fix(config): layer root and env compose files with expanded overrides

Load agent/cursor env overrides in config loader; pass root .env plus
environment-specific env files in env-service; align compose env_file mounts.

Co-authored-by: Cursor <cursoragent@cursor.com>

docker-compose.dev.yml

@@ -60,7 +60,6 @@ services:
       MINIMAX_API_TYPE: ${MINIMAX_API_TYPE:-openai-compatible}
       MINIMAX_PROVIDER: minimax
       TAVILY_API_KEYS: ${TAVILY_API_KEYS:-}
-      TAVILY_API_KEY: ${TAVILY_API_KEY:-}
       RUNNER_AUTH_TOKEN: ${RUNNER_AUTH_TOKEN:-}
     ports:
       - "127.0.0.1:${PI_AGENT_RUNNER_PORT:-18865}:18865"
@@ -94,19 +93,38 @@ services:
       HTTP_PORT: "${HTTP_PORT:-8080}"
       HTTP_HOST: "0.0.0.0"
       AGENT_BACKEND: ${AGENT_BACKEND:-pi-agent}
+      AGENT_TIMEOUT: ${AGENT_TIMEOUT:-30m}
+      MAX_CONCURRENT_AGENTS: ${MAX_CONCURRENT_AGENTS:-8}
       DATA_DIR: /app/data
       # 独占业务与对话库
       APP_DB_DSN: postgres://${SYSTEM_DB_USER:-app}:${SYSTEM_DB_PASSWORD:-dev_secret_db_pass}@system-db:5432/${SYSTEM_DB_NAME:-agent_system_dev}?sslmode=disable
       # 共享知识库
-      POSTGRES_SHARED_KB_DSN: postgres://${KB_DB_USER:-regkb}:${KB_DB_PASSWORD:-shared_kb_secret_pass}@shuimu-kb-shared:5432/${KB_DB_NAME:-regulations}?sslmode=disable
+      POSTGRES_SHARED_KB_DSN: postgres://${KB_DB_USER:-regkb}:${KB_DB_PASSWORD:?KB_DB_PASSWORD is required}@shuimu-kb-shared:5432/${KB_DB_NAME:-regulations}?sslmode=disable
       CURSOR_RUNNER_URL: http://cursor-agent:18765
       PI_AGENT_RUNNER_URL: http://pi-agent:18865
       PI_AGENT_RUNNER_AUTH_TOKEN: ${RUNNER_AUTH_TOKEN:-}
       PI_AGENT_PROVIDER: ${PI_AGENT_PROVIDER:-minimax}
       PI_AGENT_MODEL: ${PI_AGENT_MODEL:-MiniMax-M2.7-highspeed}
       RUNNER_AUTH_TOKEN: ${RUNNER_AUTH_TOKEN:-}
-      ALLOW_IN_MEMORY: "false"
-      AUX_FILE_DSN: file:/var/lib/feishu/outbox_dev.db?_journal_mode=WAL&_busy_timeout=5000
+      EMBEDDING_ENDPOINT_URL: ${EMBEDDING_ENDPOINT_URL:-}
+      EMBEDDING_MODEL: ${EMBEDDING_MODEL:-bge-m3}
+      EMBEDDING_API_KEY: ${EMBEDDING_API_KEY:-}
+      RERANKER_ENDPOINT_URL: ${RERANKER_ENDPOINT_URL:-}
+      RERANKER_MODEL: ${RERANKER_MODEL:-bge-reranker-v2-m3-free}
+      RERANKER_API_KEY: ${RERANKER_API_KEY:-}
+      ADMIN_USERNAME: ${ADMIN_USERNAME:-admin}
+      ADMIN_PASSWORD: ${ADMIN_PASSWORD:-admin-secret-password-123}
+      AUTH_REGISTRATION_ENABLED: ${AUTH_REGISTRATION_ENABLED:-true}
+      AUTH_REQUIRE_APPROVAL: ${AUTH_REQUIRE_APPROVAL:-false}
+      CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-}
+      ALLOW_IN_MEMORY: ${ALLOW_IN_MEMORY:-false}
+      CACHE_ENABLED: ${CACHE_ENABLED:-true}
+      INTENT_V2_SHADOW: ${INTENT_V2_SHADOW:-false}
+      INTENT_V2_DECISION: ${INTENT_V2_DECISION:-false}
+      INTENT_V2_DECISION_TIER: ${INTENT_V2_DECISION_TIER:-none}
+      WORKFLOW_INTENTS_ENABLED: ${WORKFLOW_INTENTS_ENABLED:-true}
+      MULTI_INTENT_ENABLED: ${MULTI_INTENT_ENABLED:-true}
+      SEMANTIC_FALLBACK_ENABLED: ${SEMANTIC_FALLBACK_ENABLED:-false}
     ports:
       - "${APP_PUBLISH_HOST:-127.0.0.1}:${HTTP_PORT:-8080}:${HTTP_PORT:-8080}"
     healthcheck: