Add selective Models.dev sync and reviewed upstream diffs #91

Part of #71.

Outcome

Add a maintenance-only Models.dev import that produces a reviewed, pinned metadata snapshot and an upstream diff for the curated Provider allowlist.

Scope

• Fetch and validate Models.dev in an explicit maintenance/build workflow.
• Filter to the approved Provider allowlist.
• Import only non-secret metadata such as model IDs, limits, modalities, and pricing.
• Generate a deterministic snapshot and human-reviewable upstream diff.
• Retain provenance, schema version, tested date, offline fallback, and rollback.

Non-goals

• Runtime network authority, automatic Provider enablement, route/auth changes, or mutation of user settings.

Acceptance criteria

• Import is deterministic for a pinned upstream response.
• Schema drift and unknown fields fail closed with a reviewable report.
• New Providers or models are never auto-enabled.
• Base URLs, auth, protocol, and capability claims remain CodexHub-reviewed data.
• Offline builds use the last reviewed snapshot.

Required verification

• Pinned fixture and schema-drift tests.
• Snapshot determinism and upstream-diff tests.
• Offline and rollback tests.