Add Model Settings: provider profiles, registry, API, LLM tests and frontend UI

[Spbd1]

Motivation

• Provide a configurable Model Settings dashboard so users can select deterministic, local, paid remote, or custom OpenAI-compatible LLM providers from the UI.
• Ensure paid API secrets are never stored in the browser and are read only from backend environment variables.
• Ship sensible default provider profiles (deterministic baseline, LM Studio, Ollama, OpenAI, OpenRouter, custom) and a simple testing mechanism to validate connectivity and capabilities.

Description

• Backend: added provider data model, registry, LLM client test logic, and settings service and API endpoints for listing/upserting/patching providers, testing connections, and getting/setting the active provider (engine/argument_risk_engine/classification/model_provider.py, provider_registry.py, llm_client.py, backend/app/services/settings_service.py, backend/app/api/routes_settings.py, backend/app/schemas/settings.py).
• Persistence and defaults: added JSON-backed default provider profiles and app settings under data/config/ and implemented safe read/write handling in the provider registry that normalizes legacy fields and strips secret values on patches.
• Provider testing: implemented deterministic provider short-circuit; for OpenAI-compatible providers try GET /models and fall back to a minimal chat completion, and return status, latency_ms, warnings, models, and detail while never exposing raw key values.
• Frontend: added Model Settings page and components with provider cards, editable base URL/model/timeout/max_tokens/temperature fields, API-key environment variable name input (not raw keys), test panel, active-provider selection, warnings for remote/paid providers and unverified JSON mode, and client API bindings/types (frontend/src/components/settings/*, frontend/src/api/*, frontend/src/components/layout/Sidebar.tsx).

Testing

• Ran pytest -q and all backend tests passed: 19 passed, 3 warnings (no failures).
• Built the frontend with npm run build and the build completed successfully (frontend artifacts created in dist/).
• Added automated API tests covering provider defaults, deterministic provider test, active-provider selection, and secret-metadata-only behavior which all passed.

---

Codex Task