feat: admin 端点补齐 + 视觉真推理 + 语音链路 + wire.go 收口（A+B+第3步）

批次A admin 端点（原本 404 变 200 真实数据）：
- GET /admin/llm：读 s.cfg.LLM 组 openai+anthropic 两 provider（enabled=当前 Provider、multimodal=配 VisionModel），APIKey 不进 wire 零泄露。
- GET /admin/automations：*automations.Service.List()（reminders+event rules+cron schedules，cron 加只读登记）。
- GET /admin/users：cfg.AdminUser + *auth.APIKey.List()（密钥掩码）；无用户存储，恒先返回当前 admin 账号。
- GET /admin/backthink：*backthink.Backthink.List(ctx,50)。均只读、owner/admin RBAC、{data} 信封。

批次B 视觉真推理 + 语音：
- rest.go chatRequest 加 Image?；流式 publishChatStream 带 image；userChatMessages 构造 ImageMessage(model.go:71)。
- loop/vision.go：ImageResolver 可注入（MVP 先看图再对话）；run.go Run 开头 resolveImages，无 resolver 透传直交主模型。
- vision/resolver.go：MessageResolver 调 vision.Router.Route——KindMain 保留图片交主模型多模态、KindVisionTool/OCRTool 经 dispatcher.Invoke 折叠成 [图片内容] 文本、KindUnsupported 记日志保留原图不崩。
- gateway/voice.go：VoiceService 接口 + SetVoice 注入点 + handleVoiceInput（未注入回 error 不崩）+ runVoiceTurn 异步 STT→loop chat→TTS→定向 voice_output 帧。
- ws_hub/ws_route：voice_input 接 handleVoiceInput；前端 ws.ts decodeBase64/playVoiceAudio/case voice_output。

第3步 wire.go 收口（唯一碰 wire.go 的一步）：
- Deps 补传 Automations:a.automation / Backthink:a.backthink / Users:auth.NewAPIKey(a.cfg.Auth)（*auth.APIKey 原生满足 UserStore，避免 admin 重复的复合类型）。
- gw.SetVoice(a.voice)；loop.Options.Vision = vision.NewMessageResolver(router, info, dispatcher.Invoke)（router=NewRouter(WithVisionTool/WithOCRTool)、info=cfg.LLM.VisionModel）。

实机验证：四 admin 端点 200 真实数据（llm 双 provider 脱敏、users=admin,yeij0942,owner）；WS 握手正常。go build/vet/test 全绿 + 前端 tsc。wire.go 557 行。

cmd/cyrene/wire.go

@@ -31,6 +31,7 @@ import (
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/memory/projectindex"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/memory/vector"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/model"
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/multimodal/vision"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/multimodal/voice"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/orchestration"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/orchestration/audit"
@@ -297,6 +298,21 @@ func (a *app) wireRuntime() error {
 		return fmt.Errorf("checkpoint store: %w", perr)
 	}
 
+	// Vision routing: the loop rewrites an image-bearing user message per the
+	// vision Router — a vision-capable main model sees the image directly,
+	// otherwise the vision/OCR tool's text description replaces it (design/06 §0).
+	visionRouter := vision.NewRouter(
+		vision.WithVisionTool(visionToolName),
+		vision.WithOCRTool(ocrToolName),
+	)
+	visionResolver := vision.NewMessageResolver(
+		visionRouter,
+		func() vision.ModelInfo {
+			return vision.ModelInfo{Name: a.cfg.LLM.VisionModel, SupportsVision: a.cfg.LLM.VisionModel != ""}
+		},
+		a.dispatcher.Invoke,
+	)
+
 	a.loop = loop.New(loop.Options{
 		Agent:         ag,
 		Tools:         a.dispatcher,
@@ -310,6 +326,7 @@ func (a *app) wireRuntime() error {
 		MaxRounds:     defaultMaxRounds,
 		WorkingMemory: memory.NewWorkingMemory(0),
 		OnStream:      a.streamChunk,
+		Vision:        visionResolver,
 		Log:           logger.WithSource(a.log, "runtime/loop"),
 	})
 
@@ -417,24 +434,29 @@ func (a *app) wireChannels() error {
 // managers so the admin/user list endpoints return real data.
 func (a *app) wireFrontend() error {
 	jwt := auth.New(a.cfg.Auth)
+	apiKeys := auth.NewAPIKey(a.cfg.Auth)
 	gw, err := gateway.New(a.cfg, gateway.Deps{
-		Log:       logger.WithSource(a.log, "gateway"),
-		Auth:      jwt,
-		Bus:       a.bus,
-		Registry:  a.caps,
-		Loop:      a.loop,
-		Session:   a.sessions,
-		Personas:  a.personas,
-		Memories:  a.memStore,
-		IoT:       a.iot,
-		Scheduler: a.scheduler,
-		Tasks:     a.tasks,
-		Streaming: true,
-		Frontend:  resolveFrontendFS(a.log),
+		Log:         logger.WithSource(a.log, "gateway"),
+		Auth:        jwt,
+		Bus:         a.bus,
+		Registry:    a.caps,
+		Loop:        a.loop,
+		Session:     a.sessions,
+		Personas:    a.personas,
+		Memories:    a.memStore,
+		IoT:         a.iot,
+		Scheduler:   a.scheduler,
+		Tasks:       a.tasks,
+		Automations: a.automation,
+		Users:       apiKeys,
+		Backthink:   a.backthink,
+		Streaming:   true,
+		Frontend:    resolveFrontendFS(a.log),
 	})
 	if err != nil {
 		return fmt.Errorf("gateway: %w", err)
 	}
+	gw.SetVoice(a.voice)
 	a.gw = gw
 	return nil
 }