feat(server): hot-reload config store and reloadable infra clients

- Replace single Load() with a watching Store that re-reads config files
  (and config.local.yaml) and fans out a ReloadEvent with a per-field diff
  so consumers can decide whether the change is hot-applicable or requires
  a process restart.
- Wrap llm, retrieval, vector store, and object storage clients in
  Reloadable* shells so the bootstrap can swap their underlying impls when
  config changes without re-instantiating handlers.
- Make jwt.Manager and ops TokenIssuer mutable under a lock so secrets and
  TTLs can be rotated live; thread default plan code through a setter on
  the ops AdminUserService.
- Wire ConfigStore through bootstrap and every cmd/main.go, scheduler /
  worker / tenant-api / ops-api start the watcher; services and handlers
  take a config.Provider so they always read current values for things
  like generation.stream_enabled, scheduler dispatch, retrieval, etc.
- Switch shared/config decoding off viper to a Kratos-derived runtime
  package so env placeholders (\${VAR:default}) resolve consistently and
  the same source machinery powers both the loader and the watcher.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/shared/config/runtime/file/file.go

@@ -0,0 +1,110 @@
+// Package file is adapted from go-kratos/kratos config/file.
+//
+// Upstream: https://github.com/go-kratos/kratos/tree/v2.9.2/config/file
+// License: MIT, see ../LICENSE.kratos.
+package file
+
+import (
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/geo-platform/tenant-api/internal/shared/config/runtime"
+)
+
+type file struct {
+	path  string
+	names map[string]struct{}
+}
+
+func NewSource(path string, names ...string) runtime.Source {
+	return &file{path: path, names: namesSet(names)}
+}
+
+func (f *file) loadFile(path string) (*runtime.KeyValue, error) {
+	file, err := os.Open(path)
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close()
+
+	data, err := io.ReadAll(file)
+	if err != nil {
+		return nil, err
+	}
+	info, err := file.Stat()
+	if err != nil {
+		return nil, err
+	}
+	return &runtime.KeyValue{
+		Key:    info.Name(),
+		Format: format(info.Name()),
+		Value:  data,
+	}, nil
+}
+
+func (f *file) loadDir(path string) ([]*runtime.KeyValue, error) {
+	files, err := os.ReadDir(path)
+	if err != nil {
+		return nil, err
+	}
+	kvs := make([]*runtime.KeyValue, 0, len(files))
+	for _, item := range files {
+		if item.IsDir() || strings.HasPrefix(item.Name(), ".") || !f.matchName(item.Name()) {
+			continue
+		}
+		kv, err := f.loadFile(filepath.Join(path, item.Name()))
+		if err != nil {
+			return nil, err
+		}
+		kvs = append(kvs, kv)
+	}
+	return kvs, nil
+}
+
+func (f *file) Load() ([]*runtime.KeyValue, error) {
+	info, err := os.Stat(f.path)
+	if err != nil {
+		return nil, err
+	}
+	if info.IsDir() {
+		return f.loadDir(f.path)
+	}
+	kv, err := f.loadFile(f.path)
+	if err != nil {
+		return nil, err
+	}
+	return []*runtime.KeyValue{kv}, nil
+}
+
+func (f *file) Watch() (runtime.Watcher, error) {
+	return newWatcher(f)
+}
+
+func (f *file) match(path string) bool {
+	return f.matchName(filepath.Base(path))
+}
+
+func (f *file) matchName(name string) bool {
+	if len(f.names) == 0 {
+		return true
+	}
+	_, ok := f.names[name]
+	return ok
+}
+
+func namesSet(names []string) map[string]struct{} {
+	if len(names) == 0 {
+		return nil
+	}
+	out := make(map[string]struct{}, len(names))
+	for _, name := range names {
+		name = strings.TrimSpace(name)
+		if name == "" {
+			continue
+		}
+		out[filepath.Base(name)] = struct{}{}
+	}
+	return out
+}

server/internal/shared/config/runtime/file/format.go

@@ -0,0 +1,10 @@
+package file
+
+import "strings"
+
+func format(name string) string {
+	if idx := strings.LastIndexByte(name, '.'); idx >= 0 {
+		return name[idx+1:]
+	}
+	return ""
+}

server/internal/shared/config/runtime/file/watcher.go

@@ -0,0 +1,78 @@
+package file
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"sync"
+
+	"github.com/fsnotify/fsnotify"
+
+	"github.com/geo-platform/tenant-api/internal/shared/config/runtime"
+)
+
+type watcher struct {
+	f  *file
+	fw *fsnotify.Watcher
+
+	ctx      context.Context
+	cancel   context.CancelFunc
+	stopOnce sync.Once
+}
+
+func newWatcher(f *file) (runtime.Watcher, error) {
+	fw, err := fsnotify.NewWatcher()
+	if err != nil {
+		return nil, err
+	}
+	if err := fw.Add(f.path); err != nil {
+		_ = fw.Close()
+		return nil, err
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	return &watcher{f: f, fw: fw, ctx: ctx, cancel: cancel}, nil
+}
+
+func (w *watcher) Next() ([]*runtime.KeyValue, error) {
+	for {
+		select {
+		case <-w.ctx.Done():
+			return nil, w.ctx.Err()
+		case event := <-w.fw.Events:
+			if !w.f.match(event.Name) {
+				continue
+			}
+			if event.Op == fsnotify.Rename {
+				if _, err := os.Stat(event.Name); err == nil || os.IsExist(err) {
+					if err := w.fw.Add(event.Name); err != nil {
+						return nil, err
+					}
+				}
+			}
+			info, err := os.Stat(w.f.path)
+			if err != nil {
+				return nil, err
+			}
+			path := w.f.path
+			if info.IsDir() {
+				path = filepath.Join(w.f.path, filepath.Base(event.Name))
+			}
+			kv, err := w.f.loadFile(path)
+			if err != nil {
+				return nil, err
+			}
+			return []*runtime.KeyValue{kv}, nil
+		case err := <-w.fw.Errors:
+			return nil, err
+		}
+	}
+}
+
+func (w *watcher) Stop() error {
+	var err error
+	w.stopOnce.Do(func() {
+		w.cancel()
+		err = w.fw.Close()
+	})
+	return err
+}