fix(providers): accept bounded model list response shapes

[luoye520ww]

Problem

Together.ai and other OpenAI-compatible providers may return a top-level model array or a models envelope. Kun only accepted { data: [...] }, so a successful Fetch Models response appeared empty.

Root cause

parseModelIds assumed one response shape and read the entire response without a bounded body policy.

Scope

Part of #884. The current model request path already preserves configured wire IDs; this PR does not rewrite model names or touch credential resolution.

Changes

• Accept only the documented top-level array, data, and models envelopes.
• Preserve model IDs exactly after trimming; deduplicate exact IDs without lowercasing.
• Bound response bytes, model count, and individual ID length; cancel oversized streams.
• Add regression coverage for MiniMaxAI/MiniMax-M3 casing, nested payload rejection, and oversized responses.

Tests

• npm.cmd exec vitest run src/main/provider-connection.test.ts (13 passed)
• npm.cmd run typecheck (passed)
• npm.cmd run lint -- --quiet (passed)
• npm.cmd run build (passed)
• git diff --check (passed)

Review

Reviewed functionality, bounded memory, malformed payload handling, exact wire IDs, and scope. No unrelated files are included.

[XingYu-Zhong]

Reviewed against current develop after branch update. Scope is focused, the change remains needed, and no blocking issue was found. Required CI must pass before merge.