feat: add optional asset gateway control plane

admin-bootstrap.mjs

@@ -13,9 +13,10 @@
 // domain logic has a single source of truth; only the wiring differs.
 import path from 'node:path';
 import { createSubscriptionService } from './billing-subscription.mjs';
-import { createDbPool, isDatabaseConfigured } from './db.mjs';
+import { createDbPool, ensureAssetGatewaySchema, isDatabaseConfigured } from './db.mjs';
 import { createUserAuth } from './user-auth.mjs';
 import { createLlmProviderService } from './llm-providers.mjs';
+import { createAssetGatewayConfigService } from './asset-gateway.mjs';
 import { createMemoryV2AdminConfigService } from './memory-v2-admin-config.mjs';
 import { createWechatScheduleLlmConfigService } from './wechat-schedule-llm-config.mjs';
 import { createPlazaPostService, formatPostRow } from './plaza-posts.mjs';
@@ -55,6 +56,9 @@ export async function createAdminServices(env = {}) {
   );
 
   const pool = createDbPool();
+  // The back-office process can boot before the public Portal. Create only the
+  // optional control-plane tables here instead of requiring the public boot path.
+  await ensureAssetGatewaySchema(pool);
 
   // --- plaza graph (review queue, reports, featured, analytics, creators) ---
   const plazaRedis = createNoopPlazaRedis();
@@ -94,6 +98,7 @@ export async function createAdminServices(env = {}) {
   }
 
   const llmProviderService = createLlmProviderService(pool, { apiTarget, apiSecret });
+  const assetGatewayConfigService = createAssetGatewayConfigService(pool, { llmProviderService });
   const memoryV2ConfigService = createMemoryV2AdminConfigService(pool);
   const wechatScheduleLlmConfigService = createWechatScheduleLlmConfigService(pool);
   const adminSystemTestService = createAdminSystemTestService({
@@ -131,6 +136,7 @@ export async function createAdminServices(env = {}) {
     pool,
     userAuth,
     llmProviderService,
+    assetGatewayConfigService,
     memoryV2ConfigService,
     wechatScheduleLlmConfigService,
     adminSystemTestService,