[Feature][AI] Add capability-aware virtual models and weighted upstream pools #8046

Feature Request

Applications need a stable model alias while operators change providers, distribute traffic and isolate unhealthy endpoints. Existing AiProxyEngine retry/fallback and AiProviderCapabilities are foundations, not missing features.

Proposed scope

• Define tenant-scoped logical model aliases mapped to explicit provider/model/credential references and weighted upstream pools.
• Filter candidates by protocol, streaming, tool calling, structured output and modality capabilities before selection; reject unsupported combinations explicitly.
• Reuse existing retry/fallback and transport lifecycle; bound attempts by one request deadline, handle 429 cooldown and health recovery, and never switch after client-visible output.
• Add Admin validation and versioned configuration synchronization using existing channels; distinguish logical model, selected upstream and each attempt in telemetry.

Acceptance criteria

• Weighted routing and health recovery work under concurrent traffic without crossing tenant boundaries.
• Tool/JSON-schema/multimodal requests never silently downgrade capabilities; partial SSE cannot mix upstream output.
• Document and test policy update snapshots, disabled targets, exhausted pools, cancellation and secrets redaction.

Dependencies and boundaries

Coordinate #7382, #7384, #7955 and #7934. Do not replace the native proxy or add semantic routing in this issue.

Additional context

Proposed priority: P0 (for discussion, not a maintainer commitment). Workspace evidence must be reconciled with merged master and open PR ownership before implementation.

References: Higress AI plugins, agentgateway documentation. These are design references, not claims of ShenYu feature parity.

Delivery stages and adjacent contracts (2026-10-30)

Deliver deterministic aliases, capability filtering and weighted pools first; #8052 retains evidence-gated cost/quality routing. Publish the provider/model/protocol/stream/tool/schema matrix and validate complete configurations before activation. Reuse native Protocol/Provider/Transport; protocol conversion selection alone is not a model router.

Initial and fallback targets must satisfy the same tenant authorization and capabilities. Reuse #8120 managed-target/credential boundaries, #7955 actual-attempt usage and #7934 pricing. Preserve compatibility with #8051's selected prompt manifest/model family.

Master already declares JSON mode / JSON Schema capabilities. Provider-native constrained output is not gateway-owned constrained decoding: supported model/schema semantics need explicit coverage or an unknown outcome. #8257 owns generated-content validation and bounded repair; unsupported candidates cannot silently strip schema requirements. #8254 owns deterministic LLM resource caps; #7930 owns adaptive control. Test weighted eligibility, exhausted pools, 429 recovery, cancellation and no switching after output commitment under one #8121 deadline.