feat: bring-your-own inference providers and CLI agent bridging

[simonhagger]

Summary

Completes the AI substrate with two remote inference paths alongside local llama.cpp:

• OpenAI-compatible endpoints (OpenRouter / OpenAI / LM Studio / custom baseUrl): config persisted through the sensitive-classified StorageGateway entry; chat-completions requests are built and sent from desktop-main only — the API key is never returned to the renderer (config-get reports \�piKeyPresent\ only)
• CLI agents with their own OIDC logins (\claude, \codex, \opencode): PATH detection via --version\ probe, non-interactive prompt execution with per-agent argument mapping, stderr-tail surfaced on failure
• New validated channels: \�i:provider-config-get/save, \�i:cli-detect, \�i:remote-generate; preload + \DesktopAiApi\ extensions
• AI Lab Bring-Your-Own Inference section: endpoint form, CLI picker, run output

Security notes: egress happens exclusively in main inside the validated-envelope boundary; provider config stored \classification: sensitive\ (encrypted at rest via safeStorage when available); config-save logging records baseUrl/model/key-presence only. Threat model refresh deferred until agent-loop features land; no new trust boundary introduced by this increment.

Validation

• 6 new ai-providers tests (request shape, auth header, provider HTTP errors, malformed payloads, arg mapping, failure surfacing); desktop-main TS suite green
• contracts/api/preload/main builds green; renderer build (ai-lab chunk 43.41 kB), renderer tests, and repo-wide lint green
• Full matrix: build + lint + test green across all 12 projects

Security Checklist

• Security review completed
• Threat model updated or N/A explained
• Confirmed no secrets/sensitive data present in committed files