[Feature]: 支持模型自动降级（配额耗尽 / 调用失败 / 超时 → 自动切换备选模型）

### 标题 / Title

支持模型自动降级（配额耗尽 / 调用失败 / 超时 → 自动切换备选模型）
Support automatic model fallback (quota exhausted / call failed / timeout → auto-switch to backup model)

---

### 问题描述 / Problem Description

当前 QwenPaw 绑定单一主模型运行，当主模型出现配额/额度耗尽、API 调用失败或请求超时时，整个对话会直接中断或报错，用户需手动更换模型后重试，体验中断明显，尤其在长任务/批处理/无人值守场景下影响更大。

Currently QwenPaw binds to a single primary model. When that model hits quota/credit exhaustion, API call failure, or request timeout, the conversation breaks or errors out directly. Users must manually switch models and retry, causing noticeable disruption — especially impactful in long-running tasks, batch processing, or unattended scenarios.

---

### 具体痛点 / Pain Points

- 配额耗尽或调用失败时任务直接中断，无人值守场景下任务无法自动恢复，需人工介入。
When quota is exhausted or a call fails, the task breaks immediately; unattended jobs cannot recover automatically and require manual intervention.

- 手动排查"是不是模型挂了"、再切换模型、重试，链路长且重复，打断工作节奏。
Manually diagnosing "is the model down", then switching and retrying is a long, repetitive chain that disrupts workflow.

- 长任务跑到一半因模型临时不可用而失败，重试成本高，容易丢失已有上下文与进度。
Long tasks failing mid-way due to temporary model unavailability carry high retry cost and risk losing existing context and progress.

---

### 期望效果 / Desired Behavior

希望 QwenPaw 支持模型自动降级机制：

- 允许用户为主模型配置一个或多个备选模型（按优先级排序）。
- 当主模型出现配额/额度耗尽、调用失败、超时等错误时，自动切换到下一优先级的备选模型继续会话，无需手动介入。
- 切换过程对用户尽量透明（可给出轻量提示，说明已降级到哪个模型）。
- 会话上下文在切换后应保持连续，不因换模型丢失已有对话进度。

We'd like QwenPaw to support automatic model fallback:

- Allow users to configure one or more backup models for the primary model (ordered by priority).
- When the primary model hits quota/credit exhaustion, call failure, timeout, or similar errors, automatically switch to the next-priority backup model and continue the session without manual intervention.
- The switch should be as transparent as possible (a lightweight notice indicating which model was fallen back to is acceptable).
- Conversation context should remain continuous after switching — no existing progress lost due to the model change.

---

### 截图 / Screenshots

> （此处插入演示截图 / Insert demo screenshots here）

The issue names no files, tests, or entry points. Start by locating the model configuration and request-handling paths, then determine how fallback order, eligible errors, retries, user notices, and conversation context are represented. Done means configured backup models can continue a session after quota exhaustion, failures, or timeouts without losing context.

Scritto dal modello di indicizzazione a partire dal testo della issue.