#2081 feat: per-model and per-class toleration presets in account files

What

Account files can set a scheduling-toleration preset on a model, or on one class of it:

account: acme
models:
  example/chat-model:
    toleration_preset: no-overflow   # this model only
    classes:
      standard:
        toleration_preset: gpu       # overrides the model's

For requests to that model, the preset replaces the account's own preset (users.toleration_preset, set by a platform manager). The more specific setting wins: class, then model, then the account, then none. "No preset" stays distinct from an empty toleration list. Only standard can be configured until models carry other classes, as with the rest of the account file.

The account-wide preset stays owned by the admin console; the files only add model and class overrides.

How

• Migration (additive): nullable account_model_policies.toleration_preset. Written by the account-file reconcile like the other policy columns; the table's existing notify trigger refreshes caches.
• Per-key policy map: each key's KeyPolicy carries its account's per-model preset map (class folded over model), shared by Arc across the account's keys. One extra small query per refresh.
• Inference middleware: the preset is now resolved after the model is known (after the async suffix strip), so realtime, flex and background requests get the list for their model.
• Batch upload: each line is stamped by its own model, from the same policy (or the direct DB read used for a just-created hidden key).
• Unknown ids fail closed to the empty list at request time, exactly as account presets do today. Startup logs a warning for any id the files name that the deployment's scheduling.toleration_presets doesn't define (the offline validator has no access to config).

Rollout

Dormant: nothing changes until an account file sets toleration_preset. Older images ignore the new column.

Tests

• just lint rust: green. just test rust: 4241 passed.
• New tests:
  • realtime, Responses and batch: a model preset overrides the account preset on that model only, and a class preset overrides the model's;
  • a model preset pins an otherwise unpinned account on that model only;
  • per-key resolution (model over account, "no preset" vs empty list);
  • the reconcile writes, folds and clears presets, and validation rejects empty or padded ids.

🤖 Generated with Claude Code