feat(login): custom provider logins fetch and select models

After the base URL, name, and key steps, the login now opens a model
selection screen instead of blindly saving. The listing fetch runs
concurrently with a manual-id input — a WAF challenge page or a 404 no
longer passes validation silently: a base without a /vN tail is probed
once as {base}/v1 and the working base is adopted, an anthropic-wire
listing that 401s on x-api-key retries once with Bearer (relays gate
GET /models on Bearer while /messages takes the key header), and a
failed fetch shows its reason while manual add stays usable. The chosen
ids persist as [platforms.<name>] models = [...]; catalog assembly
synthesizes selected ids the listing never served (before [model.*]
overrides so they compose) and filters unselected provider entries
(after overrides, authoritative in the provider namespace). Provider-
owned entries keep their declared wire against donor backend
inheritance, and listing errors quote line/column only — a reflected
body could carry the key.

crates/codegen/kigi-tui/src/app/dispatch/router.rs

@@ -3,7 +3,8 @@ use super::auth::{
     dispatch_begin_custom_provider_entry, dispatch_begin_platform_key_entry, dispatch_cancel_login,
     dispatch_cancel_platform_key_entry, dispatch_login, dispatch_login_with, dispatch_logout,
     dispatch_open_login_picker, dispatch_submit_auth_code, dispatch_submit_custom_provider_input,
-    dispatch_submit_platform_api_key, dispatch_switch_account,
+    dispatch_submit_custom_provider_selection, dispatch_submit_platform_api_key,
+    dispatch_switch_account,
 };
 use super::ctx::{
     active_agent_session_id, get_active_agent_mut, navigate_clearing_selection,
@@ -894,6 +895,7 @@ pub(crate) fn dispatch(action: Action, app: &mut AppView) -> Vec<Effect> {
         Action::SubmitCustomProviderInput(input) => {
             dispatch_submit_custom_provider_input(app, input)
         }
+        Action::SubmitCustomProviderSelection => dispatch_submit_custom_provider_selection(app),
         Action::CopyAuthUrl => {
             if let AuthState::Authenticating {
                 auth_url: Some(url),