fix(proxy): fall back to cloud-cache provider catalog when local registry misses

[thomas-supervisor]

Closes the gap surfaced by the M2 E2E walkthrough.

The problem

User flow:

1. `POST /v1/providers` on thomas-cloud → "xiangxin" registered with originBaseUrl etc.
2. `PUT /v1/agents/bindings/claude-code` → static binding to `xiangxin/...`
3. Local: `thomas cloud login && thomas cloud sync` → cache populated with both binding AND provider metadata
4. Send a request → proxy returns "Unknown provider xiangxin" ← the bug

Cause: `attempt()` resolved providers via `getProvider()`, which only consults builtins + `~/.thomas/providers.json`. The cloud cache's `providers[]` was data the proxy never read. So users had to double-register every cloud provider locally to make routing work — defeating the "cloud下发了模型配置给local" goal.

The fix

Local-first, cloud-as-fallback:

```
attempt()

1. getProvider(id) ← builtins + ~/.thomas/providers.json (unchanged)
2. loadProviderFromCloudCache(id) ← reads ~/.thomas/cloud-cache.json (new)
3. neither → 503 unknown_provider
   ```

`src/cloud/providers.ts` is a pure cache reader: returns a `ProviderSpec` from the snapshot, or `undefined` if the provider isn't there / has unknown protocol / has no `originBaseUrl`.

Privacy boundary unchanged

Credentials NEVER come from cloud. `findCredential()` still reads only `~/.thomas/credentials.json`. If the user binds an agent to a cloud provider without a local key, they still get a 503 — but the message now mentions the provider came from cloud and points at the exact `thomas providers add` command (legacy was just "Unknown provider", a dead end).

Why local-first ordering

Explicit `thomas providers register` should win over a cloud snapshot — the user's machine remains authoritative for any provider they've explicitly locked in. The 3rd test case verifies this.

Tests

`tests/cloud-provider-fallback.test.ts` — 3 fake-server cases:

scenario	result
cloud-only provider, local key present	200; upstream sees the local key
cloud-only provider, NO local key	502; body has clearer remediation pointing at `thomas providers add `
same id in cloud + local	local wins (cloud upstream untouched)

266 / 266 tests pass, build 187 KB.

End-to-end implication

After this lands, the M2 happy path (which I walked through manually earlier today) would have just worked without the workaround:

```sh

(cloud) configure provider + binding

curl -X POST .../v1/providers ...
curl -X PUT .../v1/agents/bindings/claude-code ...

(local) login + sync + (only) add the credential

thomas cloud login --base-url http://...
thomas cloud sync
thomas providers add xiangxin ← only this remains; no register needed

go

claude "..." # routes through proxy → translates anthropic→openai → xiangxinai → translates back
```

🤖 Generated with Claude Code