feat(settings): add Jev from the service chooser with a checked key

[vastsa]

What

Redesigns the Jev (TypeSafe structured classifier) settings and folds it into
the Add service flow, so adding Jev means a checked key and an enabled
classifier.

• Add service gains its own Classifiers group with one tile for Jev
  (TypeSafe · api.typesafe.ai/v1/systemone). It is offered on the add path
  only, because Jev owns no provider row and no model list — changing an
  existing row's service can never turn it into a classifier.
• Picking it opens a Jev form in the same dialog: what the classifier does, the
  privacy notice, and the TypeSafe key. No model panes, no endpoint fields.
• Check and save runs both steps: the key is checked against the same
  System One address and classifier the Agent's JevClassify tool calls, and
  only a key that answered is stored and turns jevEnabled on. A refused key
  writes nothing and reports TypeSafe's status.
• Closing the dialog while the check is in flight cancels the whole action, so
  an abandoned dialog cannot leave a credential behind.
• The settings card is now the integration's state instead of a second place to
  enter a key: stored-key status, the Agent-mode switch, and add/replace/remove
  key actions. Removing the key still turns Jev off before deleting it.
• Credential is an API key — TypeSafe has no OAuth path.

Files

Area	Files
Host	electron/main/jev-probe.ts, electron/main/ipc/jev-ipc.ts, ipc/register.ts, mcp-control.ts (channel blocked from the MCP control surface)
Contracts	packages/shared/src/protocol.ts (jevTest), types/settings.ts (JevKeyCheckResult), secret-refs.ts (TypeSafe address + classifier id)
Renderer	settings/jev-config.ts (ordering), settings/jev-app-config.ts (wiring + key-status hook), settings/JevServiceForm.tsx, settings/JevSettingsCard.tsx, settings/service-catalog.ts, settings/ServiceChooser.tsx, settings/ProviderSetupDialog.tsx, settings/ModelConfigPage.tsx, lib/api.ts
i18n	chooserClassifiers + the Jev key/save copy in all 9 locales
Specs	settings IA, provider/model system, E2E test plan

Verification

• tsc -p apps/desktop/tsconfig.json --noEmit (renderer + Electron main): clean
• biome lint, check-style-tokens.mjs, check-architecture.mjs: clean
• electron-vite build: passes (main + preload + renderer)
• node --test apps/desktop/test/jev-*.test.mjs apps/desktop/test/service-chooser.test.mjs apps/desktop/test/mcp-control-wiring.test.mjs: 26/26
• packages/shared vitest: 1190 passed; agent-runtime Jev vitest: 5 passed
• check:pr-base: head contains current origin/main (rebased onto 7a47846)

New/changed tests cover the probe contract (address, redaction, timeout,
unreachable), the ordering rules (check → store → enable, disable → delete,
cancel), the isolated-Electron user paths (card states, chooser offers Jev on
the add path only, check-then-save, refused key, close-while-checking).

Notes

• pnpm test:e2e:jev now runs the four Jev suites plus the session-launch
  suite and the runtime's JevClassify tests.
• No Rust or host-core change.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.