feat: WebUI 改为依赖 /api/v1，UI 与 agent 共用一套 API 契约

- sources / sort / keys 三个页面的数据源从 /api/sources 切到 /api/v1/sources
  （写操作仍走 /api/sources：v1 是只读门面，不做变更）
- 编辑弹窗改用 /api/v1/sources/{name}?reveal=credentials（admin-only）取明文 key。
  这是必须的：表单要整体回传源，若不回填 key，改个端口就会把 key 清空。
- 遮蔽视图仍是默认，只有显式 reveal 才返回明文

端到端验证（真浏览器 + 临时实例，非仅 API 测试）：
- sources/sort/keys 三页实际发出 GET /api/v1/sources，0 console error
- editSource('demo') → reveal=credentials，#s-key 与 #s-url 正确回填
- 写入往返：改 base_url /v1→/v2 后重开，key 仍在（未被清空）
- 落盘 api_key 明文残留 0、密文 1

测试：+1（reveal 必须 admin，否则任意 user key 可读全部凭据）
变异验证：reveal 去掉 admin 校验 → 403 断言变红

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(cherry picked from commit 926b9f6565)

internal/gateway/apiv1_test.go

@@ -271,3 +271,29 @@ func serveViaHandler(t *testing.T, g *Gateway, req *http.Request) *httptest.Resp
 	g.Handler().ServeHTTP(rec, req)
 	return rec
 }
+
+// TestAPIV1RevealRequiresAdmin: the only way to read a key in the clear is the
+// explicit admin-only reveal. Without the role check this endpoint would hand
+// every source credential to any valid (even user-scoped) key.
+func TestAPIV1RevealRequiresAdmin(t *testing.T) {
+	g, _, user := v1Gateway(t)
+	rec := serveViaHandler(t, g, newAuthedRequest(t, http.MethodGet, "/api/v1/sources/up?reveal=credentials", user))
+	if rec.Code != http.StatusForbidden {
+		t.Errorf("user reveal = %d, want 403: %s", rec.Code, rec.Body.String())
+	}
+	if strings.Contains(rec.Body.String(), "sk-up-secret") {
+		t.Error("a forbidden reveal still leaked the key")
+	}
+	rec = doReq(t, g, http.MethodGet, "/api/v1/sources/up?reveal=credentials", "")
+	if rec.Code != http.StatusOK {
+		t.Fatalf("admin reveal = %d: %s", rec.Code, rec.Body.String())
+	}
+	if !strings.Contains(rec.Body.String(), "sk-up-secret") {
+		t.Error("admin reveal should return the key in the clear (the edit form needs it)")
+	}
+	// The masked default view must still hide it on the same path.
+	rec = doReq(t, g, http.MethodGet, "/api/v1/sources/up", "")
+	if strings.Contains(rec.Body.String(), "sk-up-secret") {
+		t.Error("the default view leaked the key")
+	}
+}