feat(model): LLM token 预算可配置化 — models.json每模型maxTokens + LLM_FALLBACK_MAX_TOKENS回退兜底

- config.go: LLMConfig.FallbackMaxTokens(LLM_FALLBACK_MAX_TOKENS, 默认8192)
- runtimeconfig/models.go: Group.MaxTokens(models.json每模型独立预算, 负值拒绝)
- model/fallback.go: Chain.WithTokenBudget + applyBudget; runtime.go buildSnapshot接入(active.MaxTokens, env.FallbackMaxTokens)
- 优先级: 显式Request.MaxTokens > 组maxTokens > 仅多步链末端的LLM_FALLBACK_MAX_TOKENS > 适配器默认8192; 单步链不动env兜底(避免OpenAI主模型行为回归)
- gateway admin: AdminLlmProvider.MaxTokens 透传/回显/负值400
- .env.example + .env(LLM_FALLBACK_MAX_TOKENS=8192); Docs/api-client v0.27 + api-reference + design/04
- 新增测试(config/runtimeconfig/budget_test/admin_write), build/vet/test绿+3平台交叉编译

internal/runtime/model/runtime.go

@@ -169,6 +169,12 @@ func buildSnapshot(groups []runtimeconfig.Group, env config.LLMConfig) (*runtime
 	if err != nil && !errors.Is(err, ErrNoModel) {
 		return nil, err
 	}
+	if chain != nil {
+		// Budgets are resolved inside the chain: the active group's own
+		// maxTokens (models.json) wins, and env.FallbackMaxTokens only caps the
+		// last step of a chain that really has a fallback (design/04 §3.1).
+		chain = chain.WithTokenBudget(active.MaxTokens, env.FallbackMaxTokens)
+	}
 	router := NewRouter(DefaultModelForProvider(cfg),
 		WithVisionModel(env.VisionModel),
 		WithDefaultProvider(cfg.Provider),