refactor(agent): runAgent uses Agent upstreams only; deprecate legacy settings.pi fields

pi.provider / baseUrl / model / thinkingLevel / apiKeySecretRef are now
DEPRECATED_SETTINGS_FIELDS: kept in the schema for stored JSON, dropped
from PATCH /settings and from the settings sections, never read by the
server. runAgent fails with a clear message when no upstream is set.
The agent demo gate checks the default upstream provider; e2e seeds a
fake upstream as default. OpenAPI summaries say Agent upstream.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/test/pi.test.ts

@@ -58,13 +58,19 @@ describe("OAuth 请求", () => {
 });
 
 describe("settings.pi 兼容", () => {
-  it("缺省 defaultUpstreamId = null;旧字段仍可读写;PATCH 不能直接改 defaultUpstreamId", () => {
+  it("缺省 defaultUpstreamId = null;PATCH 不能直接改 defaultUpstreamId,旧字段被丢弃", () => {
     expect(C.DEFAULT_SETTINGS.pi.defaultUpstreamId).toBeNull();
     expect(C.GlobalSettings.safeParse(C.DEFAULT_SETTINGS).success).toBe(true);
     const patch = C.GlobalSettingsUpdate.parse({
-      pi: { defaultUpstreamId: "7d3f7f5e-8a8c-4b8e-9f0a-1b2c3d4e5f60", provider: "fake", contextBudget: 64_000 },
+      pi: {
+        defaultUpstreamId: "7d3f7f5e-8a8c-4b8e-9f0a-1b2c3d4e5f60",
+        provider: "fake",
+        apiKey: "sk-x",
+        model: "m",
+        contextBudget: 64_000,
+      },
     });
-    expect(patch.pi).toEqual({ provider: "fake", contextBudget: 64_000 });
+    expect(patch.pi).toEqual({ contextBudget: 64_000 });
     const current = { ...C.DEFAULT_SETTINGS, pi: { ...C.DEFAULT_SETTINGS.pi, defaultUpstreamId: "keep-me" } };
     expect(C.mergeSettings(current as never, patch).pi.defaultUpstreamId).toBe("keep-me");
   });