feat(auth): add Profile API key capability fallback

[XXPermanentXX]

Summary

• add Profile-level api_key_capabilities allowlists keyed by leaf command path, with unsupported API Key commands reading only api_key and base_url from default
• preserve explicit user intent: any --api-key / --base-url or DASHSCOPE_API_KEY / DASHSCOPE_BASE_URL bypasses fallback, while fallback notices are emitted to stderr in localized text or structured JSON
• make Command Pack API Key commands use the same route-derived capability policy and resolved client credentials
• update the built-in token-plan preset with validated text, vision, image, speech, and video capabilities; append missing preset entries after successful API Key login without deleting user entries
• add separate Token Plan TTS/ASR defaults (qwen-audio-3.0-tts-plus and qwen-audio-3.0-asr-flash), config support, documentation, and regression coverage

Verification

• vp check — 0 errors (5 warnings already present on the main baseline)
• vp test packages/core/tests/config-priority.test.ts packages/core/tests/config-store.test.ts packages/runtime/tests/auth-profile-fallback.test.ts packages/commands/tests/e2e/auth.e2e.test.ts — 78 passed, 1 skipped
• Token Plan speech default-model E2E — 3 passed, 13 skipped
• broader affected-suite regression — 142 passed, 1 skipped
• git diff HEAD --check

Test note

The opt-in live speech-recognition suite still has an environment/service-only failure: its existing setup first calls the explicitly selected cosyvoice-v3-flash, which currently returns HTTP 404 Model not exist. No affected Profile fallback or Token Plan default-model test fails.