fix(credentials): align active providers with enabled channel order

[kevin1sMe]

After trying local ASR, a legacy active provider such as local-qwen3-mlx can survive a switch back to cloud channels. Settings marks the first enabled cloud channel as current, while request resolution can interpret the stale value as a provider type and bypass channel order and enabled state.

This makes the first enabled ASR/LLM channel authoritative for credential metadata, status and new requests. Desktop credential loading reconciles cached active IDs on every load, including already migrated/restored vaults; existing gated writes persist the correction. Channel mutations repair stale caches, and explicit activation rejects unknown provider IDs when channels exist. The local model page reads backend credential status and subscribes to changes instead of using the legacy preference for its active badges.

A nonempty list with all channels disabled has no active provider. Legacy preference fallback remains supported for stores without channels. Omni retains its independent selection, ongoing recordings retain their initial channel/protocol/model, and switching away from local ASR keeps downloaded models and credentials. Restart reconciliation does not make network validation requests or silently fail over to another provider.

Validation:

• New stale-active regression fails before the fix and passes afterward.
• Full Core test suite: 1,251 passed, 1 ignored (1,070 unit tests plus 181 integration tests), including recording-session channel freezing and activation rollback preserving the cloud channel selected during native preparation. The rollback fixture creates that channel before selecting its returned ID.
• Core Clippy with warnings denied and the full npm test suite passed (TypeScript/Vite build plus all frontend/contract tests). The React state setter uses a distinct name from the backend channel activation API, retaining the activation-boundary contract.
• Isolated production credential modules: 101 synthetic tests passed, including 3 new desktop load/restart regressions and a new Linux status regression. The fixture entry point only redirects nested module paths and excludes native ASR dependencies.
• Platform CI passed on fd8f4fbe: macOS backend tests, Windows checks/test compilation and Rust-only tests, Android checks, macOS Rust 1.88 MSRV, Chromium/WebKit UI motion, and Linux Core/egui tests, Clippy and deb/rpm packaging. A rebuilt-app microphone smoke test remains to be completed.

Selection policy is documented in docs/provider-channel-selection.md.