Fix paid model role assignment

[BitL8-ByteShort]

Summary

• allow any available, capability-compatible known-paid model to appear in role assignment dropdowns when paid routing is enabled
• make explicit role selection opt a disabled model into the unsaved draft; Automatic never enables models
• preserve curated model profiles across legacy catalog refreshes while failing closed on live capability downgrades
• reject zero-score role assignments consistently in UI and core validation
• prepare the immutable 0.2.1 release artifact

Verification

• npm run verify — 220/220 tests, TypeScript check, production build
• npm audit --audit-level=high — 0 vulnerabilities
• responsive browser QA at 1440x900 and 390x844 — no horizontal overflow or console errors
• security diff scan — 0 findings across all changed production surfaces
• npm publish dry run and disposable global install — passed; CLI reports 0.2.1
• package SHA-256: b0c0e161bec91ac384d12336d9786aa41870a65d3a291a72760a1e84fb3a489c

Closes the provider-agnostic paid-model assignment gap observed with xAI Grok on Linux.