Phase 10A: Add model-assisted planner shadow mode

[paullizer]

Summary

• add a versioned, strict model-assisted capability planner contract over the current request and safe server-authorized inventory
• support fail-closed off and observational shadow modes without changing deterministic recommendation, toggles, capability execution, runtime nodes, finalization, or response behavior
• preserve selected built-ins and a generic selected-agent mandate while rejecting unknown fields, IDs, vocabularies, ineligible capabilities, selected-only proposals, and over-budget results
• support Azure OpenAI, OpenAI-style, and Anthropic-compatible chat clients with exact-schema prompting, disabled SDK retries, bounded optional-parameter fallback, and one shared transport deadline
• resolve configured planner models only from governed global admin endpoints, preventing personal/group endpoint ID collisions
• persist only compact sanitized shadow summaries and emit fixed privacy-safe completed, rejected, timed-out, and control-comparison events
• add backend settings normalization, version 0.250.069, feature documentation, release notes, and combined Phase 9/10A quality gates

Safety Boundaries

• planner output is inert in Phase 10A and cannot create a choice card or clarification UI
• no planner-selected capability, tool, plugin, action, or external query can execute
• current user text is sent only to the already authorized planner model endpoint
• conversation history, evidence, canonical IDs, instructions, tools, endpoints, secrets, opaque agent references, raw responses, and inaccessible counts are excluded from persisted metadata and telemetry
• capability resumes, cancelled turns, disabled mode, and turns without a safe unselected discoverable capability skip or discard planning
• timeout, malformed output, refusal, filtering, client error, or unsupported transport preserves deterministic fallback

Validation

• combined compile, BAC, XSS, functional, route-policy, and UI-contract gate: 228 passed, 5 skipped
• all 5 skips are expected environment-gated browser/live-smoke cases
• full-file Broken Access Control scan passed for all 7 touched application modules
• full-file XSS sink scan passed for all 7 touched application modules
• 139 deterministic evaluation rows execute through safe inventory projection and strict result validation
• editor diagnostics, Python compilation, and CRLF-aware whitespace checks passed

Refs #1021