feat(admin): configure model providers from database

deploy/README.md

@@ -85,20 +85,14 @@ EPAY_CHAT_ENABLED=false
 # Fixed birth-time rectification fee shown by the account UI.
 RECTIFICATION_PRICE_CREDITS=3
 
-# Recommended multi-model catalog. The JSON references server-only keys.
-LLM_DEFAULT_MODEL_ID=deepseek-pro
-LLM_MODELS_JSON='[{"id":"deepseek-pro","label":"DeepSeek V4 Pro","description":"更适合复杂分析","provider":"openai-compatible","baseURL":"https://api.deepseek.com","apiKeyEnv":"DEEPSEEK_API_KEY","model":"deepseek-v4-pro","creditCost":1},{"id":"gpt-5-mini","label":"ChatGPT 5 Mini","description":"响应稳定、速度均衡","provider":"openai","apiKeyEnv":"OPENAI_API_KEY","model":"openai/gpt-5-mini","creditCost":1}]'
-DEEPSEEK_API_KEY=<server-secret>
-OPENAI_API_KEY=<server-secret>
+# Required to encrypt/decrypt model-provider API keys stored in the admin database.
+# Base64 decoding must produce exactly 32 random bytes; do not reuse other keys.
+MODEL_PROVIDER_CONFIG_ENCRYPTION_KEY=<independent-base64-encoded-32-byte-key>
+# OpenAI-compatible origins must be explicitly server-allowlisted.
+# MODEL_PROVIDER_BASE_URL_ALLOWLIST=https://api.deepseek.com
 
-# Legacy single-model OpenAI configuration remains supported:
-# OPENAI_API_KEY=<server-secret>
-# MASTRA_MODEL=openai/gpt-5-mini
-
-# Legacy single OpenAI-compatible provider remains supported:
-# LLM_BASE_URL=https://provider.example/v1
-# LLM_API_KEY=<server-secret>
-# LLM_MODEL=provider-model-id
+# The admin database model catalog is the only runtime model/provider source.
+# Provider API keys are entered in the admin UI and are never read from provider env vars.
 
 # Required VedAstro server-side upstream for chart creation and rectification:
 VEDASTRO_GATEWAY_MODE=official_first