feat(studio): edit startup configuration and support ROOT restart

[yufeng201]

Description

Studio's Settings → Server configuration lets ROOT edit the actual startup ov.conf through a VLM/Embedding form or a JSON editor. Both modes share a draft and file revision; validation/save failures preserve edits. Save configuration writes the file and marks it pending restart. Save and restart saves first, then gracefully restarts a supported CLI process and waits for a new server instance before reporting success.

Configurations containing environment references are read-only in the form and editable in file mode. File validation expands the original text using the startup semantics; saves write the submitted text without parsing and serializing it. Quoted/unquoted references, string escapes, BOM and formatting remain intact. Dollar literals also use file mode to avoid introducing new environment references during form serialization.

Human Involvement

• A human participated in the implementation or review loop
• This PR was generated entirely by AI agents without human participation in the loop

Related Issue

None linked.

Type of Change

• New feature (non-breaking change that adds functionality)
• Documentation update
• Test update

Changes Made

• ROOT-only startup-file reads, preview and revision-checked saves through the existing admin configuration API. Validate OpenViking/Server schemas before atomic replacement with a private backup.
• Keep one shared draft across forms and a lazily loaded CodeMirror JSON editor. Preserve typing/undo across controlled updates and temporary read-only states. Embedding identity/dimension/input stay protected in the form; file mode edits the entire document.
• Return form_readonly for files containing dollars or escaped dollars, omit expanded model form data, and reject form patches for these files. Remove environment placeholder serialization, recursive reference restoration, credential reference tracking and resolved-provider mappings.
• Expose shared VLM thinking policy for literal configurations and Preferred/Backup badges based on credential array order. Existing legacy configuration objects remain supported.
• Reuse the ROOT-only configuration-file response for restart capability and instance identity. POST /api/v1/admin/restart accepts the saved revision, rejects stale/invalid files, serializes acceptance with Studio saves, and blocks saves after restart acceptance.
• Single-worker CLI processes return HTTP 202, drain Uvicorn, stop their managed Bot, then replace the process with the original interpreter, arguments, environment and working directory. Multi-worker and embedded ASGI launch modes report restart unsupported.
• Studio blocks edits during restart and waits for a different service instance. Saved state survives restart failure, and users can retry without saving again. Account/Cluster overrides continue to apply.
• Update English/Chinese API and server configuration documentation for the form/file boundary.

Testing

Validation for 604ffb864:

• Frontend settings/editor and configuration API suites: 49 passed.
• Backend configuration-file, bootstrap and selected configuration/restart admin contracts: 63 passed. Bootstrap/admin tests used an isolated temporary startup configuration.
• Scoped ESLint with zero warnings, Ruff checks/format checks and git diff --check passed.
• Production Web Studio build with /studio/ base passed; the existing large-chunk advisory remains.
• Regression coverage includes quoted/unquoted environment values, object credentials, Thinking references, references outside model sections, escaped literal dollars, BOM/format preservation, form-patch rejection, legacy backup bindings and private backups.

Existing dependency/deprecation and React test-environment warnings remain. Whole-project TypeScript validation and live browser/deployment validation were not rerun for this simplification.

Checklist

• Changes follow the project's coding style
• Reviewed the final change scope
• Corresponding documentation updated
• All whole-project checks pass

Additional Notes

Keep Draft. Full-file validation reuses existing schemas; external dependencies or plugin startup checks can still prevent recovery. Studio reports failure if it cannot confirm restart before its timeout. Address/port/ROOT-key changes require updating connection settings. The advisory lock coordinates Studio writers; unmanaged external editors can still race after the final check. Remote restart currently requires the single-worker CLI; other launch modes require the deployment platform.

[ZaynJarvis]

LGTM. Approving per maintainer request; merging once integration tests are green.