Orbit: derive the model picker from the provider's live /models endpoint instead of pi's full registry

Follow-up to #221.

#221 stopped retired models (gemini-2.0-flash, gemini-1.5-*, old gpt-4/o1 families) from cluttering the picker and 404'ing on use, by filtering known-legacy id patterns out of `models:list-all`. That denylist works and auto-keeps new models flowing, but it's a guess -- pi's registry has no `deprecated` flag -- and needs a pattern added whenever a generation retires.

The durable fix is to let the provider be the authority on what it actually serves: probe each provider's live `/models` endpoint (we already do this for key validation in `validateApiKey` -> `app/src/main/ipc-handlers.ts`) and intersect with pi's registry for pricing, context-window, and display names.

- Models the provider serves but pi doesn't know -> show id-only.
- Models pi knows but the provider no longer serves -> excluded automatically.

That self-maintains for both new and retired models, no denylist.

Tradeoffs to work through:

- Per-provider `/models` endpoint differences (OpenAI / openai-compatible already done; Google ListModels, Anthropic, etc. vary).
- Needs the configured API key, adds network latency to populating the picker, and an offline/failure fallback (keep the current filtered registry as the fallback).
- Cache results so we don't re-probe on every Preferences open.

Until then, the denylist + error-humanizer backstop from #221 cover it.

Separately worth considering: an upstream nudge to pi-ai (@earendil-works/pi-ai) to mark models deprecated/active in its registry, which would give an authoritative filter signal without a live probe.

Start with app/src/main/ipc-handlers.ts and the validateApiKey flow to understand the existing provider /models probing. Then trace models:list-all and the current filtered registry used by the picker. Done means intersecting provider results with pi's registry, showing unknown served IDs, excluding unavailable known models, and retaining the filtered registry when probing fails or is offline.

Written by the indexing model from the issue text.