release: bump version to 0.50.0

docs/technical/en/agents-aiprovider.md

@@ -23,11 +23,12 @@ The recommended default is:
 - business-level request shaping
 - stable `/api/v1/ai/...` endpoints
 - internal service-to-service authentication toward `aiprovider`
+- reading the default provider, model, and per-provider keys saved in Settings, then overriding `aiprovider` `.env` defaults through internal headers
 
 `aiprovider` is responsible for:
 
 - model protocol adaptation
-- provider selection by `.env`
+- provider selection by `.env` when no backend override headers are present
 - timeout and lightweight retry
 - request tracing via `X-Request-ID`
 
@@ -85,6 +86,18 @@ Optional tracing header:
 
 The backend will propagate `X-Request-ID` to `aiprovider` and return the same header in the response.
 
+### Settings API
+
+The AI settings page uses:
+
+- `GET /api/v1/settings/integrations`
+- `PUT /api/v1/settings/integrations`
+- `POST /api/v1/settings/integrations/ai-provider/connect`
+- `GET /api/v1/settings/integrations/ai-provider/secrets`
+- `GET /api/v1/settings/integrations/ai-provider/presets`
+
+These endpoints require an authenticated user. The `secrets` endpoint is only used when the settings page reveals a key or token; hiding the field restores the masked preview.
+
 ### AI provider internal API
 
 Internal-only endpoints:
@@ -172,6 +185,75 @@ Both services also return:
 
 ## Configuration
 
+### Runtime Configuration Flow
+
+The backend Settings system owns the global LLM default. The runtime flow is:
+
+1. Frontend or application code calls a `backend` `/api/v1/ai/...` endpoint.
+2. `backend` reads `category = external_integrations` from the PostgreSQL `system_settings` table.
+3. `payload.ai_provider.default_provider` selects the active provider.
+4. `payload.ai_provider.providers[provider]` supplies that provider's `api_key`, `provider_api`, `base_url`, `model`, `max_tokens`, and `anthropic_version`.
+5. `backend` converts those values to internal headers such as `X-AI-Provider`, `X-AI-Provider-API`, `X-AI-Base-URL`, `X-AI-API-Key`, and `X-AI-Model`.
+6. `aiprovider` uses those headers to override its `.env` defaults before calling the real model vendor.
+
+After the AI settings page saves a new default provider/model/key, Playground, alert briefs, datasource mapping generation, and other backend AI calls all use that same default.
+
+#### Persistence Shape
+
+AI settings are persisted in PostgreSQL, not a JSON file. The core payload shape is:
+
+```json
+{
+  "ai_provider": {
+    "service_url": "http://localhost:8010",
+    "service_token": "",
+    "default_provider": "openai",
+    "providers": {
+      "openai": {
+        "provider_api": "openai-completions",
+        "base_url": "https://api.openai.com/v1",
+        "model": "gpt-5.1",
+        "api_key": "<saved secret>",
+        "max_tokens": 4096,
+        "anthropic_version": "2023-06-01"
+      },
+      "minimax": {
+        "provider_api": "anthropic-messages",
+        "base_url": "https://api.minimaxi.com/anthropic",
+        "model": "MiniMax-M2.7",
+        "api_key": "<saved secret>",
+        "max_tokens": 1200,
+        "anthropic_version": "2023-06-01"
+      }
+    },
+    "timeout_seconds": 60,
+    "retry_attempts": 2
+  }
+}
+```
+
+Legacy single-slot settings are mapped to `providers[provider]` on read and are written back in the new shape on save.
+
+#### Key Fallback
+
+Each provider has its own key slot. Resolution order is:
+
+1. `providers[provider].api_key` in PostgreSQL
+2. the provider-specific variable in `aiprovider/.env`, such as `OPENAI_API_KEY`, `MINIMAX_API_KEY`, or `ANTHROPIC_API_KEY`
+3. the generic `AI_API_KEY` in `aiprovider/.env`
+
+`.env` is only a fallback. After the settings page saves successfully, or after the connection test succeeds, PostgreSQL becomes the global default source.
+
+#### Settings Page Behavior
+
+- The Provider select controls the global default provider.
+- The model select saves the default model for the selected provider.
+- The LLM API Key field shows a masked preview while hidden; keys with a `-` prefix keep the prefix, for example `sk-********`, and keys without a prefix are fully masked.
+- Clicking the eye icon fetches and displays the full plaintext value; hiding restores the masked preview.
+- `Save AI Configuration` saves the current form as the global default.
+- `Test Connection` uses the current form for a real model-chain test, then saves it as the global default only when the test succeeds.
+- Leaving a key field empty keeps the old key; it does not delete it.
+
 ### Backend
 
 Recommended backend `.env`:
@@ -208,6 +290,18 @@ AI_HTTP_RETRY_ATTEMPTS=2
 AI_ANALYSIS_SYSTEM_PROMPT=你是态势感知分析助手。请基于输入的上下文、观测与约束，输出结构化、克制、可执行的分析。
 ```
 
+Optional provider-specific keys:
+
+```env
+MINIMAX_API_KEY=sk-cp-xxxxx
+OPENAI_API_KEY=sk-xxxxx
+ANTHROPIC_API_KEY=sk-ant-xxxxx
+DEEPSEEK_API_KEY=sk-xxxxx
+DASHSCOPE_API_KEY=sk-xxxxx
+MOONSHOT_API_KEY=sk-xxxxx
+OPENROUTER_API_KEY=sk-or-xxxxx
+```
+
 ### OpenAI-compatible example
 
 ```env