P1-6: Per-team / per-user rate limiting + budgets (already-modeled Team table not consumed at runtime)

Problem

`aisix-core/src/models/team.rs` ships a `Team` resource with rate_limit field; CRUD is in `crates/aisix-admin/src/teams_handlers.rs`. But the Limiter (`crates/aisix-ratelimit/src/limiter.rs`) is keyed on ApiKey id only and never consults team membership. Same story for Budget.

Multi-tenant SaaS customers REQUIRE per-team caps (one team can't drain the org's RPM); we're shipping the data model but not the enforcement.

Scope

DP (moonming/ai-gateway)

• Add `team_id` field to `ApiKey` (already partially there).
• Limiter: when an api_key has a team_id, check the team's rate_limit FIRST (combined for the whole team), then the api_key's own.
• Budget tracker: same — team-level monthly cap, in addition to api_key cap.
• Composition rule: hit ANY of the layers = reject. Most-restrictive wins (LiteLLM convention).
• Need P0-5 (Redis backend) since team-level state must be cross-replica.

CP (api7/api7ee-3-control-plane)

• `team` resource (already exists in DP; CRUD doesn't exist on api7ee CP yet — it's actually in DP admin only). Promote to CP-managed: add CRUD, push to etcd.
• ApiKey schema: add `team_id` FK (nullable).

Dashboard UI (api7/AISIX-Cloud)

• New page "Teams" under Environment scope.
• ApiKey form: team picker.

e2e

• 2 keys in same team, team RPM=10. Hit each with 6 req → 11th request 429.
• Same with budgets.

Estimate

DP 3d, CP 2d (need to promote team to CP-managed first), UI 1.5d, e2e 1d

Start with aisix-core/src/models/team.rs, crates/aisix-admin/src/teams_handlers.rs, and crates/aisix-ratelimit/src/limiter.rs to trace the existing Team, ApiKey, and limiter paths. Then review the Redis backend requirement and the CP and dashboard scopes. Done means team and key limits and budgets compose correctly across replicas, with the described CRUD, picker, and end-to-end 429 scenarios covered.