fix: 将 litellm 依赖窗口收敛到已验证上界(排除 1.99.0 回归) (#2320)

* Exclude litellm 1.99.0 from allowed versions

litellm 1.99.0 (released 2026-09-01T00:42:41Z) now forwards the
prompt_cache_key argument to the OpenAI provider. The provider cache
contract test asserts the key is not passed through without verified
capture, so CI backend-tests (3/3) and the downstream backend-gate
went red on every branch right after the release, unrelated to any
code change.

Local capture server reproduction: with 1.98.0 the captured request
body carries no prompt_cache_key; with 1.99.0 it carries
prompt_cache_key=cache-key. This one-line exclusion follows the
existing quarantine pattern for 1.82.7 / 1.82.8 and keeps the tested
behaviour until the contract is adapted deliberately.

* Bound litellm below the 1.99.0 behavioral change

Pin the dependency window to a verified upper bound (latest 1.98.x)
instead of quarantining only 1.99.0, and sync every doc that hardcodes
the litellm constraint string so docs cannot drift from requirements.txt
again.

* Sync .env.example runtime constraint comment to the litellm upper bound

requirements.txt

@@ -38,7 +38,7 @@ orjson>=3.10,<4             # LiteLLM runtime JSON dependency; explicitly bundle
 
 # AI analysis
 # Keep the historical minimum version while excluding quarantined builds and avoiding future major breaks.
-litellm>=1.80.10,!=1.82.7,!=1.82.8,<2.0.0   # Unified LLM client (Gemini/Anthropic/OpenAI/DeepSeek etc.)
+litellm>=1.80.10,!=1.82.7,!=1.82.8,<1.99.0   # Unified LLM client (Gemini/Anthropic/OpenAI/DeepSeek etc.)
 tiktoken>=0.8.0,<0.12.0    # BPE tokenizer for LLM token counting (pin <0.12 to avoid plugin registration issues, #537)
 openai>=1.0.0               # OpenAI SDK (transitive dependency of litellm, kept explicit)
 PyYAML>=6.0                 # YAML parser for LITELLM_CONFIG support