feat(contracts,db): Pi upstream contracts and pi_upstream table

- contracts/pi.ts: 41 builtin provider ids + openai-compatible + fake, auth kinds,
  upstream row/view/create/update, provider capability table (oauth modes, termsNote),
  test/models/oauth start/complete schemas
- settings.pi gains defaultUpstreamId; legacy single-upstream fields kept for fallback
- api.ts: /pi/providers, /pi/upstreams CRUD, test, models, oauth start/complete/logout
  (writes and login are console-session only)
- migration 0027: pi_upstream, agent_run.upstream_id, one-time conversion of saved
  legacy settings.pi into a default upstream

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/test/db-sync.test.ts

@@ -39,7 +39,8 @@ type Obj = z.ZodObject;
 const ROWS: Record<string, { row: Obj; dbOnly?: string[]; apiOnly?: string[] }> = {
   AcquisitionPlan: { row: C.AcquisitionPlan },
   AcquisitionSlot: { row: C.AcquisitionSlot, apiOnly: ["currentAsset"] },
-  AgentRun: { row: C.AgentRun },
+  // upstream_id 只在服务端使用(runAgent 选上游),不在 AgentRun 视图里
+  AgentRun: { row: C.AgentRun, dbOnly: ["upstreamId"] },
   AgentRunEvent: { row: C.AgentRunEventRow },
   AgentRunMessage: { row: C.AgentRunMessage },
   CapabilityInvocation: { row: C.CapabilityInvocation },
@@ -99,6 +100,8 @@ const ROWS: Record<string, { row: Obj; dbOnly?: string[]; apiOnly?: string[] }>
   SlotDeferral: { row: C.SlotDeferral },
   SlotUnit: { row: C.SlotUnit },
   SubscriptionHistory: { row: C.SubscriptionHistory },
+  // W7-A Pi 上游(0027):secret_ref 不出 API
+  PiUpstream: { row: C.PiUpstreamRow, dbOnly: ["secretRef"] },
 };
 
 /** 引擎自有表(@umt/tasks 内部使用,不经 API 暴露),不要求 Row schema */
@@ -191,6 +194,9 @@ const ENUMS: Record<string, z.ZodEnum> = {
   ReconcileRunMode: C.ReconcileMode,
   ReconcileRunStatus: C.ReconcileStatus,
   SecretPurpose: C.SecretPurpose,
+  PiUpstreamAuthKind: C.PiAuthKind,
+  PiUpstreamStatus: C.PiUpstreamStatus,
+  PiUpstreamThinkingLevel: C.PiThinkingLevel,
   ServerMappingItemType: C.ServerItemType,
   ServerMappingMatchStatus: C.ServerMatchStatus,
   SiteAdapter: C.SiteAdapter,