fix(openviking): support discovery with user-bound API keys

[Grivn]

提交 PR 前请阅读贡献指南、Contributing Guide与开发和验证指南 / Development and Verification Guide。
Before opening a PR, read the Contributing Guide, 贡献指南, and the Development and Verification Guide / 开发和验证指南.
PR 标题和提交信息必须使用 Conventional Commits（type(scope): subject），且不得包含 emoji。 / PR titles and commits must use Conventional Commits (type(scope): subject) and must not contain emoji.
本仓库接受 Bug 修复、兼容性适配、现有能力增强、性能或体验优化和维护类 PR。全新能力、Provider、持久化格式或安全边界变更必须先提 Issue 并获得维护者确认。 / This repository accepts bug fixes, compatibility work, improvements to existing capabilities, performance or UX optimization, and maintenance. New capabilities, Providers, persistence formats, or security-boundary changes require prior maintainer approval in an Issue.
外部贡献者的仅文档类 PR 不直接接受；请先提 Issue 讨论。维护者的发布说明与文档维护不受此限制。 / Documentation-only PRs from external contributors are not accepted directly; open an Issue first. Maintainer release notes and documentation maintenance are exempt.

摘要 / Summary

OpenViking 的普通 user key 无权枚举 Admin API，导致保存服务配置失败。本修复允许显式填写 discoveryUser，使用数据面只读校验同步一个用户空间，并使后续请求遵循 key 绑定的身份。

OpenViking service saves fail when a user key cannot enumerate Admin APIs. An explicit discoveryUser now validates and synchronizes one namespace through the read-only data API, and subsequent operations use the identity bound to the key.

关联 Issue 或背景 / Related Issue or Context

Fixes #271

基于 main 84d469ffa838a36fa579295d94029fcac8ac058e 的隔离工作树。已检索所有状态的相关 PR，核对 #234 的精确写入约束；未改动无关 draft #229。

Developed in an isolated checkout from main 84d469f, after checking related PRs in every state and preserving #234's exact-write contract. The unrelated draft #229 is untouched. Implementation commit: 4ed532540a6353e87be08f744934d9c51f829c5b.

涉及区域 / Affected Areas

• Host 激活、Headless 或 bundle / Host activation, Headless, or bundle
• 运行时记忆 / Runtime Memory
• 项目档案 / Project Documents
• 记忆空间或 Provider / Memory Spaces or Providers
• 子 Agent 或 Agent 工作流 / Subagent or Agent workflow
• Web UI 或对话交互 / Web UI or conversation interaction
• 设置、存储或安全 / Settings, storage, or security
• CLI、RPC、命令或工具 / CLI, RPC, commands, or tools
• 安装、更新或发布 / Installation, update, or release
• 测试、构建或文档 / Tests, build, or documentation
• 其他（请说明）/ Other (explain below)

PR 类型 / PR Type

• 面向用户的功能或行为变更 / User-facing feature or behavior change
• Bug 修复 / Bug fix
• 增强或优化 / Enhancement or optimization
• 兼容性适配 / Compatibility change
• 维护或重构 / Maintenance or refactor
• 测试或构建 / Tests or build

最新代码确认 / Latest Codebase Confirmation

• 我已基于最新 main 分支开发，或在提交前已 rebase 或合并最新 main。 / I developed from the latest main, or rebased or merged the latest main before submitting.

同步命令 / Sync command:

git fetch origin main
git merge-base --is-ancestor origin/main HEAD

AI 编码披露 / AI Coding Disclosure

• 完全 AI 编码：全部编程改动由 AI 产出，并由贡献者接受和审查。 / Fully AI-coded: AI produced all programming changes, which the contributor accepted and reviewed.
• 部分 AI 辅助：AI 帮助编写或修改了部分内容。 / Partially AI-assisted: AI helped write or modify part of the change.
• 未使用 AI 编码辅助。 / No AI coding assistance was used.

使用的 AI 模型 / AI model used: gpt-6-astra (max)

使用的编码 Agent 工具 / Coding Agent tool used: Codex

仓库规范检查 / Repository Rules

• 未修改 DSH 官方源码，未让 tsconfig 指向 DSH 源码 checkout，仅使用正式的 @deepseek-ai/* NPM 契约。 / I did not modify DSH source or point tsconfig at a DSH source checkout, and used only published @deepseek-ai/* NPM contracts.
• Client 与 Host 边界仍以浏览器安全的 src/host/protocol.ts 为准，没有在两侧重复定义 wire DTO。 / The Client and Host boundary still uses browser-safe src/host/protocol.ts as the source for wire DTOs.
• 持久化格式、RPC 权限、路径或凭据处理的变更包含兼容或拒绝路径、安全分析和相应测试。 / Changes to persistence formats, RPC authority, paths, or credentials include compatibility or rejection paths, security analysis, and tests.
• 没有提交 token、密钥、私有记忆、未脱敏日志或生成的 lib/ 文件。 / I did not commit tokens, credentials, private memory, unredacted logs, or generated lib/ files.
• 用户可见文案和长期文档已同步维护中文与英文版本，命令、配置键和路径保持一致。 / User-facing copy and long-lived documentation are synchronized in Chinese and English, with matching commands, configuration keys, and paths.
• 会改变发布制品或其元数据的 PR 已添加 changeset；仅测试、CI 或站点文档变更可不添加。 / A PR that changes a published artifact or its metadata includes a changeset; test-only, CI-only, and site-documentation-only changes may omit one.
• 新增和修改的代码、注释、文档、提交信息不含 emoji。 / New and modified code, comments, documentation, and commits contain no emoji.

兼容性与数据安全 / Compatibility and Data Safety

• 新路径必须显式提供安全的 account、discoveryUser 与 API key，使用 GET /api/v1/fs/ls 验证现有用户记忆根。字段留空保留原 admin 发现，不在失败后自动降级；拒绝、无效响应、超时或取消均不替换原服务配置。 / Explicit user-key discovery requires safe account/user identifiers and a key, then validates the existing root with fs/ls. Empty discoveryUser preserves admin discovery. No automatic fallback or health-only acceptance; failed validation leaves prior settings intact.
• 上游 api_key 模式从 key 解析身份，因此此模式不发送 trusted account/user 请求头；account 标识本地映射，不能验证或覆盖 key 所属账号。后续读取、精确写入和删除均保持该约束，并拒绝空间用户与配置不匹配。 / Data operations omit trusted identity headers because the backend binds identity to the key. The account identifies the local projection; it cannot verify or override that identity. All subsequent data operations retain the selected user scope.
• 无新 Provider、RPC 权限、wire DTO 或持久化格式；凭据继续仅留在 Host。不同 Provider 实例、Runtime 与 Documents 隔离保持。降级前清除新字段并恢复 admin 配置，或禁用服务并恢复兼容配置；发现和降级均不删除远端记忆。 / No new Provider, RPC authority, wire DTO or storage format. Credentials remain Host-owned, composed instances remain isolated, and rollback requires compatible service configuration without deleting remote data.
• 使用未修改的正式 @deepseek-ai/* npm 包；真实 WebUI 为 DSH 0.1.7-alpha.1、17 个打包 Mnemon 制品与校验过的官方 CLI 0.2.9。 / Unchanged published DSH packages only; browser validation uses DSH 0.1.7-alpha.1, 17 packed Mnemon artifacts and verified official CLI 0.2.9.

本地验证 / Local Validation

执行的命令 / Commands run:

# Node 24.20.0; pnpm 10.13.1; official Mnemon CLI 0.2.9.
export VITEST_MAX_FORKS=1 VITEST_MIN_FORKS=1
export VITEST_MAX_THREADS=1 VITEST_MIN_THREADS=1
export MNEMON_PLUGIN_VERIFY_CONCURRENCY=1
export MNEMON_NATIVE_TEST_CLI=/absolute/path/to/mnemon
pnpm run verify
# Sequentially after verify:
pnpm run verify:plugins --skip-build
pnpm run verify:docs
pnpm run release:intent
git diff --check

结果摘要 / Result summary:

完整 verify 通过：根测试 1,352 通过 / 6 跳过，16 个插件合计 402 通过 / 2 跳过；OpenViking 独立包 69 通过（含新路径 20 项）/ 1 个可选 live 测试跳过。新增真实 Host 组合回归与 2 个通用设置表单分支通过，官方 Mnemon CLI 0.2.9 的 Native Source 集成、Headless、可复现构建和公开包检查均通过。

Full verify passed: 1,352 root tests and 402 plugin tests, with 8 documented optional/platform skips. OpenViking passed 69 tests, including 20 new regressions. The composed Host, accepted/rejected generic settings form, real Native CLI, Headless, deterministic builds and public package checks passed.

顺序 verify:plugins --skip-build 通过全部 16 个独立插件、17 个 tarball、外部 SDK 消费者、真实 DSH Starter 及可选 Strategy 组合，且无工作区依赖泄漏。/ Sequential artifact verification passed all 16 independent plugins, 17 tarballs, the public SDK consumer, and real DSH Starter/optional Strategy composition without workspace links.

首次并发运行触发已有性能或 UI 超时；保留失败记录，未扩大测试时限或性能预算。根测试在独占窗口、单 Vitest worker 下完整通过。制品检查以公开 MNEMON_PLUGIN_VERIFY_CONCURRENCY=1 顺序执行。/ Initial concurrent runs hit existing timing/UI timeouts; those outcomes are retained and no timeout or budget was increased. The unchanged root suite passed in an exclusive window; artifacts use the script’s public single-package setting.

文档检查通过 1,734 个本地链接与 66 个 Markdown 锚点，双语路径及官方插件覆盖通过；changeset 覆盖 Provider 和 Memory Spaces Source 的发布输入。/ Documentation passed 1,734 local links, 66 anchors, bilingual paths and official plugin coverage; changeset coverage passed for Provider and Memory Spaces Source publication inputs.

用户可见变更证据 / Local Feature Evidence

证据 / Evidence:

完整的中英文验收记录、前后 tarball 哈希、官方 DSH 字节证明和脱敏请求记录见 English / 中文。实现为 4ed532540a6353e87be08f744934d9c51f829c5b，真实 WebUI 使用该实现对应的 17 个制品。

The bilingual record contains before/after artifact hashes, unchanged official DSH byte checks, and redacted requests. The real WebUI uses all 17 artifacts corresponding to implementation 4ed5325.

基线在 account 留空与填写后均收到 Admin access restrictions；请求分别为 accounts 与 users。/ Baseline saves fail with the account empty and filled, reaching the accounts and users Admin routes respectively.

修复后：alice 保存成功；bob 保存被拒，原 key 与唯一活动 alice 映射经持久化核验保持。拒绝后浏览与直接检索均显示 1 条原 canary，Runtime 独立写入 1 条组合 canary。最终 11 条 Provider 请求中 Admin 调用、account/user 身份请求头均为 0。

After the fix, alice saves successfully. Replacing it with bob is rejected while the original key and sole active alice projection remain persisted. Content and direct search still show one exact canary, and Runtime independently stores one composition canary. All 11 Provider requests use data APIs with zero Admin calls or account/user identity headers. See persisted-state and browser checks and real CLI composition.

验证边界 / Validation limits: OpenViking responses come from an official-contract loopback fixture. This is not a real Volcengine account, live cloud availability, semantic-model quality or cloud write-permission certification. / OpenViking 响应来自基于官方契约的回环夹具，并非真实火山云账号、在线云服务、语义模型质量或云端写权限认证。