feat: WebUI 改为依赖 /api/v1，UI 与 agent 共用一套 API 契约

- sources / sort / keys 三个页面的数据源从 /api/sources 切到 /api/v1/sources
  （写操作仍走 /api/sources：v1 是只读门面，不做变更）
- 编辑弹窗改用 /api/v1/sources/{name}?reveal=credentials（admin-only）取明文 key。
  这是必须的：表单要整体回传源，若不回填 key，改个端口就会把 key 清空。
- 遮蔽视图仍是默认，只有显式 reveal 才返回明文

端到端验证（真浏览器 + 临时实例，非仅 API 测试）：
- sources/sort/keys 三页实际发出 GET /api/v1/sources，0 console error
- editSource('demo') → reveal=credentials，#s-key 与 #s-url 正确回填
- 写入往返：改 base_url /v1→/v2 后重开，key 仍在（未被清空）
- 落盘 api_key 明文残留 0、密文 1

测试：+1（reveal 必须 admin，否则任意 user key 可读全部凭据）
变异验证：reveal 去掉 admin 校验 → 403 断言变红

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(cherry picked from commit 926b9f6565)

internal/gateway/apiv1.go

@@ -68,6 +68,19 @@ func (g *Gateway) apiV1Routes(w http.ResponseWriter, r *http.Request) {
 		}
 		for _, s := range g.core.Sources() {
 			if s.Name == name {
+				// ?reveal=credentials is admin-only and is what the Web UI's
+				// edit dialog uses: a form that round-trips a source must be
+				// able to show the current key, otherwise saving an unrelated
+				// field would blank it. Everything else stays masked.
+				if r.URL.Query().Get("reveal") == "credentials" {
+					if reqRole(r.Context()) != "admin" {
+						writeError(w, http.StatusForbidden, "forbidden",
+							"admin role required to reveal credentials")
+						return
+					}
+					writeJSON(w, http.StatusOK, map[string]interface{}{"source": s})
+					return
+				}
 				writeJSON(w, http.StatusOK, map[string]interface{}{"source": maskSource(s)})
 				return
 			}
@@ -176,6 +189,9 @@ func (g *Gateway) apiV1Index(w http.ResponseWriter, r *http.Request) {
 			"path_escape":  "URL-encode source and key names; {name} is a single path segment",
 			"idempotency":  "POST /api/sources and PUT /api/sources/{name} both upsert by name",
 			"config_truth": "all configuration lives in config.yaml; API writes are persisted immediately",
+			"credentials": "credentials are masked by default. GET /api/v1/sources/{name}?reveal=credentials " +
+				"returns them in the clear and is admin-only — the Web UI edit dialog uses it, because a form " +
+				"that round-trips a source must show the current key or saving another field would blank it.",
 		},
 	}
 	writeJSON(w, http.StatusOK, index)