fix(config): recover startup from incompatible model settings

[wsp1911]

Summary

• Make BitFun configuration loading capability-aware.
• Repair or isolate recoverable model configuration issues during startup.
• Add atomic cloud speech configuration persistence.
• Add structured diagnostics and a reusable standalone configuration loader.

Fixes #

Type and Areas

Type:

Regression fix / bug fix

Areas:

Rust core, desktop/Tauri, App Server protocol/client, Web UI, services-core, configuration tooling

Motivation / Impact

The configuration manager previously validated every configured model as a text-generation model.

A pure speech-recognition model (Qwen ASR) contained:

• ai.models[19].context_window = 0
• ai.models[19].max_tokens = 0

This caused global configuration initialization to fail before the Desktop window was created, making the application appear unable to start.

This change:

• Treats text-generation fields as capability-specific.
• Removes inapplicable generation fields from speech, image, and embedding models.
• Keeps mixed text-plus-speech models subject to text-generation validation.
• Disables only individually invalid recoverable models instead of rejecting the entire configuration.
• Repairs invalid primary, fast, function-agent, subagent, and capability-slot references.
• Backs up the original configuration before automatic repair.
• Uses in-memory defaults for malformed JSON or unrecoverable configuration shapes without overwriting the original file.
• Persists configuration through strict atomic replacement.
• Shows a startup recovery warning after the Web UI becomes interactive.
• Saves cloud speech model data, the speech default slot, and voice-input settings in a single atomic mutation, avoiding intermediate invalid states.

Verification

Passed:

• cargo test -p bitfun-core --no-default-features --lib service::config — 77 passed
• cargo test -p bitfun-desktop --lib — 240 passed
• cargo check -p bitfun-desktop
• cargo test -p bitfun-app-server
• cargo test -p bitfun-app-server-protocol
• cargo test -p bitfun-app-server-client
• cargo test -p bitfun-services-core --no-default-features --features json-io --lib json_store
• pnpm run type-check:web
• pnpm --dir src/web-ui exec vitest run src/infrastructure/api/service-api/ConfigAPI.test.ts src/infrastructure/api/adapters/websocket-adapter.test.ts — 26 passed
• pnpm run i18n:audit
• pnpm run check:core-boundaries
• pnpm run check:core-boundaries:test
• pnpm run check:repo-hygiene
• git diff --check

Real configuration verification:

• The standalone loader analyzed the affected configuration without printing credentials.
• Result: 25 configured models, 25 enabled models, 3 recoverable changes, semantic validation valid.
• Reported fields:
  • ai.models[19].context_window
  • ai.models[19].max_tokens
• The repaired copy was rechecked successfully with zero remaining changes.
• The original user configuration was not modified.

Interactive UI validation was not performed, in accordance with the repository instructions.

Reviewer Notes

• The original startup evidence is preserved in early-startup.log.
• Configuration schema versioning is independent from the BitFun application version.
• Reasoning-schema errors remain hard failures because they represent runtime contract violations.
• Automatic recovery writes backups under the configuration backup directory.
• The standalone loader is located at E:/Projects/OpenBitFun/bitfun-config-loader.
• No credentials or configuration values are emitted by the loader diagnostics.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above.
• User-facing strings, docs, and locales are updated where applicable.