feat: admin 端点补齐 + 视觉真推理 + 语音链路 + wire.go 收口（A+B+第3步）

批次A admin 端点（原本 404 变 200 真实数据）：
- GET /admin/llm：读 s.cfg.LLM 组 openai+anthropic 两 provider（enabled=当前 Provider、multimodal=配 VisionModel），APIKey 不进 wire 零泄露。
- GET /admin/automations：*automations.Service.List()（reminders+event rules+cron schedules，cron 加只读登记）。
- GET /admin/users：cfg.AdminUser + *auth.APIKey.List()（密钥掩码）；无用户存储，恒先返回当前 admin 账号。
- GET /admin/backthink：*backthink.Backthink.List(ctx,50)。均只读、owner/admin RBAC、{data} 信封。

批次B 视觉真推理 + 语音：
- rest.go chatRequest 加 Image?；流式 publishChatStream 带 image；userChatMessages 构造 ImageMessage(model.go:71)。
- loop/vision.go：ImageResolver 可注入（MVP 先看图再对话）；run.go Run 开头 resolveImages，无 resolver 透传直交主模型。
- vision/resolver.go：MessageResolver 调 vision.Router.Route——KindMain 保留图片交主模型多模态、KindVisionTool/OCRTool 经 dispatcher.Invoke 折叠成 [图片内容] 文本、KindUnsupported 记日志保留原图不崩。
- gateway/voice.go：VoiceService 接口 + SetVoice 注入点 + handleVoiceInput（未注入回 error 不崩）+ runVoiceTurn 异步 STT→loop chat→TTS→定向 voice_output 帧。
- ws_hub/ws_route：voice_input 接 handleVoiceInput；前端 ws.ts decodeBase64/playVoiceAudio/case voice_output。

第3步 wire.go 收口（唯一碰 wire.go 的一步）：
- Deps 补传 Automations:a.automation / Backthink:a.backthink / Users:auth.NewAPIKey(a.cfg.Auth)（*auth.APIKey 原生满足 UserStore，避免 admin 重复的复合类型）。
- gw.SetVoice(a.voice)；loop.Options.Vision = vision.NewMessageResolver(router, info, dispatcher.Invoke)（router=NewRouter(WithVisionTool/WithOCRTool)、info=cfg.LLM.VisionModel）。

实机验证：四 admin 端点 200 真实数据（llm 双 provider 脱敏、users=admin,yeij0942,owner）；WS 握手正常。go build/vet/test 全绿 + 前端 tsc。wire.go 557 行。

internal/services/gateway/ws_hub.go

@@ -28,6 +28,7 @@ const (
 	wsChatSubject   = "ws.chat"
 	wsStreamSubject = "ws.stream"
 	wsVoiceInput    = "ws.voice_input"
+	wsVoiceOutput   = "voice_output"
 	wsReadLimit     = 4096
 	wsWriteWait     = 10 * time.Second
 	wsPongWait      = 60 * time.Second
@@ -72,6 +73,7 @@ type hub struct {
 	runner      Chatter
 	auditor     SubagentAuditor
 	taskOutputs TaskOutputStore
+	voice       VoiceService
 	streaming   bool
 	log         *slog.Logger
 	upgrader    websocket.Upgrader
@@ -90,6 +92,7 @@ func newHub(s *Server) *hub {
 		runner:      s.runner,
 		auditor:     s.auditor,
 		taskOutputs: s.taskOutputs,
+		voice:       s.voice,
 		streaming:   s.streaming,
 		log:         s.log,
 		origins:     origins,
@@ -213,14 +216,14 @@ func (h *hub) streamChat(ctx context.Context, payload any) {
 		_ = json.Unmarshal(b, &req)
 	}
 	turnID := newTurnID()
-	if h.runner == nil || strings.TrimSpace(req.Text) == "" {
+	if h.runner == nil || (strings.TrimSpace(req.Text) == "" && strings.TrimSpace(req.Image) == "") {
 		h.broadcast(wsEvent{Type: "stream_end", TurnID: turnID, Seq: int(h.streamSeq.Add(1)), Data: map[string]any{"stopReason": "idle"}})
 		return
 	}
 	if req.SessionID == "" {
 		req.SessionID = "web"
 	}
-	res, err := h.runner.Run(ctx, req.SessionID, []model.Message{model.TextMessage(model.RoleUser, req.Text)})
+	res, err := h.runner.Run(ctx, req.SessionID, userChatMessages(req.Text, req.Image))
 	if err != nil {
 		h.log.Error("ws chat run", "err", err, "session", req.SessionID)
 		h.broadcast(wsEvent{Type: "stream_end", TurnID: turnID, Seq: int(h.streamSeq.Add(1)), Data: map[string]any{"stopReason": "error", "error": err.Error()}})
@@ -256,6 +259,7 @@ func (h *hub) broadcastStream(payload any) {
 type chatStreamRequest struct {
 	SessionID string `json:"sessionId"`
 	Text      string `json:"text"`
+	Image     string `json:"image,omitempty"`
 }
 
 // handleWS upgrades /ws/chat after authenticating the JWT from the query token or
@@ -382,11 +386,11 @@ func (c *wsConn) enqueueJSON(ev wsEvent) {
 }
 
 // publishChatStream publishes a ws.chat streaming trigger (REST stream mode).
-func (s *Server) publishChatStream(ctx context.Context, sessionID, text string) {
+func (s *Server) publishChatStream(ctx context.Context, sessionID, text, image string) {
 	if s.bus == nil {
 		return
 	}
-	_ = s.bus.Publish(ctx, wsChatSubject, map[string]any{"sessionId": sessionID, "text": text})
+	_ = s.bus.Publish(ctx, wsChatSubject, map[string]any{"sessionId": sessionID, "text": text, "image": image})
 }
 
 // wsToken extracts the JWT from the ?token= query or the Authorization header.