feat(server): hot-reload config store and reloadable infra clients

- Replace single Load() with a watching Store that re-reads config files
  (and config.local.yaml) and fans out a ReloadEvent with a per-field diff
  so consumers can decide whether the change is hot-applicable or requires
  a process restart.
- Wrap llm, retrieval, vector store, and object storage clients in
  Reloadable* shells so the bootstrap can swap their underlying impls when
  config changes without re-instantiating handlers.
- Make jwt.Manager and ops TokenIssuer mutable under a lock so secrets and
  TTLs can be rotated live; thread default plan code through a setter on
  the ops AdminUserService.
- Wire ConfigStore through bootstrap and every cmd/main.go, scheduler /
  worker / tenant-api / ops-api start the watcher; services and handlers
  take a config.Provider so they always read current values for things
  like generation.stream_enabled, scheduler dispatch, retrieval, etc.
- Switch shared/config decoding off viper to a Kratos-derived runtime
  package so env placeholders (\${VAR:default}) resolve consistently and
  the same source machinery powers both the loader and the watcher.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/tenant/app/template_service.go

@@ -22,16 +22,15 @@ import (
 )
 
 type TemplateService struct {
-	pool            *pgxpool.Pool
-	templates       repository.TemplateRepository
-	llm             llm.Client
-	rabbitMQ        *rabbitmq.Client
-	knowledge       *KnowledgeService
-	streams         *stream.GenerationHub
-	streamEnabled   bool
-	articleTimeout  time.Duration
-	maxOutputTokens int64
-	cache           sharedcache.Cache
+	pool           *pgxpool.Pool
+	templates      repository.TemplateRepository
+	llm            llm.Client
+	rabbitMQ       *rabbitmq.Client
+	knowledge      *KnowledgeService
+	streams        *stream.GenerationHub
+	cfg            generationRuntimeConfig
+	configProvider runtimeConfigProvider
+	cache          sharedcache.Cache
 }
 
 type generationJob struct {
@@ -58,21 +57,14 @@ func NewTemplateService(
 	cfg config.GenerationConfig,
 	llmMaxOutputTokens int64,
 ) *TemplateService {
-	articleTimeout := cfg.ArticleTimeout
-	if articleTimeout <= 0 {
-		articleTimeout = 8 * time.Minute
-	}
-
 	svc := &TemplateService{
-		pool:            pool,
-		templates:       templates,
-		llm:             llmClient,
-		rabbitMQ:        rabbitMQClient,
-		knowledge:       knowledge,
-		streams:         streams,
-		streamEnabled:   cfg.StreamEnabled,
-		articleTimeout:  articleTimeout,
-		maxOutputTokens: llmMaxOutputTokens,
+		pool:      pool,
+		templates: templates,
+		llm:       llmClient,
+		rabbitMQ:  rabbitMQClient,
+		knowledge: knowledge,
+		streams:   streams,
+		cfg:       generationRuntimeFromConfig(cfg, config.LLMConfig{MaxOutputTokens: llmMaxOutputTokens}),
 	}
 
 	return svc
@@ -83,6 +75,23 @@ func (s *TemplateService) WithCache(c sharedcache.Cache) *TemplateService {
 	return s
 }
 
+func (s *TemplateService) WithConfigProvider(provider runtimeConfigProvider) *TemplateService {
+	s.configProvider = provider
+	return s
+}
+
+func (s *TemplateService) runtimeConfig() generationRuntimeConfig {
+	if s != nil && s.configProvider != nil {
+		if cfg := s.configProvider.Current(); cfg != nil {
+			return generationRuntimeFromConfig(cfg.Generation, cfg.LLM)
+		}
+	}
+	if s == nil {
+		return generationRuntimeFromConfig(config.GenerationConfig{}, config.LLMConfig{})
+	}
+	return s.cfg
+}
+
 type TemplateListItem struct {
 	ID               int64                  `json:"id"`
 	Scope            string                 `json:"scope"`
@@ -397,7 +406,8 @@ func (s *TemplateService) Generate(ctx context.Context, templateID int64, req Ge
 		return nil, response.ErrServiceUnavailable(50310, "generation_queue_unavailable", "generation queue is busy, please retry")
 	}
 
-	if s.streamEnabled {
+	runtimeCfg := s.runtimeConfig()
+	if runtimeCfg.StreamEnabled && s.streams != nil {
 		s.streams.Start(articleID, taskID, initialTitle)
 	}
 
@@ -467,16 +477,17 @@ func (s *TemplateService) executeGeneration(ctx context.Context, job generationJ
 	}
 
 	prompt := buildGenerationPrompt(job.TemplateKey, job.TemplateName, job.PromptTemplate, job.Params, knowledgePrompt)
+	runtimeCfg := s.runtimeConfig()
 	generateReq := llm.GenerateRequest{
 		Prompt:          prompt,
-		Timeout:         s.articleTimeout,
-		MaxOutputTokens: s.maxOutputTokens,
+		Timeout:         runtimeCfg.ArticleTimeout,
+		MaxOutputTokens: runtimeCfg.MaxOutputTokens,
 	}
 	if job.WebSearch.Enabled {
 		generateReq.WebSearch = &job.WebSearch
 	}
 	result, err := s.llm.Generate(ctx, generateReq, func(delta string) {
-		if s.streamEnabled && delta != "" {
+		if runtimeCfg.StreamEnabled && delta != "" {
 			s.streams.AppendDelta(job.ArticleID, job.TaskID, title, delta)
 		}
 	})
@@ -557,7 +568,7 @@ func (s *TemplateService) executeGeneration(ctx context.Context, job generationJ
 	defer cancel()
 	invalidateArticleCaches(cleanupCtx, s.cache, job.TenantID, &job.ArticleID)
 
-	if s.streamEnabled {
+	if runtimeCfg.StreamEnabled && s.streams != nil {
 		s.streams.Complete(job.ArticleID, job.TaskID, title, content)
 	}
 }
@@ -602,7 +613,8 @@ func (s *TemplateService) failGeneration(ctx context.Context, job generationJob,
 	_ = quotaRepo.RefundReservation(cleanupCtx, job.ReservationID, job.TenantID)
 	invalidateArticleCaches(cleanupCtx, s.cache, job.TenantID, &job.ArticleID)
 
-	if s.streamEnabled {
+	runtimeCfg := s.runtimeConfig()
+	if runtimeCfg.StreamEnabled && s.streams != nil {
 		s.streams.Fail(job.ArticleID, job.TaskID, title, errMsg)
 	}
 }