refactor(server): drop stale prompt text, duplicated routes and dead options

- lib/system-prompts.ts: delete the extended prompt kept only to reach
  the 4096-token cache threshold of two old Claude models; describe the
  current canvas-first UI in the App Features section
- app/api/chat/route.ts: remove the server-side example cache (the
  browser answers examples itself), the ENABLE_HISTORY_XML_REPLACE
  option and its helper, the unread messageMetadata fields; the
  DEBUG_LLM_PAYLOAD blocks become one describeMessages summary
- app/api/log-feedback and log-save share scoreLatestTrace in
  lib/langfuse.ts
- app/api/admin/test-model and validate-model call a shared
  testModelConnection() instead of one route faking a request to the
  other and passing trust through the body
- lib/dynamo-quota-manager.ts reads the failing item from the
  conditional update instead of a second GetItem
- lib/ai-providers.ts: geminiThinkingOptions helper for the google and
  vertexai cases, drop the unused fourth resolveBaseURL parameter
- edge-functions: always stream, shrink messageSchema, drop model
  aliases nothing sends
- delete app/api/chat/xml_guide.md, parseOutputTokenLimit, unused type
  exports and export keywords on file-internal symbols
- env.example: drop variables nothing reads, document the quota,
  validation and analytics variables, mention the apiKeyEnv array form
  (also in docs/*/ai-providers.md)

env.example

@@ -8,6 +8,7 @@ AI_PROVIDER=bedrock
 # Tip: For a single-provider quick multi-model setup, list comma-separated model IDs.
 # The first one becomes the default and the rest appear in the model picker.
 # For multiple providers or custom apiKeyEnv/baseUrlEnv, use AI_MODELS_CONFIG / ai-models.json instead.
+# There, apiKeyEnv may also be an array of env var names: each request picks one that has a value at random.
 # Example: AI_MODEL=doubao-seed-1-8-251215,doubao-seed-1-6-flash,doubao-seed-1-6-pro
 AI_MODEL=global.anthropic.claude-sonnet-4-5-20250929-v1:0
 
@@ -28,8 +29,6 @@ AI_MODEL=global.anthropic.claude-sonnet-4-5-20250929-v1:0
 # OpenAI Configuration
 # OPENAI_API_KEY=sk-...
 # OPENAI_BASE_URL=https://api.openai.com/v1  # Optional: Custom OpenAI-compatible endpoint
-# OPENAI_ORGANIZATION=org-...  # Optional
-# OPENAI_PROJECT=proj_...      # Optional
 # Note: o1/o3/gpt-5 models automatically enable reasoning summary (default: detailed)
 # OPENAI_REASONING_EFFORT=low   # Optional: Reasoning effort (minimal/low/medium/high) - for o1/o3/gpt-5
 # OPENAI_REASONING_SUMMARY=detailed  # Optional: Override reasoning summary (none/brief/detailed)
@@ -142,6 +141,18 @@ AI_MODEL=global.anthropic.claude-sonnet-4-5-20250929-v1:0
 # ADMIN_PASSWORD=your-admin-password
 # SETTINGS_FILE=./data/settings.json  # Optional: custom settings file location
 
+# Quota & Validation (Optional, also editable in the admin panel)
+# Quota enforcement is disabled unless DYNAMODB_QUOTA_TABLE is set.
+# DYNAMODB_QUOTA_TABLE=next-ai-draw-io-quota  # DynamoDB table that stores the per-IP counters
+# DYNAMODB_REGION=ap-northeast-1              # Region of the table
+# QUOTA_TIMEZONE=UTC                          # Timezone for the daily reset boundary
+# DAILY_REQUEST_LIMIT=10                      # Requests per IP per day
+# DAILY_TOKEN_LIMIT=200000                    # Tokens per IP per day
+# TPM_LIMIT=20000                             # Tokens per minute
+# ENABLE_VLM_VALIDATION=true                  # Visually validate generated diagrams with a vision model
+# VALIDATION_MODEL=                           # Falls back to the default AI model when empty
+# VALIDATION_TIMEOUT=30000                    # Validation timeout in ms
+
 # Draw.io Configuration (Optional)
 # By default the app serves its own copy of draw.io from /drawio (downloaded into
 # public/drawio by `npm run dev` / `npm run build`). Same origin is required for
@@ -156,9 +167,7 @@ AI_MODEL=global.anthropic.claude-sonnet-4-5-20250929-v1:0
 # NEXT_PUBLIC_BASE_PATH=/nextaidrawio
 
 # PDF Input Feature (Optional)
-# Enable PDF file upload to extract text and generate diagrams
-# Enabled by default. Set to "false" to disable.
-# ENABLE_PDF_INPUT=true
+# PDF file upload to extract text and generate diagrams
 # NEXT_PUBLIC_MAX_EXTRACTED_CHARS=150000  # Max characters for PDF/text extraction (default: 150000)
 
 # Security Settings (Optional)
@@ -184,6 +193,10 @@ AI_MODEL=global.anthropic.claude-sonnet-4-5-20250929-v1:0
 # It also turns off the MCP server advertisement in Settings > About.
 # NEXT_PUBLIC_SELFHOSTED=true
 
+# Analytics (Optional)
+# Google Analytics measurement ID; nothing is loaded when unset
+# NEXT_PUBLIC_GA_ID=G-XXXXXXXXXX
+
 # Minimax Configuration (Optional)
 # Get your API key from: https://platform.minimaxi.com/docs/guides/models-intro
 # MINIMAX_API_KEY=your_minimax_api_key