fix: close P10 audit items — P10-1 sources API admin guard, P10-2 scope prefix strip, P10-3 runtime source timeout w/ stream-safe clients

- api.go: handleSourcesAPI now requires admin role (GET leaks upstream api_keys, POST/DELETE mutate routing)
- chat.go: hasScopeModel made a Gateway method that strips source-model/:// prefix strictly via Registry.EffectiveModel (only when the prefix names a real source serving the bare model) so dash-bearing ids like deepseek-v4-flash-free are never corrupted; +TestHasScopeModelWithSourcePrefix
- config.go: DefaultSourceTimeout/QueueTimeout/Concurrency constants shared by YAML ApplyDefaults and runtime sources
- core.go: mergedSources applies the same defaults to runtime sources (JSON never persisted timeout fields); a dead upstream can no longer hold a concurrency slot forever
- provider.go: split non-streaming client{Timeout} vs stream client{} sharing a Transport with ResponseHeaderTimeout, so long SSE bodies are not cut by client.Timeout; ChatStream uses doRawStream
- plan.md: mark P4-4/5/6 done, record P4-7/8 (tier-order, audit export, UI key view, zen upstream diagnosis)
- online verified: user key -> /api/sources 403 (GET+POST), admin 200, AUTO stream/non-stream healthy

internal/config/config.go

@@ -19,13 +19,20 @@ type Config struct {
 	DefaultModel  string   `yaml:"default_model"` // e.g. "AUTO" or a model id
 	AdapterDir    string   `yaml:"adapter_dir"`
 	RuntimeFile   string   `yaml:"runtime_file"`
-	MaxConcurrent int      `yaml:"max_concurrent"` // global inflight cap, 0 = unlimited
-	TLSCertFile   string   `yaml:"tls_cert_file,omitempty"` // PEM cert; when set together with tls_key_file, serve HTTPS
-	TLSKeyFile    string   `yaml:"tls_key_file,omitempty"`  // PEM private key
+	MaxConcurrent int      `yaml:"max_concurrent"`            // global inflight cap, 0 = unlimited
+	TLSCertFile   string   `yaml:"tls_cert_file,omitempty"`   // PEM cert; when set together with tls_key_file, serve HTTPS
+	TLSKeyFile    string   `yaml:"tls_key_file,omitempty"`    // PEM private key
 	PublicBaseURL string   `yaml:"public_base_url,omitempty"` // external base for generated config snippets; default inferred from request
 	Sources       []Source `yaml:"sources"`
 }
 
+// Defaults applied to any source (YAML or runtime) that leaves a field unset.
+const (
+	DefaultSourceTimeout      = 120 * time.Second
+	DefaultSourceQueueTimeout = 60 * time.Second
+	DefaultSourceConcurrency  = 8
+)
+
 // Model is a single exposed model id bound to a source, with priority used by
 // AUTO auto selection (higher number = preferred).
 type Model struct {
@@ -149,13 +156,13 @@ func (c *Config) ApplyDefaults() error {
 			s.Adapter = "openai"
 		}
 		if s.Timeout == 0 {
-			s.Timeout = 120 * time.Second
+			s.Timeout = DefaultSourceTimeout
 		}
 		if s.QueueTimeout == 0 {
-			s.QueueTimeout = 60 * time.Second
+			s.QueueTimeout = DefaultSourceQueueTimeout
 		}
 		if s.MaxConcurrent == 0 {
-			s.MaxConcurrent = 8
+			s.MaxConcurrent = DefaultSourceConcurrency
 		}
 		if seen[s.Name] {
 			return fmt.Errorf("config: duplicate source name %q", s.Name)