Isolate cloud model access before enabling product RAG workflows

The API and ingestion tools now use a fixed internal model gateway while
governed profiles, embedding cache assignments, traceable citations, and
stable API errors establish the boundaries required by later workflows.

Constraint: The current Alibaba Cloud workspace rejects all three live model calls with authentication failures
Rejected: Give the API or seed tools the Bailian key and direct egress | combines database access, cloud credentials, and public network access
Rejected: Mix offline and Bailian vectors in one demo namespace | makes profile activation and retrieval ambiguous
Confidence: high
Scope-risk: moderate
Reversibility: clean
Directive: Keep Bailian credentials and egress exclusive to model-gateway and create a new immutable profile hash for any embedding identity change
Tested: make verify; 121 backend tests; 14 frontend tests; fresh and populated Alembic upgrade-downgrade-upgrade; two idempotent offline seeds; Docker health and HTTP retrieval; isolated provider smoke
Not-tested: Successful live Bailian responses because the supplied workspace credential currently fails authentication

scripts/init-local-secrets.sh

@@ -21,6 +21,8 @@ generate_secret() {
 generate_secret postgres_bootstrap_password
 generate_secret postgres_migrator_password
 generate_secret postgres_app_password
+generate_secret model_gateway_api_token
+generate_secret model_gateway_worker_token
 
 if [[ "${1:-}" == "--with-bailian" ]]; then
   bailian_path="$secret_dir/bailian_api_key"
@@ -41,5 +43,9 @@ if [[ "${1:-}" == "--with-bailian" ]]; then
   unset bailian_key
   printf 'Created local Bailian secret without echoing its value: %s\n' "$bailian_path"
 else
-  printf 'Bailian key not created. Rotate the exposed key, then rerun with --with-bailian.\n'
+  if [[ -s "$secret_dir/bailian_api_key" ]]; then
+    printf 'Existing local Bailian secret was not modified.\n'
+  else
+    printf 'Bailian key not created. Rotate the exposed key, then rerun with --with-bailian.\n'
+  fi
 fi