feat(model-config): layer setup and env credentials

[im10furry]

Summary

• make the default model path provider → credential environment-variable reference → model ID → confirmation
• retain only references in interactive configuration and resolve credentials at request boundaries
• gate advanced output, context, and reasoning controls on values reported by model discovery
• preserve legacy explicit credentials during YAML import without exposing them in the UI

Verification

• bun test ./packages/core/src/test/unit/model-config-yaml.test.ts ./packages/core/src/test/unit/model-selector-actions.test.ts ./packages/core/src/test/e2e/tui-interactions.misc.test.tsx
• bun run typecheck
• bun run build:cli
• git diff --check