fix(cli): honor an explicit --router on configure provider

[249469326i-lang]

Fixes #1341

Summary

• The headless configure provider branch applied the provider payload and persisted immediately, so an explicit --router disabled was silently dropped: a fresh profile reported routerMode: "recommended" and synthesized the default c0–c3 tier ladder instead of disabling the router.
• The explicit flag is now plumbed through to the router mutation after the provider apply (same order as the onboard --provider path).

Semantics

• Explicit --router <mode> is authoritative, matching the command help (recommended | openrouter-mix | disabled).
• Omitted --router keeps the stored/synthesized router state untouched on a re-save (a provider key rotation never re-enables a disabled router).
• An invalid mode now exits 2 with the mode validation message instead of being silently ignored.

Tests

• tests/test_cli/test_onboard_cmd_headless_semantics.py:
  • fresh-config repro: configure provider --router disabled yields [squilla_router] enabled = false;
  • keep-current: a provider re-save without --router leaves a disabled router disabled;
  • invalid --router exits 2 naming the mode constraint.
• Focused suites: 42 passed (headless semantics) + 341 passed (related onboard/mutation suites); ruff clean.
• Manually verified on Windows: the released 0.5.4 CLI reports routerMode: "recommended" for the issue's repro command; after this fix the same command reports "disabled" and writes enabled = false to config.toml.