fix(wechat): stop relay bootstrap from hijacking LLM provider selection.

Schedule LLM now binds an explicit provider key and fails closed on network errors so dead relay endpoints cannot block ordinary chat; relay bootstrap is opt-in only.

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -178,7 +178,12 @@ H5_PUBLIC_BASE_URL=http://127.0.0.1:5173
 # MEMIND_WECHAT_INTENT_TIMEOUT_MS=4000
 # MEMIND_WECHAT_INTENT_CANARY_OPENIDS=
 
-# H5 Session stream replay（docs/h5-session-architecture-20260706.md Patch 4c）
+# 微信待办/提醒 LLM 意图（独立于 Intent Router；须绑定 DeepSeek 等直连 key，勿依赖全局 selected）
+# H5_WECHAT_SCHEDULE_LLM_ENABLED=0
+# MEMIND_WECHAT_SCHEDULE_LLM_MODEL_PROVIDER_KEY_ID=
+# MEMIND_WECHAT_SCHEDULE_LLM_MODEL=deepseek-v4-pro
+
+# H5 Session stream replay
 # 默认 0：session SSE 仍纯透传 goosed；设 1 时 Portal 持久化 session 事件并支持 Last-Event-ID 重连补发。
 # MEMIND_SESSION_STREAM_REPLAY=0
 
@@ -232,7 +237,7 @@ H5_ADMIN_PASSWORD=change-me-admin
 # H5_ADMIN_WORKSPACE_ROOT=/Users/john/PycharmProjects/tkmind
 # LLM Key 数据库加密（可选；默认派生自 TKMIND_SERVER__SECRET_KEY）
 # H5_SETTINGS_ENCRYPTION_KEY=change-me-encryption-key
-# 启动时自动导入 Relay（若不存在同名配置）；改用手动 Provider 时请设为 1
+# Relay bootstrap 默认关闭；仅本地调试 relay 时设 H5_RELAY_BOOTSTRAP_DISABLED=0
 # H5_RELAY_BOOTSTRAP_DISABLED=1
 # H5_RELAY_BOOTSTRAP_NAME=Local Goose Relay DeepSeek
 # H5_RELAY_BOOTSTRAP_URL=http://127.0.0.1:18300/relay/buyer/v1/chat/completions