chore: remove dead code found in redundancy audit

- provider.truncate: zero callers (oneLineStr is the used superset)
- gateway.normalizeModel: zero callers
- config.resolvedAPIKey: zero callers (core.resolveSourceKey is the live equivalent)
- Stats.Records: zero callers (CSV export uses AuditRecords)
- store.containsString: zero callers
- Config.MaxConcurrent: global inflight-cap field never read; per-source
  MaxConcurrent is what actually drives semaphores. Legacy configs carrying a
  top-level max_concurrent key still load (yaml.v3 ignores unknown fields —
  verified by test).
- gui renderer esc(): zero callers; renderer uses textContent, and the embedded
  WebUI has its own esc()

cmd/gui/renderer/app.js

@@ -26,16 +26,6 @@ const state = {
 
 const $ = (s) => document.querySelector(s);
 
-function esc(s) {
-  return String(s == null ? "" : s).replace(
-    /[&<>"']/g,
-    (c) =>
-      ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[
-        c
-      ],
-  );
-}
-
 function toast(msg, isErr, ms) {
   const t = $("#toast");
   t.textContent = msg;

internal/config/config.go

@@ -20,7 +20,6 @@ type Config struct {
 	DefaultModel  string       `yaml:"default_model"` // e.g. "AUTO" or a model id
 	AdapterDir    string       `yaml:"adapter_dir"`
 	RuntimeFile   string       `yaml:"runtime_file"`
-	MaxConcurrent int          `yaml:"max_concurrent"`            // global inflight cap, 0 = unlimited
 	TLSCertFile   string       `yaml:"tls_cert_file,omitempty"`   // PEM cert; when set together with tls_key_file, serve HTTPS
 	TLSKeyFile    string       `yaml:"tls_key_file,omitempty"`    // PEM private key
 	PublicBaseURL string       `yaml:"public_base_url,omitempty"` // external base for generated config snippets; default inferred from request

internal/config/secret.go

@@ -128,15 +128,3 @@ func (b *SecretBox) MustDecrypt(v string) string {
 	}
 	return out
 }
-
-// resolvedAPIKey resolves a source key from api_key_env (env var) or api_key.
-func resolvedAPIKey(src Source, box *SecretBox) (string, error) {
-	if src.APIKeyEnv != "" {
-		v := os.Getenv(src.APIKeyEnv)
-		if v == "" {
-			return "", fmt.Errorf("source %s: env %s is empty or unset", src.Name, src.APIKeyEnv)
-		}
-		return v, nil
-	}
-	return box.MustDecrypt(src.APIKey), nil
-}

internal/config/store.go

@@ -186,15 +186,6 @@ func (s *Store) encryptLocked() {
 	}
 }
 
-func containsString(list []string, s string) bool {
-	for _, x := range list {
-		if x == s {
-			return true
-		}
-	}
-	return false
-}
-
 func removeString(list []string, s string) []string {
 	out := list[:0]
 	for _, x := range list {

internal/gateway/chat.go

@@ -388,13 +388,6 @@ func (g *Gateway) handleChat(w http.ResponseWriter, r *http.Request) {
 	g.singleChat(w, ctx, cands, inner, effective, rec)
 }
 
-func normalizeModel(m string) string {
-	if isAuto(m) {
-		return ""
-	}
-	return m
-}
-
 func firstModel(p *provider.Provider) string {
 	ms := p.Models()
 	if len(ms) > 0 {

internal/gateway/stats.go

@@ -380,26 +380,6 @@ type StatsRow struct {
 	Stat
 }
 
-// Records returns request records filtered by unix-millisecond time range and key.
-func (s *Stats) Records(from, to int64, key string) []Req {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	out := make([]Req, 0, len(s.recs))
-	for _, r := range s.recs {
-		if key != "" && r.Key != key {
-			continue
-		}
-		if from > 0 && r.Time < from {
-			continue
-		}
-		if to > 0 && r.Time > to {
-			continue
-		}
-		out = append(out, r)
-	}
-	return out
-}
-
 // AuditRecords returns every request row from the audit file plus its rotated
 // .old files within the [from,to] unix-millisecond window, optionally for one
 // masked key id. Unlike Records it is not bounded by the in-memory ring, so it

internal/provider/provider.go

@@ -1119,10 +1119,3 @@ func pickFirst(a, b int) int {
 	}
 	return b
 }
-
-func truncate(s string, n int) string {
-	if len(s) <= n {
-		return s
-	}
-	return s[:n] + "..."
-}