优化页面交互并增强 Provider 配置能力

- 表单下拉框不再用 label 包裹，改为 div + aria-label，避免点击后
  下拉面板瞬间关闭
- Provider 卡片新增「从上游获取模型」和「修改」入口，支持编辑
  base URL、API Key 与 api_mode，凭据写入对应的环境变量
- 服务端抽出 provider-model-discovery 统一不同 api_mode 的模型发现，
  旧的 custom_providers 与新的 providers 字典结构都能正确更新
- Agent Bridge 改为后台启动，HTTP 接口在 Python 运行时就绪前即可用；
  worker 连接被拒时按类型重试，不重放可能已产生副作用的请求
- 断线重连后恢复 profiles、models 与会话列表，健康检查改为自调度
  的 setTimeout，离线时 2 秒后重试
- 批量删除确认文案改用 Popconfirm content，避免变成侧栏触发器文本

tests/server/provider-update-controller.test.ts

@@ -127,4 +127,67 @@ describe('providers controller update', () => {
     expect(defaultConfig.custom_providers[0].api_mode).toBe('codex_responses')
     expect(researchConfig.custom_providers[0].api_mode).toBe('chat_completions')
   })
+  it('updates a built-in Base URL and key without changing defaults or another profile', async () => {
+    const { update } = await loadProvidersController()
+    const before = readFileSync(join(hermesHome, 'profiles', 'research', 'config.yaml'), 'utf8')
+    const ctx = makeCtx('minimax-cn', { base_url: 'https://proxy.invalid/anthropic/v1', api_key: 'new-key' })
+    await update(ctx)
+    expect(ctx.body).toEqual({ success: true })
+    const env = readFileSync(join(hermesHome, 'profiles', 'research', '.env'), 'utf8')
+    expect(env).toContain('MINIMAX_CN_API_KEY=new-key')
+    expect(env).toContain('MINIMAX_CN_BASE_URL=https://proxy.invalid/anthropic/v1')
+    expect(readFileSync(join(hermesHome, '.env'), 'utf8')).not.toContain('new-key')
+    expect(readFileSync(join(hermesHome, 'profiles', 'research', 'config.yaml'), 'utf8')).toBe(before)
+  })
+
+  it('keeps an existing key when only the URL is edited', async () => {
+    const { update } = await loadProvidersController()
+    const ctx = makeCtx('deepseek', { base_url: 'https://new.invalid/v1' })
+    await update(ctx)
+    const env = readFileSync(join(hermesHome, 'profiles', 'research', '.env'), 'utf8')
+    expect(env).toContain('DEEPSEEK_API_KEY=old-research-key')
+    expect(env).toContain('DEEPSEEK_BASE_URL=https://new.invalid/v1')
+  })
+
+  it('edits a dict-backed provider in place and preserves its models and extra configuration', async () => {
+    const path = join(hermesHome, 'profiles', 'research', 'config.yaml')
+    writeFileSync(path, YAML.dump({
+      model: { provider: 'custom:dict-proxy', default: 'selected-model' },
+      providers: { original_key: {
+        name: 'dict-proxy', url: 'https://old.invalid/v1', api_key: 'old-key',
+        models: { 'selected-model': { context_length: 12345 } }, extra_body: { keep: true },
+      } },
+    }))
+    const { update } = await loadProvidersController()
+    const ctx = makeCtx('custom:dict-proxy', {
+      base_url: 'https://new.invalid/v1', api_key: 'new-key', source: 'providers', providerKey: 'original_key',
+    })
+    await update(ctx)
+    expect(ctx.body).toEqual({ success: true })
+    const config = readYaml(path)
+    expect(config.custom_providers).toBeUndefined()
+    expect(config.model).toEqual({ provider: 'custom:dict-proxy', default: 'selected-model' })
+    expect(config.providers.original_key).toMatchObject({
+      base_url: 'https://new.invalid/v1', api_key: 'new-key',
+      models: { 'selected-model': { context_length: 12345 } }, extra_body: { keep: true },
+    })
+  })
+
+  it('updates an env-backed custom key in the same profile', async () => {
+    const path = join(hermesHome, 'profiles', 'research', 'config.yaml')
+    writeFileSync(path, YAML.dump({ providers: { proxy: { base_url: 'https://proxy.invalid/v1', key_env: 'PROXY_KEY', model: 'keep' } } }))
+    const { update } = await loadProvidersController()
+    await update(makeCtx('custom:proxy', { api_key: 'new-key', source: 'providers', providerKey: 'proxy' }))
+    expect(readFileSync(join(hermesHome, 'profiles', 'research', '.env'), 'utf8')).toContain('PROXY_KEY=new-key')
+    expect(readYaml(path).providers.proxy.model).toBe('keep')
+  })
+
+  it.each(['', 'bad-url', 'file:///tmp/model'])('rejects an invalid URL before writing the key: %s', async base_url => {
+    const { update } = await loadProvidersController()
+    const ctx = makeCtx('deepseek', { base_url, api_key: 'must-not-save' })
+    await update(ctx)
+    expect(ctx.status).toBe(400)
+    expect(readFileSync(join(hermesHome, 'profiles', 'research', '.env'), 'utf8')).toContain('DEEPSEEK_API_KEY=old-research-key')
+  })
+
 })