feat: add scoped model runtime configuration

Introduce provider, model, and invocation contracts with encrypted configuration persistence. Add web runtime fencing, route fallback, recovery middleware, workspace scoping, and comprehensive tests.

tests/test_error_normalization_middleware.py

@@ -295,6 +295,8 @@ class TestMiddleware:
             self._run_awrap(mw, req, handler)
         assert excinfo.value.provider == "openrouter"
         assert excinfo.value.__cause__ is raised
+        assert excinfo.value.message == "Provider request failed."
+        assert "boom" not in str(excinfo.value.model_dump())
 
     def test_awrap_passes_through_non_provider_model_exception(self):
         """If the model isn't a recognized provider SDK, the exception