feat: scaffold ai gateway identity and design

.env.example

@@ -1,7 +1,7 @@
 APP_ENV=development
 HTTP_ADDR=:8088
 
-# Reuse the same PostgreSQL instance as Agent memory, but use an independent
+# Reuse the same PostgreSQL 18 instance as Agent memory, but use an independent
 # database. When running from the host, use the externally reachable host/port.
 AI_GATEWAY_DATABASE_NAME=easyai_ai_gateway
 AI_GATEWAY_DATABASE_URL=postgresql://easyai:easyai2025@localhost:5432/easyai_ai_gateway?sslmode=disable
@@ -17,9 +17,22 @@ AI_GATEWAY_DATABASE_URL=postgresql://easyai:easyai2025@localhost:5432/easyai_ai_
 # Keep this aligned with easyai-server-main CONFIG_JWT_SECRET in the first migration phase.
 CONFIG_JWT_SECRET=this is a very secret secret
 
-# Used when the gateway delegates OpenAPI sk-* validation, file upload, and settlement callbacks.
+# Identity mode:
+# - standalone: Gateway owns users, groups, login/API keys, wallet, recharge, and local billing.
+# - server-main: server-main owns users/API keys/billing; Gateway stores synced users/groups for policy execution.
+# - hybrid: both sources are accepted and separated by gateway_users.source.
+IDENTITY_MODE=hybrid
+
+# Used when the gateway delegates OpenAPI sk-* validation, user/group sync, file upload, and settlement callbacks.
 SERVER_MAIN_BASE_URL=http://localhost:3000
 SERVER_MAIN_INTERNAL_TOKEN=change-me
 
+# Gateway writes progress events locally, then calls this server-main endpoint.
+# server-main receives the callback and pushes it through the existing WebSocket gateway.
+TASK_PROGRESS_CALLBACK_ENABLED=true
+TASK_PROGRESS_CALLBACK_URL=http://localhost:3000/internal/platform/task-progress-callbacks
+TASK_PROGRESS_CALLBACK_TIMEOUT_MS=5000
+TASK_PROGRESS_CALLBACK_MAX_ATTEMPTS=10
+
 CORS_ALLOWED_ORIGIN=http://localhost:5178
 VITE_GATEWAY_API_BASE_URL=http://localhost:8088