v3.11.0 — Cross-provider failover

Your turn finishes even when a provider doesn't.

Added

• Automatic cross-provider failover (on by default). When an API call fails hard — provider down, rate-limited (429), 5xx, timeout, or bad key (401) — Kodiqa transparently retries the same request on the next configured provider (rebuilding the messages in its format) and continues the turn there. It notifies loudly when it switches (⚠ Failing over to <model>) and never fails over on a user interrupt.
• /failover — on / off, auto (use every provider with a key), or an explicit order: /failover claude deepseek qwen.

Single-provider users are unaffected (nothing to fail over to). No competitor has this.

Tests

• test_failover.py — candidate selection, the failover logic (switch on failure, stay on success, never on interrupt, respect the off switch), and the /failover command. 419 total; ruff + CI green.