feat: verify audited real model providers

[ZanderKong]

Summary

• Replace the active vision provider with Xiaomi MiMo mimo-v2.5 and use its documented multimodal request contract.
• Preserve structured model-output validation, provider-specific redaction, auditable fallback evidence, and safe real API tooling.
• Record verified synthetic real-call evidence for DeepSeek, MiMo, SiliconFlow OCR, and deterministic auto fallback.

Verification

• 263 passed, 52 skipped
• python -m compileall -q data_agent
• git diff --check
• Real synthetic smoke: DeepSeek PASS, MiMo PASS, SiliconFlow PASS, auto fallback PASS.
• Exact-value secret audits passed for repository, final evidence workspaces, SQLite, reports, and exported ZIP packages.

Scope and safety

• No API keys, local .env, SQLite workspaces, ZIP artifacts, or historical handoff plans are included.
• The prior Volcengine timeout is retained only as a historical note; MiMo is the active vision provider.