feat(compute): 新增 /admin/compute/proxy/{path} 透传 compute-engine 管理 API

- compute_client.proxy(): 转发到引擎 /api/<path>，保留原始状态码/响应体
- rbac_operator 新增 compute_proxy 端点(GET/POST/PUT/DELETE/PATCH)，运营端鉴权
- 使 admin 端可 1:1 驱动 new-api 完整管理面(models/channels/groups/tokens/users/logs/redemption/ratio)

app/services/compute_client.py

@@ -104,3 +104,21 @@ async def get_logs(user_pat: str) -> dict:
     """用户 token 流水。"""
     headers = {"Authorization": f"Bearer {user_pat}"}
     return await _request(method="GET", path="/api/log/self", headers=headers)
+
+
+async def proxy(method: str, path: str, *, json_body: dict | None = None, params: dict | None = None) -> dict:
+    """管理 API 透传：转发到引擎 ``/api<path>``，返回 ``{status, body}``。
+
+    供 /admin/compute/proxy/** 使用，让 admin 端可 1:1 驱动 compute-engine(new-api) 的完整管理面
+    （models/channels/groups/tokens/users/logs/redemption/ratio 等），不改写每个端点契约。
+    保留引擎原始状态码与响应体（网关层不吞错误）。
+    """
+    url = f"{_base()}/api{path}"
+    try:
+        async with httpx.AsyncClient(timeout=config.COMPUTE_TIMEOUT) as client:
+            resp = await client.request(
+                method, url, json=json_body, params=params, headers=_admin_headers(),
+            )
+        return {"status": resp.status_code, "body": resp.text or "{}"}
+    except httpx.HTTPError as exc:
+        return {"status": 502, "body": '{"error": "%s"}' % str(exc)}