refactor(custom-model): move the real-home link into the registry recipe

- linkFromRealHome/realHomeFallback on the configDir recipe; the apply consumer is generic and names no CLI
- lstat guard so boot-recovery re-applies survive a dangling link; symlink is best-effort
- resolve the real home from the session's own dirEnvVar override before the server's, threaded through both routes and boot recovery (Session.envOverrideValue)
- deepseek links profiles/sessions/settings.yaml; boot-recovery test covers the session lookup

src/web/routes/session-routes.ts

@@ -1618,7 +1618,8 @@ export function registerSessionRoutes(
       body.modelId,
       session.id,
       contextLength,
-      session.workingDir
+      session.workingDir,
+      (envVar) => session.envOverrideValue(envVar)
     );
     if (!applied) {
       return createErrorResponse(ApiErrorCode.OPERATION_FAILED, `${session.mode} has no known custom-model mechanism`);
@@ -4514,7 +4515,8 @@ export function registerSessionRoutes(
         customModel.modelId,
         qsCustomModelSessionId,
         cmContextLength,
-        workspacePath
+        workspacePath,
+        (envVar) => qsGatedEnvOverrides?.[envVar]
       );
       if (!cmApplied) {
         return createErrorResponse(ApiErrorCode.OPERATION_FAILED, `${mode} has no known custom-model mechanism`);

src/web/server.ts

@@ -1470,7 +1470,13 @@ export class WebServer extends EventEmitter {
         endpoint,
         saved.modelId,
         session.id,
-        endpoint.modelContextLengths?.[saved.modelId]
+        endpoint.modelContextLengths?.[saved.modelId],
+        // Boot recovery deliberately omits `workingDir` (no reason to re-answer a trust
+        // dialog that already fired once), so the session-env lookup rides in after it:
+        // a session with its own DSH_HOME override must link its config dir back to
+        // THAT home, not the server's, exactly like the routes do.
+        undefined,
+        (envVar) => session.envOverrideValue(envVar)
       )?.envOverrides;
     } catch (err) {
       console.warn('[WebServer] Failed to rebuild custom-model env on recovery:', err);