Isolate cloud model access before enabling product RAG workflows

The API and ingestion tools now use a fixed internal model gateway while
governed profiles, embedding cache assignments, traceable citations, and
stable API errors establish the boundaries required by later workflows.

Constraint: The current Alibaba Cloud workspace rejects all three live model calls with authentication failures
Rejected: Give the API or seed tools the Bailian key and direct egress | combines database access, cloud credentials, and public network access
Rejected: Mix offline and Bailian vectors in one demo namespace | makes profile activation and retrieval ambiguous
Confidence: high
Scope-risk: moderate
Reversibility: clean
Directive: Keep Bailian credentials and egress exclusive to model-gateway and create a new immutable profile hash for any embedding identity change
Tested: make verify; 121 backend tests; 14 frontend tests; fresh and populated Alembic upgrade-downgrade-upgrade; two idempotent offline seeds; Docker health and HTTP retrieval; isolated provider smoke
Not-tested: Successful live Bailian responses because the supplied workspace credential currently fails authentication

backend/app/core/request_context.py

@@ -0,0 +1,30 @@
+"""Per-request trace context with a bounded, non-secret public identifier."""
+
+from __future__ import annotations
+
+import uuid
+from collections.abc import Awaitable, Callable
+
+from fastapi import Request, Response
+
+REQUEST_ID_HEADER = "x-request-id"
+type CallNext = Callable[[Request], Awaitable[Response]]
+
+
+def _request_id(value: str | None) -> str:
+    if value is not None:
+        try:
+            return str(uuid.UUID(value))
+        except (ValueError, AttributeError):
+            pass
+    return str(uuid.uuid4())
+
+
+async def trace_request(request: Request, call_next: CallNext) -> Response:
+    """Attach a UUID trace ID and return it without trusting arbitrary input."""
+
+    trace_id = _request_id(request.headers.get(REQUEST_ID_HEADER))
+    request.state.trace_id = trace_id
+    response = await call_next(request)
+    response.headers[REQUEST_ID_HEADER] = trace_id
+    return response