Adapt session model selection to the slash/input/session architecture

- host trio kept on the merged api-proxy: session.models (provider-grouped
  advisory directory), session.selectModel (validated provider, advisory
  model), installAgentLlmTarget threaded through create/resume/ensureSession;
  the gateway declares the llm inject it reads
- history no longer piggybacks modelTarget: the current target travels on
  session.models alone (the /model popup is the sole consumer)
- new @deepseek-ai/dsh-client-ui-model plugin: /model popupSelect over the
  wire — options load the directory (group label in the detail column,
  provider-local failures listed inline), onSelect routes selectModel;
  failures ride the popup shell's error/retry surface
- ModelSelector package, conversation.composer.control slot, and the
  Session-side modelSelection state machine are removed: model selection
  belongs to the /model popup; the named conversation.input.model seat
  stays empty until a control-seat entry is designed for it

tsconfig.client.json

@@ -39,6 +39,7 @@
     { "path": "./packages/client/ui-command" },
     { "path": "./packages/client/ui-skill" },
     { "path": "./packages/client/ui-subagent" },
+    { "path": "./packages/client/ui-model" },
     { "path": "./packages/client/ui-question" },
     { "path": "./packages/client/ui-trajectory" },
     { "path": "./packages/client/ui-theme" },