feat: admin 端点补齐 + 视觉真推理 + 语音链路 + wire.go 收口（A+B+第3步）

批次A admin 端点（原本 404 变 200 真实数据）：
- GET /admin/llm：读 s.cfg.LLM 组 openai+anthropic 两 provider（enabled=当前 Provider、multimodal=配 VisionModel），APIKey 不进 wire 零泄露。
- GET /admin/automations：*automations.Service.List()（reminders+event rules+cron schedules，cron 加只读登记）。
- GET /admin/users：cfg.AdminUser + *auth.APIKey.List()（密钥掩码）；无用户存储，恒先返回当前 admin 账号。
- GET /admin/backthink：*backthink.Backthink.List(ctx,50)。均只读、owner/admin RBAC、{data} 信封。

批次B 视觉真推理 + 语音：
- rest.go chatRequest 加 Image?；流式 publishChatStream 带 image；userChatMessages 构造 ImageMessage(model.go:71)。
- loop/vision.go：ImageResolver 可注入（MVP 先看图再对话）；run.go Run 开头 resolveImages，无 resolver 透传直交主模型。
- vision/resolver.go：MessageResolver 调 vision.Router.Route——KindMain 保留图片交主模型多模态、KindVisionTool/OCRTool 经 dispatcher.Invoke 折叠成 [图片内容] 文本、KindUnsupported 记日志保留原图不崩。
- gateway/voice.go：VoiceService 接口 + SetVoice 注入点 + handleVoiceInput（未注入回 error 不崩）+ runVoiceTurn 异步 STT→loop chat→TTS→定向 voice_output 帧。
- ws_hub/ws_route：voice_input 接 handleVoiceInput；前端 ws.ts decodeBase64/playVoiceAudio/case voice_output。

第3步 wire.go 收口（唯一碰 wire.go 的一步）：
- Deps 补传 Automations:a.automation / Backthink:a.backthink / Users:auth.NewAPIKey(a.cfg.Auth)（*auth.APIKey 原生满足 UserStore，避免 admin 重复的复合类型）。
- gw.SetVoice(a.voice)；loop.Options.Vision = vision.NewMessageResolver(router, info, dispatcher.Invoke)（router=NewRouter(WithVisionTool/WithOCRTool)、info=cfg.LLM.VisionModel）。

实机验证：四 admin 端点 200 真实数据（llm 双 provider 脱敏、users=admin,yeij0942,owner）；WS 握手正常。go build/vet/test 全绿 + 前端 tsc。wire.go 557 行。

internal/services/gateway/server.go

@@ -40,6 +40,8 @@ import (
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/model"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/orchestration"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/task"
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/services/automations"
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/services/backthink"
 )
 
 // source is the log provenance tag for every record this package emits.
@@ -110,6 +112,26 @@ type TaskOutputStore interface {
 	TaskOutput(ctx context.Context, id string) (task.OutputEvent, error)
 }
 
+// AutomationStore enumerates the automations and reminders for the admin list.
+// *automations.Service is the production implementation. The gateway maps each
+// record to its wire shape.
+type AutomationStore interface {
+	List() []automations.AutomationRecord
+}
+
+// UserStore enumerates the accounts and API keys visible to the admin panel.
+// The production implementation reads the configured admin account plus the
+// auth.APIKey table. The gateway maps each summary to its wire shape.
+type UserStore interface {
+	List() []auth.UserSummary
+}
+
+// BackthinkStore enumerates the persisted background-think records for the
+// M9/M10 monitor panel. *backthink.Backthink is the production implementation.
+type BackthinkStore interface {
+	List(ctx context.Context, limit int) ([]backthink.Record, error)
+}
+
 // Deps carries the gateway's injected dependencies. Every field is nil-tolerant
 // except Auth, which is required (authentication backs login and every RBAC
 // decision). Registry/Loop are satisfied by the concrete *capability.Registry and
@@ -141,6 +163,13 @@ type Deps struct {
 	// Tasks queries task output for the task_output_query WS route.
 	// Optional (task_output_query returns a clear error when unset).
 	Tasks TaskOutputStore
+	// Automations lists automations and reminders. Optional.
+	Automations AutomationStore
+	// Users lists accounts and API keys. Optional (falls back to the configured
+	// single admin account).
+	Users UserStore
+	// Backthink lists background-think records. Optional.
+	Backthink BackthinkStore
 	// Streaming marks the injected Loop as streaming-capable (its OnStream is
 	// wired to publish ws.stream_chunk). When set the hub skips its own single
 	// final stream_chunk emission, since deltas already stream through OnStream.
@@ -165,6 +194,10 @@ type Server struct {
 	iot         IoTStore
 	auditor     SubagentAuditor
 	taskOutputs TaskOutputStore
+	automations AutomationStore
+	users       UserStore
+	backthink   BackthinkStore
+	voice       VoiceService
 	streaming   bool
 	frontend    fs.FS
 	log         *slog.Logger
@@ -193,6 +226,9 @@ func New(cfg *config.Config, deps Deps) (*Server, error) {
 		iot:         deps.IoT,
 		auditor:     deps.Scheduler,
 		taskOutputs: deps.Tasks,
+		automations: deps.Automations,
+		users:       deps.Users,
+		backthink:   deps.Backthink,
 		streaming:   deps.Streaming,
 		frontend:    deps.Frontend,
 		log:         sourcedLog(deps.Log),
@@ -229,6 +265,10 @@ func (s *Server) Handler() http.Handler {
 	mux.Handle("GET /api/v1/admin/plugins", adminAuth(http.HandlerFunc(s.adminListPlugins)))
 	mux.Handle("GET /api/v1/admin/channels", adminAuth(http.HandlerFunc(s.adminListChannels)))
 	mux.Handle("GET /api/v1/admin/iot", adminAuth(http.HandlerFunc(s.adminListIoT)))
+	mux.Handle("GET /api/v1/admin/llm", adminAuth(http.HandlerFunc(s.adminGetLlm)))
+	mux.Handle("GET /api/v1/admin/automations", adminAuth(http.HandlerFunc(s.adminListAutomations)))
+	mux.Handle("GET /api/v1/admin/users", adminAuth(http.HandlerFunc(s.adminListUsers)))
+	mux.Handle("GET /api/v1/admin/backthink", adminAuth(http.HandlerFunc(s.adminListBackthink)))
 	mux.Handle("POST /api/v1/admin/plugins/policy", s.auth.Authorize(auth.RoleOwner)(http.HandlerFunc(s.adminSetPolicy)))
 
 	var h http.Handler = mux