fix(desktop): auto-recover dangling model refs on provider removal

[SivanCola]

Summary

When a provider is deleted or replaced in desktop settings, tabs with stale model refs (default_model, planner_model, tab.model) would fail at startup with unknown model "deepseek-flash" (configured: glm-4v) errors. This adds automatic fallback to the first configured provider, fixes all open tab refs on provider deletion, and shows actionable recovery UI.

Key changes

• ResolveModelWithFallback — resolves a model ref with automatic fallback to the first configured provider when the ref is stale. Only picks providers with a valid API key.
• RemoveProvider auto-migration — detects both "name" and "name/model" refs in default_model and planner_model. Auto-migrates to fallback instead of blocking. Only refuses when no other configured provider exists.
• buildTabController / rebuild / currentProviderEntryForTab — all use fallback resolution so stale refs don't crash the session.
• DeleteProvider tab sync — traverses all open tabs and fixes model refs targeting the deleted provider. Always calls rebuild() and propagates errors.
• Settings health diagnostics — SettingsView now exposes currentModel, currentModelValid, defaultModelValid, plannerModelValid, modelWarning.
• Sync methods — SyncActiveTabModelToDefault() and SyncAllTabModelsToDefault() Wails bindings with frontend buttons.
• Startup error recovery UI — structured error fields (startupErrCode, startupErrModel, startupErrConfigured, startupRecoveryModel). Banner shows "Switch to X" button, "Open model settings" shortcut, and expandable error details.
• SetModelForTab fix — now clears tab.StartupErr, sets tab.Ready = true, and emits agent:ready so the frontend refreshes Meta/Balance/Effort after model recovery.

Risk mitigations verified

1. LoadForRoot loads global credentials via loadDotEnvForRoot before ResolveModelWithFallback is called — Configured() correctly detects keyed providers.
2. CLI does not call config.RemoveProvider — the auto-migration semantic is desktop-only in practice.
3. DeleteProvider correctly propagates rebuild() errors (no _ = a.rebuild()).
4. StartupErrorBanner uses useController.setModel which dispatches Meta/Context/Effort refreshes after recovery.

Test plan

go test ./internal/config/...     # 15 new tests + all existing pass
cd desktop && go test ./...       # existing tests pass
cd desktop/frontend && npm run build  # type check passes (pre-existing Wails errors only)