Isolate cloud model access before enabling product RAG workflows

The API and ingestion tools now use a fixed internal model gateway while
governed profiles, embedding cache assignments, traceable citations, and
stable API errors establish the boundaries required by later workflows.

Constraint: The current Alibaba Cloud workspace rejects all three live model calls with authentication failures
Rejected: Give the API or seed tools the Bailian key and direct egress | combines database access, cloud credentials, and public network access
Rejected: Mix offline and Bailian vectors in one demo namespace | makes profile activation and retrieval ambiguous
Confidence: high
Scope-risk: moderate
Reversibility: clean
Directive: Keep Bailian credentials and egress exclusive to model-gateway and create a new immutable profile hash for any embedding identity change
Tested: make verify; 121 backend tests; 14 frontend tests; fresh and populated Alembic upgrade-downgrade-upgrade; two idempotent offline seeds; Docker health and HTTP retrieval; isolated provider smoke
Not-tested: Successful live Bailian responses because the supplied workspace credential currently fails authentication

backend/tests/unit/test_config_and_secrets.py

@@ -46,6 +46,27 @@ def test_base_urls_drop_trailing_slashes() -> None:
     assert settings.bailian_rerank_base_url.endswith("/v1")
 
 
+def test_model_gateway_url_is_fixed_to_internal_service() -> None:
+    settings = Settings(model_gateway_base_url="http://model-gateway:8000/")
+
+    assert settings.model_gateway_base_url == "http://model-gateway:8000"
+
+
+@pytest.mark.parametrize(
+    "value",
+    [
+        "https://model-gateway:8000",
+        "http://model-gateway:9000",
+        "http://127.0.0.1:8000",
+        "http://model-gateway:8000/proxy",
+        "http://user:model-token@model-gateway:8000",
+    ],
+)
+def test_model_gateway_url_rejects_ssrf_and_credential_variants(value: str) -> None:
+    with pytest.raises(ValueError, match="fixed internal service URL"):
+        Settings(model_gateway_base_url=value)
+
+
 def test_embedding_dimension_accepts_compose_string(monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setenv("EMBEDDING_DIMENSION", "1024")