feat(server): hot-reload config store and reloadable infra clients

- Replace single Load() with a watching Store that re-reads config files
  (and config.local.yaml) and fans out a ReloadEvent with a per-field diff
  so consumers can decide whether the change is hot-applicable or requires
  a process restart.
- Wrap llm, retrieval, vector store, and object storage clients in
  Reloadable* shells so the bootstrap can swap their underlying impls when
  config changes without re-instantiating handlers.
- Make jwt.Manager and ops TokenIssuer mutable under a lock so secrets and
  TTLs can be rotated live; thread default plan code through a setter on
  the ops AdminUserService.
- Wire ConfigStore through bootstrap and every cmd/main.go, scheduler /
  worker / tenant-api / ops-api start the watcher; services and handlers
  take a config.Provider so they always read current values for things
  like generation.stream_enabled, scheduler dispatch, retrieval, etc.
- Switch shared/config decoding off viper to a Kratos-derived runtime
  package so env placeholders (\${VAR:default}) resolve consistently and
  the same source machinery powers both the loader and the watcher.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/worker/assist/kol_assist_worker.go

@@ -13,6 +13,7 @@ import (
 	"go.uber.org/zap"
 
 	sharedcache "github.com/geo-platform/tenant-api/internal/shared/cache"
+	"github.com/geo-platform/tenant-api/internal/shared/config"
 	"github.com/geo-platform/tenant-api/internal/shared/llm"
 	"github.com/geo-platform/tenant-api/internal/shared/messaging/rabbitmq"
 	tenantapp "github.com/geo-platform/tenant-api/internal/tenant/app"
@@ -30,6 +31,7 @@ type KolAssistWorker struct {
 	cache             sharedcache.Cache
 	retryInterval     time.Duration
 	processTimeout    time.Duration
+	configProvider    config.Provider
 	consumerPrefix    string
 	workerConcurrency int
 }
@@ -65,6 +67,11 @@ func NewKolAssistWorker(
 	}
 }
 
+func (w *KolAssistWorker) WithConfigProvider(provider config.Provider) *KolAssistWorker {
+	w.configProvider = provider
+	return w
+}
+
 func (w *KolAssistWorker) Start(ctx context.Context) {
 	if w == nil || w.rabbitMQ == nil || w.repo == nil || w.llm == nil {
 		return
@@ -166,7 +173,7 @@ func (w *KolAssistWorker) handleDelivery(parent context.Context, delivery amqp.D
 		return
 	}
 
-	ctx, cancel := context.WithTimeout(parent, w.processTimeout)
+	ctx, cancel := context.WithTimeout(parent, w.runtimeProcessTimeout())
 	defer cancel()
 
 	if err := w.Process(ctx, *job); err != nil {
@@ -184,6 +191,25 @@ func (w *KolAssistWorker) handleDelivery(parent context.Context, delivery amqp.D
 	}
 }
 
+func (w *KolAssistWorker) runtimeProcessTimeout() time.Duration {
+	if w != nil && w.configProvider != nil {
+		if cfg := w.configProvider.Current(); cfg != nil {
+			return kolAssistProcessTimeout(cfg.Generation)
+		}
+	}
+	if w != nil && w.processTimeout > 0 {
+		return w.processTimeout
+	}
+	return kolAssistProcessTimeout(config.GenerationConfig{})
+}
+
+func kolAssistProcessTimeout(cfg config.GenerationConfig) time.Duration {
+	if cfg.ArticleTimeout > 0 {
+		return cfg.ArticleTimeout
+	}
+	return 5 * time.Minute
+}
+
 func (w *KolAssistWorker) rejectDelivery(delivery amqp.Delivery, requeue bool, err error, taskID string, tenantID int64) {
 	if nackErr := delivery.Nack(false, requeue); nackErr != nil && w.logger != nil {
 		w.logger.Warn("kol assist nack failed",