feat(delete): real deletes — adapters seeded once into adapter_dir (existing dir is authoritative), sources removed from config.yaml on delete; drop tombstone mechanism for both. Docs: multi-key architecture, gateway_keys as seed

internal/config/config_test.go

@@ -196,4 +196,53 @@ func TestSecretBoxRoundTrip(t *testing.T) {
 	if _, err := bad.Decrypt(v); err == nil {
 		t.Fatal("expected decrypt failure with wrong key")
 	}
-}
+}
+func TestRemoveSourceFromYAML(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "cfg.yaml")
+	content := `
+listen: 127.0.0.1:9999
+gateway_keys: [sk-1]
+default_model: AUTO
+adapter_dir: adapters
+runtime_file: runtime.json
+sources:
+  - name: deepseek
+    base_url: https://api.deepseek.com
+    api_key: sk-d
+    adapter: deepseek
+    models:
+      - id: deepseek-v4-flash
+  - name: ollama
+    base_url: http://127.0.0.1:11434
+    adapter: ollama
+    models:
+      - id: llama3
+`
+	if err := os.WriteFile(path, []byte(content), 0644); err != nil {
+		t.Fatal(err)
+	}
+	if err := RemoveSourceFromYAML(path, "deepseek"); err != nil {
+		t.Fatalf("remove: %v", err)
+	}
+	reloaded, err := Load(path)
+	if err != nil {
+		t.Fatalf("reload: %v", err)
+	}
+	if len(reloaded.Sources) != 1 {
+		t.Fatalf("sources = %d, want 1", len(reloaded.Sources))
+	}
+	if reloaded.Sources[0].Name != "ollama" {
+		t.Fatalf("remaining = %q, want ollama", reloaded.Sources[0].Name)
+	}
+	if reloaded.Sources[0].Models[0].ID != "llama3" {
+		t.Fatalf("remaining models broken: %+v", reloaded.Sources[0].Models)
+	}
+	// removing a non-existent name is a no-op that keeps the file valid
+	if err := RemoveSourceFromYAML(path, "nope"); err != nil {
+		t.Fatalf("remove missing: %v", err)
+	}
+	if cfg, err := Load(path); err != nil || len(cfg.Sources) != 1 {
+		t.Fatalf("after no-op: %v %v", len(cfg.Sources), err)
+	}
+}