feat(llm): Z.AI GLM-5.3 and GLM-5.3-Flash

Both are added to the Z.AI static model list with their 1M-token context
and 128K max output. GLM-5.3-Flash is natively multimodal, so it gets the
vision and video capabilities — through an `override` rule, because the
provider's `defaults: { vision: false }` already set the flag and a fill
rule would have skipped it silently.

Neither model can stop thinking (`thinking.type` only accepts "enabled"),
so they get their own reasoning rule with low/high/max and no `disabled`,
placed before the `glm-5*` family rule that would otherwise swallow them.

CHANGELOG.md

@@ -8,6 +8,14 @@ release PR may merge — and a section is closed at the commit that bumps it.
 
 ## [Unreleased]
 
+### Added
+
+- Z.AI's new models are selectable on the **Models** page: **GLM-5.3** and **GLM-5.3-Flash**,
+  both with a 1M-token context. GLM-5.3-Flash is natively multimodal, so images and videos
+  attached to a message are sent to it directly instead of as a file path. Both always think —
+  Z.AI does not allow turning it off — and the reasoning control offers *low / high / max*
+  (default *max*) instead of an on/off switch.
+
 ### Fixed
 
 - The **Providers** page said *API key missing* on every provider, including the ones