fix(provider): enforce connection protocol contracts / 系统修复模型连接协议与错误恢复

[SivanCola]

Problem

Changing a saved provider connection's API format could keep a provider-specific route prefix and append a different protocol suffix. A DeepSeek Anthropic route could therefore become /anthropic/v1/chat/completions, return HTTP 404, expose the opaque internal provider ID, and later reload as a generic interrupted turn.

Fix

• Add optional catalog identity to installed ProviderView records while keeping ProviderEntry.Name, saved provider/model references, cache keys, and session references stable.
• Register DeepSeek's documented Chat, Responses, and Anthropic bases and resolve exact official protocol switches from that registry.
• Preserve custom gateways, query-bearing URLs, and unknown paths; reject high-confidence protocol suffix conflicts in the editor, save path, and runtime with a recommended endpoint.
• Carry safe structured failure diagnostics with provider ID, display name, protocol, HTTP status, category, and a sanitized request path.
• Show the connection display name and API format in the primary error while keeping the internal ID and request path in diagnostic details.
• Persist failed versus interrupted terminal display metadata so provider failures reload as their original HTTP/protocol error and user cancellation remains an interruption.

Compatibility and cache behavior

• No provider ID or model-reference migration is required; deepseek-anthropic remains the stable connection ID.
• New Wails and persisted JSON fields are optional. Legacy connections and sessions retain their previous fallback behavior, and older readers ignore the additional fields.
• The provider-visible interrupted-turn recovery summary is byte-identical with and without the local display metadata, preserving prompt-cache behavior.
• Existing custom endpoints are never silently rewritten.

Impact declarations

Cache-impact: low - local recovery display metadata and typed error diagnostics change, while provider-visible request and recovery-summary bytes remain unchanged.

Cache-guard: go test ./internal/agent -run TestInterruptedRecoveryDisplayMetadataDoesNotChangeProviderBlock -count=1 verifies byte-identical provider-visible recovery content.

System-prompt-review: SivanCola reviewed the internal/boot endpoint-validation wiring; it does not change system-prompt content, ordering, or serialization.

Documentation-impact: updated - the English and Chinese provider endpoint registries now document the DeepSeek Anthropic base alongside Chat and Responses routes.

Related PRs

• fix(agent,control): make interrupted turns recoverable without repeating side effects / 中断回合可恢复且不重复副作用 #9868 implements broader interrupted tool-execution recovery. This PR only distinguishes provider failure presentation from user/runtime interruption; the overlapping persistence and controller files will need semantic reconciliation when the second PR is rebased.
• fix(provider): ignore request_url that merely repeats base_url #9464 adjusts adapter-level request_url derivation. This PR validates the effective endpoint contract before adapter construction and does not depend on that change.

Validation

• go test ./... -count=1 -p 1
• go test ./internal/config ./internal/provider/... ./internal/agent ./internal/boot ./internal/control -count=1 -p 1 after rebasing onto 218033719
• (cd desktop && go test . -count=1)
• focused frontend endpoint, provider editor, and controller metadata tests
• (cd desktop/frontend && pnpm build) including TypeScript, lint, architecture, CSS, theme, and bundle-budget checks
• git diff --check origin/main-v2...HEAD

The default parallel root suite intermittently timed out TestGoalTurnRunsPastTheOldRoundCeiling at its five-second wait boundary under local cross-package load. The same test passed 10/10 in isolation, the owning package passed normally, and the complete root suite passed with package concurrency disabled.