feat(custom-model): generate Run-menu entries from saved endpoint profiles

Follow-up to #393, picking up the work Ark0N invited in his merge comment:
"generate those entries from the saved profiles rather than a fixed
duplicate per harness, and put it in a follow-up PR so this one stays the
backend... The Run-menu picker is yours if you want it."

Adds the frontend surface the backend has been waiting on:

- Run menu: a "Custom Endpoints" section lists one entry per (harness that
  supports customModelInjection, saved endpoint) pair, e.g.
  "Claude Code (llama.cpp)". The harness list comes from
  window.__codemanCustomModelClis, injected at page render straight off the
  CLI registry's own capabilities (never a hardcoded id list in the
  frontend), so a CLI whose injection recipe lands later appears with no
  frontend change. Picking an entry runs that harness's own existing run*()
  function unmodified (case creation, env overrides, everything, forced to
  a single instance) and then applies the endpoint's default model to the
  session it creates via the existing POST /api/sessions/:id/custom-model
  route. Entries are hidden for a remote/docker active case, since that
  route already refuses both.
- Settings: App Settings -> Models gets a "Custom model endpoints" group
  wiring up the customModelEndpointsEnabled toggle (declared since #393,
  read by nothing until now) plus CRUD against the existing
  /api/model-endpoints routes: list, add/edit (inline form), delete,
  discover models.
- Backend: CustomModelHost gains an optional defaultModelId, the model the
  picker applies with no further choice per endpoint (one generated menu
  entry per CLI+endpoint pair, not per CLI+endpoint+model). The route
  refuses a value that isn't one of the endpoint's own discovered models,
  and a fresh discovery drops a default that no longer appears rather than
  carrying an invalid one forward.

Docs: docs/custom-model-endpoints.md describes the new picker and settings
panel; CLAUDE.md's Custom Model Endpoint Profiles entry drops the
"backend-only" status note and documents the picker's generation mechanism.

Tests: four new route tests cover defaultModelId validation, acceptance,
and the drop/keep behaviour across a re-discovery; a new render-index-html
test pins the __codemanCustomModelClis injection (present, agent CLIs
supporting the capability, antigravity and shell excluded) and its
solo-window skip. No browser test was added for the Run-menu picker itself
or the settings CRUD panel (this box has no tmux, so the live server used
by test:browser/test:mobile could not be exercised here) -- worth a
Playwright pass before merge, same as any other frontend PR.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RqZeHrRS6DYcGcGX2p9EwG

src/web/routes/custom-model-routes.ts

@@ -33,6 +33,21 @@ function adminOnly(req: FastifyRequest, reply: { code: (n: number) => unknown })
   return createErrorResponse(ApiErrorCode.FORBIDDEN, 'Admin only in multi-user mode');
 }
 
+/**
+ * `defaultModelId` names the model the Run-menu picker applies for this endpoint with
+ * no further choice, so it must actually be one of the discovered `models` — a schema
+ * `.refine()` can't see across the two fields the way this can, and would also run on
+ * every unrelated field edit rather than only when either of these two changes.
+ */
+function invalidDefaultModel(host: Pick<CustomModelHost, 'defaultModelId' | 'models'>): ApiResponse<never> | null {
+  if (host.defaultModelId === undefined) return null;
+  if ((host.models ?? []).includes(host.defaultModelId)) return null;
+  return createErrorResponse(
+    ApiErrorCode.INVALID_INPUT,
+    'defaultModelId must be one of the endpoint’s discovered models'
+  );
+}
+
 async function discoverModels(host: Pick<CustomModelHost, 'baseUrl' | 'apiKey' | 'authStyle'>): Promise<string[]> {
   const headers: Record<string, string> = {};
   const apiKey = host.apiKey?.trim();
@@ -78,6 +93,8 @@ export function registerCustomModelRoutes(app: FastifyInstance): void {
     if (isBlockedWebviewUrl(host.baseUrl)) {
       return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Endpoint base URL is not allowed');
     }
+    const badDefault = invalidDefaultModel(host);
+    if (badDefault) return badDefault;
     const hosts = await readCustomModelHosts(CODEMAN_CONFIG_DIR);
     if (hosts.some((item) => item.id === host.id)) {
       return createErrorResponse(ApiErrorCode.ALREADY_EXISTS, 'Model endpoint already exists');
@@ -94,6 +111,8 @@ export function registerCustomModelRoutes(app: FastifyInstance): void {
     if (isBlockedWebviewUrl(host.baseUrl)) {
       return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Endpoint base URL is not allowed');
     }
+    const badDefault = invalidDefaultModel(host);
+    if (badDefault) return badDefault;
     const hosts = await readCustomModelHosts(CODEMAN_CONFIG_DIR);
     const index = hosts.findIndex((item) => item.id === id);
     if (index === -1) return createErrorResponse(ApiErrorCode.NOT_FOUND, 'Model endpoint not found');
@@ -131,7 +150,12 @@ export function registerCustomModelRoutes(app: FastifyInstance): void {
       try {
         const models = await discoverModels(host);
         const next = [...hosts];
-        next[index] = { ...host, models, lastDiscoveredAt: new Date().toISOString() };
+        // A default that no longer appears in the fresh list would leave the Run-menu
+        // picker applying a model id the endpoint just told us it doesn't serve; drop
+        // it rather than carry it forward silently invalid.
+        const defaultModelId =
+          host.defaultModelId && models.includes(host.defaultModelId) ? host.defaultModelId : undefined;
+        next[index] = { ...host, models, defaultModelId, lastDiscoveredAt: new Date().toISOString() };
         await writeCustomModelHosts(CODEMAN_CONFIG_DIR, next);
         return { success: true, data: { models } };
       } catch (err) {