Adapt session model selection to the slash/input/session architecture

- host trio kept on the merged api-proxy: session.models (provider-grouped
  advisory directory), session.selectModel (validated provider, advisory
  model), installAgentLlmTarget threaded through create/resume/ensureSession;
  the gateway declares the llm inject it reads
- history no longer piggybacks modelTarget: the current target travels on
  session.models alone (the /model popup is the sole consumer)
- new @deepseek-ai/dsh-client-ui-model plugin: /model popupSelect over the
  wire — options load the directory (group label in the detail column,
  provider-local failures listed inline), onSelect routes selectModel;
  failures ride the popup shell's error/retry surface
- ModelSelector package, conversation.composer.control slot, and the
  Session-side modelSelection state machine are removed: model selection
  belongs to the /model popup; the named conversation.input.model seat
  stays empty until a control-seat entry is designed for it

packages/client/connection/tests/fixture.spec.ts

@@ -71,7 +71,6 @@ describe('createFixtureApi', () => {
     expect(empty.result.value).toEqual({
       events: [],
       hasMore: false,
-      modelTarget: { provider: 'deepseek', model: 'deepseek-v4-flash' },
     })
   })
 
@@ -93,7 +92,6 @@ describe('createFixtureApi', () => {
     expect(selected.result.value.selected).toEqual({ provider: 'openai', model: 'gpt-5' })
     const history = await api.sessions.history(req({ sessionId }))
     if (!history.result.ok) throw new Error('history failed')
-    expect(history.result.value.modelTarget).toEqual({ provider: 'openai', model: 'gpt-5' })
 
     const prompt = await api.sessions.prompt(req({
       sessionId,