feat(backthink/admin): ③b — rag/delete 真实现 + D1 推送出口钩子(自建优先→个推兜底) + api-reference 补 D2/D3/D5 补丁

- B5: POST /admin/rag/delete 真做(DeleteDocument→DeleteProject 级联删章节+索引清理, owner+审计, 200/404/500, 500降级兜底); users/iot scenarios+rules 诚实501(无用户表/IoT场景规则模型, 消息写明缺什么, 不伪造), 锁住 501+not_implemented
- D1: backthink/push_outlet.go PushExporter{Export}; pushOutlet 自建HTTP(2xx=送达, token仅Authorization头+error脱敏)优先→Getui兜底(未接入, 诚实日志'getui not integrated'+(false,nil)); backthink.Deps.Exporter → pusher.withExporter, Push 在WS/IM后 exportAsync(detached+5s超时, 失败仅日志, 不破坏现有投递, 限流不上报); config PushOutletConfig(PUSH_EXPORTER_* + GETUI_*占位)
- 前端 Rag.tsx/api.ts 删除后 reload + 类型; Docs/api-client v0.31 + api-reference(#23 owner/200-404, §8.4, 端点表PATCH/DELETE messages + pinned + messages?q=)
- 测试(push_outlet/admin_rag_delete/admin_honest501/knowledge store), 后端+前端build全绿+3平台交叉编译
- 刻意: Getui SDK 未接入(无SDK不硬造), 主人自建服务填 PUSH_EXPORTER_URL/TOKEN 即可

internal/config/config.go

@@ -30,6 +30,7 @@ type Config struct {
 	IoT         IoTConfig
 	Voice       VoiceConfig
 	Background  BackgroundConfig
+	PushOutlet  PushOutletConfig
 	WSHub       WSHubConfig
 	ExecSandbox ExecSandbox
 	MCP         MCPConfig
@@ -177,6 +178,31 @@ type BackgroundConfig struct {
 	KindWindowSec         int  `env:"THINK_KIND_WINDOW_SEC" default:"7200"`
 }
 
+// PushOutletConfig configures the proactive push outlet (D1, design/12 §4/§6).
+// Proactive messages are mirrored to the owner's self-hosted unified push
+// service (primary); Getui (个推) is the deferred fallback for when that service
+// is unavailable. The Getui* fields are reserved placeholders — the SDK is not
+// integrated, so an unavailable primary logs the pending fallback rather than
+// pretending to push.
+type PushOutletConfig struct {
+	// Enabled turns the outlet hook on. When false no export is attempted.
+	Enabled bool `env:"PUSH_EXPORTER_ENABLED" default:"false"`
+	// URL is the self-hosted unified push service endpoint (HTTP POST JSON).
+	// Empty leaves the primary tier unconfigured.
+	URL string `env:"PUSH_EXPORTER_URL"`
+	// Token is sent as "Authorization: Bearer <token>"; it is never logged.
+	Token string `env:"PUSH_EXPORTER_TOKEN"`
+	// TimeoutSec bounds one export attempt. Zero uses the service default (5s).
+	TimeoutSec int `env:"PUSH_EXPORTER_TIMEOUT_SEC" default:"5"`
+
+	// Getui* are reserved for the fallback tier; the SDK is not integrated yet,
+	// so these values are read but unused (kept so the env contract is stable).
+	GetuiAppID        string `env:"GETUI_APP_ID"`
+	GetuiAppKey       string `env:"GETUI_APP_KEY"`
+	GetuiMasterSecret string `env:"GETUI_MASTER_SECRET"`
+	GetuiBaseURL      string `env:"GETUI_BASE_URL"`
+}
+
 // WSHubConfig holds the WebSocket hub limits.
 type WSHubConfig struct {
 	MaxConnections     int `env:"WS_MAX_CONNECTIONS" default:"1000"`

internal/config/config_test.go

@@ -66,6 +66,35 @@ func TestLoad_EnvOverridesDefault(t *testing.T) {
 	}
 }
 
+func TestLoad_PushOutletEnv(t *testing.T) {
+	t.Setenv("JWT_SECRET", strings.Repeat("s", 40))
+	t.Setenv("PUSH_EXPORTER_ENABLED", "true")
+	t.Setenv("PUSH_EXPORTER_URL", "https://push.example.com/hook")
+	t.Setenv("PUSH_EXPORTER_TOKEN", "tok")
+	t.Setenv("PUSH_EXPORTER_TIMEOUT_SEC", "9")
+	t.Setenv("GETUI_APP_ID", "app-id")
+
+	cfg, err := Load("")
+	if err != nil {
+		t.Fatalf("Load() error: %v", err)
+	}
+	if !cfg.PushOutlet.Enabled {
+		t.Error("PushOutlet.Enabled = false, want true")
+	}
+	if cfg.PushOutlet.URL != "https://push.example.com/hook" {
+		t.Errorf("PushOutlet.URL = %q, want the configured endpoint", cfg.PushOutlet.URL)
+	}
+	if cfg.PushOutlet.Token != "tok" {
+		t.Errorf("PushOutlet.Token = %q, want tok", cfg.PushOutlet.Token)
+	}
+	if cfg.PushOutlet.TimeoutSec != 9 {
+		t.Errorf("PushOutlet.TimeoutSec = %d, want 9", cfg.PushOutlet.TimeoutSec)
+	}
+	if cfg.PushOutlet.GetuiAppID != "app-id" {
+		t.Errorf("PushOutlet.GetuiAppID = %q, want app-id", cfg.PushOutlet.GetuiAppID)
+	}
+}
+
 func TestLoad_DotEnvThenProcessEnv(t *testing.T) {
 	path := writeEnvFile(t, `PORT=7000
 LOG_LEVEL=error