fix(custom-model): address third pre-merge review (Ark0N)

Blocker 1: the loading banner hides itself ~200ms after it reopens.

- _showCenterStatus reuses one shared DOM node; dismiss() scheduled
  el.hidden = true 200ms later with nothing to cancel it. On the
  Claude path, switchingToast.dismiss() is followed by one same-
  origin request (5-30ms locally) before _watchLlamaSwapLoading opens
  the new banner -- well inside that window -- so the stale timer
  fired against the shared node and hid the fresh banner, leaving the
  whole model-load wait with no progress text, no log line and no
  reachable Cancel button.
- Fixed by parking the pending timeout on the element and clearing it
  at the top of _showCenterStatus. Added a regression test that
  reproduces the exact repro (open, dismiss, reopen 20ms later,
  advance past 200ms) alongside the existing Cancel-button DOM tests;
  confirmed it fails without the fix and passes with it.

Blocker 2: the swap-conflict warning named other users' sessions.

- Both affectedSessions scans (POST .../custom-model and quick-start)
  walked the whole session map with no ownership filter, so in multi-
  user mode a non-admin pointing their own session at a shared
  endpoint learned another user's session name and id -- which with
  autoNameSessions on is that user's own prompt.
- The swap is still blocked pending confirmation regardless of
  ownership (a foreign session is just as real a disruption); only
  which ones get NAMED back to the caller is scoped, via the
  already-imported canAccessOwned. Added a two-owner test to
  test/routes/session-custom-model.test.ts covering both the
  foreign-owner (blocked, not named) and same-owner (named) cases.

Smaller ride-along fixes:

- server.ts boot recovery now passes contextLength into
  applyCustomModelInjection, so CLAUDE_CODE_MAX_CONTEXT_TOKENS is
  correctly rebuilt into _envOverrides after a restart instead of
  surviving only because tmux retains the old setenv.
- pumpLlamaSwapLogTail's finally now deletes by IDENTITY, not just by
  key, so an aborted pump finishing after a newer entry was created
  for the same endpoint can no longer delete that newer entry and
  orphan its connection.
- docs/custom-model-endpoints.md now notes that clearing a custom
  model removes injected keys by name, including CLAUDE_CONFIG_DIR --
  so a session that also had CLAUDE_CONFIG_DIR set via envOverrides
  (the per-client-account case) silently falls back to the default
  account on clear.

Left for later, as flagged in the review itself: the quick-start
case-scaffolding/cancel ordering (real behavioural reordering across
a large handler, too risky to make without a live re-test), and
retiring runCustomModelEntry's mode === 'claude' branch behind a
launchStrategy registry field (explicitly deferred by the reviewer to
"the next one").

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ea59JhUmHBm1gRCsiYF33R

test/custom-model-run-menu-ui.test.ts

@@ -16,7 +16,7 @@
  */
 import { readFileSync } from 'node:fs';
 import { JSDOM } from 'jsdom';
-import { describe, expect, it } from 'vitest';
+import { describe, expect, it, vi } from 'vitest';
 
 const CONSTANTS_JS = readFileSync(new URL('../src/web/public/constants.js', import.meta.url), 'utf-8');
 const SESSION_UI_JS = readFileSync(new URL('../src/web/public/session-ui.js', import.meta.url), 'utf-8');
@@ -970,6 +970,29 @@ describe('Custom Model Endpoint Profiles: _showCenterStatus Cancel button (real
     expect(win.document.querySelector('.center-status-cancel')).toBeNull();
   });
 
+  it('reopening within the 200ms fade cancels the previous dismiss(), so the fresh banner is not hidden out from under it', () => {
+    // The real bug: dismiss() schedules el.hidden = true 200ms later with nothing
+    // to cancel it. _runCustomModelEntryViaRestart calls switchingToast.dismiss()
+    // then awaits one same-origin request (5-30ms locally) before reopening the
+    // banner for the model-load wait — well inside that 200ms window — so the
+    // stale timer fired against the shared DOM node and hid the fresh banner.
+    vi.useFakeTimers();
+    try {
+      const { win, app } = bootAppWithRealCenterStatus();
+      const first = app._showCenterStatus('Claude started — switching to llama-swap…');
+      first.dismiss();
+      vi.advanceTimersByTime(20);
+      app._showCenterStatus('Loading qwen3 on llama-box…');
+      vi.advanceTimersByTime(280);
+
+      const el = win.document.getElementById('customModelCenterStatus') as HTMLElement;
+      expect(el.hidden).toBe(false);
+      expect(el.textContent).toContain('Loading qwen3 on llama-box…');
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
   it('re-asserts [hidden] over the flex display, so dismiss() actually hides it', () => {
     // .center-status-banner is display:flex, which defeats the `hidden` attribute —
     // dismiss()'s only visibility lever — unless this rule exists: without it the card