fix(billing): surface quota saturation events for admin auditing

Thread int32 saturation clamps from tiered settlement and video task
recompute into the consume/task logs under admin_info, so oversized or
malformed billing inputs stay auditable. Clamp negative audio duration
before token conversion and gate the saturation UI markers on admin.

model/log_format_test.go

@@ -0,0 +1,35 @@
+package model
+
+import (
+	"testing"
+
+	"github.com/QuantumNous/new-api/common"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestFormatUserLogsStripsQuotaSaturation verifies the admin-only quota
+// saturation marker (nested under other.admin_info) is removed for non-admin
+// log views, since formatUserLogs strips the whole admin_info object.
+func TestFormatUserLogsStripsQuotaSaturation(t *testing.T) {
+	other := common.MapToJsonStr(map[string]interface{}{
+		"model_price": 0.004,
+		"admin_info": map[string]interface{}{
+			"quota_saturation": map[string]interface{}{
+				"op":      "QuotaFromDecimal",
+				"kind":    "overflow",
+				"clamped": common.MaxQuota,
+			},
+		},
+	})
+	logs := []*Log{{Other: other}}
+
+	formatUserLogs(logs, 0)
+
+	parsed, err := common.StrToMap(logs[0].Other)
+	require.NoError(t, err)
+	_, hasAdminInfo := parsed["admin_info"]
+	require.False(t, hasAdminInfo, "admin_info (and nested quota_saturation) must be stripped for non-admin views")
+	// Non-admin billing fields remain visible.
+	require.Contains(t, parsed, "model_price")
+}