feat(config): 运行时配置体系①——LLM 多厂商独立组落 models.json + 面板落盘 + 热更新

- runtimeconfig/models.go: models.json 承载 [{id,provider,baseUrl,apiKey,model,fallback?,multimodal?}] 多厂商独立组(首项=生效)
- LoadModels 优先文件/回退env(GroupFromEnv), SaveModels(0600+tmp原子写), Activate/Upsert/MaskedKey脱敏
- 面板 POST /admin/llm 落盘 models.json(取代temporary内存) + GET 列组(脱敏)
- runtime/model/runtime.go: RuntimeLLM(adapter+router) atomic快照可热替换, Reload 重建不中断进行中请求; per-role路由用接口
- wire 用 NewRuntimeLLM(adapter+router), 保留 a.modelAdapter(=runtime stack, 审查模型随热更新)
- .env 退兜底(.env.example注明); apiKey不打印/Config()脱敏/热更新不中断
- 全仓 go build/vet/test 绿(54包)+交叉编译+前端build绿(79模块); api-client v0.15已同步
- 遗留: vision ModelInfo 仍读静态env(后续纳入); 保存组=生效组(第一版语义)

internal/services/gateway/admin_write_llm_channels.go

@@ -2,10 +2,7 @@ package gateway
 
 import (
 	"context"
-	"crypto/rand"
-	"encoding/hex"
 	"encoding/json"
-	"fmt"
 	"net/http"
 	"strings"
 	"time"
@@ -14,6 +11,7 @@ import (
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/channel/adapter"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/channel/session"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/config"
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/config/runtimeconfig"
 	apperr "git.yeij.top/AskaEth/Cyrene_v2/internal/errors"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/model"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/user"
@@ -35,40 +33,92 @@ const (
 	llmProbePrompt = "Reply with the single word: OK"
 )
 
-// llmProviderRequest is the POST /api/v1/admin/llm body for adding a provider.
+// llmProviderRequest is the POST /api/v1/admin/llm body for adding/updating a
+// provider group. Name is a client-side display label (not persisted — the
+// models.json schema carries id/provider/baseUrl/apiKey/model/fallback/multimodal).
 type llmProviderRequest struct {
 	ID         string `json:"id"`
 	Name       string `json:"name"`
+	Provider   string `json:"provider"`
 	BaseURL    string `json:"baseUrl"`
+	APIKey     string `json:"apiKey"`
 	Model      string `json:"model"`
 	Multimodal bool   `json:"multimodal"`
 	Fallback   string `json:"fallback"`
 }
 
-// adminAddLlmProvider records a provider for the process lifetime, reflected in
-// the GET /admin/llm listing. It is not bound to the model router (config is
-// immutable after startup), so it is reported as temporary in the response.
+// adminAddLlmProvider saves a provider group to models.json (read-modify-write,
+// promoting it to the active group) and hot-reloads the running LLM stack so the
+// new provider/model takes effect without a restart (design/04 §3.1). The API key
+// is persisted to the gitignored file but never returned or logged.
 func (s *Server) adminAddLlmProvider(w http.ResponseWriter, r *http.Request) {
 	var req llmProviderRequest
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "invalid request body"))
 		return
 	}
-	if strings.TrimSpace(req.Name) == "" || strings.TrimSpace(req.Model) == "" {
+	if strings.TrimSpace(req.Model) == "" || strings.TrimSpace(req.BaseURL) == "" {
 		s.auditClaims(r, "llm.addProvider", "error")
-		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "name and model are required"))
+		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "baseUrl and model are required"))
+		return
+	}
+	provider := req.Provider
+	if provider == "" {
+		provider = model.ProviderOpenAI
+	}
+	if provider != model.ProviderOpenAI && provider != model.ProviderAnthropic {
+		s.auditClaims(r, "llm.addProvider", "error")
+		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "invalid provider"))
+		return
+	}
+	if s.llm == nil {
+		s.auditClaims(r, "llm.addProvider", "error")
+		writeError(w, apperr.Wrap(apperr.ErrInternal, "llm_unavailable", "LLM 配置服务未注入"))
 		return
 	}
 	id := req.ID
 	if id == "" {
-		id = newIDHex()
+		id = runtimeconfig.NewID()
+	}
+	// Promote the saved group to the active (index 0) slot, then persist and
+	// hot-reload so Current() reflects the new provider/model immediately.
+	groups := runtimeconfig.Activate(s.llm.Groups(), runtimeconfig.Group{
+		ID:         id,
+		Provider:   provider,
+		BaseURL:    req.BaseURL,
+		APIKey:     req.APIKey,
+		Model:      req.Model,
+		Fallback:   req.Fallback,
+		Multimodal: req.Multimodal,
+	})
+	if err := runtimeconfig.SaveModels(s.llm.Path(), groups); err != nil {
+		s.auditClaims(r, "llm.addProvider", "error")
+		s.log.Error("llm save models", "path", s.llm.Path(), "error", err)
+		writeError(w, apperr.Wrap(apperr.ErrInternal, "llm_persist_failed", "failed to save models.json"))
+		return
+	}
+	if err := s.llm.Reload(); err != nil {
+		s.auditClaims(r, "llm.addProvider", "error")
+		s.log.Error("llm reload", "error", err)
+		writeError(w, apperr.Wrap(apperr.ErrInternal, "llm_reload_failed", "saved but failed to hot-reload"))
+		return
+	}
+	saved := AdminLlmProvider{
+		ID:         id,
+		Name:       providerDisplayName(runtimeconfig.Group{Provider: provider}),
+		Provider:   provider,
+		BaseURL:    req.BaseURL,
+		Model:      req.Model,
+		Multimodal: req.Multimodal,
+		Enabled:    id == s.llm.Group().ID,
+		Fallback:   req.Fallback,
 	}
-	provider := AdminLlmProvider{ID: id, Name: req.Name, BaseURL: req.BaseURL, Model: req.Model, Multimodal: req.Multimodal, Fallback: req.Fallback}
-	s.llmMu.Lock()
-	s.llmExtra = append(s.llmExtra, provider)
-	s.llmMu.Unlock()
 	s.auditClaims(r, "llm.addProvider", "ok")
-	writeJSON(w, http.StatusCreated, map[string]any{"provider": provider, "temporary": true})
+	writeJSON(w, http.StatusCreated, map[string]any{
+		"provider":  saved,
+		"persisted": true,
+		"path":      s.llm.Path(),
+	})
 }
 
 // llmTestRequest is the POST /api/v1/admin/llm/test body.
@@ -267,12 +317,3 @@ func describeIdentity(a adapter.Actor, _ *user.OwnerProfile) string {
 		return "未命中主人白名单 → 按陌生人处理（default deny，记忆只读不写）"
 	}
 }
-
-// newIDHex returns a 16-byte hex id.
-func newIDHex() string {
-	b := make([]byte, 16)
-	if _, err := rand.Read(b); err != nil {
-		return fmt.Sprintf("id-%d", time.Now().UnixNano())
-	}
-	return hex.EncodeToString(b)
-}