fix(distributed): sync gallery OpCache + caches across frontend replicas

[localai-bot]

Summary

When scaling the LocalAI frontend past one replica, several pieces of in-memory state were per-process while writes already touched the shared PostgreSQL + NATS layer. This PR closes the read-side gap.

• OpCache + OpStatus (UI's /api/operations 1Hz poll): operations flickered in and out as the load balancer alternated. The Models page re-fetched the whole gallery on every flicker because its useEffect([operations.length]) re-fires when the count changes.
• ModelConfigLoader: a chat completion that landed on replica B after the install completed on replica A failed to find the new model — B's loader was still the old one.
• UpgradeChecker: 6-hour cache stayed stale on peer replicas after a backend upgrade, so /api/backends/upgrades kept surfacing an upgrade that had already shipped.

This mirrors the jobs.Dispatcher distributed pattern for gallery ops: NATS wildcard subscriptions for live sync, PostgreSQL gallery_operations hydration on startup, plus broadcast invalidation for caches that mirror disk state.

What's in scope

• OpCache gains SetMessagingClient / SetGalleryStore / Start(ctx). Set/SetBackend upsert cache_key + is_backend_op and broadcast OpCacheEvent on gallery.opcache.start. DeleteUUID broadcasts on gallery.opcache.end. Start hydrates from PostgreSQL via the new GalleryStore.ListActive() then subscribes to both subjects.
• GalleryService.SubscribeBroadcasts subscribes to SubjectGalleryProgressWildcard (new lock-light mergeStatus), SubjectGalleryCancelWildcard (new applyCancel), and the new SubjectCacheInvalidateModels / SubjectCacheInvalidateBackends. Two new hooks (OnModelsChanged, existing OnBackendOpCompleted) get wired in startup.go to LoadModelConfigsFromPath and UpgradeChecker.TriggerCheck respectively. Hydrate() restores active rows on startup. CancelOperation tolerates the cancel func living on a different replica.
• modelHandler and backendHandler publish on the cache-invalidation subjects after their successful local reload, so peers refresh too. Originating replica reloads inline and never enters the broadcast handler.
• OpStatus.MarshalJSON/UnmarshalJSON round-trip the error as a string via an internal opStatusWire. The published payload now wraps the status in GalleryProgressEvent{JobID, Status} so wildcard subscribers don't need to parse the subject string.
• GalleryOperationRecord gains CacheKey + IsBackendOp columns; Create uses OnConflict-DoUpdates so OpCache.Set racing ahead of the service goroutine no longer breaks the row.
• core/http/app.go wires the OpCache distributed setters when application.Distributed() != nil. core/application/startup.go calls Hydrate + sets OnModelsChanged + SubscribeBroadcasts right after SetGalleryStore/SetNATSClient.

Test plan

• go test ./core/services/galleryop/... — 44/44 specs pass (5 new spec groups: OpStatus JSON wire format, OpCache distributed sync, OpCache PostgreSQL hydration, GalleryService broadcast sync, cache-invalidation broadcasts, GalleryService PostgreSQL hydration)
• go test ./core/http/routes/... — passes
• go test ./core/services/jobs/... — passes
• go test ./core/services/agents/... — passes
• go build ./core/... && go vet ./core/... — clean
• golangci-lint run on changed packages — clean
• Manual: scale local-ai Deployment to 2 replicas, install a model — operation card should remain stable across the 1Hz poll, Models page should not continuously refetch, and a chat completion routed to the non-installing replica should find the model.