feat(config): 运行时配置体系①——LLM 多厂商独立组落 models.json + 面板落盘 + 热更新

- runtimeconfig/models.go: models.json 承载 [{id,provider,baseUrl,apiKey,model,fallback?,multimodal?}] 多厂商独立组(首项=生效)
- LoadModels 优先文件/回退env(GroupFromEnv), SaveModels(0600+tmp原子写), Activate/Upsert/MaskedKey脱敏
- 面板 POST /admin/llm 落盘 models.json(取代temporary内存) + GET 列组(脱敏)
- runtime/model/runtime.go: RuntimeLLM(adapter+router) atomic快照可热替换, Reload 重建不中断进行中请求; per-role路由用接口
- wire 用 NewRuntimeLLM(adapter+router), 保留 a.modelAdapter(=runtime stack, 审查模型随热更新)
- .env 退兜底(.env.example注明); apiKey不打印/Config()脱敏/热更新不中断
- 全仓 go build/vet/test 绿(54包)+交叉编译+前端build绿(79模块); api-client v0.15已同步
- 遗留: vision ModelInfo 仍读静态env(后续纳入); 保存组=生效组(第一版语义)

internal/runtime/agent/options.go

@@ -40,8 +40,10 @@ type Option func(*Agent)
 // optional per-role Router. When router is non-nil it overrides the Request's
 // Model from the request contents — which is how vision requests are routed to
 // the vision model — otherwise the agent's configured Model or the adapter
-// default applies.
-func WithModel(adapter model.Adapter, router *model.Router) Option {
+// default applies. router is a model.ModelRouter (implemented by *model.Router
+// and by the hot-swappable model.RuntimeLLM) so a reloaded provider can swap it
+// without rebuilding the agent.
+func WithModel(adapter model.Adapter, router model.ModelRouter) Option {
 	return func(a *Agent) {
 		a.adapter = adapter
 		a.router = router