chore(prep): shared groundwork for the Sprint-2 parallel batch

第二批（T6~T11）协调提交：
- 迁移 0005：kb 七表（entity/relation/rule/chunk vector1024+tsv 生成列/
  asset/color/gap），HNSW+GIN 索引，FK 级联
- ORM：七个 Kb* 模型（pgvector Vector/TSVECTOR/Computed）
- 配置：检索与 embedding、华为 JWKS、短信全参数组
- 错误码：40110/40111/42910/42911/61000
- 骨架路由：kb.py + auth_sms.py（已注册）；依赖：tencentcloud-sdk-python-sms
  + spike extra（onnxruntime/opencv）；gitignore：models/ 与 spike 输出

packages/shared/config.py

@@ -168,6 +168,41 @@ class Settings(BaseSettings):
         alias="UPLOAD_SCENES_JSON",
     )
 
+    # --- 知识库与检索（架构 §8.3，TD-08）--------------------------------------
+    kb_vector_dimensions: int = 1024
+    # 当前默认 = 确定性假实现；真实 BGE-M3 ONNX 是后续任务，届时只换这里。
+    kb_embedding_model: str = "deterministic-v1"
+    kb_embedding_device: str = "cpu"
+    retrieval_top_k: int = 50
+    # 重排权重（架构 §8.3 唯一口径）：0.45 向量 + 0.2 关键词 + 0.25 规则 + 0.1 新鲜度。
+    retrieval_rerank_weights: dict[str, float] = Field(
+        default_factory=lambda: {"vector": 0.45, "keyword": 0.2, "rule": 0.25, "freshness": 0.1},
+        alias="RETRIEVAL_RERANK_WEIGHTS_JSON",
+    )
+
+    # --- 华为账号登录（FR-ACC-01；联调待 AGC 配置，见《前置开通清单》§3）------
+    huawei_jwks_url: str = "https://oauth-login.cloud.huawei.com/oauth2/v3/certs"
+    huawei_audience: str = ""  # = AGC App ID；空配置时验签必须拒绝而不是跳过
+    huawei_issuer: str = "https://accounts.huawei.com"
+    huawei_jwks_cache_seconds: int = 86400
+
+    # --- 手机号验证码登录（FR-ACC-04/14，TD-32）--------------------------------
+    # fake = 验证码打日志（dev）；tencent = 真实发送（待签名审核通过后切换）
+    sms_provider: str = "fake"
+    tencent_sms_secret_id: str = ""
+    tencent_sms_secret_key: str = ""
+    tencent_sms_sdk_app_id: str = ""
+    tencent_sms_sign_name: str = ""
+    tencent_sms_template_id: str = ""
+    sms_code_ttl_seconds: int = 300
+    sms_code_length: int = 6
+    sms_verify_max_attempts: int = 5
+    sms_resend_cooldown_seconds: int = 60
+    sms_hourly_limit: int = 5
+    sms_daily_limit: int = 10
+    sms_ip_daily_limit: int = 20
+    sms_device_daily_limit: int = 10
+
     # --- Observability -----------------------------------------------------
     otel_enabled: bool = False
     otel_service_name: str = "meida-api"
@@ -182,6 +217,7 @@ class Settings(BaseSettings):
         "llm_budget_tiers",
         "task_bonus_rules",
         "upload_scenes",
+        "retrieval_rerank_weights",
         mode="before",
     )
     @classmethod