feat(providers): discover direct mobile models

[tcballard]

Summary

Implements the authenticated model-inventory portion of
WF-ROADMAP-0016 as the second child in the Phase 3 PR stack.

Adds:

• bounded authenticated Moonshot/Kimi and OpenRouter model catalogs
• discovered model publication without changing Automatic
• searchable, refreshable Destinations with explicit Chat selection
• model-removal and sanitized refresh-failure behavior
• deterministic catalog, execution, and AppModel boundary tests

Stack parent: #124
Stack root: #123

Scope

Included

• authenticated GET https://api.moonshot.ai/v1/models
• authenticated GET https://openrouter.ai/api/v1/models/user?output_modalities=text
• 4 MiB response and 1,000-model per-provider bounds
• normalized model ID, display name, and context-window metadata
• discovered-model execution through the matching compiled provider endpoint and credential
• search, pull-to-refresh, toolbar refresh, and explicit model selection in Destinations
• preservation of existing inventory after a refresh failure
• removal of discovered destinations and an invalid active selection after key removal

Excluded

• OpenAI Platform dynamic discovery; the generic model list does not reliably identify chat-capable models, so GPT-5.6 remains the compiled fallback
• persistence or cloud sync of the fetched catalog
• remote executable provider metadata
• adding any discovered model to Automatic
• account/OAuth authentication, Apple Foundation Models, or paired Mac execution

Product / Architecture Decisions

• Catalog reads happen behind a dedicated provider-model actor; views never read Keychain or call provider endpoints.
• Only providers with a reviewed useful catalog endpoint opt into discovery.
• Catalog payloads are size-, count-, and identifier-bounded before publication.
• Existing destinations survive transient refresh failures and the UI receives only a sanitized provider-level notice.
• Removing a credential removes that provider's discovered destinations.
• Discovered destinations remain hosted, API-metered, and explicit-only.
• OpenAI Platform keeps compiled metadata until a trustworthy chat-capability catalog is available.

User-Facing Contract

Destinations

• A configured Kimi or OpenRouter key triggers model refresh.
• Users can search the current inventory by model, provider, or model ID.
• Pull-to-refresh and the refresh toolbar button recheck available models.
• Selecting a ready row switches to Chat with that model pinned.
• A refresh failure keeps the last useful models visible and shows a bounded notice.

Routing

• Discovery does not modify Automatic.
• A discovered model executes through its own provider endpoint and credential.
• Removing a key removes its discovered models and clears a now-invalid selection.

Verification

Ran

• xcrun swift-format format --in-place on all changed Swift files
• xcodegen generate --spec ios/WayfinderIOS/project.yml
• signed iOS Simulator tests through XcodeBuildMCP on iPhone 17
• unsigned CI-equivalent iOS Simulator tests with CODE_SIGNING_ALLOWED=NO
• git diff --check

Covered

• signed: 54 passed, 0 failed, 0 skipped
• unsigned CI-equivalent: 53 passed, 0 failed, 1 expected Keychain smoke skip
• authenticated endpoint and bearer-header contracts
• Kimi and OpenRouter response normalization
• missing-key network suppression
• malformed and oversized catalog failure sanitization
• discovered-model publication, execution, and explicit-only eligibility
• key-removal inventory cleanup
• existing streaming, cancellation, persistence, routing, and credential tests

Review Path

1. ProviderModelCatalog.swift request, bounds, and normalization
2. AppModel inventory lifecycle and destination rebuilding
3. dynamic model dispatch in OpenAICompatibleProvider
4. Destinations search, refresh, and selection behavior
5. catalog and routing boundary tests
6. roadmap and iOS README updates

Notes For Reviewer

This PR intentionally targets codex/ios-provider-presets, not main.
GitHub should show only the model-inventory layer. Review #124 first, then this
PR. Provider catalog contracts were checked against current official Kimi and
OpenRouter documentation on 2026-07-25.

Implementation Process

Implemented with AI assistance under the roadmap contract; final scope, review,
and acceptance decisions remain with the maintainer.