fix: 并发突发下共享管理员会话只登录一次

首版共享会话在缓存未命中时各线程各自登录：突发冷缓存下
N 路并发开通会在网关刷出 N 次 bcrypt。改为锁内双重检查
登录（RLock 可重入，_login 成功后写回同一缓存）：第一路
登录，其余线程等锁后直接播种。实例本身仍不跨线程，401
时照常走刷新->重登录自愈。
测试：FakeApi 加锁（假实现自身线程安全，失败指向真代码）；
新增 10 线程同起并发单测，断言 10 路全成功且管理员登录
恰好 1 次；全量 cloud 795（4 跳过）、host 69、deploy 19
全绿；真网关 10 路突发实测 0 错误、墙钟 0.774s、临时号
已清。

cloud/tests/test_sub2api.py

@@ -7,6 +7,7 @@
 import os
 import sqlite3
 import sys
+import threading
 import unittest
 from pathlib import Path
 from unittest import mock
@@ -31,6 +32,7 @@ class FakeApi:
 
     def __init__(self):
         self.calls = []
+        self._lock = threading.Lock()
         self.admin_token = "adm-tok"
         self.user_token = "usr-tok"
         self.groups = [{"id": 2, "name": "codex-system"}]
@@ -43,6 +45,10 @@ class FakeApi:
         self.create_user_hook = None
 
     def __call__(self, method, url, body=None, token=None):
+        with self._lock:
+            return self._handle(method, url, body, token)
+
+    def _handle(self, method, url, body=None, token=None):
         path = url.split("28084", 1)[-1] if "28084" in url else url
         self.calls.append((method, path, body, token))
         if path == "/api/v1/auth/login" and body.get("email") == "adm@x":
@@ -267,6 +273,38 @@ class TestEnsureGatewayKey(unittest.TestCase):
         finally:
             self._restore_admin_env(old)
 
+    def test_shared_admin_session_concurrent_burst_logs_in_once(self):
+        old = self._admin_env()
+        barrier = threading.Barrier(10)
+        results = []
+        errors = []
+
+        def run(i):
+            try:
+                barrier.wait(timeout=10)
+                conn = _conn()
+                key = ensure_user_gateway_key(
+                    conn, "user-c%d" % i, request=self.api)
+                results.append(key)
+            except Exception as exc:  # noqa: BLE001 - 汇总后断言
+                errors.append(exc)
+
+        try:
+            threads = [threading.Thread(target=run, args=(i,))
+                       for i in range(10)]
+            for t in threads:
+                t.start()
+            for t in threads:
+                t.join(timeout=30)
+            self.assertEqual(errors, [])
+            self.assertEqual(len(results), 10)
+            self.assertTrue(all(k.startswith("sk-probe-")
+                                for k in results))
+            # 突发冷缓存：10 路并发也只登录一次。
+            self.assertEqual(self._admin_login_count(), 1)
+        finally:
+            self._restore_admin_env(old)
+
 
 class TestProviderCommand(unittest.TestCase):
     def test_server_command_sub2api(self):