feat(desktop): capability-aware connection diagnostics

[Lxr-max]

Summary

Connection tests could report “connected” while the endpoint was functionally incompatible (/models missing, responses vs chat/completions mismatch, developer role rejected, auth OK but the selected wire dead). This upgrades diagnostics from a single pass/fail string to layered capability classification so the renderer can show actionable reasons.

Capability layers:

1. authentication
2. endpoint-shape
3. wire-support
4. model-discovery
5. role-compatibility
6. reasoning-compatibility

Overall status is compatible, degraded-compatible (reachable and usable with a known limitation), or incompatible. Probe-only conclusions are tagged source: "probe-only" so they are not treated as generate-time facts. This is additive on top of the existing provider auth/wire/baseUrl path and is meant to compose with the shared effective-provider contract from #216 rather than rewrite that stack.

Type of change

• New feature

Linked issue

Fixes #213

Related: #214, #216 (connection-test / generate parity is out of scope here)

Checklist

• I checked the linked issue / relevant context before starting
• Targeted pnpm tests/typecheck pass for shared, providers, and desktop; repo biome check on commit
• Added/updated tests for the change
• Added a changeset (pnpm changeset) if user-visible
• Updated i18n strings for the diagnostic UI

Principles 5b

• Compatible: existing IPC fields (ok, probeMethod, hint) remain; reasons / compatibility are additive
• Upgradeable: no disk schema change; new fields are optional on older renderers
• Lean: no new dependencies; classifiers live in shared + gateway-compat
• Elegant: one taxonomy consumed by main-process probes, provider error mapping, and the diagnostic panel

What the renderer gets

runProviderTest now returns reasons: ConnectionCapabilityReason[] plus compatibility. Settings Test connection shows a structured diagnostic panel (layer checklist + i18n causes). Missing /models with working inference is a warning (degraded-compatible), not a hard fail. responses vs chat/completions incompatibility is an explicit wire-support failure with suggestedWire.

Tests

Cover auth vs endpoint vs wire vs model-discovery failures, /models 404 + live inference → degraded-compatible, responses/chat mismatch, developer-role degraded path, and renderer preference for IPC reasons over local errorCode inference.