fix(models): include extension-registered providers in settings and auth routes

[elrond298]

Problem

Providers registered by an extension package (any extension that calls
pi.registerProvider / createProvider while loading resources) never appear in the
Models config panel, so their credentials cannot be managed from Pi Web — even though
the composer's model selector offers them and they work in a session.

With such an extension installed and its key stored in auth.json:

• /api/models → lists the provider's models ✅
• /api/auth/providers → apiKeyProviders has no entry for that provider ❌

Root cause

Extension providers reach a model runtime in createAgentSessionServices(): it runs the
resource loader, then replays pendingProviderRegistrations onto its ModelRuntime
(dist/core/agent-session-services.js).

/api/models builds its runtime that way — hence the model is offered in the composer.
The four auth routes instead called a bare ModelRuntime.create(), which only knows
built-in providers plus models.json. getProviders() never contained the extension
provider (so the panel could not list it) and getProvider(id) returned undefined for
its login / logout / save-key paths.

Fix

New lib/model-runtime.ts exports createModelRuntimeWithExtensions(), which builds the
runtime through createAgentSessionServices({ cwd: agentDir, agentDir }). All four auth
routes now use it:

• app/api/auth/providers/route.ts — panel listing
• app/api/auth/api-key/[provider]/route.ts — save key
• app/api/auth/login/[provider]/route.ts — OAuth / device-code login
• app/api/auth/logout/[provider]/route.ts — OAuth logout

Deliberate choices:

• cwd is the agent dir, not a request-supplied project. Only global package extensions
  load; a browsed repository's project-local .pi/extensions are never imported, so these
  routes cannot become a new execution path for untrusted repository code (related: Project-local .pi extensions execute local commands during pi-web session startup without project trust confirmation #236).
• Not cached. These routes serve auth status and login/logout, so they need current
  credentials rather than a stale snapshot.

Verification

Dev server started from this branch (pi-web 0.9.1) with a provider extension installed
(14 models registered, key already in auth.json):

GET /api/auth/providers
-  before: apiKeyProviders ... "newapi", "oc-sdk-go"        (extension provider absent)
+  after:  apiKeyProviders ..., "<ext-provider>", "newapi", "oc-sdk-go"
+
+  {"id":"<ext-provider>","displayName":"<Ext Provider>","configured":true,
+   "source":"stored","modelCount":14,"supportsOAuth":false}

• /api/models unchanged — same list, extension models still present
• POST /api/auth/api-key/<unknown> still fails cleanly (... does not support API key login) rather than crashing
• npm run lint clean; no type errors in the changed files
• cost: 3.3 s on the first request (Turbopack compile + extension load), 0.4 s steady state

Scope

• Fixes the settings-panel / credential-management gap only. Related but not fixed:
  Bug: "Chat only" tool preset drops extension-registered model providers, so sending fails with "Model not found" #804 — a "Chat only" session never loads extensions, so that session's own runtime
  still lacks extension providers. That path is session creation (startRpcSession),
  not the auth routes.
• lib/provider-usage.ts contains the same bare ModelRuntime.create(); quota lookup
  for extension providers stays unavailable there. Left out to keep this diff small.
• Same panel as Bug: Anthropic (and other dual-auth providers) never appear in the Models config panel #309 (dual-auth providers), different cause.