feat: adopt structured runtime configuration

.github/workflows/ci.yml

@@ -177,7 +177,7 @@ jobs:
           --health-timeout 3s
           --health-retries 20
     env:
-      DATABASE_URL: postgres://asterrouter:asterrouter@127.0.0.1:5432/asterrouter_e2e_test?sslmode=disable
+      ASTERROUTER_SERVER_STORAGE_DATABASE_URL: postgres://asterrouter:asterrouter@127.0.0.1:5432/asterrouter_e2e_test?sslmode=disable
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
@@ -207,7 +207,7 @@ jobs:
       - name: First-install setup browser journey
         env:
           ASTER_SETUP_JOURNEY_DIR: ${{ runner.temp }}/asterrouter-setup-journey
-          DATABASE_URL: postgres://asterrouter:asterrouter@127.0.0.1:5432/asterrouter_e2e_setup_test?sslmode=disable
+          ASTER_SETUP_JOURNEY_DATABASE_URL: postgres://asterrouter:asterrouter@127.0.0.1:5432/asterrouter_e2e_setup_test?sslmode=disable
         run: bash scripts/test-setup-browser-journey.sh
       - name: Upload browser evidence
         if: always()

.github/workflows/nightly.yml

@@ -76,7 +76,7 @@ jobs:
           --health-timeout 3s
           --health-retries 20
     env:
-      DATABASE_URL: postgres://asterrouter:asterrouter@127.0.0.1:5432/asterrouter_nightly_e2e?sslmode=disable
+      ASTERROUTER_SERVER_STORAGE_DATABASE_URL: postgres://asterrouter:asterrouter@127.0.0.1:5432/asterrouter_nightly_e2e?sslmode=disable
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v6

.gitignore

@@ -6,6 +6,7 @@ dist/
 *.test
 coverage.out
 backend/data/
+backend/config/config.yaml
 
 # Frontend
 frontend/dist/

Dockerfile

@@ -7,7 +7,7 @@ RUN npm ci
 COPY frontend/ ./
 RUN npm run build
 
-FROM golang:1.25-alpine AS backend
+FROM golang:1.26-alpine AS backend
 WORKDIR /src/backend
 COPY backend/go.mod backend/go.sum ./
 RUN go mod download
@@ -25,8 +25,9 @@ WORKDIR /app
 RUN adduser -D -H -u 10001 asterrouter
 COPY --from=backend /out/asterrouter /app/asterrouter
 COPY --from=frontend /src/frontend/dist /app/frontend/dist
-ENV ASTER_ADDR=:8080 \
-    ASTER_FRONTEND_DIR=/app/frontend/dist
+ENV ASTERROUTER_SERVER_HTTP_LISTEN=:8080 \
+    ASTERROUTER_SERVER_HTTP_FRONTEND_DIR=/app/frontend/dist
 EXPOSE 8080
 USER asterrouter
 ENTRYPOINT ["/app/asterrouter"]
+CMD ["server"]

README.md

@@ -84,7 +84,7 @@ Choose one business deployment role during installation. This controls the initi
 
 AI Platform is separate from relay operations. Both can issue or accept API credentials, but a relay operator owns customer balances, plans, and risk workflows. An AI platform owns the gateway boundary for developer API Keys or delegated product access; the connected product remains the source of truth for its users, sessions, subscriptions, and orders. Enterprise owns employee and department governance; Personal owns only its workspace. These are different business roots, not four pages of one customer model.
 
-Linux Release installation requires `--deployment` (or `ASTERROUTER_DEPLOYMENT_ROLE`); Docker and source development use `/setup`, which requires an explicit choice and does not preselect a role. Production and Docker deployments persist the selection in PostgreSQL and fix it for that instance. Source development without `DATABASE_URL` uses temporary in-memory storage, so its setup is intentionally lost when the process restarts and must not be treated as a production installation. At later PostgreSQL-backed starts, a configured role must match the persisted role or startup fails; an environment variable can never switch Enterprise to Platform, or any other role. This protects Provider, credential, usage, and audit data from being mixed across business models. Run another instance when a second model is needed. Existing multi-profile installations remain compatible but their profile configuration is frozen. Multi-profile operation for new deployments is a future migration capability, gated on end-to-end `profile_scope`, explicit Provider Sharing Binding, and tenant isolation.
+Linux Release installation requires `--deployment` (or installer input `ASTERROUTER_DEPLOYMENT_ROLE`); Docker and source development use `/setup`, which requires an explicit choice and does not preselect a role. Production and Docker deployments persist the selection in PostgreSQL and fix it for that instance. Source development without `ASTERROUTER_SERVER_STORAGE_DATABASE_URL` uses temporary in-memory storage, so its setup is intentionally lost when the process restarts and must not be treated as a production installation. At later PostgreSQL-backed starts, a configured role must match the persisted role or startup fails. Run another instance when a second model is needed.
 
 ### Linux release
 
@@ -100,7 +100,7 @@ Replace `enterprise` with `personal`, `relay_operator`, or `platform` as appropr
 docker compose up --build
 ```
 
-Open `http://localhost:8080/setup` to choose one deployment role and review its business boundary before completing setup. After installation, AsterRouter clears any browser session left by another deployment role and asks you to sign in again before opening the selected console. Retrying the same installation choice is safe. A system administrator can switch the active role later from Settings; the previous role is hidden but its data is retained. For non-interactive deployment, set `ASTER_DEPLOYMENT_ROLE=platform`; the older matching `ASTER_PROFILES=platform` and `ASTER_DEFAULT_PROFILE=platform` pair remains compatible as bootstrap input.
+Open `http://localhost:8080/setup` to choose one deployment role and review its business boundary before completing setup. After installation, AsterRouter clears any browser session left by another deployment role and asks you to sign in again before opening the selected console. Retrying the same installation choice is safe. A system administrator can switch the active role later from Settings; the previous role is hidden but its data is retained. For non-interactive runtime deployment, set `ASTERROUTER_SERVER_BOOTSTRAP_DEPLOYMENT_ROLE=platform`.
 
 ## Private deployment and managed delivery
 
@@ -141,7 +141,7 @@ To expose the one-click demo entry on the sign-in page, start the isolated demo
 bash scripts/dev.sh --demo
 ```
 
-Demo mode enables the built-in demo account and must only be used locally or on an isolated public demo instance. Docker users can enable it with `ASTER_DEMO_MODE=true docker compose up --build`; production instances should keep it disabled.
+Demo mode enables the built-in demo account and must only be used locally or on an isolated public demo instance. Docker users can enable it with `ASTERROUTER_SERVER_BOOTSTRAP_DEMO_MODE=true docker compose up --build`; production instances should keep it disabled.
 
 Run backend tests:
 

README.zh-CN.md

@@ -84,7 +84,7 @@ AI Platform 是独立部署角色，不是中转 Customer 的一种用法。它
 
 AI 平台与中转运营是两个独立角色。两者都可能使用 API 凭据，但中转运营管理客户余额、套餐和风控；AI 平台管理开发者 API Key 或产品委托接入的网关边界，接入产品仍然拥有自己的用户、登录会话、订阅和订单事实。企业管理员工和部门治理，个人只管理自己的 Workspace；它们是不同的业务根对象，不是同一客户模型下的四个页面。
 
-Linux Release 安装必须传入 `--deployment`，也可预设 `ASTERROUTER_DEPLOYMENT_ROLE`；Docker 和源码开发通过 `/setup` 显式选择，且不会默认选中任何角色。生产与 Docker 部署会把选择写入 PostgreSQL，并固定为当前实例的业务模型。源码开发未配置 `DATABASE_URL` 时使用临时内存存储，进程重启后安装状态会丢失，不能把它当成生产安装。PostgreSQL 部署后续启动时，若环境中声明的角色与已持久化角色不一致，服务会拒绝启动；环境变量不能把企业实例切换成 AI 平台或其他角色。这样可避免不同业务模型的 Provider、凭据、用量和审计数据混在一起。需要第二种业务模型时部署独立实例。已有多 Profile 实例保持兼容运行，但其 Profile 配置被冻结。面向新部署的多 Profile 仅是未来迁移能力，前提是端到端 `profile_scope`、显式 Provider Sharing Binding 和租户隔离均已落地。
+Linux Release 安装必须传入 `--deployment`，也可预设安装器输入 `ASTERROUTER_DEPLOYMENT_ROLE`；Docker 和源码开发通过 `/setup` 显式选择，且不会默认选中任何角色。生产与 Docker 部署会把选择写入 PostgreSQL，并固定为当前实例的业务模型。源码开发未配置 `ASTERROUTER_SERVER_STORAGE_DATABASE_URL` 时使用临时内存存储，进程重启后安装状态会丢失，不能把它当成生产安装。PostgreSQL 部署后续启动时，若配置角色与已持久化角色不一致，服务会拒绝启动。需要第二种业务模型时部署独立实例。
 
 ### Linux Release
 
@@ -100,7 +100,7 @@ curl -sSL https://raw.githubusercontent.com/astercloud/asterrouter/main/deploy/i
 docker compose up --build
 ```
 
-访问 `http://localhost:8080/setup`，选择一个部署角色并确认其业务边界后完成初始配置。安装完成后，AsterRouter 会清理可能属于其他部署角色的浏览器旧会话，并要求重新登录后再进入所选后台；相同角色的安装请求可以安全重试。系统管理员可以在设置中切换活动形态，旧形态会隐藏但数据会保留。非交互部署设置 `ASTER_DEPLOYMENT_ROLE=platform`；旧的匹配 `ASTER_PROFILES=platform` 与 `ASTER_DEFAULT_PROFILE=platform` 仍作为首次启动配置兼容。
+访问 `http://localhost:8080/setup`，选择一个部署角色并确认其业务边界后完成初始配置。安装完成后，AsterRouter 会清理可能属于其他部署角色的浏览器旧会话，并要求重新登录后再进入所选后台；相同角色的安装请求可以安全重试。系统管理员可以在设置中切换活动形态，旧形态会隐藏但数据会保留。非交互运行时部署设置 `ASTERROUTER_SERVER_BOOTSTRAP_DEPLOYMENT_ROLE=platform`。
 
 ## 私有化与托管交付
 
@@ -141,7 +141,7 @@ bash scripts/dev.sh
 bash scripts/dev.sh --demo
 ```
 
-演示模式会开放内置演示账号并在登录页显示“一键体验 Demo”，只应在本地或隔离的公开演示实例使用。Docker 可通过 `ASTER_DEMO_MODE=true docker compose up --build` 启用；生产实例应保持关闭。
+演示模式会开放内置演示账号并在登录页显示“一键体验 Demo”，只应在本地或隔离的公开演示实例使用。Docker 可通过 `ASTERROUTER_SERVER_BOOTSTRAP_DEMO_MODE=true docker compose up --build` 启用；生产实例应保持关闭。
 
 运行后端测试：