feat(server): hot-reload config store and reloadable infra clients

- Replace single Load() with a watching Store that re-reads config files
  (and config.local.yaml) and fans out a ReloadEvent with a per-field diff
  so consumers can decide whether the change is hot-applicable or requires
  a process restart.
- Wrap llm, retrieval, vector store, and object storage clients in
  Reloadable* shells so the bootstrap can swap their underlying impls when
  config changes without re-instantiating handlers.
- Make jwt.Manager and ops TokenIssuer mutable under a lock so secrets and
  TTLs can be rotated live; thread default plan code through a setter on
  the ops AdminUserService.
- Wire ConfigStore through bootstrap and every cmd/main.go, scheduler /
  worker / tenant-api / ops-api start the watcher; services and handlers
  take a config.Provider so they always read current values for things
  like generation.stream_enabled, scheduler dispatch, retrieval, etc.
- Switch shared/config decoding off viper to a Kratos-derived runtime
  package so env placeholders (\${VAR:default}) resolve consistently and
  the same source machinery powers both the loader and the watcher.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/shared/retrieval/reloadable.go

@@ -0,0 +1,98 @@
+package retrieval
+
+import (
+	"context"
+	"sync"
+)
+
+type ReloadableProvider struct {
+	mu      sync.RWMutex
+	current Provider
+}
+
+func NewReloadableProvider(current Provider) *ReloadableProvider {
+	return &ReloadableProvider{current: current}
+}
+
+func (p *ReloadableProvider) Update(next Provider) {
+	if p == nil || next == nil {
+		return
+	}
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.current = next
+}
+
+func (p *ReloadableProvider) Validate() error {
+	return p.snapshot().Validate()
+}
+
+func (p *ReloadableProvider) Embed(ctx context.Context, inputs []string) ([][]float64, error) {
+	return p.snapshot().Embed(ctx, inputs)
+}
+
+func (p *ReloadableProvider) Rerank(ctx context.Context, query string, documents []string, topN int) ([]RerankResult, error) {
+	return p.snapshot().Rerank(ctx, query, documents, topN)
+}
+
+func (p *ReloadableProvider) snapshot() Provider {
+	if p == nil {
+		return disabledProvider{reason: "retrieval provider is nil"}
+	}
+	p.mu.RLock()
+	defer p.mu.RUnlock()
+	if p.current == nil {
+		return disabledProvider{reason: "retrieval provider is not initialized"}
+	}
+	return p.current
+}
+
+type ReloadableVectorStore struct {
+	mu      sync.RWMutex
+	current VectorStore
+}
+
+func NewReloadableVectorStore(current VectorStore) *ReloadableVectorStore {
+	return &ReloadableVectorStore{current: current}
+}
+
+func (s *ReloadableVectorStore) Update(next VectorStore) {
+	if s == nil || next == nil {
+		return
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.current = next
+}
+
+func (s *ReloadableVectorStore) Validate() error {
+	return s.snapshot().Validate()
+}
+
+func (s *ReloadableVectorStore) EnsureCollection(ctx context.Context, vectorSize int) error {
+	return s.snapshot().EnsureCollection(ctx, vectorSize)
+}
+
+func (s *ReloadableVectorStore) Upsert(ctx context.Context, points []VectorPoint) error {
+	return s.snapshot().Upsert(ctx, points)
+}
+
+func (s *ReloadableVectorStore) Search(ctx context.Context, req SearchRequest) ([]SearchPoint, error) {
+	return s.snapshot().Search(ctx, req)
+}
+
+func (s *ReloadableVectorStore) DeletePoints(ctx context.Context, pointIDs []string) error {
+	return s.snapshot().DeletePoints(ctx, pointIDs)
+}
+
+func (s *ReloadableVectorStore) snapshot() VectorStore {
+	if s == nil {
+		return disabledVectorStore{reason: "vector store is nil"}
+	}
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	if s.current == nil {
+		return disabledVectorStore{reason: "vector store is not initialized"}
+	}
+	return s.current
+}