feat: add file-based admin settings panel at /admin (#866)

* feat: add file-based admin settings panel at /admin

Settings saved in the panel are written to data/settings.json and
overlaid onto process.env, taking precedence over environment
variables and applying immediately without restart. Enable by setting
ADMIN_PASSWORD; on serverless platforms without persistent disk the
panel degrades to read-only.

* polish: admin panel UI improvements

- Provider logos in credential rows (shared ProviderLogo component,
  extracted from model-config-dialog)
- Scroll-spy active state in the sidebar nav
- Green success state in the save bar that clears after a few seconds
- Wider content column (max-w-6xl) for less wasted space on desktop

* polish: admin panel section toggles and reorder

- Move Quota & Rate Limits to the end of the settings page
- Add enable switches to Observability and Quota sections; default off
  with fields grayed out, auto-on when any field is already configured

* polish: make section enable switch more visible

Wrap the switch in a labeled pill ('Enabled'/'Disabled') with border
and background so the off state is clearly visible.

* refactor: derive admin registry from PROVIDER_INFO, simplify page state

- Provider options, labels, and base-URL placeholders now come from
  PROVIDER_INFO instead of hand-copied lists (fixes SiliconFlow .com/.cn
  placeholder drift; panel names now match the model-config dialog)
- Replace free-text subgroup strings + SUBGROUP_PROVIDERS reverse map
  with a typed provider field on SettingDef
- Precompute SETTINGS_BY_GROUP and PROVIDER_SUBGROUPS at module level
- Merge justSaved into saveMessage, drop unused mainRef, hoist
  fetchSettings out of the component, dedupe savedText logic
- Serialize from SETTINGS_REGISTRY directly; json validators in a map
  instead of a hardcoded key check
- Make allowPrivateUrls a function so ALLOW_PRIVATE_URLS edits in the
  admin panel apply without restart

* feat: graphical model management in admin panel

Replace the provider credential fields and raw AI_MODELS_CONFIG JSON
textarea with a Models section mirroring the in-app model settings UI:
provider instance list with logos, credential fields per provider type,
model add/remove with suggestions, per-model connectivity test, and a
default-provider star.

On save the server derives everything the runtime needs into
settings.json: credential env vars (with _2 suffixes for multiple
instances of one provider), AI_MODELS_CONFIG, and AI_PROVIDER/AI_MODEL
for the default. Secrets round-trip as masked markers and are never
sent back to the browser. The general settings registry now only
covers non-provider settings (generation, access, features,
observability, quota).

* fix: allow testing unsaved providers in admin panel

The test button previously looked up credentials by providerId in the
saved settings, so testing a newly added (unsaved) provider failed with
'Unknown provider or model'. The test endpoint now accepts the client's
current provider state; newly typed secrets are used as-is and masked
markers are resolved against the stored values, so testing works both
before and after saving.

* fix: merge env AI_MODELS_CONFIG with admin panel providers

Previously, saving in the admin panel wrote a complete AI_MODELS_CONFIG
into settings.json, which (by overlay precedence) replaced any config
from .env or ai-models.json — admins lost their env-configured models.

The panel no longer writes AI_MODELS_CONFIG. Instead its providers are
merged with the env baseline at read time in loadRawServerModelsConfig,
and panel credentials go to ADMIN_-prefixed env vars wired up via
apiKeyEnv/baseUrlEnv so they never shadow standard vars. Env-based
providers now appear read-only in the panel, name clashes are rejected,
and a panel default overrides the env default. data/ is now gitignored.

* fix: block global-credential providers already managed via env

Bedrock, Vertex AI, and Ollama credentials live in fixed env vars with
no apiKeyEnv redirection, so a panel instance of one of these would
silently override the credentials that env-configured models rely on.
The API now rejects saving such a provider when the env config already
uses that type, and the Add Provider dropdown disables it with a
'managed via env' note.

* fix: address admin panel review findings

- Security: test-model no longer resolves a stored secret when the
  request's baseUrl/provider differs from the stored entry, closing a
  path where a tampered baseUrl could exfiltrate a saved key
- Save failures are now visible: the save bar shows the error in red
  (was masked by the persistent 'Unsaved changes' text), and per-field
  validation errors from the settings API are surfaced under each field
- The Observability/Quota enable switch is now real: toggling off stages
  deletion of the group's saved values, and the toggle no longer snaps
  back to Enabled after saving
- Env provider's default star is hidden when a panel provider is the
  active default (no more double star)
- Clearing a credential field reverts to the stored value instead of
  silently deleting it; an explicit X button removes a stored secret
- Form inputs are disabled during an in-flight save

* refactor(admin): split 1549-line admin page into focused modules

Extract admin-shared.ts (types + fetch helper), setting-field.tsx
(registry-driven fields), and models-section.tsx (provider/model
manager) from page.tsx. Pure mechanical move, no behavior change.

* feat(admin): share credential fields with user dialog and localize panel

Extract ProviderCredentialsFields (display name + per-provider
credential inputs) used by both the user ModelConfigDialog and the
admin Models panel; secret input passed via renderSecret (plaintext
vs masked), test button via footer slot. Add full i18n for the admin
panel across en/zh/ja/zh-Hant, reusing modelConfig.* for shared parts.

* fix(admin): address Copilot review findings

- Reflect built-in defaults for boolean settings (ALLOW_PRIVATE_URLS
  defaults on) and allow clearing a saved boolean back to default,
  so the SSRF toggle matches actual runtime behavior.
- Harden JSON loading: filter settings values to strings only, and
  schema-validate stored ADMIN_PROVIDERS entries, dropping malformed
  ones instead of letting them reach runtime code.
- Set beforeunload returnValue so the unsaved-changes prompt shows in
  all browsers; reject non-finite numbers in settings validation.
- Fix README/CN/JA docs that claimed the panel auto-generates
  AI_MODELS_CONFIG (providers are merged at read time, not written).
- Add unit tests for corrupted-file value filtering and provider
  schema validation.

* docs: move admin panel details to dedicated docs/{en,cn,ja}/admin-panel.md

The READMEs now carry a short blurb + link, matching the existing
per-topic docs (docker.md, ai-providers.md, ...). Removes the ~22-line
inline section and the duplicated data/settings.json mentions.

* fix(admin): address follow-up Copilot findings on the prior fixes

- loadAdminProviders now validates against a stored-shape schema where
  secrets are plain strings, so a hand-edited ADMIN_PROVIDERS holding an
  {isSet} marker is dropped instead of later crashing maskSecret().
- loadSettings guards against array values (typeof [] === 'object'),
  which would otherwise overlay numeric keys onto process.env.
- Admin SecretInput uses the bare id so the shared component's
  <Label htmlFor> stays associated (only one ProviderDetail mounts).
- Add tests: marker-secret rejection, array-values guard, bedrock
  multi-secret round-trip.

lib/admin/settings-registry.ts

@@ -0,0 +1,229 @@
+// Declarative registry of the general env vars editable in the admin panel.
+// Drives both server-side validation (app/api/admin/settings) and UI
+// rendering (app/[lang]/admin). Keys are exactly the env var names.
+//
+// AI providers and models are managed separately in the panel's Models
+// section (lib/admin/providers.ts), not here.
+//
+// Not listed here (and therefore rejected by the API):
+// - NEXT_PUBLIC_* vars: baked into the client bundle at build time
+// - ADMIN_PASSWORD / SETTINGS_FILE: bootstrap values, env-only to avoid lockout
+// - Per-provider reasoning/thinking tuning vars: env-only (see env.example)
+
+export type SettingType = "string" | "secret" | "number" | "boolean" | "enum"
+
+export interface SettingDef {
+    key: string
+    group: string
+    type: SettingType
+    label: string
+    description?: string
+    options?: string[]
+    min?: number
+    max?: number
+    placeholder?: string
+    // Built-in default applied at runtime when the value is unset, so the UI
+    // can reflect actual behavior (e.g. ALLOW_PRIVATE_URLS defaults to "true").
+    default?: string
+    // Value is only picked up at process start (module-load readers)
+    restartRequired?: boolean
+}
+
+export interface SettingGroup {
+    id: string
+    title: string
+    description: string
+    // Optional sections gated by an on/off switch in the panel; fields are
+    // grayed out until enabled. Starts on when any field is already set.
+    toggleable?: boolean
+}
+
+export const SETTING_GROUPS: SettingGroup[] = [
+    {
+        id: "generation",
+        title: "Generation",
+        description: "Output parameters applied to all chat requests.",
+    },
+    {
+        id: "access",
+        title: "Access Control",
+        description: "Restrict who can use this deployment.",
+    },
+    {
+        id: "features",
+        title: "Features",
+        description: "Optional features and security toggles.",
+    },
+    {
+        id: "observability",
+        title: "Observability",
+        description: "Langfuse tracing for LLM calls.",
+        toggleable: true,
+    },
+    {
+        id: "quota",
+        title: "Quota & Rate Limits",
+        description:
+            "Per-IP usage limits. Enforcement requires a DynamoDB table.",
+        toggleable: true,
+    },
+]
+
+export const SETTINGS_REGISTRY: SettingDef[] = [
+    // ── Generation ───────────────────────────────────────────────────
+    {
+        key: "TEMPERATURE",
+        group: "generation",
+        type: "number",
+        label: "Temperature",
+        description:
+            "Leave unset for reasoning models that reject temperature.",
+        min: 0,
+        max: 2,
+    },
+    {
+        key: "MAX_OUTPUT_TOKENS",
+        group: "generation",
+        type: "number",
+        label: "Max Output Tokens",
+        min: 1,
+    },
+
+    // ── Access Control ───────────────────────────────────────────────
+    {
+        key: "ACCESS_CODE_LIST",
+        group: "access",
+        type: "string",
+        label: "Access Codes",
+        description:
+            "Comma-separated list. Users must enter one to chat. Empty = open access.",
+        placeholder: "code1,code2",
+    },
+
+    // ── Features ─────────────────────────────────────────────────────
+    {
+        key: "ENABLE_VLM_VALIDATION",
+        group: "features",
+        type: "boolean",
+        label: "VLM Diagram Validation",
+        description:
+            "Visually validate generated diagrams with a vision model.",
+    },
+    {
+        key: "VALIDATION_MODEL",
+        group: "features",
+        type: "string",
+        label: "Validation Model",
+        description: "Falls back to the default AI model when empty.",
+    },
+    {
+        key: "VALIDATION_TIMEOUT",
+        group: "features",
+        type: "number",
+        label: "Validation Timeout (ms)",
+        min: 1000,
+    },
+    {
+        key: "ENABLE_HISTORY_XML_REPLACE",
+        group: "features",
+        type: "boolean",
+        label: "History XML Compression",
+        description: "Replace old diagram XML in history with placeholders.",
+    },
+    {
+        key: "ALLOW_PRIVATE_URLS",
+        group: "features",
+        type: "boolean",
+        label: "Allow Private URLs",
+        description:
+            "Turn off to block requests to private IPs and internal hostnames (SSRF protection).",
+        // Unset means allowed at runtime (ssrf-protection: !== "false")
+        default: "true",
+    },
+
+    // ── Observability ────────────────────────────────────────────────
+    {
+        key: "LANGFUSE_PUBLIC_KEY",
+        group: "observability",
+        type: "string",
+        label: "Langfuse Public Key",
+        placeholder: "pk-lf-…",
+        restartRequired: true,
+    },
+    {
+        key: "LANGFUSE_SECRET_KEY",
+        group: "observability",
+        type: "secret",
+        label: "Langfuse Secret Key",
+        restartRequired: true,
+    },
+    {
+        key: "LANGFUSE_BASEURL",
+        group: "observability",
+        type: "string",
+        label: "Langfuse Base URL",
+        placeholder: "https://cloud.langfuse.com",
+        restartRequired: true,
+    },
+
+    // ── Quota ────────────────────────────────────────────────────────
+    {
+        key: "DAILY_REQUEST_LIMIT",
+        group: "quota",
+        type: "number",
+        label: "Daily Request Limit",
+        description: "Per IP per day.",
+        min: 1,
+    },
+    {
+        key: "DAILY_TOKEN_LIMIT",
+        group: "quota",
+        type: "number",
+        label: "Daily Token Limit",
+        description: "Per IP per day.",
+        min: 1,
+    },
+    {
+        key: "TPM_LIMIT",
+        group: "quota",
+        type: "number",
+        label: "Tokens Per Minute",
+        min: 1,
+    },
+    {
+        key: "DYNAMODB_QUOTA_TABLE",
+        group: "quota",
+        type: "string",
+        label: "DynamoDB Table",
+        description: "Quota enforcement is disabled when empty.",
+        restartRequired: true,
+    },
+    {
+        key: "DYNAMODB_REGION",
+        group: "quota",
+        type: "string",
+        label: "DynamoDB Region",
+        placeholder: "ap-northeast-1",
+        restartRequired: true,
+    },
+    {
+        key: "QUOTA_TIMEZONE",
+        group: "quota",
+        type: "string",
+        label: "Quota Timezone",
+        description: "Timezone for the daily reset boundary.",
+        placeholder: "UTC",
+        restartRequired: true,
+    },
+]
+
+export const SETTINGS_BY_KEY: Map<string, SettingDef> = new Map(
+    SETTINGS_REGISTRY.map((def) => [def.key, def]),
+)
+
+export const SETTINGS_BY_GROUP: Map<string, SettingDef[]> = new Map(
+    SETTING_GROUPS.map((g) => [
+        g.id,
+        SETTINGS_REGISTRY.filter((d) => d.group === g.id),
+    ]),
+)