chore: remove dead code found in redundancy audit

- provider.truncate: zero callers (oneLineStr is the used superset)
- gateway.normalizeModel: zero callers
- config.resolvedAPIKey: zero callers (core.resolveSourceKey is the live equivalent)
- Stats.Records: zero callers (CSV export uses AuditRecords)
- store.containsString: zero callers
- Config.MaxConcurrent: global inflight-cap field never read; per-source
  MaxConcurrent is what actually drives semaphores. Legacy configs carrying a
  top-level max_concurrent key still load (yaml.v3 ignores unknown fields —
  verified by test).
- gui renderer esc(): zero callers; renderer uses textContent, and the embedded
  WebUI has its own esc()

internal/config/config.go

@@ -20,7 +20,6 @@ type Config struct {
 	DefaultModel  string       `yaml:"default_model"` // e.g. "AUTO" or a model id
 	AdapterDir    string       `yaml:"adapter_dir"`
 	RuntimeFile   string       `yaml:"runtime_file"`
-	MaxConcurrent int          `yaml:"max_concurrent"`            // global inflight cap, 0 = unlimited
 	TLSCertFile   string       `yaml:"tls_cert_file,omitempty"`   // PEM cert; when set together with tls_key_file, serve HTTPS
 	TLSKeyFile    string       `yaml:"tls_key_file,omitempty"`    // PEM private key
 	PublicBaseURL string       `yaml:"public_base_url,omitempty"` // external base for generated config snippets; default inferred from request