fix(custom-model): act on the draft review — unparseable onclick, unwrapped envelope, wrong-session apply, missing lock, no tests

Addresses every blocker, both majors, and all but one minor from the
maintainer's review of the draft PR.

Blockers:

1. Every generated inline onclick was unparseable. JSON.stringify's own
   double quotes terminated the double-quoted HTML attribute at the first
   one, leaving btn.onclick null on every picker entry and every Discover/
   Edit/Delete button. Fixed with escapeHtml(JSON.stringify(...)) per
   argument, the same idiom deleteCase's onclick already uses four lines
   away in session-ui.js. This also closes the live-HTML-injection route
   through modelId (server-controlled, from the endpoint's own /v1/models
   reply): with quoting intact, a `>` inside it can no longer terminate the
   <button> tag early.
2. GET /api/model-endpoints wraps its body in the {success,data} envelope
   like every other /api route (server.ts's preSerialization hook applies
   to arrays too), so Array.isArray(hosts) was always false in production
   and the picker/settings panel silently saw nothing. Both call sites now
   go through _apiJson(), which already exists for exactly this.
3. A failed or declined run*() (missing CLI, isBusy, a caught exception)
   returns normally without ever changing activeSessionId, so the apply
   step used to silently re-point and restart whatever session the user was
   already looking at. runCustomModelEntry() now snapshots activeSessionId
   before the launch and requires it to have actually changed.

Majors:

4. Routes the launch through run() itself via a temporary _runMode swap
   (never persisted — setRunMode() would sync it to the server) instead of
   a parallel hardcoded dispatch table, so a custom-model launch now holds
   the same _runInFlight lock every other Run click gets. This also
   resolves the "hardcoded runners map contradicts the PR's own design"
   minor: dispatch is run()'s own, so a CLI whose customModelInjection
   recipe lands later needs no update here.
5. New test/custom-model-run-menu-ui.test.ts drives the real session-ui.js
   against a JSDOM window (runScripts:"dangerously" — this JSDOM only ever
   parses markup this module generated itself) for exactly the DOM-level
   facts the review said needed no Playwright and no tmux: a generated
   button's onclick genuinely compiles and fires, a dangerous modelId never
   produces a live element, the envelope unwrap works, the session-changed
   guard holds, run() actually gets called (proving the in-flight lock
   engages), and _runMode is restored afterward. Confirmed against the
   pre-fix code first (reproduces btn.onclick === null exactly) so this
   isn't a vacuous pass. Plus new tests in custom-model-routes.test.ts and
   render-index-html.test.ts for the other fixes below.

Minors:

- Generated entries now filter through isCliAvailable(), matching
  _refreshRunModeAvailability's own gating of the stock entries.
- The CRUD panel is now gated on customModelEndpointsEnabled
  (applyCustomModelEndpointsVisibility(), wired to the toggle's onchange
  and to settings-modal open) instead of always rendering; the endpoint GET
  no longer fires unconditionally either.
- API keys are never handed back to the browser on GET, POST or PUT —
  redactApiKey() replaces the field with a computed apiKeySet: boolean, and
  a PUT with no apiKey now keeps the stored one server-side
  (applyStoredApiKey()) instead of the client resending a value it was
  never given. New tests cover both directions (kept vs. replaced) by
  observing the actual auth header a subsequent discovery request sends.
- "+ Add endpoint" hides for a non-admin in multi-user mode
  (_applyCustomModelAdminGate(), also wired to admin-ui.js's codeman:me
  event, since the real role can resolve after settings were first opened)
  — endpoint writes were already admin-only server-side, but the button
  used to render for everyone and eat a 403.
- design doc (custom-model-endpoints-plan.md §4) now says up front that its
  toolbar-button design was superseded by the Run-menu picker.
- docs/api-reference.md gained a Custom Model Endpoints section (every
  route, the apiKeySet/defaultModelId contract, the restart mechanics).
- Wiki page now covers un-pointing a session (curl/delete, no UI yet) and
  that the picker is desktop-only for now.
- .set-inline-form uses --control-bg instead of a hardcoded black alpha
  (CLAUDE.md already records that exact literal turning the settings
  preview into a grey slab on light skins), .run-mode-custom-models gets
  the same gap: 2px .run-mode-menu's own flex gap only applies one level
  up, and the index.html comment naming the wrong function is fixed.
- __codemanCustomModelClis's JSON is now escaped against a literal
  </script> (CliEntry.label is user-clis.json-settable, unlike
  __codemanCliAvailable's booleans-only payload) via a new exported
  escapeScriptJson(), pure and unit-tested without needing a WebServer.
- Added defaultModelId + the new /v1/model-endpoints routes to
  docs/api-reference.md; left the "no zh-CN for the new Models-section
  group" minor unaddressed only insofar as the wider Models section (task
  routing, thinking effort, etc.) has never had zh-CN coverage either —
  everything this PR itself introduces (labels, hints, button text, the
  Run-menu's "Custom Endpoints" header) IS translated in i18n.js.

Regression caught while fixing #4: the admin-gate's codeman:me listener is
a module-level document.addEventListener() call, which threw in
run-mode-ui.test.ts's minimal vm-context fake document and failed all 10
of that file's tests. Fixed with optional chaining before it ever reached
the branch this commit lands on; full targeted suite (route tests,
structural guards, every settings-ui.js-loading frontend test) reverified
green afterward.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RqZeHrRS6DYcGcGX2p9EwG

src/web/public/index.html

@@ -652,7 +652,7 @@
               </button>
               <!-- Custom Model Endpoint Profiles (docs/custom-model-endpoints-plan.md): one
                    generated entry per (harness, saved endpoint) pair, e.g. "Claude Code
-                   (llama.cpp)". Built entirely by _renderCustomModelRunOptions() — hidden
+                   (llama.cpp)". Built entirely by _refreshCustomModelRunOptions() — hidden
                    when the feature is off or no endpoint has a usable default model, never
                    a fixed per-harness duplicate in this markup. -->
               <div class="run-mode-sep" id="runModeCustomModelSep" style="display: none;"></div>
@@ -2216,42 +2216,46 @@
                       <span class="set-row-label">Enable custom model endpoints</span>
                       <span class="set-row-desc">Adds a per-endpoint entry to the Run menu for every harness that can redirect to one.</span>
                     </div>
-                    <label class="switch switch-sm"><input type="checkbox" id="appSettingsCustomModelEndpoints"><span class="slider"></span></label>
+                    <label class="switch switch-sm"><input type="checkbox" id="appSettingsCustomModelEndpoints" onchange="app.applyCustomModelEndpointsVisibility()"><span class="slider"></span></label>
                   </div>
-                  <div id="customModelHostsList" class="set-group-body" data-search="endpoints"></div>
-                  <button type="button" class="btn-toolbar btn-sm" onclick="app.openCustomModelHostEditor()">+ Add endpoint</button>
-                  <div id="customModelHostEditor" class="set-inline-form" style="display:none">
-                    <h5 id="customModelHostEditorTitle">Add endpoint</h5>
-                    <div class="set-row has-field">
-                      <div class="set-row-text"><span class="set-row-label">Id</span><span class="set-row-desc">Short, stable — used in URLs, never shown to the CLI.</span></div>
-                      <input type="text" id="customModelHostId" class="set-input" placeholder="llama-cpp-local">
-                    </div>
-                    <div class="set-row has-field">
-                      <div class="set-row-text"><span class="set-row-label">Label</span></div>
-                      <input type="text" id="customModelHostLabel" class="set-input" placeholder="llama.cpp (local)">
-                    </div>
-                    <div class="set-row has-field">
-                      <div class="set-row-text"><span class="set-row-label">Base URL</span></div>
-                      <input type="text" id="customModelHostBaseUrl" class="set-input" placeholder="http://192.168.1.50:8080">
-                    </div>
-                    <div class="set-row has-field">
-                      <div class="set-row-text"><span class="set-row-label">API key</span><span class="set-row-desc">Optional. Left blank on edit keeps the existing key.</span></div>
-                      <input type="password" id="customModelHostApiKey" class="set-input" autocomplete="new-password">
-                    </div>
-                    <div class="set-row has-field">
-                      <div class="set-row-text"><span class="set-row-label">Auth header</span><span class="set-row-desc">Never send both — some servers hang indefinitely.</span></div>
-                      <select id="customModelHostAuthStyle" class="set-select">
-                        <option value="bearer">Authorization: Bearer (default)</option>
-                        <option value="api-key">api-key header (Azure)</option>
-                      </select>
-                    </div>
-                    <div class="set-row has-field">
-                      <div class="set-row-text"><span class="set-row-label">Default model</span><span class="set-row-desc">What the Run-menu picker applies for this endpoint. Discover models first.</span></div>
-                      <select id="customModelHostDefaultModel" class="set-select" disabled></select>
-                    </div>
-                    <div class="set-row-actions">
-                      <button type="button" class="btn-toolbar btn-sm" onclick="app.saveCustomModelHostFromEditor()">Save</button>
-                      <button type="button" class="btn-toolbar btn-sm" onclick="app.closeCustomModelHostEditor()">Cancel</button>
+                  <!-- Gated on the toggle above (applyCustomModelEndpointsVisibility): with the
+                       feature off, a list of endpoints that do nothing is worse than nothing. -->
+                  <div id="customModelEndpointsBody" style="display:none">
+                    <div id="customModelHostsList" class="set-group-body" data-search="endpoints"></div>
+                    <button type="button" class="btn-toolbar btn-sm" id="customModelHostAddBtn" onclick="app.openCustomModelHostEditor()">+ Add endpoint</button>
+                    <div id="customModelHostEditor" class="set-inline-form" style="display:none">
+                      <h5 id="customModelHostEditorTitle">Add endpoint</h5>
+                      <div class="set-row has-field">
+                        <div class="set-row-text"><span class="set-row-label">Id</span><span class="set-row-desc">Short, stable — used in URLs, never shown to the CLI.</span></div>
+                        <input type="text" id="customModelHostId" class="set-input" placeholder="llama-cpp-local">
+                      </div>
+                      <div class="set-row has-field">
+                        <div class="set-row-text"><span class="set-row-label">Label</span></div>
+                        <input type="text" id="customModelHostLabel" class="set-input" placeholder="llama.cpp (local)">
+                      </div>
+                      <div class="set-row has-field">
+                        <div class="set-row-text"><span class="set-row-label">Base URL</span></div>
+                        <input type="text" id="customModelHostBaseUrl" class="set-input" placeholder="http://192.168.1.50:8080">
+                      </div>
+                      <div class="set-row has-field">
+                        <div class="set-row-text"><span class="set-row-label">API key</span><span class="set-row-desc">Optional. Left blank on edit keeps the existing key.</span></div>
+                        <input type="password" id="customModelHostApiKey" class="set-input" autocomplete="new-password">
+                      </div>
+                      <div class="set-row has-field">
+                        <div class="set-row-text"><span class="set-row-label">Auth header</span><span class="set-row-desc">Never send both — some servers hang indefinitely.</span></div>
+                        <select id="customModelHostAuthStyle" class="set-select">
+                          <option value="bearer">Authorization: Bearer (default)</option>
+                          <option value="api-key">api-key header (Azure)</option>
+                        </select>
+                      </div>
+                      <div class="set-row has-field">
+                        <div class="set-row-text"><span class="set-row-label">Default model</span><span class="set-row-desc">What the Run-menu picker applies for this endpoint. Discover models first.</span></div>
+                        <select id="customModelHostDefaultModel" class="set-select" disabled></select>
+                      </div>
+                      <div class="set-row-actions">
+                        <button type="button" class="btn-toolbar btn-sm" onclick="app.saveCustomModelHostFromEditor()">Save</button>
+                        <button type="button" class="btn-toolbar btn-sm" onclick="app.closeCustomModelHostEditor()">Cancel</button>
+                      </div>
                     </div>
                   </div>
                 </div>