feat: WebUI 改为依赖 /api/v1，UI 与 agent 共用一套 API 契约

- sources / sort / keys 三个页面的数据源从 /api/sources 切到 /api/v1/sources
  （写操作仍走 /api/sources：v1 是只读门面，不做变更）
- 编辑弹窗改用 /api/v1/sources/{name}?reveal=credentials（admin-only）取明文 key。
  这是必须的：表单要整体回传源，若不回填 key，改个端口就会把 key 清空。
- 遮蔽视图仍是默认，只有显式 reveal 才返回明文

端到端验证（真浏览器 + 临时实例，非仅 API 测试）：
- sources/sort/keys 三页实际发出 GET /api/v1/sources，0 console error
- editSource('demo') → reveal=credentials，#s-key 与 #s-url 正确回填
- 写入往返：改 base_url /v1→/v2 后重开，key 仍在（未被清空）
- 落盘 api_key 明文残留 0、密文 1

测试：+1（reveal 必须 admin，否则任意 user key 可读全部凭据）
变异验证：reveal 去掉 admin 校验 → 403 断言变红

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/gateway/ui/index.html

@@ -2772,7 +2772,10 @@
 
       /* ---------- sources tab ---------- */
       async function renderSources() {
-        const j = await api("/api/sources");
+        // Read through /api/v1: the UI is a client of the same public API an
+        // agent uses, so there is one contract rather than a private path.
+        // The list view needs no credentials, so the masked view is enough.
+        const j = await api("/api/v1/sources");
         const rows = j.sources
           .map(
             (
@@ -2794,13 +2797,23 @@
       function editSource(name) {
         const wrap = document.createElement("div");
         wrap.id = "modal-wrap";
-        Promise.all([api("/api/sources"), api("/api/status")])
-          .then(([src, st]) => {
-            const s = src.sources.find((x) => x.name === name) || {
-              name: name,
-              models: [{ id: "", priority: 0, kind: "chat" }],
-            };
-            const cur = s.adapter || "openai";
+            // The edit dialog round-trips the whole source, so it must load the
+            // real api_key — otherwise saving an unrelated field would blank
+            // it. That is what ?reveal=credentials is for (admin-only).
+            const srcPath = name
+              ? "/api/v1/sources/" + encodeURIComponent(name) + "?reveal=credentials"
+              : "/api/v1/sources";
+            Promise.all([api(srcPath), api("/api/status")])
+              .then(([src, st]) => {
+                // Editing: the single-source shape. Creating: an empty form.
+                const s = name
+                  ? src.source
+                  : { name: "", models: [{ id: "", priority: 0, kind: "chat" }] };
+                if (!s) {
+                  toast(t("toastSave"));
+                  return;
+                }
+                const cur = s.adapter || "openai";
             const apps = ["", ...(st.adapters || []).map((a) => a.name)];
             if (cur && !apps.includes(cur)) apps.push(cur);
             const adSel =
@@ -3215,7 +3228,7 @@
       const sortLanes = { chat: [], image: [] };
       let sortStateMap = new Map();
       async function renderSort() {
-        const j = await api("/api/sources");
+        const j = await api("/api/v1/sources");
         let autoR = [];
         let autoImg = [];
         try {
@@ -4155,7 +4168,7 @@
       async function loadModelPairs() {
         let srcs = [];
         try {
-          srcs = (await api("/api/sources")).sources || [];
+          srcs = (await api("/api/v1/sources")).sources || [];
         } catch (e) {}
         const pairs = [];
         (srcs || []).forEach((s) =>