feat(model,capacity,vision,io): per-persona 路由 + 本地三级(默认关) + L3 分类 + OCR 独立模型 + image-crop 工具（裁决 03.4.1/03.4.3/14.4.1/14.4.4/14.4.5）

- 03.4.1：per-persona 路由载体选 models.json（组内新增 personaModels/personaProviders + 校验 + PersonaRoute()），
  Router/RuntimeLLM 快照绑定、loop 流式路径按该 turn 的 persona 路由；主步用路由结果、降级步钉自己的模型
- 03.4.3：本地第三级降级链（LLM_LOCAL_*，Configured() 含 Enabled ⇒ **默认关**），warn 标注来源
- 14.4.4：capacity 接入 L3（分类器接口 + TTL 缓存 + 严格 JSON 解析），CAPACITY_L3_ENABLED **默认 false**
- 14.4.1：语义修正 —— group.multimodal 才是「主模型能否收图」（env 路径不再臆断），LLM_VISION_MODEL 只配视觉工具；
  vision/OCR 可各用不同模型；runtime 不再因有图抢路由（vision.Router 是唯一分层权威）
- 14.4.5：新增 image-crop 工具（工具数 5→6，策略默认 owner-only），schema 支持按区域裁切
- 组合根：wire_runtime 读 group.Multimodal；capacity 装配拆出 wire_capacity.go（守 500 行）
- 复核：`go build`/`go vet`/各包 `go test -count=1` 全绿；**6 条变异反证**先红后还原（含作者自查出的 2 条假阳性变异）
- 未落：按 provider 的 thinking 开关（需 openai_encode.go/openai.go 文件面）、persona awakening（需 loader 文件面）

internal/config/config.go

@@ -88,10 +88,23 @@ type LLMConfig struct {
 	Model    string `env:"LLM_MODEL"`
 	Fallback string `env:"LLM_FALLBACK_MODEL"`
 
-	// VisionModel is the dedicated model used for image/vision requests. When
-	// set, the model router routes image content to it (see model.Router.WithVisionModel).
+	// VisionModel is the dedicated model behind the vision tool (image
+	// understanding). It is the tool's model, not the main model's ability: the
+	// per-persona/per-request routing decision belongs to the vision Router, and
+	// the main model's own image input capability is declared by the active
+	// models.json group's multimodal flag (裁决 14.4.1/14.4.5)。
 	VisionModel string `env:"LLM_VISION_MODEL"`
 
+	// OCRModel is the dedicated model behind the OCR tool. Empty reuses
+	// VisionModel, so OCR keeps working without a second endpoint (裁决 14.4.1
+	// 的「独立视觉模型 + OCR 模型」)。
+	OCRModel string `env:"LLM_OCR_MODEL"`
+
+	// Local is the optional third degradation level (裁决 03.4.3): primary →
+	// fallback → local. It defaults to off because the current machine cannot run
+	// a local model comfortably; when off the chain keeps its two-level shape.
+	Local LocalLLMConfig
+
 	// FallbackMaxTokens caps the last-resort fallback model in a group's chain
 	// (primary → fallback). It is the final safety budget: it only applies when
 	// the chain actually has a fallback step, that group sets no per-group
@@ -107,6 +120,33 @@ type LLMConfig struct {
 	AnthropicFallback string `env:"ANTHROPIC_FALLBACK_MODEL"`
 }
 
+// LocalLLMConfig configures the optional local model rung — the third level of
+// the primary → fallback → local degradation chain (裁决 03.4.3). It is opt-in
+// and defaults to off: a machine that cannot run a local model comfortably must
+// not silently pay for one. It becomes an active chain step only when Enabled is
+// true and both BaseURL and Model are set; anything less is reported and skipped
+// rather than producing a half-configured step.
+type LocalLLMConfig struct {
+	// Enabled turns the local rung on. Default false (project red line: 本地模型可开关，默认关).
+	Enabled bool `env:"LLM_LOCAL_ENABLED" default:"false"`
+	// Provider is the local endpoint's wire protocol: "openai" (llama.cpp /
+	// ollama / vLLM compatible endpoints) or "anthropic". Empty means openai.
+	Provider string `env:"LLM_LOCAL_PROVIDER" default:"openai"`
+	// BaseURL is the local endpoint's base URL (e.g. http://127.0.0.1:8080/v1).
+	BaseURL string `env:"LLM_LOCAL_BASE_URL"`
+	// APIKey is the local endpoint's key; empty is normal for a local server.
+	APIKey string `env:"LLM_LOCAL_API_KEY"`
+	// Model is the local model name. Without it the rung stays off.
+	Model string `env:"LLM_LOCAL_MODEL"`
+}
+
+// Configured reports whether the local rung has enough configuration to act as a
+// chain step. Enabled alone is not enough: a missing endpoint or model must not
+// become a step that can only fail.
+func (l LocalLLMConfig) Configured() bool {
+	return l.Enabled && strings.TrimSpace(l.BaseURL) != "" && strings.TrimSpace(l.Model) != ""
+}
+
 // EmbeddingConfig holds the optional semantic embedding API settings. When
 // unset, the runtime falls back to built-in n-gram/FTS vectors.
 type EmbeddingConfig struct {
@@ -246,6 +286,15 @@ type CapacityConfig struct {
 	// reflection-based loader only supports scalars and []string), matching the
 	// MCP config pattern.
 	ToolSetsJSON string `env:"CAPACITY_TOOL_SETS"`
+	// L3Enabled turns on the model-assisted intent layer (design/14 §2.2 L3;
+	// 裁决 14.4.4, keys chosen as the landing suggestion the owner authorized).
+	// It costs one extra model call for an undecided turn, so it defaults to off:
+	// off means the layer never runs and L1/L2/L4 behave exactly as before.
+	L3Enabled bool `env:"CAPACITY_L3_ENABLED" default:"false"`
+	// L3CacheTTL is how long a model-assisted classification of the same turn text
+	// is reused (a Go duration string such as "5m"). Zero or unparsable disables
+	// reuse; empty selects the code default of 5m.
+	L3CacheTTL string `env:"CAPACITY_L3_CACHE_TTL" default:"5m"`
 }
 
 // MCPServer describes a single MCP server: a stdio subprocess (Command/Args) or