feat(R03): unify provider catalogue, routing decisions and usage telemetry

EPIC R03 (Team Duy) - one provider catalogue, one routing flow, one usage seam.

R03-T01 tests/contracts/test_providers.py
  29 contract tests every provider must satisfy: canonical assistant message,
  streamed text == returned content, reasoning never joins the answer, parsed
  tool arguments, ProviderError for every failure. Real adapters exercised
  offline by stubbing Provider._request.
R03-T02 domain/models/provider_descriptor.py
        infrastructure/providers/provider_registry.py
  Provider facts declared once (was split across providers/factory.py,
  DEFAULT_CONFIG and PROVIDER_LABELS). ProviderRegistry.build() also stamps the
  descriptor id onto the instance, so ollama/github_copilot/codex usage is no
  longer all attributed to "openai_compat", and never mutates the caller config.
R03-T03 application/model_routing/routing_application_service.py
  Pure-Python routing policy with four modes: Off, Auto, Manual and the new
  Fallback (switch only AFTER the current model fails). Depends on a RoutingPort
  protocol; production wires the existing core.routing engine underneath.
R03-T04/T05 ui/chat_panel.py, ui/co4e_tab.py, ui/folder_tab.py
  Three near-identical routing copies (~40 lines each) replaced by a call to
  ctx.routing_application() plus a confirm callback. Mode vocabulary now lives
  in one place (normalize_mode/is_valid_mode) instead of four literal tuples.
R03-T06 infrastructure/telemetry/usage_sink.py
  Token usage extracted from both providers into UsageEvent + UsageEventSink.
  Estimation pinned against core.usage_tracker so no recorded number changes.

Also fixes a deadlock introduced while wiring AppContext: routing_application()
held _routing_lock and called routing(), which takes the same non-reentrant lock.

Suite: 186 passed, 1.22s. check_imports: PASS. All new files < 400 LOC.
2 pre-existing failures remain in test_config_security.py (EPIC R02/Team Nam).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ui/chat_panel.py

@@ -638,12 +638,16 @@ class ChatPanel(QWidget):
     def _apply_routing(self, text: str, turn: Dict[str, Any]) -> None:
         """Auto Model Routing hook — run once per outgoing message.
 
-        Off → no-op. Auto → silently switch to the best-fit model. Manual → ask
-        the user (modal, with the configured confirm timeout) before switching.
+        The decision itself lives in ``application/model_routing`` (R03-T04):
+        this method is now only the presentation half — supply the current
+        model, open the confirm dialog when the service asks for one, and render
+        the notice. Off/Auto/Manual/Fallback semantics, the never-raise
+        guarantee and the "which model do we end up on" fallback are the
+        service's job, and are shared with Co4E and AI-Edit instead of being
+        re-implemented here.
+
         Sets ``self._routed_provider``/``self._routed_model`` for THIS turn;
-        :meth:`build_provider` honours them. Never raises — a routing failure
-        must never block sending a message; it just falls back to the tab's
-        own model.
+        :meth:`build_provider` honours them.
         """
         # Recompute fresh each message; clear any previous turn's override.
         self._routed_provider = None
@@ -651,37 +655,30 @@ class ChatPanel(QWidget):
         # An explicitly-pinned Admin agent takes precedence over routing.
         if getattr(self, "_admin_agent", None) is not None:
             return
-        if not (text or "").strip():
+        cur_provider = self.ctx.config.active_provider
+        cur_model = self._model or self.ctx.config.provider_conf(cur_provider).get("model", "")
+        decision = self.ctx.routing_application().route_turn(
+            self.kind, text, cur_provider, cur_model, confirm=self._confirm_routing_switch,
+        )
+        if not decision.switched:
             return
-        try:
-            mode = self.ctx.project_routing_mode(self.kind)  # per-workspace mode
-            if mode == "off":
-                return
-            service = self.ctx.routing()
-            cur_provider = self.ctx.config.active_provider
-            cur_model = self._model or self.ctx.config.provider_conf(cur_provider).get("model", "")
-            result = service.route(self.kind, text, cur_provider, cur_model, mode_override=mode)
-            if not result.should_switch:
-                return
-            target = result.target()
-            if target is None:
-                return
-            to_provider, to_model = target
-            if mode == "manual":
-                from .routing_toggle import confirm_switch
-                timeout = float(self.ctx.config.routing.get("confirm_timeout_sec", 60) or 60)
-                if not confirm_switch(self, result.decision, timeout):
-                    return  # declined / timed out → keep current model
-            self._routed_provider = to_provider
-            self._routed_model = to_model
-            notice = self.chat_view.add_status(tr(
-                "routing.switched_notice",
-                model=to_model, task=result.task_type.value,
-                gain=f"{result.decision.score_gain:.2f}"))
-            turn["bubbles"].append(notice)
-        except Exception:  # noqa: BLE001 — routing must never block a chat turn
-            self._routed_provider = None
-            self._routed_model = None
+        self._routed_provider, self._routed_model = decision.target()
+        notice = self.chat_view.add_status(tr(
+            "routing.switched_notice",
+            model=decision.model, task=decision.task_type,
+            gain=f"{decision.score_gain:.2f}"))
+        turn["bubbles"].append(notice)
+
+    def _confirm_routing_switch(self, decision) -> bool:
+        """Manual mode: ask the user before moving this turn to another model.
+
+        Passed to the routing service as a callback so the pure-Python decision
+        layer never has to know a modal dialog exists. Returning False (declined
+        or timed out) keeps the tab's own model."""
+        from .routing_toggle import confirm_switch
+
+        timeout = float(self.ctx.config.routing.get("confirm_timeout_sec", 60) or 60)
+        return bool(confirm_switch(self, decision, timeout))
 
     def _compress_messages(self) -> None:
         """Manual compress: keep the system prompt + the last 2 turns verbatim and