fix(models): always install in place from the configured models folder

[joshistoast]

Summary

Add Models let users untick Install in place for files already inside Invoke's configured models folder. A non-in-place install from there moves the files into a new managed folder inside that same models folder.

Now any local source inside the models folder always installs in place:

• Typed file path: the option shows checked and disabled, with a tooltip and a screen-reader description: "Models in the Invoke models folder are always installed in place."
• Folder scans: the option is locked the same way when every result is inside the models folder. That includes Scan models folder and scans of a symlinked spelling of it, because the server returns resolved result paths.
• Every install path sends inplace=true for such sources: Pull, per-row Install, the row's context menu, and Install all.

Outside the folder the user's choice applies as before, and it comes back unchanged after they leave the folder.

isInModelsDir compares paths as text against the server-reported folder. It normalizes separators and trailing slashes, compares Windows drive and UNC paths case-insensitively, and never matches a path with .. segments.

Related Issues / Discussions

Closes #9796

QA Instructions

• pnpm check:release (webv2) passed: lint/types/architecture, unit (10187), browser (2896), architecture performance, project-file journeys, accessibility. The first run hit a timeout in the unrelated SettingsDialogTarget.browser.test.tsx. It passed twice in isolation, and the full rerun passed.

• New unit cases for isInModelsDir, and a browser test in AddModelsView.browser.test.tsx covering:

  • unlocked outside the folder, with the user's untick honored;
  • locked and sending inplace=true inside it;
  • the user's choice restored after leaving the folder;
  • Install all from a symlinked scan sending inplace=true for every result.

  The browser test fails on main.

• Browser (mock backend models_dir = /opt/invokeai/models; scan_folder and install POSTs stubbed):

  • Type /opt/invokeai/models/loras/detail.safetensors: the option is checked and disabled, the tooltip shows on hover, and clicking does nothing.
  • Type a path outside the folder: the option is enabled again.
  • Scan models folder, then Install all: every request has inplace=true. On main the same flow sends inplace=false after unticking.

Review

No remaining material findings. Known limits:

• Scanning a parent of the models folder leaves the option unlocked. Results inside the models folder still install in place.
• Enforcement is client-side. The backend still accepts inplace=false for these paths from the legacy UI or direct API callers, because its install path deliberately supports moving files from inside the models root (recovery sentinels).
• Retrying an old failed job reuses that job's recorded inplace.
• Paths the client cannot resolve (~, a symlinked file path typed by hand) fall back to the user's choice.

Checklist

• The PR has a short but descriptive title, suitable for a changelog
• Meaningful regression coverage added / updated where needed; obsolete tests/code removed
• Persisted-state and API changes include required migrations / compatibility validation
• Relevant performance/efficiency opportunities considered; material claims have evidence
• Material review findings resolved and relevant checks rerun
• Documentation added / updated (if applicable)
• Updated What's New copy (if doing a release after this PR)

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}