Refactor AI Config and Fix Login failure: Migrated services to a structured api directory, updated backend schemas for multiple TTS/STT providers, and improved settings/chat UI coverage.

refactor(auth): decouple sandbox node from core deployment and add dedicated provisioning script

feat(auth): bootstrap Day 1 local auth fallback, migrations, and sandbox node

feat: expose model info to users, multi-model provider cloning, cleaner profile UI ...

- Show model name under each provider button for all users (ProfilePage)
- Admin Settings: upgraded 'Register New Instance' panel with 4 fields:
  provider type, label suffix (with model-name hint), pre-set model
  dropdown, and 'Inherit API Key From' for same-type instance cloning
- Fix API key inheritance: use _clone_from marker instead of copying
  masked key; backend resolves real key from DB before saving
- Lock cloned-key instances: API key field is greyed out with lock icon
  and 'Inherited from <source>' display; Unlink button breaks the link
- Provider card header: show configured model name instead of
  'User Override / System Provided' labels
- ProfilePage: remove confusing 'Do Extra Work' override panel entirely;
  ServiceSelect is now a clean provider selector with no hidden admin UI
- SettingsPage: remove 'User Override' / 'System Provided' badge

enable OIDC