feat: universal LLM gateway with embedded multilingual admin console

- OpenAI-compatible gateway with intelligent routing via cortiq-router (allaigate)
- Embedded build-free admin SPA at /admin: 7 languages (en/ru/de/fr/es/zh/tr),
  light/dark themes, hot config reload (no restart)
- Admin API, per-request statistics + Prometheus /metrics, secret store, playground
- English documentation (primary) with Russian translations (*.ru.md)

src/secrets.rs

@@ -0,0 +1,96 @@
+//! Secret store (provider API key values) kept outside the main config.
+//!
+//! The file `config/secrets.toml` (in `.gitignore`, mode `0600`) is a map of
+//! `env_name -> value`. Key resolution order: store entry > environment variable.
+//! This allows setting keys directly from the admin panel without a restart,
+//! without writing secrets into `gateway.toml`. Values are never exposed via the
+//! API — only their presence status is returned (see `source`).
+
+use std::collections::BTreeMap;
+use std::sync::RwLock;
+
+pub struct SecretStore {
+    path: String,
+    values: RwLock<BTreeMap<String, String>>,
+}
+
+impl SecretStore {
+    /// Load the store from a file (missing file or parse error → empty store).
+    pub fn load(path: &str) -> Self {
+        let values = std::fs::read_to_string(path)
+            .ok()
+            .and_then(|raw| toml::from_str::<BTreeMap<String, String>>(&raw).ok())
+            .unwrap_or_default();
+        Self {
+            path: path.to_string(),
+            values: RwLock::new(values),
+        }
+    }
+
+    /// Secret value by env name: store first, then environment variable.
+    pub fn resolve(&self, env_name: &str) -> Option<String> {
+        if let Some(v) = self.values.read().unwrap().get(env_name) {
+            if !v.is_empty() {
+                return Some(v.clone());
+            }
+        }
+        std::env::var(env_name).ok().filter(|v| !v.is_empty())
+    }
+
+    /// Value source for display in the UI: `store` | `env` | `missing`.
+    pub fn source(&self, env_name: &str) -> &'static str {
+        let in_store = self
+            .values
+            .read()
+            .unwrap()
+            .get(env_name)
+            .map(|v| !v.is_empty())
+            .unwrap_or(false);
+        if in_store {
+            "store"
+        } else if std::env::var(env_name)
+            .ok()
+            .filter(|v| !v.is_empty())
+            .is_some()
+        {
+            "env"
+        } else {
+            "missing"
+        }
+    }
+
+    /// Set a secret (persisted to file with mode 0600).
+    pub fn set(&self, env_name: &str, value: &str) -> anyhow::Result<()> {
+        self.values
+            .write()
+            .unwrap()
+            .insert(env_name.to_string(), value.to_string());
+        self.persist()
+    }
+
+    /// Remove a secret from the store (an environment variable value, if present, remains).
+    pub fn clear(&self, env_name: &str) -> anyhow::Result<()> {
+        self.values.write().unwrap().remove(env_name);
+        self.persist()
+    }
+
+    fn persist(&self) -> anyhow::Result<()> {
+        let data = {
+            let map = self.values.read().unwrap();
+            toml::to_string(&*map)?
+        };
+        let p = std::path::Path::new(&self.path);
+        if let Some(dir) = p.parent() {
+            std::fs::create_dir_all(dir).ok();
+        }
+        let tmp = p.with_extension("toml.tmp");
+        std::fs::write(&tmp, data.as_bytes())?;
+        std::fs::rename(&tmp, p)?;
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            let _ = std::fs::set_permissions(p, std::fs::Permissions::from_mode(0o600));
+        }
+        Ok(())
+    }
+}