feat: move the model-abuse guard onto its own LLMs sub-tab

[atomantic]

Summary

• Move the Prompt Guard install card off the Model Library header onto a dedicated /models/llms/abuse sub-tab next to Model Library.
• Track each setup stage (Hugging Face token, host Python, dedicated venv, classifier packages, pinned model snapshot) with live install progress.
• Register the page in ⌘K / voice as Abuse Guard (prompt guard, model-abuse) without adding a Models sidebar sibling.

Test plan

• Server: modelAbuseGuard contract + status stages, navManifest tab coverage including /models/llms/abuse, local-LLM security-guard routes, palette manifest.
• Client: Local LLM tab routing (Runtimes / Model Library / Abuse Guard), Models drill-down for /models/llms/abuse, Abuse Guard panel stage checklist and install progress events.
• Open Models → LLMs → Abuse Guard and confirm the library header is no longer dominated by the guard card.
• Confirm each stage reflects current host status, and that Install/Cancel still complete the pinned Prompt Guard install.