feat: 服务层配置接线——email/push/rate_limit/AI凭据/行为开关/映射表/种子键

Task 9: 服务层对全局 settings 的业务引用清零,每个 DEFAULT_CONFIG 组
都有真实消费方。resolve_*_settings(email/push/ai)以空槽回退 env
(平台默认层);contact 行为开关/种子白名单/国名扩表/限流上限经
manager 的 runtime.config 接线。收口: lead_push session_factory 必填、
config.py 死代码清理、PromptProvider frozen、no_contact 视图直取、
AIService wall 参数定型 CompiledWall。403 测试全绿(389+14)。

Co-Authored-By: Claude Code <noreply@anthropic.com>

app/engine/services/rate_limit.py

@@ -1,32 +1,36 @@
-"""Minimal in-memory rate limiter (per (ip, device_id), rolling 1h window).
+"""Minimal in-memory rate limiter (per (tenant, ip, device_id), rolling 1h window).
 
 Kept aligned with the reference implementation's rate_limit.py shape. Only the chat message route uses this;
 session/history endpoints are cheap and not throttled. State is process-local
 and resets on restart, which is acceptable for a single-worker ai-kefu deploy.
+Task 9: 桶键加租户维度——多租户同 IP(共享出口 NAT/公司网络)不互相挤占
+配额;limit 经 config.engine.rate_limit_per_hour 逐租户可调(消费点
+chat_rest, 默认 DEFAULT_MAX)。
 
 Caveats:
 - Single-process, in-memory. Under `uvicorn --workers >1` each worker keeps
   its own `_buckets`, so the effective cap is `max_requests * workers`.
-- Keyed on (ip, device_id); a client rotating the `X-Device-Id` header per
+- Keyed on (tenant, ip, device_id); a client rotating the `X-Device-Id` header per
   request bypasses it. This is a light safeguard against accidental GLM-cost
   burn, NOT abuse-proof.
 """
 import time
 from collections import defaultdict
 
-_buckets: dict[tuple[str, str], list[float]] = defaultdict(list)
+_buckets: dict[tuple[str, str, str], list[float]] = defaultdict(list)
 WINDOW = 3600
 DEFAULT_MAX = 30
 
 
 def check(
+    tenant: str | None,
     ip: str | None,
     device_id: str | None,
     *,
     max_requests: int = DEFAULT_MAX,
 ) -> bool:
     """Return True if the request is under the cap (and record it), else False."""
-    key = (ip or "", device_id or "")
+    key = (tenant or "", ip or "", device_id or "")
     now = time.time()
     _buckets[key] = [t for t in _buckets[key] if t > now - WINDOW]
     if len(_buckets[key]) >= max_requests: