refactor(server): drop stale prompt text, duplicated routes and dead options

- lib/system-prompts.ts: delete the extended prompt kept only to reach
  the 4096-token cache threshold of two old Claude models; describe the
  current canvas-first UI in the App Features section
- app/api/chat/route.ts: remove the server-side example cache (the
  browser answers examples itself), the ENABLE_HISTORY_XML_REPLACE
  option and its helper, the unread messageMetadata fields; the
  DEBUG_LLM_PAYLOAD blocks become one describeMessages summary
- app/api/log-feedback and log-save share scoreLatestTrace in
  lib/langfuse.ts
- app/api/admin/test-model and validate-model call a shared
  testModelConnection() instead of one route faking a request to the
  other and passing trust through the body
- lib/dynamo-quota-manager.ts reads the failing item from the
  conditional update instead of a second GetItem
- lib/ai-providers.ts: geminiThinkingOptions helper for the google and
  vertexai cases, drop the unused fourth resolveBaseURL parameter
- edge-functions: always stream, shrink messageSchema, drop model
  aliases nothing sends
- delete app/api/chat/xml_guide.md, parseOutputTokenLimit, unused type
  exports and export keywords on file-internal symbols
- env.example: drop variables nothing reads, document the quota,
  validation and analytics variables, mention the apiKeyEnv array form
  (also in docs/*/ai-providers.md)

tests/unit/validate-model-route.test.ts

@@ -257,17 +257,37 @@ describe("testing EdgeOne", () => {
 })
 
 describe("the admin Test of the server's own base URL", () => {
-    const test = (headers: Record<string, string>) =>
+    // An admin panel entry without a URL of its own
+    const adminTest = () =>
+        testModel(
+            new Request("http://localhost/api/admin/test-model", {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    "x-admin-password": "admin-pw",
+                },
+                body: JSON.stringify({
+                    provider: {
+                        id: "p1",
+                        provider: "openai",
+                        apiKey: "panel-key",
+                        models: ["gpt-5.5"],
+                    },
+                    modelId: "gpt-5.5",
+                }),
+            }),
+        )
+    // A user naming the same address in the Settings dialog
+    const userTest = () =>
         validateModel(
             new Request("http://localhost/api/validate-model", {
                 method: "POST",
-                headers: { "Content-Type": "application/json", ...headers },
+                headers: { "Content-Type": "application/json" },
                 body: JSON.stringify({
                     provider: "openai",
                     apiKey: "panel-key",
                     modelId: "gpt-5.5",
                     baseUrl: "http://10.0.0.5:8000/v1",
-                    serverBaseUrl: true,
                 }),
             }),
         )
@@ -280,12 +300,10 @@ describe("the admin Test of the server's own base URL", () => {
         privateUrls.all = true
         try {
             streamReply({ role: "assistant", content: "OK" })
-            const admin = await (
-                await test({ "x-admin-password": "admin-pw" })
-            ).json()
+            const admin = await (await adminTest()).json()
             expect(admin.valid).toBe(true)
-            // Anyone else claiming it is still refused
-            const other = await test({})
+            // A user typing the same address is still refused
+            const other = await userTest()
             expect(other.status).toBe(400)
         } finally {
             privateUrls.all = false