fix: resolve historical repair targets from live provider config

[a328153009-droid]

在 CCS 等外部工具把当前 Provider 从 A 切到 B 后，“修复历史会话”仍可能优先选择上次保存的 A；即使 live config 中已没有 A 的映射，原实现也允许把会话再次写成 A，导致 Model provider not found。本 PR 让现有修复入口优先使用当前可解析的 Provider，并在写入前验证目标。

Changes

• Parse live config.toml as TOML. Custom provider IDs must match an exact table key; openai remains built in. IDs are data-driven and case-sensitive, including quoted keys.
• Keep history-only/manual IDs visible but unavailable for repair when their live mapping is missing. Prefer the current resolvable provider over a saved selection, and persist a selection only after successful repair.
• Recheck the current provider and target mapping after scanning, before creating a backup or rewriting history. An intervening provider switch aborts the repair.
• Preserve the meaning of an omitted target as “use current” through the manager preflight. The launcher now propagates a skipped/failed automatic repair instead of continuing launch as if it succeeded.
• Reuse the existing rollout/SQLite/catalog repair. Configuration and authentication files remain read-only in this path.

Validation

• macOS arm64: cargo test --workspace --all-features exposed one existing failure: a_busy_floating_helper_port_fails_immediately_without_waiting expects 1 attempt although the upstream macOS retry implementation makes 31 attempts. Neither that test nor the core retry implementation is changed here.
• The same workspace suite with only that test excluded: 1,228 passed, 0 failed, 2 ignored. This includes the provider repair and launcher/manager tests.
• Added A → B → A → openai regression coverage checking rollout/SQLite convergence and unchanged config/auth bytes and message body; exact quoted provider IDs; absent/malformed mappings; and a switch at the pre-write boundary.
• Frontend: 162 tests passed; TypeScript check and Vite production build passed.
• cargo clippy --workspace --all-targets --all-features: completed successfully with warnings; not a warning-free lint claim.
• git diff --check: passed. Repository-wide rustfmt remains affected by existing formatting drift; unrelated formatting was not rewritten.
• No real user session migration or packaged desktop end-to-end validation was performed for this extracted PR branch.

Scope

Related to #2090: this addresses unsafe target selection in the existing repair path. It does not add the per-session keep/fork policy proposed there or guarantee cross-provider replay of encrypted reasoning content. Automatic repair remains opt-in. External changes after history writes have begun are not made transactional by this patch.

This is independent of #2084's streaming/progress work and #1903's thread-fork workflow, though their shared repair/UI files may need merge reconciliation.

[a328153009-droid]

补充当前提交 95c3002 的云端验证：fork PR build artifacts。使用上游原有 workflow，未修改打包脚本或 CI。

• Windows：前端测试、TypeScript、前端构建、完整 cargo test --workspace、release 构建及 NSIS 打包全部通过；binaries / installer artifacts 已上传。这一平台的 Rust 测试没有排除用例。
• macOS arm64：release 构建、DMG 打包及 bundle 结构验证全部通过；DMG artifact 已上传。
• macOS x64：release 编译通过（9m36s），DMG 打包失败。日志为 hdiutil: couldn't eject "disk4" - Resource busy，之后 5 次 convert 均为 Resource temporarily unavailable。没有产出 x64 DMG，不将此 run 标为全绿。

#2098 的独立分支也遇到相同的 x64 镜像卸载/转换失败。两个 PR 都未改动相关打包脚本；底层占用源尚未确定，未另跑 main 基线。本次保留 Provider 修复范围，不混入独立打包修改。

主仓 run 目前需要维护者批准（action_required），烦请批准运行。以上安装包构建验证不等同于真实用户历史会话迁移或 Electron 端到端验证；PR 描述中的运行时边界仍然适用。

[BigPizzaV3]

复审通过。已核实：改动将历史修复目标从旧文件引用改为从活 provider 配置（config.toml + provider 表）解析快照，并增加 revalidate 保护、failed-closed 语义；本地 Rust provider_sync 49/49 通过、app 层 provider-sync-target.test.ts 3/3 通过（含 history-only/legacy targets fail closed）；与最新 main 三-way 合并干净。当前分支无 GitHub checks（UNSTABLE）建议作者触发一次三平台 CI 留档，但本地验证充分，予以合并。