feat(llm): 内置 LLM 供应商配置与审核主链接入骨架

配置层:
- Settings 新增 llm_provider/api_key/base_url/model/timeout/max_tokens
- 生产 fail-closed: GAOKAO_LLM_PROVIDER=none 禁止, provider!=none 且 API key 为空禁止
- .env.docker.example / .env.payment.example 补 LLM 变量
- payment_readiness_doctor 将 LLM 配置纳入 readiness 检查

基础设施:
- 新增 data/llm/client.py: OpenAI-compatible LLMClient
- 新增 data/llm/prompts.py: audit/cwb/full_plan prompt 模板
- 新增 data/llm/tests/test_llm.py: 12 个单元测试

主链接入:
- ReviewResultContract 新增 llm_generated / llm_summary / llm_cwb_suggestions
- _start_review_result 优先尝试 LLM 生成审核结果, 失败时回退到原规则默认逻辑
- cwb 页面优先展示 LLM 生成的三档建议

测试适配:
- conftest / health / app / p2_4 tests 注入默认 LLM 测试配置，避免被新 fail-closed 提前拦截

验证:
- data/llm/tests 12 passed
- 核心 prod settings tests 62 passed

.env.docker.example

@@ -9,6 +9,13 @@ GAOKAO_ORDERS_FERNET_KEY=replace-with-strong-orders-fernet-secret-before-product
 GAOKAO_PORTAL_UPLOAD_DIR=/var/lib/gaokao/portal_uploads
 GAOKAO_PORTAL_UPLOAD_MAX_BYTES=5242880
 GAOKAO_PORTAL_UPLOAD_MAX_FILES=5
+# LLM 自动审核 / 方案生成（生产环境必须配置）
+GAOKAO_LLM_PROVIDER=dashscope
+GAOKAO_LLM_API_KEY=replace-with-real-llm-api-key
+GAOKAO_LLM_BASE_URL=https://dashscope.aliyuncs.com/compatible-mode/v1
+GAOKAO_LLM_MODEL=qwen-plus
+GAOKAO_LLM_TIMEOUT=60
+GAOKAO_LLM_MAX_TOKENS=4096
 GAOKAO_PAYMENT_PROVIDER=mock
 GAOKAO_PAYMENT_BASE_URL=https://example.com
 GAOKAO_PAYMENT_WEBHOOK_SECRET=replace-with-independent-payment-webhook-secret