v0.8.10: settings dialog (provider, model, key), window starts on a provider

The window could be started, but it could not be pointed anywhere: a provider,
a model and a key only came in on the command line. The gear in the header now
opens a dialog that changes all three on the engine's live config.

AgentCore (app/src/core/AgentCore.*):
- providers(): the engine's preset table (cst_provider_count/at), with base
  URL, the remembered or preset model, whether a key exists and where it comes
  from (cst_creds_resolve: "saved", or the environment variable), the preset's
  key variable and the source ("built-in" / "user"). A key is read into a local
  buffer only to answer "is there one"; it never leaves the C++ side.
- modelChoices(provider): the provider's own list (cst_provider_models), the
  fetched cache (cst_ps_cached -- which writes through its out-parameters, so
  it takes a real int, not NULL: passing one cost a segfault) and the
  remembered pick. No network. modelInfo() is cst_model_info + its "200K ·
  text only" label; usage() is cst_agent_usage for the session and the turn.
- useProvider(provider, model, key) -> "" or a reason: a different provider
  goes through cst_ps_switch_provider() (the key is verified against /models
  before it is saved; offline it is kept unverified and the header says so),
  a key for the current one through cst_ps_set_key(), and the model is
  remembered in settings.json. syncConfig() takes the engine's config back
  over the app's copy, so provider/model/approval read correctly afterwards.
  The engine's session is never touched by a switch.
- open() no longer starts with an empty provider: it takes the one the engine
  used last (settings.json), else the built-in default, plus that provider's
  base URL and model. Without this the first turn could not be sent at all and
  no entry in the dialog was "in use".

QML (app/qml/SettingsDialog.qml, Main.qml):
- a modal dialog with the themed surface the other dialogs use (the Basic
  style's light panel washes out the dark theme), the provider list with its
  key state, a model field with the info label and clickable candidates, a
  password field for a new key, the session's token counters, and a note that
  reports what the last "Use this" answered.

Tests: 8 more checks -- the presets are readable, an unknown provider is
refused, the counters are readable, the gear opens the panel, the rows exist, a
model typed into the field reaches the engine, the note says so, Close puts the
dialog away. 36 checks pass. --uitest also points XDG_CONFIG_HOME at its
scratch directory now, so a run cannot rewrite the user's settings.json or
credentials, and CST_APP_SHOT writes shot.png at the end plus
shot-settings.png while the dialog is open (that is how the dialog above was
reviewed on a machine without a screen).

Verified: 36/36 UI checks, --selftest, ctest cst-app-selftest, make check rc=0,
and a screenshot of the dialog.

Version 0.8.10.

app/README.md

@@ -122,6 +122,32 @@ creates and deletes sessions. On a machine without a screen,
 `CST_APP_SHOT=shot.png` makes the run save the window as a PNG when it is
 done; `CST_APP_DUMP=1` prints how many session rows the visual tree holds.
 
+## Provider, model, key
+
+The sidebar shows where the engine points (`provider · model`); the gear in the
+header opens the dialog that changes it.
+
+- The provider list is the engine's own preset table (`cst_provider_count()`),
+  with each entry's base URL and where its key would come from: "key saved"
+  (`.agent`-independent, `<config>/cst-agent/credentials`), "key from
+  OPENAI_API_KEY", or "no key". A key itself is never sent to the QML side —
+  the dialog only ever describes it.
+- "Use this" calls `AgentCore::useProvider()`, which runs
+  `cst_ps_switch_provider()` / `cst_ps_set_key()` on the engine's live config:
+  a pasted key is verified against the provider's `/models` before it is saved
+  (offline it is kept unverified and the header says so), the model is
+  remembered in `settings.json`, and the **session is not touched**. Model
+  candidates come from the provider entry, the fetched cache
+  (`cst_ps_cached`, no network) and the remembered pick; the label next to the
+  field is `cst_model_info` ("200K · text only").
+- The dialog also reports the session's token use (`cst_agent_usage`).
+
+`--uitest` checks it end to end: the presets are readable, an unknown provider
+is refused, the gear opens the panel, the provider rows exist, a model typed
+into the field reaches the engine when "Use this" is clicked, the note says so,
+and Close puts the dialog away. The run points `XDG_CONFIG_HOME` at its scratch
+directory, so settings and keys of the real user are never rewritten.
+
 ## Tools the app provides
 
 A tool implemented in the front end is registered with `cst_tool_register()`
@@ -178,7 +204,8 @@ The build flag that keeps Unix helpers out of the picture is
       blocks, consent/ask dialogs, sidebar, responsive dock/drawer layout,
       `--uitest` for mouse, touch and small-screen checks
 - [x] session list in the sidebar: new / switch / delete, transcript replay
+- [x] settings dialog: provider, model, key (`cst_ps_*`), token counters
 - [ ] a real turn driven through the window (needs a provider key)
-- [ ] attachments (drag in, paste), settings page (provider, model, key)
+- [ ] attachments (drag in, paste)
 - [ ] Kirigami (Breeze look), tray, global shortcuts
 - [ ] Android APK (engine in-process, JNI platform tools)