fix(proxy): patch P0-P3 routing/lifecycle issues across forwarder paths

* stream_check: thread Result from get_auth_headers via map_err so
  the workspace builds again
* forwarder: scope rectifier / budget-rectifier flags per-provider so
  failover can still apply rectification on the next attempt
* forwarder: categorize before record_result; route NonRetryable and
  ClientAbort through release_permit_neutral so client-side failures
  don't pollute circuit breaker or DB health
* handler_context: parse Gemini model from uri.path() and strip both
  ?query and :action verb defensively in extract_gemini_model_from_path
* forwarder + response_processor + handlers: introduce
  ActiveConnectionGuard (RAII) so active_connections decrement covers
  the full streaming body lifetime, not just response headers
* claude_desktop_config: use sort_by_key to clear the clippy gate

src-tauri/src/services/stream_check.rs

@@ -444,7 +444,10 @@ impl StreamCheckService {
             // - AuthStrategy::ClaudeAuth → Authorization: Bearer
             // - AuthStrategy::Bearer     → Authorization: Bearer
             // 避免之前"无条件 Bearer + 条件 x-api-key 双发"导致的假阴性 / auth conflict。
-            for (name, value) in ClaudeAdapter::new().get_auth_headers(auth) {
+            let auth_headers = ClaudeAdapter::new()
+                .get_auth_headers(auth)
+                .map_err(|e| AppError::Message(format!("stream check 构造鉴权头失败: {e}")))?;
+            for (name, value) in auth_headers {
                 request_builder = request_builder.header(name, value);
             }