fix: close P10 audit items — P10-1 sources API admin guard, P10-2 scope prefix strip, P10-3 runtime source timeout w/ stream-safe clients

- api.go: handleSourcesAPI now requires admin role (GET leaks upstream api_keys, POST/DELETE mutate routing)
- chat.go: hasScopeModel made a Gateway method that strips source-model/:// prefix strictly via Registry.EffectiveModel (only when the prefix names a real source serving the bare model) so dash-bearing ids like deepseek-v4-flash-free are never corrupted; +TestHasScopeModelWithSourcePrefix
- config.go: DefaultSourceTimeout/QueueTimeout/Concurrency constants shared by YAML ApplyDefaults and runtime sources
- core.go: mergedSources applies the same defaults to runtime sources (JSON never persisted timeout fields); a dead upstream can no longer hold a concurrency slot forever
- provider.go: split non-streaming client{Timeout} vs stream client{} sharing a Transport with ResponseHeaderTimeout, so long SSE bodies are not cut by client.Timeout; ChatStream uses doRawStream
- plan.md: mark P4-4/5/6 done, record P4-7/8 (tier-order, audit export, UI key view, zen upstream diagnosis)
- online verified: user key -> /api/sources 403 (GET+POST), admin 200, AUTO stream/non-stream healthy

internal/core/core.go

@@ -298,7 +298,20 @@ func (c *Core) mergedSources() []config.Source {
 	for _, n := range order {
 		if !seen[n] {
 			seen[n] = true
-			out = append(out, c.resolveSourceKey(byName[n]))
+			s := c.resolveSourceKey(byName[n])
+			// Runtime sources (web UI edits) are persisted without timeout
+			// fields; apply the same defaults the YAML path gets so a dead
+			// upstream cannot hold a concurrency slot forever (P10-3).
+			if s.Timeout == 0 {
+				s.Timeout = config.DefaultSourceTimeout
+			}
+			if s.QueueTimeout == 0 {
+				s.QueueTimeout = config.DefaultSourceQueueTimeout
+			}
+			if s.MaxConcurrent == 0 {
+				s.MaxConcurrent = config.DefaultSourceConcurrency
+			}
+			out = append(out, s)
 		}
 	}
 	return out