feat(server): hot-reload config store and reloadable infra clients

- Replace single Load() with a watching Store that re-reads config files
  (and config.local.yaml) and fans out a ReloadEvent with a per-field diff
  so consumers can decide whether the change is hot-applicable or requires
  a process restart.
- Wrap llm, retrieval, vector store, and object storage clients in
  Reloadable* shells so the bootstrap can swap their underlying impls when
  config changes without re-instantiating handlers.
- Make jwt.Manager and ops TokenIssuer mutable under a lock so secrets and
  TTLs can be rotated live; thread default plan code through a setter on
  the ops AdminUserService.
- Wire ConfigStore through bootstrap and every cmd/main.go, scheduler /
  worker / tenant-api / ops-api start the watcher; services and handlers
  take a config.Provider so they always read current values for things
  like generation.stream_enabled, scheduler dispatch, retrieval, etc.
- Switch shared/config decoding off viper to a Kratos-derived runtime
  package so env placeholders (\${VAR:default}) resolve consistently and
  the same source machinery powers both the loader and the watcher.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/shared/config/config.go

@@ -7,7 +7,11 @@ import (
 	"strings"
 	"time"
 
-	"github.com/spf13/viper"
+	"github.com/mitchellh/mapstructure"
+
+	configruntime "github.com/geo-platform/tenant-api/internal/shared/config/runtime"
+	runtimeenv "github.com/geo-platform/tenant-api/internal/shared/config/runtime/env"
+	runtimefile "github.com/geo-platform/tenant-api/internal/shared/config/runtime/file"
 )
 
 type Config struct {
@@ -279,23 +283,28 @@ type GenerationConfig struct {
 }
 
 func Load(configPath string) (*Config, error) {
-	v := viper.New()
-	v.AutomaticEnv()
-	v.SetEnvKeyReplacer(strings.NewReplacer(".", "_"))
+	cfg, _, err := loadWithFiles(configPath)
+	return cfg, err
+}
 
-	if err := readConfigWithFallback(v, configPath); err != nil {
-		return nil, fmt.Errorf("read config: %w", err)
+func loadWithFiles(configPath string) (*Config, []string, error) {
+	configFile, err := readConfigWithFallback(configPath)
+	if err != nil {
+		return nil, nil, fmt.Errorf("read config: %w", err)
 	}
 
 	// Allow local overrides
-	_ = mergeLocalOverrideWithFallback(v, configPath)
-
-	var cfg Config
-	if err := v.Unmarshal(&cfg); err != nil {
-		return nil, fmt.Errorf("unmarshal config: %w", err)
+	localConfigFile, err := mergeLocalOverrideWithFallback(configPath)
+	if err != nil {
+		return nil, nil, fmt.Errorf("merge local config: %w", err)
 	}
 
-	applyEnvOverrides(&cfg)
+	cfg, err := decodeResolvedConfig(configFile, localConfigFile)
+	if err != nil {
+		return nil, nil, fmt.Errorf("unmarshal config: %w", err)
+	}
+
+	applyEnvOverrides(cfg)
 	normalizeRabbitMQConfig(&cfg.RabbitMQ)
 	normalizeSchedulerConfig(&cfg.Scheduler)
 	normalizeMonitoringConfig(&cfg.MonitoringWorkers)
@@ -303,30 +312,72 @@ func Load(configPath string) (*Config, error) {
 	normalizeMembershipConfig(&cfg.Membership)
 	normalizeBrandLibraryConfig(&cfg.BrandLibrary)
 
-	return &cfg, nil
+	files := []string{configFile}
+	if localConfigFile != "" {
+		files = append(files, localConfigFile)
+	}
+
+	return cfg, files, nil
 }
 
-func readConfigWithFallback(v *viper.Viper, configPath string) error {
+func readConfigWithFallback(configPath string) (string, error) {
 	var lastErr error
 	for _, candidate := range candidateConfigPaths(configPath, false) {
-		v.SetConfigFile(candidate)
-		if err := v.ReadInConfig(); err == nil {
-			return nil
+		if _, err := os.Stat(candidate); err == nil {
+			return candidate, nil
 		} else {
 			lastErr = err
 		}
 	}
-	return lastErr
+	return "", lastErr
 }
 
-func mergeLocalOverrideWithFallback(v *viper.Viper, configPath string) error {
+func mergeLocalOverrideWithFallback(configPath string) (string, error) {
 	for _, candidate := range candidateConfigPaths(configPath, true) {
-		v.SetConfigFile(candidate)
-		if err := v.MergeInConfig(); err == nil {
-			return nil
+		if _, err := os.Stat(candidate); err != nil {
+			continue
 		}
+		return candidate, nil
 	}
-	return nil
+	return "", nil
+}
+
+func decodeResolvedConfig(configFile, localConfigFile string) (*Config, error) {
+	sources := []configruntime.Source{runtimefile.NewSource(configFile)}
+	if localConfigFile != "" {
+		sources = append(sources, runtimefile.NewSource(localConfigFile))
+	}
+	sources = append(sources, runtimeenv.NewSource())
+
+	resolved := configruntime.New(configruntime.WithSource(sources...))
+	defer resolved.Close()
+
+	if err := resolved.Load(); err != nil {
+		return nil, err
+	}
+
+	settings := make(map[string]any)
+	if err := resolved.Scan(&settings); err != nil {
+		return nil, err
+	}
+
+	var cfg Config
+	decoder, err := mapstructure.NewDecoder(&mapstructure.DecoderConfig{
+		Result:           &cfg,
+		TagName:          "mapstructure",
+		WeaklyTypedInput: true,
+		DecodeHook: mapstructure.ComposeDecodeHookFunc(
+			mapstructure.StringToTimeDurationHookFunc(),
+			mapstructure.StringToSliceHookFunc(","),
+		),
+	})
+	if err != nil {
+		return nil, err
+	}
+	if err := decoder.Decode(settings); err != nil {
+		return nil, err
+	}
+	return &cfg, nil
 }
 
 func normalizeMonitoringDispatchConfig(cfg *MonitoringDispatchConfig) {