fix(gateway): provision model-service access for CoDA

[dgokeeffe]

Hotfix

Current main can configure Pi and Claude with system.ai.* model IDs while the Databricks App service principal lacks Unity AI Gateway v3 privileges. Every invocation then fails with a masked 404 ('<model>' does not exist). Static Sonnet defaults also collapse the model picker.

Fix

• deployment targets discover READY Foundation Model chat models
• grant the app SP USE CATALOG on system, USE SCHEMA on system.ai, and EXECUTE on each selected model service
• retain legacy endpoint CAN_QUERY resources for v2 compatibility
• publish the exact granted model inventory as an app secret resource because Apps SPs may invoke attached models without catalogue browse visibility
• remove static Claude/Pi model pins
• configure Claude Gateway discovery/model overrides and Pi's full compatible inventory
• fail setup visibly instead of writing an inaccessible fallback
• show an actionable startup warning when Gateway grants/catalogue provisioning is absent

Validation

• focused auth, Gateway, Claude/Pi setup and token-rotation suites: 145 passed
• git diff --check: passed
• DaveOK live app: effective UC EXECUTE verified for the app SP; setup discovered 8 Claude + 3 OSS models

Scope

This PR intentionally excludes the managed-OmniGENT host changes in #139.