models: add extra_payload to create_custom / update_custom

[stepdi]

Summary

Mirrors the new atlas-app backend field (LayerLens/atlas-app#1932) so SDK callers can attach arbitrary JSON to every outgoing chat-completions request body for their Custom Models.

`extra_payload` is deep-merged into the request body; customer values win on conflict with our hardcoded defaults. Practical uses:

• Override `temperature` (we send `0` for reproducible evals) for providers that reject it.
• Add provider-specific fields like `top_p`, `presence_penalty`, OpenRouter routing hints (`provider: { order: [...] }`).
• Send `max_completion_tokens` for OpenAI's gpt-5 / o1 / o3 endpoints, which reject `max_tokens`.

Reserved keys: `messages`, `model`, `stream` — backend returns 400.

Changes

• `models.create_custom` (sync + async) — new `extra_payload: Optional[Dict[str, Any]]` keyword argument.
• `models.update_custom` (sync + async) — same. `{}` clears the existing payload.
• Reference docs (`docs/api-reference/models-benchmarks.md`), README example (`docs/README.md`), examples (`docs/examples/models-and-benchmarks.md`), samples (`samples/core/custom_model.py`, `samples/claude-code/skills/benchmark.md`), CHANGELOG.
• Example `api_url` values updated to the full `/v1/chat/completions` form to match the backend hint (the system uses the URL verbatim — no path is appended).

Backwards-compatible: existing callers keep working — the field is optional, and the backend additions are additive.

Test plan

• `client.models.create_custom(..., extra_payload={"top_p": 0.9})` succeeds and the merged value reaches the upstream provider on a real eval.
• `client.models.update_custom(model_id, extra_payload={"temperature": 1})` replaces the stored payload.
• `client.models.update_custom(model_id, extra_payload={})` clears the stored payload.
• Old SDK call sites without the new arg still work (no breakage).

Dependencies

• Backend support lands in atlas-app#1932 — merge that first; SDK release should follow.
• Backend now also enforces Key uniqueness within (org, project) at create time and rejects loopback / IMDS api_urls. SDK callers that previously relied on the silent-overwrite behavior for duplicate keys, or pointed at restricted IPs, will now see 409 / 400 respectively.

🤖 Generated with Claude Code