feat(qoder): support BYOK model routing

[Gracker]

Summary

• forward-port the still-valid Qoder BYOK model policy onto current main
• keep Qoder authentication separate from model-provider credentials and isolate the BYOK API key from generic subprocesses
• add opt-in SDK installation, focused DeepSeek E2E wiring, Provider Manager custom env support, diagnostics, snapshots, tests, and bilingual docs

Verification

• independent read-only review: OKAY
• focused Qoder/Provider Manager/critical downstream tests: 170 passed
• root governance, docs, i18n, rendering, quality, frontend prebuild, Rust, backend typecheck/build/package checks: passed
• backend core: 1071 passed, 2 skipped
• runtime resilience: 58 passed
• architecture: 607 passed, 2 skipped
• auth: 61 passed
• self-evolution: 745 passed
• external issue reporting: 25 passed
• Trace SQL regression and scene regression: passed; all 6 real scene traces passed
• full npm run verify:pr: baseline-only failure in trace:validate because six unchanged legacy publication exceptions on main expired on 2026-08-15
• real Qoder-authenticated DeepSeek startup: NOT AVAILABLE locally because no Qoder PAT, configured CLI path, or qodercli login is present; the DeepSeek credential and local SDK are available

No release is included.

[Gracker]

CI closure: quality, Ubuntu, macOS, Windows, and Docker smoke all passed. The only failures are trace-corpus and the final trace phase of gate; both report the same six pre-existing legacy publication exceptions whose review_by date was 2026-08-15. This PR does not modify Trace/governance/legacy-publication-exceptions.json or any Trace corpus file. Local verification independently passed all preceding verify:pr phases plus trace materialization, trace tests, and all six real-trace scene regressions after the date-gated validation. Real authenticated Qoder/DeepSeek startup is NOT AVAILABLE in this environment because no Qoder PAT/qodercli login is present.