feat(config): 运行时配置体系①——LLM 多厂商独立组落 models.json + 面板落盘 + 热更新

- runtimeconfig/models.go: models.json 承载 [{id,provider,baseUrl,apiKey,model,fallback?,multimodal?}] 多厂商独立组(首项=生效)
- LoadModels 优先文件/回退env(GroupFromEnv), SaveModels(0600+tmp原子写), Activate/Upsert/MaskedKey脱敏
- 面板 POST /admin/llm 落盘 models.json(取代temporary内存) + GET 列组(脱敏)
- runtime/model/runtime.go: RuntimeLLM(adapter+router) atomic快照可热替换, Reload 重建不中断进行中请求; per-role路由用接口
- wire 用 NewRuntimeLLM(adapter+router), 保留 a.modelAdapter(=runtime stack, 审查模型随热更新)
- .env 退兜底(.env.example注明); apiKey不打印/Config()脱敏/热更新不中断
- 全仓 go build/vet/test 绿(54包)+交叉编译+前端build绿(79模块); api-client v0.15已同步
- 遗留: vision ModelInfo 仍读静态env(后续纳入); 保存组=生效组(第一版语义)

internal/services/gateway/server.go

@@ -25,7 +25,6 @@ import (
 	"net"
 	"net/http"
 	"strconv"
-	"sync"
 	"time"
 
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/auth"
@@ -219,6 +218,10 @@ type Deps struct {
 	// RAG backs the admin knowledge-base RAG module. Optional; list/search
 	// return empty when unset, and write endpoints report a clear 501.
 	RAG RagStore
+	// LLM is the hot-swappable provider stack (models.json, design/04 §3.1).
+	// Optional: when nil the admin /llm endpoints fall back to the env config so
+	// pre-existing gateway tests keep working.
+	LLM *model.RuntimeLLM
 	// AuditStore persists the admin audit trail (observability → audit). When nil
 	// the gateway degrades to an in-memory store so the endpoint still returns
 	// data; the composition root injects NewSQLiteAuditStore over a.db for real
@@ -263,12 +266,10 @@ type Server struct {
 	voice       VoiceService
 	streaming   bool
 	frontend    fs.FS
-	// llmMu guards llmExtra, the process-lifetime providers added at runtime via
-	// the admin "add provider" write. They are reflected in GET /admin/llm but are
-	// not bound to the model router (config is immutable after startup), so they
-	// are reported as temporary.
-	llmMu    sync.RWMutex
-	llmExtra []AdminLlmProvider
+	// llm is the hot-swappable provider stack (models.json). When nil the
+	// admin /llm endpoints fall back to the env config. It is optional so tests
+	// that do not wire it keep working.
+	llm      *model.RuntimeLLM
 	webhooks map[string]http.Handler
 	log      *slog.Logger
 	hub      *hub
@@ -304,6 +305,7 @@ func New(cfg *config.Config, deps Deps) (*Server, error) {
 		obs:         newObservability(deps),
 		streaming:   deps.Streaming,
 		frontend:    deps.Frontend,
+		llm:         deps.LLM,
 		webhooks:    deps.Webhooks,
 		log:         sourcedLog(deps.Log),
 	}