fix(vault): wire provider hot-reload to config.patch event

The previous commit only listened to TopicSystemConfigChanged (periodic
DB refresh), but config.patch from UI fires TopicConfigChanged. Add
subscriber in gateway_lifecycle so vault enrichment picks up provider/
model changes immediately when user saves config.

cmd/gateway_lifecycle.go

@@ -106,6 +106,22 @@ func (d *gatewayDeps) runLifecycle(
 		slog.Info("tts config reloaded", "provider", newMgr.PrimaryProvider(), "auto", string(newMgr.AutoMode()))
 	})
 
+	// Hot-swap vault enrichment provider/model on config changes via pub/sub.
+	if d.updateVaultProvider != nil {
+		d.msgBus.Subscribe("vault-enrich-config-reload", func(evt bus.Event) {
+			if evt.Name != bus.TopicConfigChanged {
+				return
+			}
+			updatedCfg, ok := evt.Payload.(*config.Config)
+			if !ok {
+				return
+			}
+			if p, m := resolveBackgroundProvider(updatedCfg, d.providerRegistry); p != nil {
+				d.updateVaultProvider(p, m)
+			}
+		})
+	}
+
 	// Log orphaned providers on agent deletion. Auto-delete is unsafe because
 	// providers can be referenced by heartbeats (FK), OAuth tokens, media chains.
 	d.msgBus.Subscribe("agent-deleted-provider-log", func(evt bus.Event) {