lua: 吸收 llmsproxy 适配器高级特性（worker 池/静态预提取/动态签名钩子）

- 适配器 worker 池化：单 LState+全局锁（串行瓶颈）→ 每 adapter 一个 gopher-lua
  LState 池，按使用该 adapter 的源并发上限求和配置池大小，并发 transform 互不阻塞
- staticInfo 预提取：name/version/endpoint/headers 加载期编译缓存，Endpoint/Headers
  读缓存不占 worker；加载即预编译首个 worker
- build_headers 动态钩子 + hmac/sha256/base64/tohex 全局：签名型上游（kimicode 等）可接入
- provider applyAdapterHeaders 接入动态头（url/method/body/api_key/timestamp/source 元数据），
  未定义时回落静态 headers，缺省补 Authorization
- LLMSource.MaxConcurrent + core.llm.sources.<name>.max_concurrent，注册时汇总
  VM.ConfigureConcurrency
- 新增 Lua VM 测试（load/transform/build_headers/并发）

验证: go test ./... 27 包 0 失败；Windows 交叉编译通过；部署后 9 adapter 全部预加载

internal/agent/api/provider.go

@@ -201,6 +201,7 @@ type BaseConfig struct {
 	Temperature   float64 `json:"temperature"`
 	MaxTokens     int     `json:"max_tokens"`
 	ContextWindow int     `json:"context_window"`
+	MaxConcurrent int     `json:"max_concurrent"`
 }
 
 // LuaAdaptedProvider 使用 Lua 脚本做请求/响应变换，直接发起 HTTP 调用
@@ -272,11 +273,7 @@ func (p *LuaAdaptedProvider) Chat(ctx context.Context, req *CompletionRequest) (
 		return nil, fmt.Errorf("create request: %w", err)
 	}
 	httpReq.Header.Set("Content-Type", "application/json")
-	httpReq.Header.Set("Authorization", "Bearer "+p.cfg.APIKey)
-
-	for k, v := range p.vm.GetAdapterHeaders(p.adapter) {
-		httpReq.Header.Set(k, v)
-	}
+	p.applyAdapterHeaders(httpReq, url, transformedBody)
 
 	resp, err := p.client.Do(httpReq)
 	if err != nil {
@@ -315,6 +312,31 @@ func (p *LuaAdaptedProvider) Chat(ctx context.Context, req *CompletionRequest) (
 	return &result, nil
 }
 
+// applyAdapterHeaders 优先调用 adapter.build_headers(meta) 动态签名钩子，
+// 未定义时回落到静态 adapter.headers，最后确保带 Authorization。
+func (p *LuaAdaptedProvider) applyAdapterHeaders(httpReq *http.Request, url, body string) {
+	meta := map[string]interface{}{
+		"url":       url,
+		"method":    http.MethodPost,
+		"body":      body,
+		"api_key":   p.cfg.APIKey,
+		"timestamp": time.Now().Unix(),
+		"source": map[string]interface{}{
+			"name": p.name,
+		},
+	}
+	hdrs, err := p.vm.BuildHeaders(p.adapter, meta)
+	if err != nil {
+		hdrs = p.vm.GetAdapterHeaders(p.adapter)
+	}
+	for k, v := range hdrs {
+		httpReq.Header.Set(k, v)
+	}
+	if httpReq.Header.Get("Authorization") == "" && p.cfg.APIKey != "" {
+		httpReq.Header.Set("Authorization", "Bearer "+p.cfg.APIKey)
+	}
+}
+
 func parseOpenAICompatibleResponse(raw []byte) (*CompletionResponse, error) {
 	var resp struct {
 		Usage struct {