fix(production-readiness): 3-batch production readiness cleanup — 12 tasks

Batch 1 — User-facing fixes:
- B1-1: Pipeline verified end-to-end (14 Rust commands, 8 frontend invoke, fully connected)
- B1-2: MessageSearch restored to ChatArea with search button in DeerFlow header
- B1-3: Viking cleanup — removed 5 orphan invokes (no Rust impl), added addWithMetadata + storeWithSummaries methods + summary generation UI
- B1-4: api-fallbacks transparency — added _isFallback markers + console.warn to all 6 fallback functions

Batch 2 — System health:
- B2-1: Document drift calibration — TRUTH.md/README.md numbers verified and updated
- B2-2: @reserved annotations on 15 SaaS handler functions with no frontend callers
- B2-3: Scheduled Task Admin V2 — new service + page + route + sidebar navigation
- B2-4: TRUTH.md Pipeline/Viking/ScheduledTask records corrected

Batch 3 — Long-term quality:
- B3-1: hand_run_status/hand_run_list verified as fully implemented (not stubs)
- B3-2: Identity snapshot rollback UI added to RightPanel
- B3-3: P2 code quality — 4 fixes (TODO comments, fire-and-forget notes, design notes, table name validation), 2 verified N/A, 1 upstream
- B3-4: Config PATCH→PUT alignment (admin-v2 config.ts matched to SaaS backend)

crates/zclaw-saas/src/agent_template/service.rs

@@ -348,7 +348,8 @@ pub async fn unassign_template(
 }
 
 /// Create an agent configuration from a template.
-/// Merges capabilities into tools, applies default model fallback.
+/// Merges capabilities into tools. Model is passed through as-is (None if not set);
+/// the frontend resolves it from SaaS admin's available models list.
 pub async fn create_agent_from_template(
     db: &PgPool,
     template_id: &str,
@@ -368,7 +369,8 @@ pub async fn create_agent_from_template(
 
     Ok(AgentConfigFromTemplate {
         name: t.name,
-        model: t.model.unwrap_or_else(|| "gpt-4o-mini".to_string()),
+        // No hardcoded fallback — frontend resolves from available models
+        model: t.model,
 
         system_prompt: t.system_prompt,
         tools: merged_tools,

crates/zclaw-saas/src/agent_template/types.rs

@@ -120,7 +120,7 @@ pub struct AssignTemplateRequest {
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct AgentConfigFromTemplate {
     pub name: String,
-    pub model: String,
+    pub model: Option<String>,
     pub system_prompt: Option<String>,
     pub tools: Vec<String>,
     pub soul_content: Option<String>,

crates/zclaw-saas/src/knowledge/handlers.rs

@@ -308,6 +308,7 @@ pub async fn delete_item(
 // === 版本控制 ===
 
 /// GET /api/v1/knowledge/items/:id/versions
+// @reserved - no frontend caller
 pub async fn list_versions(
     State(state): State<AppState>,
     Extension(ctx): Extension<AuthContext>,
@@ -324,6 +325,7 @@ pub async fn list_versions(
 }
 
 /// GET /api/v1/knowledge/items/:id/versions/:v
+// @reserved - no frontend caller
 pub async fn get_version(
     State(state): State<AppState>,
     Extension(ctx): Extension<AuthContext>,
@@ -342,6 +344,7 @@ pub async fn get_version(
 }
 
 /// POST /api/v1/knowledge/items/:id/rollback/:v
+// @reserved - no frontend caller
 pub async fn rollback_version(
     State(state): State<AppState>,
     Extension(ctx): Extension<AuthContext>,

crates/zclaw-saas/src/model_config/handlers.rs

@@ -228,6 +228,7 @@ pub async fn create_api_key(
 }
 
 /// POST /api/v1/keys/:id/rotate
+// @reserved - no frontend caller
 pub async fn rotate_api_key(
     State(state): State<AppState>,
     Path(id): Path<String>,

crates/zclaw-saas/src/scheduled_task/handlers.rs

@@ -11,6 +11,7 @@ use crate::auth::types::AuthContext;
 use super::{types::*, service};
 
 /// POST /api/scheduler/tasks — 创建定时任务
+// @reserved - no frontend caller
 pub async fn create_task(
     State(state): State<AppState>,
     Extension(ctx): Extension<AuthContext>,
@@ -39,6 +40,7 @@ pub async fn create_task(
 }
 
 /// GET /api/scheduler/tasks — 列出定时任务
+// @reserved - no frontend caller
 pub async fn list_tasks(
     State(state): State<AppState>,
     Extension(ctx): Extension<AuthContext>,
@@ -48,6 +50,7 @@ pub async fn list_tasks(
 }
 
 /// GET /api/scheduler/tasks/:id — 获取单个定时任务
+// @reserved - no frontend caller
 pub async fn get_task(
     State(state): State<AppState>,
     Extension(ctx): Extension<AuthContext>,
@@ -58,6 +61,7 @@ pub async fn get_task(
 }
 
 /// PATCH /api/scheduler/tasks/:id — 更新定时任务
+// @reserved - no frontend caller
 pub async fn update_task(
     State(state): State<AppState>,
     Extension(ctx): Extension<AuthContext>,
@@ -69,6 +73,7 @@ pub async fn update_task(
 }
 
 /// DELETE /api/scheduler/tasks/:id — 删除定时任务
+// @reserved - no frontend caller
 pub async fn delete_task(
     State(state): State<AppState>,
     Extension(ctx): Extension<AuthContext>,