feat: RAG 知识库真实数据 + 渠道端到端接线（并行∦wire.go）+ 主会话收口

【渠道端到端·接线（agent-72）】
- 新建 internal/services/channelbridge/：桥接服务（Start 对配置渠道 Connect(10s超时/warn)+SetMessageHandler+ReadMessages；
  入站 UnifiedMessage→sessions.GetOrCreate(ResolveActor 白名单结构性识别)→loop.Run→SendMessage 回执，chat 文本）。
- cmd/cyrene/channels.go：从 CHANNEL_* env 读 4 渠道凭据（telegram/qq_obv11/weixin_ilink/webhook）。
- wire.go：app 加 channelBridge 字段，wireChannels 构造适配器+bridge.Start()，close() 收尾。
- 无真凭据降级：无 CHANNEL_* → configured()false 跳过不 dial；Connect 失败 Warn 不阻启动；
  webhook 仅入站(回执 ErrUnsupported 记 debug)。身份识别绝不靠提示词。收发端到端待凭据验证。

【RAG 知识库（agent-71）】
- internal/runtime/knowledge/：真实数据源（doc=资料/记忆=经历 分离 design/03 §3③）。
  ListDocuments 走 projectindex.ListProjects(+ListChapters)、Search 走 projectindex.Search(标题/描述+章节
  命中行+上下文)+retriever.Retrieve(配 vector 真语义,命中标 semantic:true)。
- gateway/server.go：RagStore 接口+Deps.RAG 可空+3 路由(GET /admin/rag、POST /admin/rag/query、/delete)。
- admin.go：adminListRag/adminSearchRag(空 query 400)/adminDeleteRag(写 501 not_implemented,M10)。
- projectindex/store.go：ListProjects/ListChapters。
- 前端 Rag.tsx：docs 从 GET /admin/rag 拉、检索走 POST /admin/rag/query、删除调真端点(501 显示 Notice)，
  上传/分块/嵌入显示 M10 Notice；api.ts/types.ts 加 adminListRag/adminSearchRag/adminDeleteRag。

【主会话收口 wire.go】projStore 提到 app struct+wireMemory 赋值；knowledge.New(...) 注入 gateway.Deps.RAG。

实机验证：admin/rag 200(documents[] 空表非壳)、channels 枚举 4 渠道、health ok。
go build/vet/test 全绿 + 前端 tsc。wire.go 567 行。

遗留(记录)：① 群聊/陌生人 MemWritable 记忆隔离未接 loop(AGENTS.md 红线,待修) ② webhook InboundHandler
需 gateway 挂载 ③ RAG 语义路径 persona-scoped(project 记忆其他 persona 不浮现)。

internal/services/gateway/server.go

@@ -35,6 +35,7 @@ import (
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/iot"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/logger"
 	personareg "git.yeij.top/AskaEth/Cyrene_v2/internal/persona/registry"
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/knowledge"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/loop"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/memory"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/model"
@@ -132,6 +133,23 @@ type BackthinkStore interface {
 	List(ctx context.Context, limit int) ([]backthink.Record, error)
 }
 
+// RagStore backs the admin knowledge-base RAG module (design/10 §3.12 module 8).
+// *runtime/knowledge.Store is the production implementation. Every method is
+// read-only for this milestone: IndexDocument/DeleteDocument return a clear
+// "write lands in M10" error rather than a fabricated success.
+type RagStore interface {
+	// ListDocuments enumerates the knowledge-base documents (project-index
+	// entries).
+	ListDocuments(ctx context.Context) ([]knowledge.Doc, error)
+	// Search answers a knowledge-base query (line-level hierarchy + optional
+	// semantic/vector ranking).
+	Search(ctx context.Context, query string) ([]knowledge.Hit, error)
+	// IndexDocument uploads/chunks/embeds a document. M10; returns an error.
+	IndexDocument(ctx context.Context, doc knowledge.Doc) error
+	// DeleteDocument removes a document. M10; returns an error.
+	DeleteDocument(ctx context.Context, id string) error
+}
+
 // Deps carries the gateway's injected dependencies. Every field is nil-tolerant
 // except Auth, which is required (authentication backs login and every RBAC
 // decision). Registry/Loop are satisfied by the concrete *capability.Registry and
@@ -170,6 +188,9 @@ type Deps struct {
 	Users UserStore
 	// Backthink lists background-think records. Optional.
 	Backthink BackthinkStore
+	// RAG backs the admin knowledge-base RAG module. Optional; list/search
+	// return empty when unset, and write endpoints report a clear 501.
+	RAG RagStore
 	// Streaming marks the injected Loop as streaming-capable (its OnStream is
 	// wired to publish ws.stream_chunk). When set the hub skips its own single
 	// final stream_chunk emission, since deltas already stream through OnStream.
@@ -197,6 +218,7 @@ type Server struct {
 	automations AutomationStore
 	users       UserStore
 	backthink   BackthinkStore
+	rag         RagStore
 	voice       VoiceService
 	streaming   bool
 	frontend    fs.FS
@@ -229,6 +251,7 @@ func New(cfg *config.Config, deps Deps) (*Server, error) {
 		automations: deps.Automations,
 		users:       deps.Users,
 		backthink:   deps.Backthink,
+		rag:         deps.RAG,
 		streaming:   deps.Streaming,
 		frontend:    deps.Frontend,
 		log:         sourcedLog(deps.Log),
@@ -269,6 +292,9 @@ func (s *Server) Handler() http.Handler {
 	mux.Handle("GET /api/v1/admin/automations", adminAuth(http.HandlerFunc(s.adminListAutomations)))
 	mux.Handle("GET /api/v1/admin/users", adminAuth(http.HandlerFunc(s.adminListUsers)))
 	mux.Handle("GET /api/v1/admin/backthink", adminAuth(http.HandlerFunc(s.adminListBackthink)))
+	mux.Handle("GET /api/v1/admin/rag", adminAuth(http.HandlerFunc(s.adminListRag)))
+	mux.Handle("POST /api/v1/admin/rag/query", adminAuth(http.HandlerFunc(s.adminSearchRag)))
+	mux.Handle("POST /api/v1/admin/rag/delete", adminAuth(http.HandlerFunc(s.adminDeleteRag)))
 	mux.Handle("POST /api/v1/admin/plugins/policy", s.auth.Authorize(auth.RoleOwner)(http.HandlerFunc(s.adminSetPolicy)))
 
 	var h http.Handler = mux