refactor(providers): resolveEndpoint decides key and URL; getAIModel loses its second switch

Steps 4a and 4b of the provider refactor plan. resolveEndpoint(provider,
overrides) answers, by the record's credential kind, whose key a call uses
(keySource), which key, which URL, whether the URL was configured and whether
the client-chosen URL needs the redirect guard. It never throws, fetches or
logs. The five branches of getAIModel's second switch (bedrock, vertexai,
ollama, edgeone, default) are gone: Bedrock's credential selection moved
unchanged into bedrockModel(), called when the record's sdk is bedrock; every
other provider goes through resolveEndpoint and createModel, whose switch now
runs on the record's sdk field (Vertex and Ollama became cases). The three
errors for a missing Vertex key or a missing base URL stay in getAIModel with
their texts. The SSRF guard at the top reads the credential kind instead of
provider names. resolveApiKey returns whose key it found; the array apiKeyEnv
log moved to getAIModel so a later usesServerCredentials call draws no second
log line.

The behavior snapshot is unchanged, and resolveEndpoint's keySource agrees
with the pre-refactor usesServerCredentials on all 30720 input classes.

tests/unit/provider-legacy.test.ts

@@ -11,6 +11,7 @@
 import { afterAll, beforeAll, describe, expect, it, vi } from "vitest"
 import {
     type ClientOverrides,
+    resolveEndpoint,
     SINGLE_SYSTEM_PROVIDERS,
     usesServerCredentials,
     usesServerEndpoint,
@@ -179,6 +180,22 @@ describe("usesServerCredentials against its pre-refactor body", () => {
                                                     `${provider} ${JSON.stringify(overrides)} desktop=${desktop} ollamaKey=${ollamaKey}: ${actual} instead of ${expected}`,
                                                 )
                                             }
+                                            // resolveEndpoint's keySource is
+                                            // what the function will read;
+                                            // the desktop rule stays outside
+                                            const fromEndpoint =
+                                                !desktop &&
+                                                resolveEndpoint(provider, {
+                                                    ...overrides,
+                                                    baseUrl: normalizeBaseUrl(
+                                                        baseUrl ?? "",
+                                                    ),
+                                                }).keySource === "server"
+                                            if (fromEndpoint !== expected) {
+                                                expect.fail(
+                                                    `resolveEndpoint ${provider} ${JSON.stringify(overrides)} ollamaKey=${ollamaKey}: ${fromEndpoint} instead of ${expected}`,
+                                                )
+                                            }
                                             count++
                                         }
             }