feat(server): hot-reload config store and reloadable infra clients

- Replace single Load() with a watching Store that re-reads config files
  (and config.local.yaml) and fans out a ReloadEvent with a per-field diff
  so consumers can decide whether the change is hot-applicable or requires
  a process restart.
- Wrap llm, retrieval, vector store, and object storage clients in
  Reloadable* shells so the bootstrap can swap their underlying impls when
  config changes without re-instantiating handlers.
- Make jwt.Manager and ops TokenIssuer mutable under a lock so secrets and
  TTLs can be rotated live; thread default plan code through a setter on
  the ops AdminUserService.
- Wire ConfigStore through bootstrap and every cmd/main.go, scheduler /
  worker / tenant-api / ops-api start the watcher; services and handlers
  take a config.Provider so they always read current values for things
  like generation.stream_enabled, scheduler dispatch, retrieval, etc.
- Switch shared/config decoding off viper to a Kratos-derived runtime
  package so env placeholders (\${VAR:default}) resolve consistently and
  the same source machinery powers both the loader and the watcher.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/shared/config/runtime/env/env.go

@@ -0,0 +1,62 @@
+// Package env is adapted from go-kratos/kratos config/env.
+//
+// Upstream: https://github.com/go-kratos/kratos/tree/v2.9.2/config/env
+// License: MIT, see ../LICENSE.kratos.
+package env
+
+import (
+	"os"
+	"strings"
+
+	"github.com/geo-platform/tenant-api/internal/shared/config/runtime"
+)
+
+type env struct {
+	prefixes []string
+}
+
+func NewSource(prefixes ...string) runtime.Source {
+	return &env{prefixes: prefixes}
+}
+
+func (e *env) Load() ([]*runtime.KeyValue, error) {
+	return e.load(os.Environ()), nil
+}
+
+func (e *env) load(envs []string) []*runtime.KeyValue {
+	kvs := make([]*runtime.KeyValue, 0, len(envs))
+	for _, item := range envs {
+		key, value, _ := strings.Cut(item, "=")
+		if key == "" {
+			continue
+		}
+		if len(e.prefixes) > 0 {
+			prefix, ok := matchPrefix(e.prefixes, key)
+			if !ok || key == prefix {
+				continue
+			}
+			key = strings.TrimPrefix(key, prefix)
+			key = strings.TrimPrefix(key, "_")
+		}
+		if key != "" {
+			kvs = append(kvs, &runtime.KeyValue{
+				Key:   key,
+				Value: []byte(value),
+			})
+		}
+	}
+	return kvs
+}
+
+func (e *env) Watch() (runtime.Watcher, error) {
+	return NewWatcher()
+}
+
+func matchPrefix(prefixes []string, s string) (string, bool) {
+	for _, p := range prefixes {
+		if strings.HasPrefix(s, p) {
+			return p, true
+		}
+	}
+	return "", false
+}

server/internal/shared/config/runtime/env/watcher.go

@@ -0,0 +1,29 @@
+package env
+
+import (
+	"context"
+
+	"github.com/geo-platform/tenant-api/internal/shared/config/runtime"
+)
+
+var _ runtime.Watcher = (*watcher)(nil)
+
+type watcher struct {
+	ctx    context.Context
+	cancel context.CancelFunc
+}
+
+func NewWatcher() (runtime.Watcher, error) {
+	ctx, cancel := context.WithCancel(context.Background())
+	return &watcher{ctx: ctx, cancel: cancel}, nil
+}
+
+func (w *watcher) Next() ([]*runtime.KeyValue, error) {
+	<-w.ctx.Done()
+	return nil, w.ctx.Err()
+}
+
+func (w *watcher) Stop() error {
+	w.cancel()
+	return nil
+}