feat(templates): source templates for multi-key balancing

A template stores every source field except name and api_key, so
operators spin up N key-bearing sources from one shared skeleton
instead of duplicating the whole source block N times.

- config: SourceTemplate type + RuntimeConfig.SourceTemplates stored
  in runtime.json alongside runtime sources
- store: UpsertTemplate / ListTemplates / RemoveTemplate
- core: Templates / SaveTemplate / RemoveTemplate
- gateway: GET/POST/DELETE /api/source_templates
- webui: source list gains a Templates button opening a manager with
  per-template edit/delete; the add-source dialog gains 'from
  template' (event-delegated picker) and 'as template' (card modal)
  buttons in its header; z-index fixed so the template editor layers
  above the manager

internal/gateway/api.go

@@ -134,6 +134,45 @@ func csvHeaders(w http.ResponseWriter, filename string) {
 	w.Header().Set("Content-Disposition", "attachment; filename="+filename)
 }
 
+// handleSourceTemplatesAPI manages reusable source templates (a Source minus
+// name and api_key) stored in the runtime file so the WebUI can spin up
+// multiple key-bearing sources from one shared template.
+func (g *Gateway) handleSourceTemplatesAPI(w http.ResponseWriter, r *http.Request) {
+	if reqRole(r.Context()) != "admin" {
+		writeError(w, http.StatusForbidden, "forbidden", "admin role required")
+		return
+	}
+	path := strings.TrimPrefix(r.URL.Path, "/api/source_templates")
+	path = strings.Trim(path, "/")
+	switch r.Method {
+	case http.MethodGet:
+		writeJSON(w, http.StatusOK, map[string]interface{}{"templates": g.core.Templates()})
+	case http.MethodPost:
+		var t config.SourceTemplate
+		if err := json.NewDecoder(r.Body).Decode(&t); err != nil {
+			writeError(w, http.StatusBadRequest, "invalid_request", "invalid json: "+err.Error())
+			return
+		}
+		if err := g.core.SaveTemplate(t); err != nil {
+			writeError(w, http.StatusBadRequest, "template_error", err.Error())
+			return
+		}
+		writeJSON(w, http.StatusOK, map[string]interface{}{"ok": true, "templates": g.core.Templates()})
+	case http.MethodDelete:
+		if path == "" {
+			writeError(w, http.StatusBadRequest, "invalid_request", "template name required")
+			return
+		}
+		if err := g.core.RemoveTemplate(path); err != nil {
+			writeError(w, http.StatusBadRequest, "template_error", err.Error())
+			return
+		}
+		writeJSON(w, http.StatusOK, map[string]interface{}{"ok": true})
+	default:
+		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "")
+	}
+}
+
 // exportKey resolves which masked key id an export covers: admins may pass
 // any key filter, user keys are always scoped to themselves (records and
 // aggregates are keyed by the masked keyID form).