refactor: route TPM reservation and settlement through the derived value

Five call sites (QuotaGate entry, RetryMW/EmbeddingClient success and
transient-failure settlement) now read effective_est_tokens() instead of
est_tokens. Success paths gain an unavailable branch that keeps delta at
zero once usage frames may be missing; it has no producer yet, so
behaviour is unchanged while the tpm>0 => est_tokens>0 gate still holds.

src/polygateway/embedding.py

@@ -268,7 +268,11 @@ class EmbeddingClient:
                     source_name=source.name,
                     operation="embedding",
                 )
-            actual = result.prompt_tokens
+            if result.usage_source == "unavailable":
+                # 与 RetryMW 同口径: 用量不可得时按入场预扣量结算(设计 §3.2 #9)
+                actual = source.effective_est_tokens()
+            else:
+                actual = result.prompt_tokens
             await self._record_quietly(self._breaker.record_success(entry))
             await self._record_quietly(self._quota.mark_progress())
             latency_ms = int((self._now() - started) * 1000)
@@ -291,7 +295,8 @@ class EmbeddingClient:
             reasons[source.name] = reason
             await self._record_quietly(self._breaker.record_failure(entry, reason, dead))
             if not dead:
-                actual = source.est_tokens  # 保守: 失败请求可能已被网关计费(CHS 同款)
+                # 保守: 失败请求可能已被网关计费(CHS 同款);与入场预扣同源取值
+                actual = source.effective_est_tokens()
             await self._emit(batch, source, call_id, started, session_id, parent_call_id, error=exc)
             return _FailedBatch(exc, immediate=dead)
         finally: