feat: add Volcengine Ark China direct API

[Astro-Han]

Summary

• Add Volcengine Ark direct API access for China under the stable persisted provider ID volcengine-ark.
• Preserve the exact doubao-seed-2-0-pro-260215 snapshot model through Desktop, CLI, storage, headless, runtime thinking controls, and a deterministic two-stage tool-call loop.
• Vendor the real Volcengine SVG byte-for-byte through the existing brand-mask and third-party-notice governance seams.

Why

Issue #860 Phase 3 requires the China Ark direct API to be a first-class provider without conflating it with Ark Coding Plan, Ark Agent Plan, or BytePlus ModelArk. Volcengine's versioned Node SDK establishes the China endpoint, ARK_API_KEY namespace, explicit thinking request object, reasoning_content response field, exact model ID, and tool-call replay contract. The current models.dev snapshot has no Volcengine/Ark provider, and no auditable Ark /models contract was found, so this slice deliberately uses a versioned official fallback snapshot instead of guessing discovery.

Refs #860.

Scope

This PR implements only Volcengine Ark direct API access in China at https://ark.cn-beijing.volces.com/api/v3. Ark Coding Plan, Ark Agent Plan, BytePlus global access, other providers, and Phase 7 are explicit non-goals.

The provider has one registry owner and uses modelDiscovery: { kind: 'fallback' }. It does not add a second adapter, discovery path, brand mask, notice checker, or credential store.

Verification

• npm run typecheck — passed for every workspace after rebuilding the rebased Core dependency artifact.
• npm test — passed for every workspace, including the final Desktop result of 2,419 passed and 0 failed. Conflict-sensitive coverage includes Core registry/catalog/auth, Storage exact persistence, Runtime thinking and two-stage tool-call replay, Headless env/Harbor isolation, CLI exact target resolution, Desktop brand governance, and the pre-existing Ollama local/Cloud alias contracts from fix: preserve Ollama Cloud aliases without auth #907.
• npm --workspace @maka/desktop run build:renderer and node scripts/check-third-party-notices.mjs — passed; the packaged renderer contains the byte-identical notice.
• npm run check:stale — passed after rebuilding the renderer artifact.
• git diff --check origin/main...HEAD — passed.
• SVG integrity — the vendored file is byte-identical to @lobehub/icons-static-svg@1.91.0 at immutable Lobe Icons commit e4302041fbb3039608d25f9f618bd462783b875e, path packages/static-svg/icons/volcengine.svg, MIT license, SHA-256 f29d0bdc284b33d8664ef221add7fbf06a5b370ef92767fa33f6020c914d3d33.
• Independent reviewer — 0 P0–P3 on final HEAD 0eb4e812; the re-review also ran Runtime (1,474 passed, 7 skipped, 0 failed) and CLI (318 passed, 0 failed), confirming feat: add AskUserQuestion runtime and TUI #908 AskUserQuestion behavior remains intact.

Two validation-order signals were resolved without product changes: the first post-rebase typecheck read a stale Core dist that predated stepfun-ai, and the first stale check correctly detected that the renderer had not yet been rebuilt. Rebuilding the respective artifacts made both original commands pass. Neither run produced an Ark assertion failure.

Local Desktop E2E was deferred to CI under the Issue #860 delivery contract; CI E2E remains a merge gate. Static screenshots are not applicable because this adds no new layout or interaction: the existing catalog/detail UI and ProviderAssetMask are exercised by deterministic E2E and computed-style contracts. A live Ark smoke was not run because no safe user credential was available; no secret or raw provider response was recorded.

Impact

Users can configure Volcengine Ark China with the official endpoint and ARK_API_KEY, select the exact supported snapshot model, control thinking, and complete tool-use turns across Desktop and non-Desktop hosts. Existing provider IDs, the StepFun Global provider, Ollama no-auth aliases, and plan products remain unchanged. No migration is required.

Reviewer notes

Authoritative evidence:

• Volcengine Node SDK, immutable commit a35803083bda10d8f55cea99c5556d35c66cc944: https://github.com/volcengine/volcengine-nodejs-sdk/tree/a35803083bda10d8f55cea99c5556d35c66cc944/service/arkruntime
• Volcengine OpenViking purchase/activation guidance, immutable commit a0e822a0cd5d02e8ed5330a7f7a6d13279f8308b: https://github.com/volcengine/OpenViking/tree/a0e822a0cd5d02e8ed5330a7f7a6d13279f8308b
• Current models.dev API snapshot checked for provider ownership: https://models.dev/api.json
• Lobe Icons byte source: https://github.com/lobehub/lobe-icons/blob/e4302041fbb3039608d25f9f618bd462783b875e/packages/static-svg/icons/volcengine.svg

Review focus: the default runtime request must send thinking: { type: 'enabled' }; assistant replay must preserve reasoning_content and tool_calls; the tool result must retain tool_call_id; the second request must keep the exact model ID. Rollback is a sequence of five independently revertible commits.

Ready for review

• Verification is complete and the results above are current
• Impact, compatibility, migration, documentation, and release-note needs are addressed
• User-visible UI/UX changes include visual evidence, or Verification explains why it is not applicable