feat(toolset): 工具系统重构为 toolset 统一管理，新增系统预置工具集

将工具管理从"agent 挂单个 tool"改为"agent 挂 toolset"模式：
- 三个系统预置工具集（system_basic/system_chat/system_workflow）入 DB
- 新增 send_file 工具（系统对话工具集）、修复 approval actor 调用 bug
- 后端 agent 加载全部走 toolset 链路，移除 load_tools_from_list
- 前端工具集中心卡片展示 + agent 配置改为 toolset 多选
- resource API 增加 category 过滤与系统 toolset 保护

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

kilostar/api/resource.py

@@ -290,16 +290,22 @@ async def create_custom_toolset(
 
 @resource_router.get("/custom-toolset")
 async def list_custom_toolsets(
+    category: Optional[str] = None,
     token_data: TokenData = Depends(RoleChecker(allowed_roles=UserAuthority.USER)),
 ):
-    """列出工具组：USER 只能看到自己的；ADMIN 及以上可看全部。"""
+    """列出工具组：支持按 category 过滤。USER 只能看到自己的+系统的；ADMIN 看全部。"""
     from kilostar.utils.check_user.role_check import get_authority
 
     global_state_machine = ray_actor_hook("global_state_machine").global_state_machine
     toolsets = await global_state_machine.list_custom_toolsets.remote()
     authority = await get_authority(token_data.user_id)
     if authority < UserAuthority.ADMINISTRATOR:
-        toolsets = [t for t in toolsets if t.get("owner_id") == token_data.user_id]
+        toolsets = [
+            t for t in toolsets
+            if t.get("is_system") or t.get("owner_id") == token_data.user_id
+        ]
+    if category:
+        toolsets = [t for t in toolsets if t.get("category") == category]
     return {"toolsets": toolsets}
 
 
@@ -326,6 +332,8 @@ async def update_custom_toolset(
     existing = await global_state_machine.get_custom_toolset.remote(toolset_id)
     if not existing:
         raise HTTPException(status_code=404, detail="Custom toolset not found")
+    if existing.get("is_system"):
+        raise HTTPException(status_code=403, detail="系统预置工具集不可修改")
     await _assert_toolset_owner_or_admin(existing, token_data)
     name = body.name if body.name is not None else existing["name"]
     tools = body.tools if body.tools is not None else existing["tools"]
@@ -348,11 +356,13 @@ async def delete_custom_toolset(
     toolset_id: str,
     token_data: TokenData = Depends(RoleChecker(allowed_roles=UserAuthority.USER)),
 ):
-    """删除工具组：USER 只能删自己的；ADMIN 及以上可删任意。"""
+    """删除工具组：系统预置不可删；USER 只能删自己的；ADMIN 及以上可删任意用户的。"""
     global_state_machine = ray_actor_hook("global_state_machine").global_state_machine
     existing = await global_state_machine.get_custom_toolset.remote(toolset_id)
     if not existing:
         raise HTTPException(status_code=404, detail="Custom toolset not found")
+    if existing.get("is_system"):
+        raise HTTPException(status_code=403, detail="系统预置工具集不可删除")
     await _assert_toolset_owner_or_admin(existing, token_data)
     ok = await global_state_machine.delete_custom_toolset.remote(toolset_id)
     if not ok: