feat: add request route failover

[qq992833550]

Summary

• Retry chat generation on another eligible route for retryable upstream failures, up to three distinct routes per request.
• Exclude attempted routes and record each failed route before resolving the next candidate.
• Stop failover after any visible text, reasoning, usage, image, or server-tool side effect to avoid duplicate output or work.
• Cover route exclusion, retryable error classification, attempt limits, cancellation, and side-effect guards with tests.

Change type

• Bug fix
• Feature
• Documentation
• Refactor
• Configuration / deployment
• Security hardening
• Other

Affected areas

• Frontend / UI
• Backend / API
• Authentication / authorization
• Conversations / streaming
• Files / RAG / extraction
• Model routing / providers
• MCP / tools
• Billing / payments
• Admin console
• Deployment / Docker / configuration
• Documentation

Verification

• gofmt on all changed Go files
• go test ./...
• go vet ./...
• go build -trimpath -o /tmp/deeix-chat ./cmd/server

Screenshots, API examples, or logs

Not applicable; this is backend routing behavior with no UI or public API shape change.

Configuration, migration, and compatibility notes

No configuration, database migration, generated API contract, or deployment change is required. Existing route selection behavior is unchanged when no routes are excluded or when an error is not retryable.

Documentation

• Documentation is not needed for this change.
• Documentation was updated.
• Documentation still needs to be updated.

Security and privacy

• No secrets, tokens, credentials, local config, or personal data are included.
• User data access remains scoped by authenticated user context unless an admin-only path explicitly requires broader access.
• Security-sensitive behavior was reviewed, including authentication, authorization, provider routing, file processing, billing, and admin APIs where relevant.

Checklist

• I searched existing issues and pull requests.
• Changes are focused and do not include unrelated refactors.
• Tests or static verification were run where practical.
• User-facing behavior, deployment steps, API contracts, or configuration changes are documented.
• Generated artifacts are included only when this project explicitly requires them.
• Caches, build output, .pyc files, .env files, and local storage data are not committed.