fix(core): 修复启动重复播种 admin key + 配置封存非幂等

根因是 unseal 时序：NewFromConfig 把解密放在最后，而之前几步已经在读凭据。

1. seedKeys 重复播种（生产已累积 4 个同名 admin key）
   seedKeys 用 cfg.Keys[i].Key 与明文 gateway_keys 比对去重，但此时内存里的
   key 还是密文 enc:v1:…，比对永不命中 ⇒ 每次重启追加一个同值 admin key。
   实测：core.New(path) 连续重启，seeded key 数 2→3→4 递增。
   （旧测试用 NewFromConfig 构造全新内存对象，没有「盘上已有密文」这个前提，
    复现不出 —— 必须走 core.New 这条读盘的生产路径。）

2. 启动恒重写 config.yaml
   migratePlaintextSecrets 按内存状态判断，而 Save() 末尾会把内存恢复为明文，
   于是每次调用都判定「还有明文」并重写；注释却自称幂等。
   改为 UnsealSecrets 在解密前记录「盘上是否明文」，SealIfNeeded 据此决定
   是否写回 ⇒ 已封存的配置启动不再落盘。

原测试 TestMigratePlaintextSecretsIsIdempotent 用 ModTime 比较，两次写落在同一
时间戳刻度内就看不出来，所以表现为 ~1/6 概率的 flake 而非稳定失败。已改为比较
文件内容并走真实启动路径（UnsealSecrets + SealIfNeeded），并顺带消除该 flake。

附带更正：先前判断「rebuildRegistry 也会拿到密文 API key」不成立 ——
mergedSources → resolveSourceKey 对每个 source 独立解密（belt-and-braces），
provider 始终拿到明文。unseal 前置仍予保留，以消除对该兜底路径的隐性依赖、
并让 seedKeys 在明文下比较。

判据：
- TestRestartDoesNotDuplicateSeededKeys（敏感：回退顺序必红）
- TestSealingIsIdempotentAcrossStarts（12/12 稳定，原先 1/6 flake）
- TestProvidersGetPlaintextCredentials（钉 provider 必须拿到明文这一不变量）

internal/config/secret_config_test.go

@@ -119,7 +119,24 @@ sources:
 	}
 }
 
-func TestMigratePlaintextSecretsIsIdempotent(t *testing.T) {
+// Sealing a config is a one-time migration: the FIRST run writes, every later
+// start must leave the file alone.
+//
+// This test previously called migratePlaintextSecrets() twice and compared
+// ModTime. That assertion was both weak and wrong:
+//
+//   - migratePlaintextSecrets decides from IN-MEMORY state, and Save() ends by
+//     unsealing memory so the running process keeps working. So every call sees
+//     "plaintext present" and rewrites the file. Comparing ModTime hid this
+//     because two writes inside one filesystem timestamp tick look identical —
+//     the test flaked (~1 in 6) instead of failing.
+//   - it also exercised a function production no longer calls on the startup
+//     path, which now uses UnsealSecrets + SealIfNeeded (they decide from the
+//     ON-DISK state).
+//
+// So the test targets that real path and compares file CONTENT, which cannot be
+// fooled by timestamp granularity.
+func TestSealingIsIdempotentAcrossStarts(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "config.yaml")
 	runtime := filepath.Join(dir, "runtime.json")
@@ -132,29 +149,52 @@ func TestMigratePlaintextSecretsIsIdempotent(t *testing.T) {
 	}
 	cfg.AttachSecretBox(box)
 
-	if err := cfg.migratePlaintextSecrets(); err != nil {
-		t.Fatalf("first migrate: %v", err)
+	hadPlaintext, err := cfg.UnsealSecrets(box)
+	if err != nil {
+		t.Fatalf("unseal: %v", err)
+	}
+	if !hadPlaintext {
+		t.Fatal("a config written with a clear-text credential must report plaintext")
+	}
+	if err := cfg.SealIfNeeded(hadPlaintext); err != nil {
+		t.Fatalf("seal: %v", err)
 	}
 	first, err := os.ReadFile(path)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if !strings.Contains(string(first), encPrefix) {
-		t.Fatal("migration did not seal the value")
+		t.Fatal("sealing did not encrypt the value on disk")
 	}
 	// In-memory must be plaintext so the running process keeps working.
 	if cfg.Sources[0].APIKey != "sk-clear" {
 		t.Errorf("in-memory api_key = %q, want plaintext", cfg.Sources[0].APIKey)
 	}
 
-	// Second run: already sealed => no write.
-	before, _ := os.Stat(path)
-	if err := cfg.migratePlaintextSecrets(); err != nil {
-		t.Fatalf("second migrate: %v", err)
+	// Simulate the next start: load from disk, unseal, seal-if-needed. The file
+	// was already sealed, so nothing may be written.
+	cfg2, err := Load(path)
+	if err != nil {
+		t.Fatal(err)
 	}
-	after, _ := os.Stat(path)
-	if before.ModTime() != after.ModTime() {
-		t.Error("second migrate rewrote an already-sealed config")
+	cfg2.AttachSecretBox(box)
+	hadPlaintext2, err := cfg2.UnsealSecrets(box)
+	if err != nil {
+		t.Fatalf("second unseal: %v", err)
+	}
+	if hadPlaintext2 {
+		t.Error("a sealed config reported plaintext — SealIfNeeded would rewrite " +
+			"the file on every start")
+	}
+	if err := cfg2.SealIfNeeded(hadPlaintext2); err != nil {
+		t.Fatalf("second seal: %v", err)
+	}
+	second, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(first) != string(second) {
+		t.Error("the second start rewrote an already-sealed config; startup must be a no-op")
 	}
 }