feat(server): hot-reload config store and reloadable infra clients

- Replace single Load() with a watching Store that re-reads config files
  (and config.local.yaml) and fans out a ReloadEvent with a per-field diff
  so consumers can decide whether the change is hot-applicable or requires
  a process restart.
- Wrap llm, retrieval, vector store, and object storage clients in
  Reloadable* shells so the bootstrap can swap their underlying impls when
  config changes without re-instantiating handlers.
- Make jwt.Manager and ops TokenIssuer mutable under a lock so secrets and
  TTLs can be rotated live; thread default plan code through a setter on
  the ops AdminUserService.
- Wire ConfigStore through bootstrap and every cmd/main.go, scheduler /
  worker / tenant-api / ops-api start the watcher; services and handlers
  take a config.Provider so they always read current values for things
  like generation.stream_enabled, scheduler dispatch, retrieval, etc.
- Switch shared/config decoding off viper to a Kratos-derived runtime
  package so env placeholders (\${VAR:default}) resolve consistently and
  the same source machinery powers both the loader and the watcher.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/worker/generate/template_assist_worker.go

@@ -10,6 +10,7 @@ import (
 	amqp "github.com/rabbitmq/amqp091-go"
 	"go.uber.org/zap"
 
+	"github.com/geo-platform/tenant-api/internal/shared/config"
 	"github.com/geo-platform/tenant-api/internal/shared/messaging/rabbitmq"
 	tenantapp "github.com/geo-platform/tenant-api/internal/tenant/app"
 )
@@ -22,6 +23,7 @@ type TemplateAssistWorker struct {
 	logger            *zap.Logger
 	retryInterval     time.Duration
 	processTimeout    time.Duration
+	configProvider    config.Provider
 	consumerPrefix    string
 	workerConcurrency int
 }
@@ -51,6 +53,11 @@ func NewTemplateAssistWorker(
 	}
 }
 
+func (w *TemplateAssistWorker) WithConfigProvider(provider config.Provider) *TemplateAssistWorker {
+	w.configProvider = provider
+	return w
+}
+
 func (w *TemplateAssistWorker) Start(ctx context.Context) {
 	if w == nil || w.rabbitMQ == nil || w.templateService == nil {
 		return
@@ -112,7 +119,7 @@ func (w *TemplateAssistWorker) handleDelivery(parent context.Context, delivery a
 		return
 	}
 
-	ctx, cancel := context.WithTimeout(parent, w.processTimeout)
+	ctx, cancel := context.WithTimeout(parent, w.runtimeProcessTimeout())
 	defer cancel()
 
 	terminal, err := w.templateService.IsAssistTaskTerminal(ctx, *job)
@@ -143,6 +150,25 @@ func (w *TemplateAssistWorker) handleDelivery(parent context.Context, delivery a
 	}
 }
 
+func (w *TemplateAssistWorker) runtimeProcessTimeout() time.Duration {
+	if w != nil && w.configProvider != nil {
+		if cfg := w.configProvider.Current(); cfg != nil {
+			return templateAssistProcessTimeout(cfg.Generation)
+		}
+	}
+	if w != nil && w.processTimeout > 0 {
+		return w.processTimeout
+	}
+	return templateAssistProcessTimeout(config.GenerationConfig{})
+}
+
+func templateAssistProcessTimeout(cfg config.GenerationConfig) time.Duration {
+	if cfg.ArticleTimeout > 0 {
+		return cfg.ArticleTimeout
+	}
+	return 5 * time.Minute
+}
+
 func (w *TemplateAssistWorker) rejectDelivery(delivery amqp.Delivery, requeue bool, err error, taskID, taskType string) {
 	if nackErr := delivery.Nack(false, requeue); nackErr != nil && w.logger != nil {
 		w.logger.Warn("template assist nack failed",