Fix model availability and simplify provider setup

[ZeroPoint95]

Provider setup now starts with a choice. Model pickers show only models available through connected providers.

Changed

• Provider selection: Show all nine supported providers in one flat list. OpenRouter is first and initially selected; Ollama is second. No extra providers menu or page counter.
• Add another provider: The later + add a provider menu shows the same nine setup options, marked connected or not connected. /connect includes OpenRouter too. Add OpenRouter after Ollama using its browser/key form without repeating onboarding or losing the draft. Connected rows open provider management; saved OpenRouter keys can be removed with two-Enter confirmation, while shell credentials explain how to disconnect.
• Browser sign-in: OpenRouter and Codex both say enter connects in browser and wait for confirmation. Authorization links use short clickable text. Ctrl+Y copies the complete URL during setup.
• Setup navigation: Keep the numbered connection and basic-settings screens. Esc skips idle setup; during a connection attempt, it cancels first. Back cancels unfinished work, and late responses cannot advance setup or switch models. Working connections bypass the chooser.

Fixed

• Fresh-install terminal test: Confirm the initially selected OpenRouter row with Enter. The test no longer moves to Ollama before checking the OpenRouter connection screen.
• Available models only: List each connected provider's own models, including installed Ollama models and explicitly anonymous custom APIs. Combine catalogs when several providers are connected. Removing a connection or its credentials removes its rows after refresh or relaunch. Public catalogs and built-in guesses cannot make disconnected providers selectable.
• Available default model: Keep the preferred model only when it appears in the available catalog; otherwise choose a listed model. With no known models, show no assumed default and hold the draft until discovery completes. Automatic replacements preserve the saved preference.
• Model confirmation: Enter selects the highlighted model and immediately closes the picker. /model and model-name clicks in both Home and chat apply the selected model to actual requests. Drafts stay intact, and confirmation with no matching model changes nothing.

Validation

• Fresh-install regression: The real tmux subtest reproduced the timeout before the fix and passed afterwards. It checks Enter on the default OpenRouter row, the connection screen, the two-step title and Escape out of setup. Provider keys are removed from the launched process; no live credential or model call is needed.
• PR gate passes: make pr-ready BASE=d0a6f4995 passes after merging current dev and resolving the getting-started manual conflict. Build, vet, packed manual, laws, config, e2e, manual, modelsource and every TUI shard pass. The three former completion failures are cleared. The command real-init test still fails, but the gate reproduced it on dev and classified it as pre-existing.
• Manual checks: Disposable Docker profiles covered five real Ollama models, provider combinations, credential removal and recorded request model IDs. Native trials covered isolated homes, profile resume, provider ordering, full authorization links and reachable browser callbacks. A fresh Docker terminal also covered Ollama onboarding, all nine later provider choices, adding OpenRouter through a controlled API fixture, a request with the selected cloud model and key, and removing OpenRouter while preserving all five Ollama models.
• Rebuilt: Native and Docker binaries use 27287499c. The Docker launcher opens a fresh shell; run codeaf inside to start it.

The compiled manual and unreleased change entry are updated. Keep this PR as a draft for manual evaluation.

[ZeroPoint95]

Review pass on 9376454: full diff read, build/vet/laws battery, race run on touched packages, and a trial merge with current dev.

Must fix

The fresh-install e2e step now chooses Ollama instead of OpenRouter. internal/e2e/tui_e2e_test.go:235 presses Down then Enter on the new provider chooser and then waits for the connect openrouter heading, the sign in once in your browser sentence and the setting up · 1 of 2 title. That sequence predates the commit that put OpenRouter first and preselected it: Down now lands on Ollama, whose screen reads connect ollama and starts a local probe, so the subtest times out after twenty seconds. Press Enter alone (or Home, Enter). CI never runs this lane (e2e tag, tmux and a real provider key), and the suite skips without a key, so this is verified by reading setupProviderRows/providerCatalog, not by execution.

Not this PR's doing, for the record

The three red completion tests (TestANewAtTokenWaitsForTheWalkInFlightAndIsSettledByItsFollowUp, TestRecentWalksNeverOverlapAndCoalesceOpeningBursts, TestAtBoxesShareOnePendingRecentCatalog) fail at the merge base 0dbeccf exactly as the description says. They pass on current dev and on a trial merge of this branch with dev, so merging clears them; a rebase would make the branch's own gate green.

Verified clean

Check	Result
Build darwin + windows, vet, make test-laws	clean
go test -race on touched packages	only failures already present on dev, the three base-side tests above, and one flake in untouched teams code
Trial merge with dev (5 commits behind, 11 overlapping files)	builds, vets, touched-package tests pass except the known cmd/codeaf real-init failure dev already has
Binary size vs SIZE-BUDGET	under budget
CI on 9376454	all green

Traced the risky parts: the available-model gate applies only to local doors; the key revoke on disconnect reaches the live process; cancelled setup attempts cannot persist a credential or move the model; the catalog warm runs off the loop; a keyless custom CODEAF_BASE_URL cannot reach the empty-picker state because the process refuses to open without a key. Manual and changelog claims match the code.

Leaving this as a draft per the description's request for manual evaluation.