fix(wechat): stop relay bootstrap from hijacking LLM provider selection.

Schedule LLM now binds an explicit provider key and fails closed on network errors so dead relay endpoints cannot block ordinary chat; relay bootstrap is opt-in only.

Co-authored-by: Cursor <cursoragent@cursor.com>

wechat-schedule-llm-config.mjs

@@ -34,6 +34,8 @@ async function ensureConfigTable(pool) {
 function defaultsFromEnv(env = process.env) {
   return {
     scheduleLlmEnabled: normalizeBoolean(env.H5_WECHAT_SCHEDULE_LLM_ENABLED, false),
+    modelProviderKeyId: String(env.MEMIND_WECHAT_SCHEDULE_LLM_MODEL_PROVIDER_KEY_ID ?? '').trim() || null,
+    model: String(env.MEMIND_WECHAT_SCHEDULE_LLM_MODEL ?? '').trim() || null,
   };
 }
 
@@ -65,6 +67,8 @@ export function createWechatScheduleLlmConfigService(pool, { env = process.env }
         stored.scheduleLlmEnabled,
         defaults.scheduleLlmEnabled,
       ),
+      modelProviderKeyId: String(stored.modelProviderKeyId ?? defaults.modelProviderKeyId ?? '').trim() || null,
+      model: String(stored.model ?? defaults.model ?? '').trim() || null,
     };
   }
 
@@ -90,6 +94,14 @@ export function createWechatScheduleLlmConfigService(pool, { env = process.env }
           payload.scheduleLlmEnabled === undefined
             ? current.scheduleLlmEnabled
             : normalizeBoolean(payload.scheduleLlmEnabled, current.scheduleLlmEnabled),
+        modelProviderKeyId:
+          payload.modelProviderKeyId === undefined
+            ? (current.modelProviderKeyId ?? '')
+            : String(payload.modelProviderKeyId ?? '').trim(),
+        model:
+          payload.model === undefined
+            ? (current.model ?? '')
+            : String(payload.model ?? '').trim(),
       };
       const now = Date.now();
       await pool.query(