location /deepseek/ {
    limit_req zone=spq_ai burst=5 nodelay;

    # 1) Validate the PB token. 401 → block; 200 → continue.
    auth_request /_spq_validate;
    auth_request_set $spq_auth_status $upstream_status;

    # 2) Strip the client's Authorization header.
    proxy_set_header Authorization "";

    # 3) Inject the DeepSeek key.
    include /etc/nginx/snippets/deepseek-key.conf;
    proxy_set_header Authorization "Bearer $deepseek_key";

    # 4) Rewrite path: /deepseek/v1/chat/completions → /v1/chat/completions
    rewrite ^/deepseek/(.*)$ /$1 break;

    proxy_pass https://api.deepseek.com;
    proxy_ssl_server_name on;
    proxy_set_header Host api.deepseek.com;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_buffering off;   # streaming responses
}

location = /_spq_validate {
    internal;
    proxy_pass http://127.0.0.1:8092/;
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
    proxy_set_header Authorization $http_authorization;
}