fix(lobe-chat): repoint the System Agent off its gpt-5-mini default onto fleet models

The gpt-5-mini calls were Lobe's System Agent -- a background model,
separate from the chat model, used for auto-naming conversations, history
summarization, translation, query rewrite, thread naming, and assistant
metadata. Its default is openai/gpt-5-mini, which our OpenAI provider (the
gateway) forwards verbatim; the scoped key blocks it, so every background
task 403'd and the log filled with 'Tried to access gpt-5-mini' while
auto-naming silently failed.

Set SYSTEM_AGENT to route all six documented keys (topic, translation,
agentMeta, queryRewrite, historyCompress, thread) at fleet models --
summarizer for the naming/summarize tasks (same seat as gen at temp 0),
gen where quality matters. Any key left unset falls back to the gpt-5-mini
default, so all six are explicit.

Notably this one IS env-configurable (SYSTEM_AGENT), unlike the per-model
output-token cap which is UI-only -- a mixed result on the
manageable-by-agent axis.

stacks/lobe-chat/.env.example

@@ -8,3 +8,5 @@ OPENAI_PROXY_URL=http://10.250.50.70:4000/v1
 OPENAI_API_KEY=
 ACCESS_CODE=
 KEY_VAULTS_SECRET=
+# System-agent background model routing (avoids the gpt-5-mini default 403ing on the scoped key)
+SYSTEM_AGENT=topic=openai/summarizer,translation=openai/gen,agentMeta=openai/gen,queryRewrite=openai/summarizer,historyCompress=openai/summarizer,thread=openai/summarizer

stacks/lobe-chat/README.md

@@ -153,3 +153,23 @@ ssh lkraven@10.0.50.45 'cd /opt/docker/compose/lobe-chat && docker compose up -d
 
 `lkraven` owns `/opt/docker` and is in the `docker` group on this host, so no sudo
 is needed. Note ESH is outside the infra-ops NOPASSWD grant.
+
+## System Agent — why `gpt-5-mini` was being called
+
+Lobe has a **System Agent**: a background model, separate from your chat model,
+that auto-names conversations, summarizes history, rewrites RAG queries, and
+generates assistant metadata. **Its default is `openai/gpt-5-mini`.** Because our
+OpenAI provider is the gateway, that model name is forwarded verbatim to LiteLLM,
+and the scoped key (local models only) 403s it — filling the gateway log with
+"Tried to access gpt-5-mini" and silently breaking auto-naming.
+
+Fixed by env (`SYSTEM_AGENT`), so this is scriptable, not a UI setting — a point
+IN Lobe's favour on the manageable-by-agent axis, unlike the output-token cap:
+
+```
+SYSTEM_AGENT=topic=openai/summarizer,translation=openai/gen,agentMeta=openai/gen,queryRewrite=openai/summarizer,historyCompress=openai/summarizer,thread=openai/summarizer
+```
+
+All six documented keys are set explicitly — any omitted key falls back to the
+`gpt-5-mini` default. `summarizer`/`classifier` are the same seat as `gen` at
+temp 0, the right fit for naming/summarizing; `gen` where output quality matters.

stacks/lobe-chat/compose.yaml

@@ -58,6 +58,16 @@ services:
       # Pin the visible model list so the picker shows fleet seats rather than
       # Lobe's built-in OpenAI catalogue (which would 404 against the gateway).
       - OPENAI_MODEL_LIST=${OPENAI_MODEL_LIST:--all,+gen,+gen-reasoning,+char-rp,+char-rp-reasoning,+char-rp-fable,+summarizer,+summarizer-large,+classifier,+image-judge,+coder-fast,+chat-judge}
+      # SYSTEM AGENT — the background model Lobe uses for auto-naming
+      # conversations (topic), history summarization, translation, query
+      # rewrite, thread naming, and assistant-meta generation. ITS DEFAULT IS
+      # `openai/gpt-5-mini`, which our OpenAI provider (= the gateway) forwards
+      # verbatim; the scoped key does not grant gpt-5-mini, so every background
+      # task 403s and the log fills with "Tried to access gpt-5-mini". Repoint
+      # ALL keys at fleet models (any key left unset falls back to gpt-5-mini).
+      # summarizer/classifier are the same seat as gen at temp 0 -- the right
+      # fit for naming/summarizing; gen where output quality matters.
+      - SYSTEM_AGENT=${SYSTEM_AGENT:-topic=openai/summarizer,translation=openai/gen,agentMeta=openai/gen,queryRewrite=openai/summarizer,historyCompress=openai/summarizer,thread=openai/summarizer}
       # LAN-exposed on a home-lab segment with no auth in front: gate it.
       - ACCESS_CODE=${ACCESS_CODE:?set in .env, from the vault}
       # Encrypts any provider keys a user stores in the UI.