feat: opencode zen adapter + first-run config generation, fix stats/stream bugs

- adapters/opencode.lua: opencode.ai zen free pool adapter — sends the
  opencode client User-Agent (zen fingerprints clients by UA; non-official
  clients hit FreeUsageLimitError); pairs with api_key: public
- config: no config file ships in the repo; first run generates a default
  config at the -config path with a random admin key, loopback listen and a
  keyless zen source (config.EnsureDefault); remove config.example.yaml
- lua: seed bundled adapters from the embedded FS instead of a hardcoded
  name list
- ui: widen model kind select (chat was clipped to 'cha')
- phase 5 bugfixes: stats ms/s bucket mixing, cleanScopes nil, ctx.Err
  guards, direct-path ModelAvailable, empty stream body failure,
  bestImageModel rewrite, transform failure recording, Core.mu, timer,
  effective model for tool-calls

internal/config/secret.go

@@ -15,6 +15,16 @@ import (
 
 var encPrefix = "enc:v1:"
 
+// NewGatewayKey generates a fresh random gateway admin key with the
+// "sk-gw-" prefix, used when bootstrapping a default config on first run.
+func NewGatewayKey() (string, error) {
+	b := make([]byte, 16)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return "sk-gw-" + hex.EncodeToString(b), nil
+}
+
 // SecretBox encrypts and decrypts sensitive values (upstream API keys,
 // custom header values, gateway keys) for persist-time protection. The
 // master key comes from the LLMS_PROXY_MASTER_KEY environment variable