feat: admin 端点补齐 + 视觉真推理 + 语音链路 + wire.go 收口（A+B+第3步）

批次A admin 端点（原本 404 变 200 真实数据）：
- GET /admin/llm：读 s.cfg.LLM 组 openai+anthropic 两 provider（enabled=当前 Provider、multimodal=配 VisionModel），APIKey 不进 wire 零泄露。
- GET /admin/automations：*automations.Service.List()（reminders+event rules+cron schedules，cron 加只读登记）。
- GET /admin/users：cfg.AdminUser + *auth.APIKey.List()（密钥掩码）；无用户存储，恒先返回当前 admin 账号。
- GET /admin/backthink：*backthink.Backthink.List(ctx,50)。均只读、owner/admin RBAC、{data} 信封。

批次B 视觉真推理 + 语音：
- rest.go chatRequest 加 Image?；流式 publishChatStream 带 image；userChatMessages 构造 ImageMessage(model.go:71)。
- loop/vision.go：ImageResolver 可注入（MVP 先看图再对话）；run.go Run 开头 resolveImages，无 resolver 透传直交主模型。
- vision/resolver.go：MessageResolver 调 vision.Router.Route——KindMain 保留图片交主模型多模态、KindVisionTool/OCRTool 经 dispatcher.Invoke 折叠成 [图片内容] 文本、KindUnsupported 记日志保留原图不崩。
- gateway/voice.go：VoiceService 接口 + SetVoice 注入点 + handleVoiceInput（未注入回 error 不崩）+ runVoiceTurn 异步 STT→loop chat→TTS→定向 voice_output 帧。
- ws_hub/ws_route：voice_input 接 handleVoiceInput；前端 ws.ts decodeBase64/playVoiceAudio/case voice_output。

第3步 wire.go 收口（唯一碰 wire.go 的一步）：
- Deps 补传 Automations:a.automation / Backthink:a.backthink / Users:auth.NewAPIKey(a.cfg.Auth)（*auth.APIKey 原生满足 UserStore，避免 admin 重复的复合类型）。
- gw.SetVoice(a.voice)；loop.Options.Vision = vision.NewMessageResolver(router, info, dispatcher.Invoke)（router=NewRouter(WithVisionTool/WithOCRTool)、info=cfg.LLM.VisionModel）。

实机验证：四 admin 端点 200 真实数据（llm 双 provider 脱敏、users=admin,yeij0942,owner）；WS 握手正常。go build/vet/test 全绿 + 前端 tsc。wire.go 557 行。

internal/auth/apikey.go

@@ -71,3 +71,26 @@ func (k *APIKey) Revoke(key string) {
 	defer k.mu.Unlock()
 	delete(k.keys, key)
 }
+
+// List returns a summary of every currently registered API key for the admin
+// panel. Key material is never returned; each identifier is masked so the panel
+// can tell keys apart without exposing the secret. The in-memory store keeps no
+// creation time, so CreatedAt is nil for every entry.
+func (k *APIKey) List() []UserSummary {
+	k.mu.RLock()
+	defer k.mu.RUnlock()
+	out := make([]UserSummary, 0, len(k.keys))
+	for key, role := range k.keys {
+		out = append(out, UserSummary{ID: maskKey(key), Username: "apikey", Role: role})
+	}
+	return out
+}
+
+// maskKey renders a key's leading and trailing groups so the panel can identify
+// an entry without revealing the secret. Short keys are fully hidden.
+func maskKey(key string) string {
+	if len(key) <= 8 {
+		return "••••"
+	}
+	return key[:4] + "••••" + key[len(key)-4:]
+}

internal/auth/auth.go

@@ -12,6 +12,7 @@ package auth
 import (
 	"errors"
 	"fmt"
+	"time"
 )
 
 // Role is an authorization role in the owner>admin>viewer hierarchy.
@@ -91,3 +92,14 @@ func (r Role) rank() int {
 func HasRole(role, required Role) bool {
 	return role.rank() >= required.rank()
 }
+
+// UserSummary is the read-only shape of an account or API key visible to the
+// admin panel (GET /api/v1/admin/users). CreatedAt is nil when the source does
+// not track a creation time (the configured admin account and in-memory keys
+// both omit it).
+type UserSummary struct {
+	ID        string
+	Username  string
+	Role      Role
+	CreatedAt *time.Time
+}