feat: config.yaml only, OpenRouter free models, remove runtime.json config

- Move all config (auto rules, keys) from runtime.json to config.yaml
- Store now only holds runtime sources (WebUI-created)
- Add OpenRouter free models to config.yaml
- One-time migration from legacy runtime.json on startup
- Fix gateway tests for new config structure
- Update core.go with migrateFromRuntime, saveConfig, seedKeys/seedAuto
- Remove SaveKey/KeyByValue/AutoRules from Store
- Add Config.Save() with YAML marshaling
- Update WebUI admin keys visibility (show all keys including admin)
- Bump binary to 11MB with luajit

internal/gateway/gateway_test.go

@@ -37,9 +37,13 @@ func mockUpstream() *httptest.Server {
 
 func newTestGateway(t *testing.T, srcs ...config.Source) *Gateway {
 	t.Helper()
+	td := t.TempDir()
+	cfgPath := filepath.Join(td, "config.yaml")
+	os.WriteFile(cfgPath, []byte("listen: :0"), 0644)
 	cfg := &config.Config{
-		AdapterDir:  filepath.Join(t.TempDir(), "adapters"),
-		RuntimeFile: filepath.Join(t.TempDir(), "runtime.json"),
+		Path:        cfgPath,
+		AdapterDir:  filepath.Join(td, "adapters"),
+		RuntimeFile: filepath.Join(td, "runtime.json"),
 		GatewayKeys: []string{"sk-test"},
 		Sources:     srcs,
 	}
@@ -543,9 +547,9 @@ func TestSourcesAPIAddAndPersist(t *testing.T) {
 	if !strings.Contains(rr.Body.String(), "new-m") {
 		t.Fatalf("new model not live: %s", rr.Body.String())
 	}
-	// verify persistence file exists
-	if _, err := os.Stat(g.core.Config().RuntimeFile); err != nil {
-		t.Fatalf("runtime file not written: %v", err)
+	// verify source persisted to config.yaml
+	if _, err := os.Stat(g.core.Config().Path); err != nil {
+		t.Fatalf("config file not written: %v", err)
 	}
 }