fix(tui): restore session cost when live pricing is unverifiable (#5241)

[Hmbown]

Summary

Fixes #5241. Session cost no longer stays unverified_live_pricing forever when live pricing cannot be verified (including the reporter path where https://api.codewhale.net/session returns 503 control_plane_not_attached).

Honest path:

• Do not treat a control-plane /session 503 as a healthy live price list
• Do not treat Models.dev live overlays as rates (capabilities-only; leftover cost is ignored)
• Restore usable session cost via provider-docs bundled fallback rates
• Verified provider-live /models rows still win when the endpoint returns usable data

Bundled fallback routes (USD per 1M, cache-read / input / output):

• Fireworks accounts/fireworks/models/deepseek-v4-flash and deepseek-v4-flash-0731 — $0.028 / $0.14 / $0.28
• Fireworks accounts/fireworks/models/kimi-k3 — $0.30 / $3.00 / $15.00
• Fireworks accounts/fireworks/models/deepseek-v4-pro (default Fireworks route, same honesty gap) — $0.145 / $1.74 / $3.48
• OpenCode Zen deepseek-v4-flash — $0.028 / $0.14 / $0.28

These are Fireworks Standard / OpenCode Zen PAYG published cards, not first-party DeepSeek's $0.0028 cache-hit.

Testing

• cargo fmt --all
• cargo test -p codewhale-tui --lib --locked pricing::tests — 59 passed
• live_catalog_origin_prefers_per_provider_over_models_dev
• cost_report_distinguishes_bundled_fallback_from_no_usable_fallback
• cargo clippy --workspace --all-targets --all-features --locked
• cargo test --workspace --all-features --locked

Checklist

• Updated docs or comments as needed
• Added or updated tests where relevant
• Verified TUI behavior manually if UI changes
• Harvested/co-authored credit uses a GitHub numeric noreply address

Harvest notes (v098-final local lane)

• Intent: Pricing endpoint returns 503 - all sessions show unverified_live_pricing #5241 / SHA-6137 — session cost must leave unverified_live_pricing when control-plane /session is 503 / unattached; usable bundled rates for common Fireworks/Zen routes; live wins when healthy; models.dev is not a rate source.
• Keep: hand/bundled rate table + tests that unverifiable live degrades to priced turns (with a defect receipt for real provider-live mismatches); live-verified rows still win; Models.dev live cost is stripped/ignored.
• Do not harvest: models.dev cost invented from the capabilities catalog; pretending api.codewhale.net/session 503 is a healthy live price list; first-party DeepSeek $0.0028 cache-hit on Fireworks/Zen.
• Provenance: rebuilt on current main (5ac75add); issue Pricing endpoint returns 503 - all sessions show unverified_live_pricing #5241 by @alitvak69; no community PR to harvest.
• v098-final: isolated pricing honesty fix; no tag/publish from this lane.