fix(wechat): stop relay bootstrap from hijacking LLM provider selection.

Schedule LLM now binds an explicit provider key and fails closed on network errors so dead relay endpoints cannot block ordinary chat; relay bootstrap is opt-in only.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/portal-agent-services-bootstrap.mjs

@@ -190,7 +190,8 @@ export async function bootstrapPortalAgentServices({
   const wordFilterService =
     createWordFilterServiceFn(pool);
 
-  const relayBootstrapTask = env.H5_RELAY_BOOTSTRAP_DISABLED === '1'
+  // Relay bootstrap is opt-in only; production uses direct provider keys (e.g. DeepSeek).
+  const relayBootstrapTask = env.H5_RELAY_BOOTSTRAP_DISABLED !== '0'
     ? Promise.resolve({ ok: true, created: false, skipped: true })
     : llmProviderService
       .ensureBootstrapRelay()

server/portal-agent-services-bootstrap.test.mjs

@@ -367,6 +367,10 @@ test('falls back from PG experience and degrades invalid image config', async ()
 
 test('keeps disabled experience null and reports background LLM failures', async () => {
   const setup = createSetup({
+    env: {
+      EXPERIENCE_PG_URL: 'postgres://experience',
+      H5_RELAY_BOOTSTRAP_DISABLED: '0',
+    },
     runtime: {
       experienceEnabled: false,
       agentWorker: { enabled: false },