Add guided API-key Provider onboarding from curated presets #90

Part of #71.

Outcome

Add a guided API-key onboarding flow that instantiates a reviewed Provider preset or a fully custom Provider without weakening existing configuration ownership.

Scope

• Offer curated presets, search/filter, and a custom Provider option from Add Provider.
• Prefill reviewed endpoint/protocol defaults.
• Accept an API key or environment-variable reference.
• Run model discovery and protocol probes and preview models and compatibility warnings.
• Atomically save, regenerate the catalog, and synchronize enabled clients.
• Handle existing IDs with update, save-as-new, and cancel.

Non-goals

• OAuth, subscription login, secret-vault migration, or silent preset updates to existing user configuration.

Acceptance criteria

• Users can complete onboarding for a supported API-key preset and for a custom Provider.
• Upstream credentials remain backend-only and are redacted from logs, diagnostics, and errors.
• Probe/discovery failures preserve the draft and produce actionable recovery choices.
• Preset updates never overwrite user-owned URL, protocol, models, capabilities, or ordering.
• Save/catalog/client synchronization is atomic and recoverable.

Required verification

• Frontend UI-contract tests and production build.
• Provider config, probe, catalog, redaction, and rollback tests.
• Focused manual onboarding smoke for one preset and one custom Provider.