重构: 后端 df-ai/commands 拆分+df-nodes/workflow 改造+P0 bug 修复

- df-ai: context 历史中毒三档自愈 sanitize_messages(AC3)+anthropic_compat tool_use_id None 跳过(AC1/AC2)+删 router/stream 死码
- df-core: events 加 select_type+decisions 多选审批契约(F-260615-01)
- df-execute: shell run_command 工具复用(F-260615-05)
- df-nodes: human_node 多选校验+2 端到端测(F-01)+取消跳 set_failed(B-03b-R1/R2/R8)
- df-workflow: executor/dag/state cancel 闭环(B-06/07/03a/b)+provider approve options(R-PD-5)
- df-storage: find_path_conflict 抽公共(R-PD-11)+COLS 常量断言
- df-ideas: 删 IdeaPromoter/PromotionPolicy 死码(R-PD-14)
- src-tauri/commands/ai: secret keyring 迁移(FR-S1/R-PD-4)+GeneratingGuard RAII+disarm(B-09/26)+newConversation 软复位(B-10)+stream 心跳/stop select/空回复判错(B-02/04/05/15)+run_command(F-05)+mask audit(AR-3)
- src-tauri/commands/{project,task,workflow,mod,lib,state}: task detail IPC(F-02)+approve decisions+task list 联动(B-29)
- Cargo.lock+Cargo.toml 依赖同步

src-tauri/src/commands/ai/knowledge_inject.rs

@@ -29,10 +29,15 @@ async fn resolve_embed_provider(
             return None;
         }
     };
-    Some((
-        df_ai::build_provider(&rec.provider_type, &rec.base_url, &rec.api_key, &rec.default_model),
-        model,
-    ))
+    // build_provider_for 含空 key 早失败:Err → 返回 None 触发 LIKE 降级(与原 embed 失败降级行为一致)
+    let provider = match super::secret::build_provider_for(&rec) {
+        Ok(p) => p,
+        Err(e) => {
+            tracing::warn!("embedding provider 密钥不可用(降级 LIKE): {}", e);
+            return None;
+        }
+    };
+    Some((provider, model))
 }
 
 /// 生成文本嵌入(向量检索用)
@@ -317,12 +322,11 @@ async fn extract_knowledge_from_conversation(
         tool_choice: None,
     };
 
-    let provider: Box<dyn LlmProvider> = df_ai::build_provider(
-        &provider_config.provider_type,
-        &provider_config.base_url,
-        &provider_config.api_key,
-        &provider_config.default_model,
-    );
+    let provider: Box<dyn LlmProvider> = match super::secret::build_provider_for(provider_config) {
+        Ok(p) => p,
+        // 空 key 早失败:上层(maybe_spawn_extraction/trigger_extraction_now)已 warn log 降级,语义一致
+        Err(e) => return Err(anyhow::anyhow!("provider 密钥不可用: {}", e)),
+    };
     // LLM 并发限流（知识提炼属独立调用，纳入双层 Semaphore）
     let _global_permit = llm_concurrency.acquire_global().await;
     let _per_conv_permit = llm_concurrency.acquire_per_conv().await;