fix: stabilize agent runtime and Zotero configuration

[zuowen7]

What changed

• replace fixed Agent V2 tool-call ceilings with progress-aware leases and stalled-call detection
• preserve compact thought summaries and uninterrupted multi-turn execution
• make every Zotero route consume the merged runtime configuration
• keep Zotero credentials and user ID in the ignored local override, and seed the runtime config from the tracked source template

Root cause

Agent runs were stopped by fixed per-turn counters even while making progress. Zotero settings were saved through the merged config service but read back through a legacy default-file-only path, so the saved API key was invisible to Zotero routes.

Validation

• backend full suite: 2347 passed, 7 skipped
• frontend suite: 825 passed
• Zotero/config regression: 75 passed, 5 skipped
• real Zotero status endpoint: HTTP 200, connected=true, verified=true
• configured private-value scan: 0 values present in the push diff