feat: add provider models endpoint and fix Settings Save buttons

[AmidVoshakul]

Summary

Adds /api/providers/:id/models endpoint and fixes Settings functionality issues:

• Fixes Save buttons not working in Settings > Config (CSP was blocking Alpine.js)
• Model dropdown now filters to show only models for selected provider
• Auto-resets model to provider's default when provider changes

Changes

• API: New GET /api/providers/:id/models returns available models for a specific provider
• ModelCatalog: New default_model_for_provider() method for default model per provider
• Settings: Model dropdown dynamically filters by selected provider
• Settings: Save buttons now work (CSP relaxed with 'unsafe-inline')
• Config: Provider auth_status only shows "configured" when both URL and API key exist

Testing

• Live integration tested - Settings > Config shows correct models per provider
• Verified model resets to default when provider changes
• Agents > Spawn form works correctly

Security

• No new unsafe code
• No secrets in diff
• User input validated at API boundaries