feat: 服务层配置接线——email/push/rate_limit/AI凭据/行为开关/映射表/种子键

Task 9: 服务层对全局 settings 的业务引用清零,每个 DEFAULT_CONFIG 组
都有真实消费方。resolve_*_settings(email/push/ai)以空槽回退 env
(平台默认层);contact 行为开关/种子白名单/国名扩表/限流上限经
manager 的 runtime.config 接线。收口: lead_push session_factory 必填、
config.py 死代码清理、PromptProvider frozen、no_contact 视图直取、
AIService wall 参数定型 CompiledWall。403 测试全绿(389+14)。

Co-Authored-By: Claude Code <noreply@anthropic.com>

tests/test_rate_limit.py

@@ -4,18 +4,18 @@ from app.engine.services.rate_limit import check, _reset_for_test
 def test_allows_under_cap():
     _reset_for_test()
     for _ in range(30):
-        assert check("1.2.3.4", "dev1") is True
+        assert check("t1", "1.2.3.4", "dev1") is True
 
 
 def test_blocks_over_cap():
     _reset_for_test()
     for _ in range(30):
-        assert check("1.2.3.4", "dev1") is True
-    assert check("1.2.3.4", "dev1") is False
+        assert check("t1", "1.2.3.4", "dev1") is True
+    assert check("t1", "1.2.3.4", "dev1") is False
 
 
 def test_isolated_buckets():
     _reset_for_test()
     for _ in range(30):
-        check("1.2.3.4", "dev1")
-    assert check("5.6.7.8", "dev2") is True  # different ip+device unaffected
+        check("t1", "1.2.3.4", "dev1")
+    assert check("t1", "5.6.7.8", "dev2") is True  # different ip+device unaffected