Provider-disable policy: fail-closed way to disable a provider globally or per project

Split out of #203 (part 2), which is otherwise fixed and now closed. This part was never implemented.

Request

A fail-closed config switch to make a provider unavailable, e.g.:

[policy]
disabled_providers = ["copilot"]

The original reporter hit this with Copilot: it can surface via provider auto-detection when GitHub-related credentials/env happen to exist locally, which is surprising if the user does not want Copilot used or even shown.

Expected

A disabled provider should be excluded from all of:

• provider auto-detection
• provider lists / model routing
• jcode login --provider <name>
• credential/env probing
• failover paths

Current state (verified on v0.56.34-dev)

Not implemented. grep -rn "disabled_providers" crates/ docs/ returns nothing, and there is no equivalent provider_disabled / hide_provider concept anywhere in the tree.

Decision needed

Scope of the switch (global only vs per-project override), and whether "disabled" means hidden-but-loadable or hard-refused at every entry point including explicit --provider. Fail-closed at every entry point is what the reporter asked for.

Start by searching crates/ and docs/ for configuration handling, provider auto-detection, routing, login, credential probing, and failover entry points. Resolve whether the policy is global or per-project and whether explicit --provider is refused or only hidden. Done means disabled providers are blocked consistently across every listed entry point.