feat(model): LLM token 预算可配置化 — models.json每模型maxTokens + LLM_FALLBACK_MAX_TOKENS回退兜底

- config.go: LLMConfig.FallbackMaxTokens(LLM_FALLBACK_MAX_TOKENS, 默认8192)
- runtimeconfig/models.go: Group.MaxTokens(models.json每模型独立预算, 负值拒绝)
- model/fallback.go: Chain.WithTokenBudget + applyBudget; runtime.go buildSnapshot接入(active.MaxTokens, env.FallbackMaxTokens)
- 优先级: 显式Request.MaxTokens > 组maxTokens > 仅多步链末端的LLM_FALLBACK_MAX_TOKENS > 适配器默认8192; 单步链不动env兜底(避免OpenAI主模型行为回归)
- gateway admin: AdminLlmProvider.MaxTokens 透传/回显/负值400
- .env.example + .env(LLM_FALLBACK_MAX_TOKENS=8192); Docs/api-client v0.27 + api-reference + design/04
- 新增测试(config/runtimeconfig/budget_test/admin_write), build/vet/test绿+3平台交叉编译

internal/runtime/model/fallback.go

@@ -19,6 +19,13 @@ type Step struct {
 // single provider is expected.
 type Chain struct {
 	steps []Step
+	// groupMaxTokens is the active model group's own budget (models.json
+	// maxTokens). When > 0 it applies to every step of the group's chain and
+	// wins over fallbackMaxTokens.
+	groupMaxTokens int
+	// fallbackMaxTokens is the last-resort budget (LLM_FALLBACK_MAX_TOKENS). It
+	// only applies to the final step of a chain that actually has a fallback.
+	fallbackMaxTokens int
 }
 
 // NewChain builds a fallback chain from the given steps.
@@ -26,6 +33,37 @@ func NewChain(steps ...Step) *Chain {
 	return &Chain{steps: steps}
 }
 
+// WithTokenBudget sets the chain's token budgets: the active group's own budget
+// and the last-resort fallback budget. It must be called before the chain is
+// published to concurrent callers (the runtime builds a fresh chain per
+// snapshot and swaps it in atomically), so the fields are never mutated in
+// flight.
+func (c *Chain) WithTokenBudget(groupMaxTokens, fallbackMaxTokens int) *Chain {
+	c.groupMaxTokens = groupMaxTokens
+	c.fallbackMaxTokens = fallbackMaxTokens
+	return c
+}
+
+// applyBudget resolves the effective MaxTokens for step idx, honoring the
+// precedence: an explicit Request.MaxTokens > the group's MaxTokens > the
+// last-resort LLM_FALLBACK_MAX_TOKENS > the adapter default. The last-resort
+// budget only applies when the chain really has a fallback step (len > 1) and
+// only to that final step; a single-step chain is a primary model, not a
+// fallback, so its adapter default is left untouched.
+func (c *Chain) applyBudget(req Request, idx int) Request {
+	if req.MaxTokens != 0 {
+		return req
+	}
+	if c.groupMaxTokens > 0 {
+		req.MaxTokens = c.groupMaxTokens
+		return req
+	}
+	if c.fallbackMaxTokens > 0 && len(c.steps) > 1 && idx == len(c.steps)-1 {
+		req.MaxTokens = c.fallbackMaxTokens
+	}
+	return req
+}
+
 // NewOpenAIChatChain builds a fallback chain from a single supplier config: the
 // primary model first, then cfg.Fallback (when set and distinct), both served
 // by an OpenAIChatAdapter against the same OpenAI-compatible endpoint. It
@@ -45,8 +83,8 @@ func (c *Chain) Chat(ctx context.Context, req Request, opts Options) (Response,
 		return Response{}, ErrNoSteps
 	}
 	var lastErr error
-	for _, s := range c.steps {
-		stepReq := req
+	for i, s := range c.steps {
+		stepReq := c.applyBudget(req, i)
 		if s.Model != "" {
 			stepReq.Model = s.Model
 		}
@@ -68,8 +106,8 @@ func (c *Chain) ChatStream(ctx context.Context, req Request, onEvent func(Stream
 		return Response{}, ErrNoSteps
 	}
 	var lastErr error
-	for _, s := range c.steps {
-		stepReq := req
+	for i, s := range c.steps {
+		stepReq := c.applyBudget(req, i)
 		if s.Model != "" {
 			stepReq.Model = s.Model
 		}