feat(server): hot-reload config store and reloadable infra clients

- Replace single Load() with a watching Store that re-reads config files
  (and config.local.yaml) and fans out a ReloadEvent with a per-field diff
  so consumers can decide whether the change is hot-applicable or requires
  a process restart.
- Wrap llm, retrieval, vector store, and object storage clients in
  Reloadable* shells so the bootstrap can swap their underlying impls when
  config changes without re-instantiating handlers.
- Make jwt.Manager and ops TokenIssuer mutable under a lock so secrets and
  TTLs can be rotated live; thread default plan code through a setter on
  the ops AdminUserService.
- Wire ConfigStore through bootstrap and every cmd/main.go, scheduler /
  worker / tenant-api / ops-api start the watcher; services and handlers
  take a config.Provider so they always read current values for things
  like generation.stream_enabled, scheduler dispatch, retrieval, etc.
- Switch shared/config decoding off viper to a Kratos-derived runtime
  package so env placeholders (\${VAR:default}) resolve consistently and
  the same source machinery powers both the loader and the watcher.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/worker/generate/article_generation_worker.go

@@ -34,6 +34,7 @@ type ArticleGenerationWorker struct {
 	logger            *zap.Logger
 	retryInterval     time.Duration
 	processTimeout    time.Duration
+	configProvider    config.Provider
 	consumerPrefix    string
 	workerConcurrency int
 }
@@ -53,11 +54,6 @@ func NewArticleGenerationWorker(
 		workerConcurrency = 1
 	}
 
-	processTimeout := cfg.ArticleTimeout + 2*time.Minute
-	if processTimeout <= 2*time.Minute {
-		processTimeout = 10 * time.Minute
-	}
-
 	return &ArticleGenerationWorker{
 		pool:              pool,
 		rabbitMQ:          rabbitMQClient,
@@ -67,12 +63,17 @@ func NewArticleGenerationWorker(
 		kolWorker:         kolWorker,
 		logger:            logger,
 		retryInterval:     defaultArticleGenerationWorkerRetryInterval,
-		processTimeout:    processTimeout,
+		processTimeout:    articleGenerationProcessTimeout(cfg),
 		consumerPrefix:    fmt.Sprintf("worker-generate-%d", os.Getpid()),
 		workerConcurrency: workerConcurrency,
 	}
 }
 
+func (w *ArticleGenerationWorker) WithConfigProvider(provider config.Provider) *ArticleGenerationWorker {
+	w.configProvider = provider
+	return w
+}
+
 func (w *ArticleGenerationWorker) Start(ctx context.Context) {
 	if w == nil || w.pool == nil || w.rabbitMQ == nil {
 		return
@@ -134,7 +135,7 @@ func (w *ArticleGenerationWorker) handleDelivery(parent context.Context, deliver
 		return
 	}
 
-	ctx, cancel := context.WithTimeout(parent, w.processTimeout)
+	ctx, cancel := context.WithTimeout(parent, w.runtimeProcessTimeout())
 	defer cancel()
 
 	task, terminal, err := w.loadTask(ctx, envelope.TaskID)
@@ -205,6 +206,26 @@ func (w *ArticleGenerationWorker) handleDelivery(parent context.Context, deliver
 	}
 }
 
+func (w *ArticleGenerationWorker) runtimeProcessTimeout() time.Duration {
+	if w != nil && w.configProvider != nil {
+		if cfg := w.configProvider.Current(); cfg != nil {
+			return articleGenerationProcessTimeout(cfg.Generation)
+		}
+	}
+	if w != nil && w.processTimeout > 0 {
+		return w.processTimeout
+	}
+	return articleGenerationProcessTimeout(config.GenerationConfig{})
+}
+
+func articleGenerationProcessTimeout(cfg config.GenerationConfig) time.Duration {
+	processTimeout := cfg.ArticleTimeout + 2*time.Minute
+	if processTimeout <= 2*time.Minute {
+		return 10 * time.Minute
+	}
+	return processTimeout
+}
+
 func (w *ArticleGenerationWorker) handleTaskFailure(ctx context.Context, task tenantapp.ClaimedGenerationTask, stage string, taskErr error) {
 	task.TaskType = strings.TrimSpace(task.TaskType)
 	switch {