feat: add v2 BYOK OpenAI-compatible LLM credentials

[suguanYang]

Summary

• Add optional llm_config (OpenAI-compatible credentials) to v2 only (POST /v2/jobs, POST /v2/retrieval/query); v1 is unchanged.
• Thread credentials through job metadata → worker parse (greenlet-scoped overrides) and agentic retrieval (async ContextVar).
• Mask API keys in original_request snapshots; raw keys stay in job metadata for the worker only (MVP plaintext-at-rest).

Usage

Semantics

• Flat root {api_key, model, base_url} → both text and vision
• models.{text,vision} → same endpoint, different model ids (shared api_key / base_url)
• text / vision objects → fully replace that channel (different endpoints / keys)
• a channel with no resolved model keeps server defaults

One multimodal model

{
  "llm_config": {
    "api_key": "sk-...",
    "model": "gpt-4o",
    "base_url": "https://api.openai.com/v1"
  }
}

Same endpoint, different models

{
  "llm_config": {
    "api_key": "sk-...",
    "base_url": "https://api.openai.com/v1",
    "models": { "text": "gpt-4o-mini", "vision": "gpt-4o" }
  }
}

Two different provider endpoints

{
  "llm_config": {
    "text": {
      "api_key": "sk-...",
      "model": "gpt-4o-mini",
      "base_url": "https://api.openai.com/v1"
    },
    "vision": {
      "api_key": "sk-ali-...",
      "model": "qwen-vl-max",
      "base_url": "https://dashscope.aliyuncs.com/compatible-mode/v1"
    }
  }
}

Node SDK

import { Knowhere } from "@ontos-ai/knowhere-sdk";

const client = new Knowhere({ apiKey: "..." });

// Flat multimodal
await client.jobs.create({
  sourceType: "url",
  sourceUrl: "https://example.com/doc.pdf",
  llmConfig: {
    apiKey: "sk-...",
    model: "gpt-4o",
    baseUrl: "https://api.openai.com/v1",
  },
});

// Same endpoint, different models
await client.retrieval.query({
  query: "What is the refund policy?",
  useAgentic: true,
  llmConfig: {
    apiKey: "sk-...",
    baseUrl: "https://api.openai.com/v1",
    models: { text: "gpt-4o-mini", vision: "gpt-4o" },
  },
});

Companion PRs

• Python SDK: feat: support llm_config BYOK on jobs and retrieval knowhere-python-sdk#33
• Node SDK: feat: support llmConfig BYOK on jobs and retrieval knowhere-node-sdk#123
• Docs: https://github.com/Ontos-AI/knowhere-api-docs/pull/23

Test plan

• make check (ruff + pyright)
• pytest packages/shared-python/shared/tests/test_llm_config.py
• Flat llm_config applies to both channels
• models map uses shared auth with different model ids
• Split text + vision uses different endpoints
• Confirm job responses do not expose raw API keys
• Confirm v1 ignores / rejects llm_config