feat(gateway): 补齐桌面端高级媒体直连接口

新增图片矢量化、视频超分、每日用量、计价与任务隔离能力，并通过环境变量解析平台凭据。

已通过 Go 全量门禁、迁移检查、镜像构建以及 Vectorizer 五格式和 Topaz 3 秒视频真实 DEV 验收。

apps/api/internal/runner/credential_env_test.go

@@ -0,0 +1,32 @@
+package runner
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/easyai/easyai-ai-gateway/apps/api/internal/store"
+)
+
+func TestCandidateWithEnvironmentCredentialsResolvesNamesAtRuntime(t *testing.T) {
+	t.Setenv("TEST_GATEWAY_PROVIDER_SECRET", "secret-value")
+	candidate, err := candidateWithEnvironmentCredentials(store.RuntimeModelCandidate{
+		Credentials: map[string]any{"safe": "existing"},
+		PlatformConfig: map[string]any{"credentialEnv": map[string]any{
+			"apiKey": "TEST_GATEWAY_PROVIDER_SECRET",
+		}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if candidate.Credentials["apiKey"] != "secret-value" || candidate.Credentials["safe"] != "existing" {
+		t.Fatalf("credentials not resolved: %+v", candidate.Credentials)
+	}
+}
+
+func TestCandidateWithEnvironmentCredentialsDoesNotLeakMissingValue(t *testing.T) {
+	candidate := store.RuntimeModelCandidate{PlatformConfig: map[string]any{"credentialEnv": map[string]any{"apiKey": "MISSING_GATEWAY_PROVIDER_SECRET"}}}
+	_, err := candidateWithEnvironmentCredentials(candidate)
+	if err == nil || strings.Contains(err.Error(), "MISSING_GATEWAY_PROVIDER_SECRET") {
+		t.Fatalf("missing credential error should be generic: %v", err)
+	}
+}