feat(server): hot-reload config store and reloadable infra clients

- Replace single Load() with a watching Store that re-reads config files
  (and config.local.yaml) and fans out a ReloadEvent with a per-field diff
  so consumers can decide whether the change is hot-applicable or requires
  a process restart.
- Wrap llm, retrieval, vector store, and object storage clients in
  Reloadable* shells so the bootstrap can swap their underlying impls when
  config changes without re-instantiating handlers.
- Make jwt.Manager and ops TokenIssuer mutable under a lock so secrets and
  TTLs can be rotated live; thread default plan code through a setter on
  the ops AdminUserService.
- Wire ConfigStore through bootstrap and every cmd/main.go, scheduler /
  worker / tenant-api / ops-api start the watcher; services and handlers
  take a config.Provider so they always read current values for things
  like generation.stream_enabled, scheduler dispatch, retrieval, etc.
- Switch shared/config decoding off viper to a Kratos-derived runtime
  package so env placeholders (\${VAR:default}) resolve consistently and
  the same source machinery powers both the loader and the watcher.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/tenant/app/prompt_generate_service.go

@@ -23,17 +23,16 @@ import (
 )
 
 type PromptRuleGenerationService struct {
-	pool            *pgxpool.Pool
-	llm             llm.Client
-	rabbitMQ        *rabbitmq.Client
-	knowledge       *KnowledgeService
-	streams         *stream.GenerationHub
-	streamEnabled   bool
-	articleTimeout  time.Duration
-	maxOutputTokens int64
-	cache           sharedcache.Cache
-	publishJobs     *PublishJobService
-	logger          *zap.Logger
+	pool           *pgxpool.Pool
+	llm            llm.Client
+	rabbitMQ       *rabbitmq.Client
+	knowledge      *KnowledgeService
+	streams        *stream.GenerationHub
+	cfg            generationRuntimeConfig
+	configProvider runtimeConfigProvider
+	cache          sharedcache.Cache
+	publishJobs    *PublishJobService
+	logger         *zap.Logger
 }
 
 type promptRuleGenerationJob struct {
@@ -119,20 +118,13 @@ func NewPromptRuleGenerationService(
 	cfg config.GenerationConfig,
 	llmMaxOutputTokens int64,
 ) *PromptRuleGenerationService {
-	articleTimeout := cfg.ArticleTimeout
-	if articleTimeout <= 0 {
-		articleTimeout = 8 * time.Minute
-	}
-
 	svc := &PromptRuleGenerationService{
-		pool:            pool,
-		llm:             llmClient,
-		rabbitMQ:        rabbitMQClient,
-		knowledge:       knowledge,
-		streams:         streams,
-		streamEnabled:   cfg.StreamEnabled,
-		articleTimeout:  articleTimeout,
-		maxOutputTokens: llmMaxOutputTokens,
+		pool:      pool,
+		llm:       llmClient,
+		rabbitMQ:  rabbitMQClient,
+		knowledge: knowledge,
+		streams:   streams,
+		cfg:       generationRuntimeFromConfig(cfg, config.LLMConfig{MaxOutputTokens: llmMaxOutputTokens}),
 	}
 
 	return svc
@@ -153,6 +145,23 @@ func (s *PromptRuleGenerationService) WithLogger(logger *zap.Logger) *PromptRule
 	return s
 }
 
+func (s *PromptRuleGenerationService) WithConfigProvider(provider runtimeConfigProvider) *PromptRuleGenerationService {
+	s.configProvider = provider
+	return s
+}
+
+func (s *PromptRuleGenerationService) runtimeConfig() generationRuntimeConfig {
+	if s != nil && s.configProvider != nil {
+		if cfg := s.configProvider.Current(); cfg != nil {
+			return generationRuntimeFromConfig(cfg.Generation, cfg.LLM)
+		}
+	}
+	if s == nil {
+		return generationRuntimeFromConfig(config.GenerationConfig{}, config.LLMConfig{})
+	}
+	return s.cfg
+}
+
 func (s *PromptRuleGenerationService) GenerateFromRule(ctx context.Context, req GenerateFromRuleRequest) (*GenerateFromRuleResponse, error) {
 	actor := auth.MustActor(ctx)
 	extra := clonePromptRuleExtraParams(req.ExtraParams)
@@ -440,7 +449,8 @@ func (s *PromptRuleGenerationService) enqueuePromptRuleGeneration(ctx context.Co
 		return nil, response.ErrServiceUnavailable(50310, "generation_queue_unavailable", "generation queue is busy, please retry")
 	}
 
-	if s.streamEnabled && s.streams != nil {
+	runtimeCfg := s.runtimeConfig()
+	if runtimeCfg.StreamEnabled && s.streams != nil {
 		s.streams.Start(articleID, taskID, promptRuleGeneratingTitlePlaceholder)
 	}
 
@@ -505,17 +515,18 @@ func (s *PromptRuleGenerationService) executeGeneration(ctx context.Context, job
 		StartedAt: &now,
 	})
 
+	runtimeCfg := s.runtimeConfig()
 	req := llm.GenerateRequest{
 		Prompt:          job.Prompt,
-		Timeout:         s.articleTimeout,
-		MaxOutputTokens: s.maxOutputTokens,
+		Timeout:         runtimeCfg.ArticleTimeout,
+		MaxOutputTokens: runtimeCfg.MaxOutputTokens,
 	}
 	if job.WebSearch.Enabled {
 		req.WebSearch = &job.WebSearch
 	}
 
 	result, err := s.llm.Generate(ctx, req, func(delta string) {
-		if s.streamEnabled && delta != "" {
+		if runtimeCfg.StreamEnabled && s.streams != nil && delta != "" {
 			s.streams.AppendDelta(job.ArticleID, job.TaskID, title, delta)
 		}
 	})
@@ -596,7 +607,7 @@ func (s *PromptRuleGenerationService) executeGeneration(ctx context.Context, job
 	defer cancel()
 	invalidateArticleCaches(cleanupCtx, s.cache, job.TenantID, &job.ArticleID)
 
-	if s.streamEnabled {
+	if runtimeCfg.StreamEnabled && s.streams != nil {
 		s.streams.Complete(job.ArticleID, job.TaskID, title, content)
 	}
 
@@ -721,7 +732,8 @@ func (s *PromptRuleGenerationService) failGeneration(ctx context.Context, job pr
 	_ = quotaRepo.RefundReservation(cleanupCtx, job.ReservationID, job.TenantID)
 	invalidateArticleCaches(cleanupCtx, s.cache, job.TenantID, &job.ArticleID)
 
-	if s.streamEnabled {
+	runtimeCfg := s.runtimeConfig()
+	if runtimeCfg.StreamEnabled && s.streams != nil {
 		s.streams.Fail(job.ArticleID, job.TaskID, failureTitle, errMsg)
 	}
 }