v0.8.67 Setup support: provider/model readiness card for constitution-first setup

[Hmbown]

Problem

Provider/model setup is the highest-friction first-run path. The full setup wizard needs a provider/model step that gets a new user to first success with one API key and one default model, while still leaving advanced provider routing available after the happy path.

Depends on/provider-adjacent work in v0.8.65, including #3385, #3384, #3383, #3382, #3083, #3075, #3024, #3222, #3004, #1978, #1519, and related auth/custom-endpoint issues.

Product shape

Primary first-run path:

1. Show a recommended provider first, with “choose another provider” available.
2. Ask for exactly one API key for the selected provider.
3. Validate the key and endpoint immediately.
4. Show recommended default models for that provider, with clear labels for fast/default/deep-thinking behavior where the provider supports them.
5. Save the selected default model.
6. Return a safe summary: provider, default model, health state, and redacted auth state.

Advanced path, not first-run default:

• custom base URL or OpenAI-compatible endpoint,
• model id passthrough,
• fallback chains,
• script-backed key retrieval,
• provider capability overrides,
• route health/debug details.

This step should feel like choosing a character/loadout before starting, not filling out an integration matrix.

Scope

• Let users choose provider, paste one key, validate it, and select the default model from the wizard.
• Use provider-owned model catalogs/live model cache when available; support custom model ids when no catalog match exists, but keep that behind advanced controls.
• Support secret input safely, including script-backed key retrieval where implemented.
• Run live health checks: key present, endpoint reachable, model valid, streaming/tool/reasoning support known, /v1/models or equivalent status where applicable.
• Preserve existing provider config and warn before replacing values.
• Produce a safe summary with provider/model and redacted auth state, not raw secrets.

Questions this step should ask

• Which provider do you want to use now?
• Paste the API key for that provider.
• Which default model should CodeWhale use?
• Do you want to configure advanced routing now, or start with this route and return later?

Definition of done

• A fresh user can configure at least one provider/model route from the setup wizard using one API key and one default model selection.
• Existing users can inspect and update provider/model config without losing existing settings.
• Provider health check failures are actionable and do not block skipping.
• Advanced endpoint/fallback/custom-model options do not clutter the primary first-run path.
• Tests cover default provider, custom endpoint, missing key, invalid model, default model persistence, and redacted summary behavior.