Allow overriding the model id advertised on /v1/models (collides with the real DeepSeek API in multi-provider clients)

### Summary

The OpenAI-compatible server advertises `deepseek-v4-flash` and `deepseek-v4-pro` on `GET /v1/models` (hardcoded in `ds4_server.c`, around the `append_model_json(&b, s, "deepseek-v4-flash"/"deepseek-v4-pro")` calls). These ids are identical to the ones used by the official DeepSeek cloud API.

### Problem

Many clients aggregate several OpenAI-compatible providers (e.g. multi-provider CLIs/agents, LibreChat, Open WebUI, router front-ends). When such a client has **both** a local `ds4` endpoint **and** the real DeepSeek cloud configured, the identical model ids collide. Clients typically resolve a request by model id and pick the first/"first-class" provider that owns it, so requests meant for the **local** ds4 endpoint get routed to `api.deepseek.com` (or the wrong API key gets attached). The result is `401 Authentication Fails` or, worse, **unintended paid cloud usage** instead of local inference.

There is currently no CLI flag to change the advertised id (confirmed via `--help`), so the only workarounds are patching the binary or editing the source.

### Proposed fix

Add a flag to override the served model id, e.g.:

```
--served-model-name NAME # overrides what /v1/models advertises
# and what incoming requests are matched against
```

Precedent: vLLM's `--served-model-name`, llama.cpp's `--alias`. Default behavior unchanged when the flag is absent. Ideally the override also applies to the request-matching path (and, if relevant, to the `deepseek-chat` / `deepseek-reasoner` thinking aliases), so a user can run ds4 under a neutral id like `ds4-flash` / `ds4-pro` and avoid the collision entirely.

### Why it matters

ds4 is intentionally DeepSeek-API-compatible, which is great — but that same compatibility makes the local engine indistinguishable from the cloud at the model-id level. A one-line override flag would make it safe to run side-by-side with the real DeepSeek API.