feat(local-model): install a model from the server, with a job that can pause

POST /api/local-model/install, cancel, resume and runtime, and DELETE
/api/local-model. The GET gains an `install` object the window polls. All of
it is experimental and admin only in multi-user mode.

One job of five steps (runtime, model, verify, agent, connect) driven by a
pure reducer over explicit state, step and transition tables. One job at a
time (409). The consent is bound to the size shown: `acknowledgedBytes` must
be the server's own total (409 size-changed). A job a server restart
interrupted comes back paused and never continues without a click. Every
failure is a code with one next step.

The model is judged against the budget the runtime measured before it is
downloaded. A missing coding agent is installed with its stock command
through the shared runner, audited. Connect writes one endpoint record under
the reserved id through mutateCustomModelHosts() and switches
customModelEndpointsEnabled on through mutateSettingsFile(), remembering the
flag's value. The model's digest is stored and read again at boot and before
every session start on that endpoint; a changed model refuses the launch.

Remove answers 409 with the session names while a live session uses the
endpoint, undoes the two writes first, restores the flag only when this
feature switched it on and no other endpoint is saved, and deletes only
inside local-model/. The coding agent stays.

The server starts the runtime at boot when a model is installed and stops
it at shutdown beside stopDeepSeekWeb().

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

src/types/local-model-install.ts

@@ -22,15 +22,19 @@
  * | Route                            | Body                        | Refusals                                              |
  * |----------------------------------|-----------------------------|-------------------------------------------------------|
  * | `GET /api/local-model`           | none                        | none (a failed probe is an answer)                    |
- * | `POST /api/local-model/install`  | `LocalModelInstallRequest`  | 400 not a row the server offers; 409 `job-running`,   |
+ * | `POST /api/local-model/install`  | `LocalModelInstallRequest`  | 400 not a row the server offers, or a saved endpoint  |
+ * |                                  |                             | already has the reserved id; 409 `job-running`,       |
  * |                                  |                             | `already-installed`, `size-changed`                   |
  * | `POST /api/local-model/cancel`   | none                        | 409 `wrong-state` (no job is running)                 |
- * | `POST /api/local-model/resume`   | `LocalModelResumeRequest`   | 409 `wrong-state` (not paused or failed)              |
+ * | `POST /api/local-model/resume`   | `LocalModelResumeRequest`   | 409 `job-running`, `wrong-state` (not paused or       |
+ * |                                  |                             | failed)                                               |
  * | `POST /api/local-model/runtime`  | `LocalModelRuntimeRequest`  | 409 `wrong-state` (not installed), `job-running`      |
  * | `DELETE /api/local-model`        | `LocalModelRemoveRequest`   | 409 `job-running`, `sessions-open`                    |
  *
  * A 409 is the error envelope plus `data: LocalModelConflict`:
- * `{ success: false, error, errorCode: 'CONFLICT', data: { reason, message, ... } }`.
+ * `{ success: false, error, errorCode: 'CONFLICT', data: { reason, message, ... } }`. A 409
+ * WITHOUT `data` is a write of `settings.json` or of the endpoint store that was refused
+ * because the file does not parse; `error` names the fix.
  *
  * The rules of src/types/local-model.ts hold here too:
  *  1. A size a person reads travels twice: as bytes and as decimal GB text from `formatGb()`
@@ -427,18 +431,14 @@ export interface LocalModelInstallView {
   actions: LocalModelAction[];
 }
 
-/**
- * The `data` of `GET /api/local-model`. Admin only in multi-user mode.
- *
- * `install` is optional in the type only until the route emits it: from the stage that ships
- * the install verbs on it is always present.
- */
+/** The `data` of `GET /api/local-model`. Admin only in multi-user mode. */
 export interface LocalModelStatus {
   hardware: HardwareFacts;
   recommendation: Recommendation;
   /** `LocalModelCatalog.updated`. */
   catalogUpdated: string;
-  install?: LocalModelInstallView;
+  /** Where the install stands. Always present. */
+  install: LocalModelInstallView;
 }
 
 // ---------- Request bodies and answers ----------
@@ -557,6 +557,12 @@ export interface LocalModelStateFile {
     /** The digest `/api/tags` reported after the pull. Compared again at boot and before a session starts. */
     digest?: string;
   };
+  /**
+   * The model of the job this one replaced, when it was another model: what that job left in
+   * the model store is deleted once the runtime runs, before the new model is downloaded.
+   * Absent once that was done, and in `idle` and `installed`.
+   */
+  replacedModelId?: string;
   /** The coding agent of the job or of the installation. */
   cli?: { id: string; label: string };
   /** The runtime, once its port was chosen. */