feat: 添加 Provider Registry、StatusLine、Cache Stats 和其他增强

- providerRegistry: OpenAI 兼容 provider 切换（Cerebras/Groq/DeepSeek/Qwen）
- StatusLine: 增强状态栏（缓存命中率、TTL 倒计时、自定义 shell 命令）
- cacheStats: 缓存命中率和 token 签名追踪
- ultrareviewPreflight: 代码审查预检服务
- SkillsMenu/filterSkills: 技能菜单过滤增强
- MagicDocs/langfuse prompts: 提示词更新
- claude.ts: API 客户端更新

Co-Authored-By: glm-5-turbo <zai-org@claude-code-best.win>

src/services/langfuse/__tests__/langfuse.test.ts

@@ -170,6 +170,21 @@ describe('Langfuse integration', () => {
       const result = sanitizeToolOutput('MCPTool', 'mcp data')
       expect(result).toBe('[MCPTool output redacted, 8 chars]')
     })
+
+    test('redacts VaultHttpFetch output (vault tool, PR-2)', async () => {
+      const { sanitizeToolOutput } = await import('../sanitize.js')
+      const result = sanitizeToolOutput(
+        'VaultHttpFetch',
+        'sk-secret-bearer-token',
+      )
+      expect(result).toBe('[VaultHttpFetch output redacted, 22 chars]')
+    })
+
+    test('redacts LocalVaultFetch output (vault tool, future PR-3)', async () => {
+      const { sanitizeToolOutput } = await import('../sanitize.js')
+      const result = sanitizeToolOutput('LocalVaultFetch', 'plaintext-secret')
+      expect(result).toBe('[LocalVaultFetch output redacted, 16 chars]')
+    })
   })
 
   describe('sanitizeGlobal', () => {

src/services/langfuse/sanitize.ts

@@ -7,7 +7,16 @@ const REDACTED_FILE_TOOLS = new Set([
   'FileEditTool',
 ])
 const REDACTED_SHELL_TOOLS = new Set(['BashTool', 'PowerShellTool'])
-const SENSITIVE_OUTPUT_TOOLS = new Set(['ConfigTool', 'MCPTool'])
+// Vault-class tools and tools that intentionally surface user secrets must
+// have their tool_result redacted in Langfuse traces. PR-2 ships VaultHttpFetch;
+// LocalVaultFetch is reserved for a future PR. Adding both here proactively
+// keeps Langfuse export safe even before the tools land.
+const SENSITIVE_OUTPUT_TOOLS = new Set([
+  'ConfigTool',
+  'MCPTool',
+  'VaultHttpFetch',
+  'LocalVaultFetch',
+])
 
 function escapeRegExp(value: string): string {
   return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')