Admin-gated Settings: runtime model selection, is_admin enforced (#90)

Closes #79. Agent model + on/off move into an admin-only Settings section, and
is_admin is enforced for the first time. The live Runner is hot-swapped behind an
atomic.Pointer with routes always registered, so a settings change takes effect
with no restart; /capabilities reads the pointer. Secrets stay in the env, never
the DB. Precedence: Settings → env → default. Verified live: swap on/off/model,
bad spec → 400, race-clean. Gadfly blocking round addressed (dead code removed,
error-swallowing fixed, frontend 503 handling, holder dedup).

internal/api/api.go

@@ -6,13 +6,13 @@
 package api
 
 import (
+	"context"
 	"log/slog"
 	"net/http"
 
 	"github.com/gin-gonic/gin"
 	sloggin "github.com/samber/slog-gin"
 
-	"gitea.stevedudenhoeffer.com/steve/pansy/internal/agent"
 	"gitea.stevedudenhoeffer.com/steve/pansy/internal/config"
 	"gitea.stevedudenhoeffer.com/steve/pansy/internal/service"
 )
@@ -23,9 +23,12 @@ type handlers struct {
 	cfg  *config.Config
 	svc  *service.Service
 	oidc *oidcClient // nil unless OIDC is configured (see config.OIDCReady)
-	// agent is nil unless the assistant is configured; the chat routes are only
-	// registered when it isn't, so a handler never has to check.
-	agent *agent.Runner
+	// agent holds the live Runner behind an atomic pointer. Unlike oidc it is
+	// never nil — the holder is always present and its Runner may be nil when the
+	// assistant is off. The chat routes are registered unconditionally and
+	// nil-check agent.get(), so a settings change can turn the assistant on or off
+	// at runtime (#79) rather than only at boot.
+	agent *agentHolder
 }
 
 // New builds the gin engine with the standard middleware stack and registers the
@@ -131,37 +134,30 @@ func New(cfg *config.Config, svc *service.Service) *gin.Engine {
 	plantings.PATCH("/:id", h.updatePlanting)
 	plantings.DELETE("/:id", h.deletePlanting)
 
-	// The garden assistant, registered only when it can actually be offered —
-	// the same shape as OIDC. An instance with no API key serves the app
-	// normally and simply doesn't have these routes.
-	if !cfg.Agent.Ready() {
-		// Say WHY, at startup, in the logs an operator is already looking at.
-		// Someone who set the key and sees no assistant otherwise has nothing to
-		// check — and "is the variable reaching the container?" is exactly the
-		// question they need answered.
-		slog.Info("api: garden assistant disabled",
-			"enabled", cfg.Agent.Enabled,
-			"hasApiKey", cfg.Agent.OllamaCloudAPIKey != "",
-			"model", cfg.Agent.Model,
-			"hint", "needs OLLAMA_CLOUD_API_KEY set in the container's environment (not just the stack's)")
-	}
-	if cfg.Agent.Ready() {
-		runner, err := agent.NewRunner(svc, cfg)
-		if err != nil {
-			// Configured but unusable (an unresolvable model spec, say). Log it and
-			// carry on without the assistant rather than refusing to start: a
-			// garden planner that won't boot because of a chat feature is worse
-			// than one without chat.
-			slog.Error("api: garden assistant disabled", "error", err)
-		} else {
-			h.agent = runner
-			agentGroup := v1.Group("/agent", h.requireAuth())
-			agentGroup.POST("/chat", h.agentChat)
-			gardens.GET("/:id/agent/history", h.getAgentHistory)
-			gardens.DELETE("/:id/agent/history", h.deleteAgentHistory)
-			slog.Info("api: garden assistant enabled", "model", cfg.Agent.Model)
-		}
+	// The garden assistant. Its routes are registered UNCONDITIONALLY and the live
+	// Runner sits behind an atomic pointer in the holder, so a settings change can
+	// turn the assistant on or off at runtime (#79). Each handler nil-checks
+	// agent.get(); a chat request while the assistant is off gets a clean 503
+	// (AGENT_DISABLED), not a panic and not a missing route.
+	//
+	// The holder resolves its initial Runner from settings + environment at
+	// construction. If the key never reaches the container, the assistant is off
+	// and the reason is logged below — the same operability need #72 added.
+	h.agent = newAgentHolder(context.Background(), svc)
+	if cfg.Agent.OllamaCloudAPIKey == "" {
+		slog.Info("api: garden assistant has no API key",
+			"hint", "set OLLAMA_CLOUD_API_KEY in the container's environment (not just the stack's); the model can be chosen in Settings")
 	}
+	agentGroup := v1.Group("/agent", h.requireAuth())
+	agentGroup.POST("/chat", h.agentChat)
+	gardens.GET("/:id/agent/history", h.getAgentHistory)
+	gardens.DELETE("/:id/agent/history", h.deleteAgentHistory)
+
+	// Instance settings: admin-only, and the first thing to enforce is_admin.
+	// requireAdmin runs after requireAuth (it reads the actor requireAuth stored).
+	settings := v1.Group("/settings", h.requireAuth(), h.requireAdmin())
+	settings.GET("", h.getSettings)
+	settings.PATCH("", h.updateSettings)
 
 	// Undo. A change set is addressed by its own id; the service resolves the
 	// owning garden for the permission check, same as objects and plantings.
@@ -203,11 +199,12 @@ func New(cfg *config.Config, svc *service.Service) *gin.Engine {
 // capabilities reports what this instance can actually do, so the UI offers only
 // what works.
 //
-// It reports whether the runner BUILT, not whether it was configured: a
-// configured-but-unresolvable model leaves the routes unregistered, and saying
-// "yes" there would offer a chat tab whose first message 404s.
+// It reports whether the assistant is live RIGHT NOW, not merely configured:
+// the chat routes always exist, but a request while the Runner is nil is refused,
+// so offering the tab must track the live Runner. Reading agent.get() (an atomic
+// load) means this reflects a settings-driven swap on the very next poll.
 func (h *handlers) capabilities(c *gin.Context) {
-	c.JSON(http.StatusOK, gin.H{"agent": h.agent != nil})
+	c.JSON(http.StatusOK, gin.H{"agent": h.agent.get() != nil})
 }
 
 // healthz is a liveness probe: always returns {"ok": true} when the server is up.