feat(coach): local / self-hosted LLM provider with an optional API key - #51

…ities

One press of "Detect server & configure" now sets up the local provider from just a base URL.

The two settings most likely to fail a turn — `tools` and `response_format` — are gated by the
server's LAUNCH FLAGS, which no metadata endpoint exposes (`/v1/models` describes the model, not
the request surface). So LocalCapabilityProbe sends the fields and reads the answer:

1. GET /v1/models — reachability, model list, sole-model shortcut. Only fatal step.
2. Engine identity, best-effort, from each engine's own info route: /version (vLLM),
   /api/version (Ollama), /props (llama.cpp), /get_server_info (SGLang), /api/v0/models
   (LM Studio). Deliberately not `owned_by`, which every proxy rewrites. Cosmetic only.
3. A chat request carrying one throwaway tool.
4. A chat request carrying a minimal json_schema; json_object only if that is refused.

4xx = the server refused the field (vLLM answers 400 for a disabled tool parser and 422 for an
unknown field, so the status carries no extra meaning). 5xx or transport failure = inconclusive,
and the setting is LEFT AT ITS DEFAULT rather than switched off, with a note saying why. Tool
calling only ever turns off on an explicit refusal — an inconclusive probe must not silently
strip the coach of its ability to read the user's data. The probe also never picks a model when
several are served and none matches the current one; guessing would move a working setup.

Corrects docs/local-llm-coach.md §2 on vLLM. Verified against a live vLLM 0.27.1 server:
`role: developer` returns HTTP 422 "unknown role: developer". The earlier claim that vLLM
tolerates the role came from v0.11.0's pydantic models (extra="allow"); current vLLM
deserializes strictly. Two of the five engines now hard-fail without the fold, so the
developer -> system fold is load-bearing rather than defensive.

Also: a reasoning model truncated mid-thought (content null, finish_reason "length") now reports
the token limit and points at the Max tokens field instead of a bare "model returned no output".
vLLM 0.27 puts the chain of thought in `message.reasoning`, older builds and SGLang in
`reasoning_content`; the adapter reads neither.

…xt window

Auto-detect now reads the context window each engine advertises and fills in Max tokens from it:
vLLM `max_model_len`, llama.cpp `n_ctx`/`n_ctx_train`, LM Studio `loaded_context_length`/
`max_context_length`, Ollama `model_info["<arch>.context_length"]` via POST /api/show, SGLang
/get_model_info. The summary line now ends with e.g. "262k ctx".

It is a DERIVATION, not a copy. A context window is prompt + completion, and a server checks
`max_tokens` against what is left after the prompt — so copying 262144 across would have the
request rejected outright on any server where the prompt matters. Instead:

  headroom  = context - 6144        (measured coach prompt 3.1-3.3k, doubled for tool results
                                     and replayed history)
  suggested = min(headroom, 32768)  (a coach_response needs far less; the cap stops a 262k
                                     context becoming a runaway generation budget)
  headroom < 512 -> leave blank and warn

The warning is the more valuable half. Ollama's default num_ctx is 2048 — smaller than the coach's
own prompt — so without detection the prompt is silently truncated and the model gets blamed. The
note points at the server-side fix (num_ctx / -c / --max-model-len), not at an app setting, because
no app setting can help there.

13 new tests: the derivation (cap, reserve, prompt+budget always fits, Ollama-2048 flagged rather
than budgeted, unreported context stays blank) and per-engine field parsing.

Detect server & configure is also how you refresh the model list, so it
gets pressed on setups that already work. It was overwriting settings the
user had chosen by hand:

- Tool calling and Response format are now only written when the probe
  reached a verdict. `suggested*`'s safe defaults (tools ON, structured
  OFF) are right for a first run and wrong for a re-detect — a user who
  turned tools off for a vLLM server without --enable-auto-tool-choice
  had them switched back on, and every turn 400'd. Probes are skipped
  entirely when pickModel returns blank on a multi-model server.
- Max tokens is no longer cleared when the server reports no context
  window. 0 means "not detected", not "discard what the user typed".
- The capability probes are now measured against a baseline chat request
  carrying no optional fields. Without it any whole-request rejection —
  an unloadable model id, an auth-gated chat route, a broken chat
  template — read as "tools: not supported" and persisted
  toolCalling = false, costing the coach all data access while blaming
  the wrong thing. A refused baseline skips the probes and changes
  nothing.

Also:

- stripThinking handles a leading unmatched </think>. R1-style distills
  on llama.cpp/Ollama get the opening tag from the chat template, so the
  completion starts mid-thought; the whole chain of thought was reaching
  CoachResponseParser and burning maxFinalAttempts repair generations at
  up to 180 s each before the turn failed.
- Local readiness is validate(baseUrl) == null, not isNotBlank(). The
  field persists per keystroke, so one character flipped the coach to
  "Active" while every turn failed with the URL error already shown
  inline in Settings.
- An unnormalizable URL raises Decoding(MALFORMED), not MissingAPIKey —
  the key is optional on this provider.
- isPrivateHost accepts local-only names: single-label hosts, .lan,
  .home, .internal, .home.arpa, .ts.net. Addressing a box by the name
  the router or mDNS hands out is ordinary, and it was rejected with
  "must be on your local network" — where it was.
- The Timeout field reconciles with the store on focus loss; it clamps to
  10..1800 on write and skips blank, so the text could show a value that
  was never stored, or an empty box over a live setting.
- The local provider sends with redirects disabled. validate() vets the
  typed URL, not where the request lands, and cleartext is permitted
  app-wide — a 307 off the LAN would resend the health-context body in
  the clear. Cloud providers keep redirects.

docs/local-llm-coach.md §3 and §5a updated to match.

1099 tests, 0 failures.