fix(custom-model): replace the native confirm() popup with an in-app modal

The llama-swap "this will unload it for session X" warning used a native
browser confirm() popup, which looks out of place next to the rest of the
app's own modals.

Adds #customModelSwapConfirmModal (index.html) with Cancel/Switch-anyway
buttons, styled to match the app. _confirmModelSwap(message) shows it and
returns a promise that resolves true/false the same way confirm() would;
_resolveModelSwapConfirm(proceed) (wired to both buttons and the backdrop
click) settles it. Both llama-swap conflict call sites
(_quickStartWithCustomModelConfirm for the one-shot launch path,
_runCustomModelEntryViaRestart for Claude's restart path) now await this
instead of calling confirm() directly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RqZeHrRS6DYcGcGX2p9EwG

test/custom-model-one-shot-launch.test.ts

@@ -156,7 +156,7 @@ describe('_quickStartWithCustomModelConfirm', () => {
 
   it('confirming re-sends with confirmed:true and returns the second response', async () => {
     const { win, app } = bootApp();
-    win.confirm = (() => true) as typeof win.confirm;
+    app._confirmModelSwap = async () => true;
     let calls = 0;
     withFetch(win, (body) => {
       calls += 1;
@@ -184,7 +184,7 @@ describe('_quickStartWithCustomModelConfirm', () => {
 
   it('cancelling never re-sends, and reports a cancellation error', async () => {
     const { win, app } = bootApp();
-    win.confirm = (() => false) as typeof win.confirm;
+    app._confirmModelSwap = async () => false;
     let calls = 0;
     withFetch(win, () => {
       calls += 1;