feat(desktop): customize model connection requests

[M4n5ter]

English

Summary

Model connection setup now opens on All providers and keeps the active category when search is cleared, so providers such as OpenRouter are directly discoverable without knowing their catalog classification first.

Connections can define provider-independent custom HTTP headers and an extra JSON request body. Header values remain encrypted in the Runtime Policy credential vault; Desktop receives only saved header names and never reads retained values back into the renderer. Extra body data remains part of the connection catalog, is canonicalized and size-bounded, and rejects collisions with Maka-generated top-level fields explicitly.

Request customization is composed in the shared Runtime model factory rather than a Desktop client. The same settings therefore apply to Desktop, CLI, and TUI across OpenAI Chat Completions, OpenAI Responses, and Anthropic Messages clients. Runtime Host uses a singular, frame-safe credential export contract with Base64 wire payloads for configuration transfer.

The Desktop editor keeps advanced settings compact until opened, preserves stored header values through an explicit keep-saved state, and gives Save and Cancel controls sufficient separation from the following row divider.

Verification

• Core test suite passed
• Storage: 772 passed, 12 skipped, 0 failed
• Runtime: 3,256 passed, 9 skipped, 0 failed
• Runtime Host: 777 passed, 0 failed
• CLI after rebasing the transient-frame fix from current main: 350 passed, 0 failed
• Desktop: 1,132 passed, 0 failed
• Desktop provider Playwright E2E: 1 passed
• CLI/TUI shared-setting integration covers custom headers and extra body
• npm run build
• npm run lint
• npm run format:check
• git diff --check
• Real Desktop CDP verification with the current user data: OpenRouter retained X-Title: Maka without returning its value to the renderer, retained provider.only: ["openrouter", "deepseek"], and connected through deepseek/deepseek-v4-flash-0731
• Two-pass Thermos correctness and maintainability review with no remaining findings

Checklist

• Tests cover the user-visible behavior and shared Runtime request path
• Lint, format, typecheck, build, and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

中文

概要

模型连接设置现在默认展示全部提供商，并在清除搜索时保留当前分类，因此无需预先知道目录分类即可直接找到 OpenRouter 等提供商。

连接可以配置与提供商无关的自定义 HTTP 请求头和额外 JSON 请求体。请求头 value 继续加密存储在 Runtime Policy 凭据库中；Desktop 只会拿到已保存的请求头名称，不会把保留值读回 Renderer。额外请求体属于连接目录数据，会经过规范化和容量限制；如果与 Maka 生成的顶层字段冲突，会明确失败。

请求定制在共享 Runtime 模型工厂中组合，而不是由 Desktop client 单独处理。因此同一份设置会同时对 Desktop、CLI 和 TUI 生效，并覆盖 OpenAI Chat Completions、OpenAI Responses 与 Anthropic Messages client。Runtime Host 的配置导出使用单项、帧安全的凭据协议，并通过 Base64 wire payload 传输。

Desktop 的高级设置默认保持紧凑；展开后通过明确的“保留已保存值”状态保护现有请求头 value，并为 Save、Cancel 按钮与下一行分隔线保留足够间距。

验证

• Core 测试套件通过
• Storage：772 通过，12 跳过，0 失败
• Runtime：3,256 通过，9 跳过，0 失败
• Runtime Host：777 通过，0 失败
• rebase 当前 main 的中间 frame 修复后，CLI：350 通过，0 失败
• Desktop：1,132 通过，0 失败
• Desktop provider Playwright E2E：1 通过
• CLI/TUI 共享设置集成测试覆盖自定义请求头与额外请求体
• npm run build
• npm run lint
• npm run format:check
• git diff --check
• 使用当前用户数据进行真实 Desktop CDP 验证：OpenRouter 保留 X-Title: Maka 且不向 Renderer 回传 value，保留 provider.only: ["openrouter", "deepseek"]，并通过 deepseek/deepseek-v4-flash-0731 成功连接
• 两轮 Thermos 正确性与可维护性审查最终均无遗留问题

检查清单

• 测试覆盖用户可见行为与共享 Runtime 请求路径
• lint、format、typecheck、build 与相关测试套件均已在本地通过

此 PR 是否包含行为变化？

• 是——已在概要中说明
• 否