chore: remove dead code found in redundancy audit

- provider.truncate: zero callers (oneLineStr is the used superset)
- gateway.normalizeModel: zero callers
- config.resolvedAPIKey: zero callers (core.resolveSourceKey is the live equivalent)
- Stats.Records: zero callers (CSV export uses AuditRecords)
- store.containsString: zero callers
- Config.MaxConcurrent: global inflight-cap field never read; per-source
  MaxConcurrent is what actually drives semaphores. Legacy configs carrying a
  top-level max_concurrent key still load (yaml.v3 ignores unknown fields —
  verified by test).
- gui renderer esc(): zero callers; renderer uses textContent, and the embedded
  WebUI has its own esc()

internal/gateway/chat.go

@@ -388,13 +388,6 @@ func (g *Gateway) handleChat(w http.ResponseWriter, r *http.Request) {
 	g.singleChat(w, ctx, cands, inner, effective, rec)
 }
 
-func normalizeModel(m string) string {
-	if isAuto(m) {
-		return ""
-	}
-	return m
-}
-
 func firstModel(p *provider.Provider) string {
 	ms := p.Models()
 	if len(ms) > 0 {

internal/gateway/stats.go

@@ -380,26 +380,6 @@ type StatsRow struct {
 	Stat
 }
 
-// Records returns request records filtered by unix-millisecond time range and key.
-func (s *Stats) Records(from, to int64, key string) []Req {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	out := make([]Req, 0, len(s.recs))
-	for _, r := range s.recs {
-		if key != "" && r.Key != key {
-			continue
-		}
-		if from > 0 && r.Time < from {
-			continue
-		}
-		if to > 0 && r.Time > to {
-			continue
-		}
-		out = append(out, r)
-	}
-	return out
-}
-
 // AuditRecords returns every request row from the audit file plus its rotated
 // .old files within the [from,to] unix-millisecond window, optionally for one
 // masked key id. Unlike Records it is not bounded by the in-memory ring, so it