feat(model): LLM token 预算可配置化 — models.json每模型maxTokens + LLM_FALLBACK_MAX_TOKENS回退兜底

- config.go: LLMConfig.FallbackMaxTokens(LLM_FALLBACK_MAX_TOKENS, 默认8192)
- runtimeconfig/models.go: Group.MaxTokens(models.json每模型独立预算, 负值拒绝)
- model/fallback.go: Chain.WithTokenBudget + applyBudget; runtime.go buildSnapshot接入(active.MaxTokens, env.FallbackMaxTokens)
- 优先级: 显式Request.MaxTokens > 组maxTokens > 仅多步链末端的LLM_FALLBACK_MAX_TOKENS > 适配器默认8192; 单步链不动env兜底(避免OpenAI主模型行为回归)
- gateway admin: AdminLlmProvider.MaxTokens 透传/回显/负值400
- .env.example + .env(LLM_FALLBACK_MAX_TOKENS=8192); Docs/api-client v0.27 + api-reference + design/04
- 新增测试(config/runtimeconfig/budget_test/admin_write), build/vet/test绿+3平台交叉编译

internal/config/config_test.go

@@ -91,6 +91,55 @@ IOT_PROVIDER=none
 	}
 }
 
+// unsetEnvForTest clears key for the test and restores the original value (or
+// absence) on cleanup, so a .env file is not shadowed by an ambient process env
+// variable. config tests are not parallel, so this is safe.
+func unsetEnvForTest(t *testing.T, key string) {
+	t.Helper()
+	if v, ok := os.LookupEnv(key); ok {
+		t.Cleanup(func() { _ = os.Setenv(key, v) })
+	} else {
+		t.Cleanup(func() { _ = os.Unsetenv(key) })
+	}
+	if err := os.Unsetenv(key); err != nil {
+		t.Fatalf("unset %s: %v", key, err)
+	}
+}
+
+func TestLoad_LlmFallbackMaxTokens(t *testing.T) {
+	t.Setenv("JWT_SECRET", strings.Repeat("s", 40))
+	unsetEnvForTest(t, "LLM_FALLBACK_MAX_TOKENS")
+
+	// Default: the last-resort fallback budget is a meaningful 8192.
+	cfg, err := Load("")
+	if err != nil {
+		t.Fatalf("Load() error: %v", err)
+	}
+	if cfg.LLM.FallbackMaxTokens != 8192 {
+		t.Errorf("LLM.FallbackMaxTokens = %d, want default 8192", cfg.LLM.FallbackMaxTokens)
+	}
+
+	// A .env file is parsed into the field.
+	path := writeEnvFile(t, "LLM_FALLBACK_MAX_TOKENS=4096\n")
+	cfg, err = Load(path)
+	if err != nil {
+		t.Fatalf("Load(%q) error: %v", path, err)
+	}
+	if cfg.LLM.FallbackMaxTokens != 4096 {
+		t.Errorf("LLM.FallbackMaxTokens = %d, want 4096 from .env", cfg.LLM.FallbackMaxTokens)
+	}
+
+	// Process env wins over .env.
+	t.Setenv("LLM_FALLBACK_MAX_TOKENS", "2048")
+	cfg, err = Load(path)
+	if err != nil {
+		t.Fatalf("Load(%q) error: %v", path, err)
+	}
+	if cfg.LLM.FallbackMaxTokens != 2048 {
+		t.Errorf("LLM.FallbackMaxTokens = %d, want 2048 (process env wins)", cfg.LLM.FallbackMaxTokens)
+	}
+}
+
 func TestLoad_MissingRequiredFails(t *testing.T) {
 	// Do not set JWT_SECRET.
 	if _, err := Load(""); err == nil {