')
     }
 
+    // 验证 providerEndpoint 枚举值
+    const validEndpoints = ['responses', 'auto']
+    if (!validEndpoints.includes(providerEndpoint)) {
+      throw new Error(
+        `Invalid providerEndpoint: ${providerEndpoint}. Must be one of: ${validEndpoints.join(', ')}`
+      )
+    }
+
     // 规范化 baseApi（确保不以 / 结尾）
     const normalizedBaseApi = baseApi.endsWith('/') ? baseApi.slice(0, -1) : baseApi
 
@@ -98,7 +106,7 @@ class OpenAIResponsesAccountService {
       quotaResetTime,
       quotaStoppedAt: '',
       disableAutoProtection: disableAutoProtection.toString(), // 关闭自动防护
-      providerEndpoint // Provider 端点类型：responses(默认) | completions | auto
+      providerEndpoint // Provider 端点类型：responses(默认) | auto
     }
 
     // 保存到 Redis
@@ -167,6 +175,16 @@ class OpenAIResponsesAccountService {
       // 直接保存，不做任何调整
     }
 
+    // 验证 providerEndpoint 枚举值
+    if (updates.providerEndpoint !== undefined) {
+      const validEndpoints = ['responses', 'auto']
+      if (!validEndpoints.includes(updates.providerEndpoint)) {
+        throw new Error(
+          `Invalid providerEndpoint: ${updates.providerEndpoint}. Must be one of: ${validEndpoints.join(', ')}`
+        )
+      }
+    }
+
     // 自动防护开关
     if (updates.disableAutoProtection !== undefined) {
       updates.disableAutoProtection = updates.disableAutoProtection.toString()