[025] Add custom LLM provider support

[konard]

Parent epic: #1

Phase: Teleton Agent Integration
Priority: 25

Scope

Allow users to configure approved local or cloud LLM providers for Teleton Agent without committing credentials.

Implementation Steps

• Define provider configuration schemas and secret reference handling.
• Add validation for local, cloud, and custom endpoint providers.
• Document privacy implications for each provider mode.

Acceptance Criteria

• Provider credentials are stored through secure references only.
• Invalid provider configurations return actionable validation errors.
• Cloud provider use requires explicit user opt-in.

Automation

Generated from #1 using scripts/decompose-epic.mjs.