feat(providers): Moonshot AI provider + extract shared OpenAI-compat helpers

- Add MoonshotProvider and MoonshotCodeProvider (OpenAI-compatible)
- Extract `fetch_openai_models()` and `build_openai_llm()` shared functions,
  deduplicating model-listing and client construction across OpenAI,
  OpenRouter, DeepSeek, LM Studio, and Z.AI providers
- Add `lists_models` field to `ProviderUiMeta` — drives frontend model
  picker dynamically instead of hardcoded `type_id` list
- Port DeepSeek, LM Studio, OpenRouter model listing to `fetch_openai_models`
- Set `lists_models: true` on Z.AI provider (missed in prior pass)

feat(mcp): named key placeholders {SECRET:name}/{ENV:name} in connector URLs

- `apply_key_placeholder` now accepts an `env` map alongside `api_key`
- Named tokens resolve from the connector's described `env[]` fields,
  with `{SECRET:name}` falling back to `api_key` for backward compat
- Replace `substitute_secret_tokens` with `substitute_named_tokens`
- Unresolved tokens are left in place (visible misconfig) rather than
  silently producing a wrong URL

fix(ui): connector detail hides generic API key when schema has secret

fix(ui): model picker uses `lists_models` from provider types endpoint

crates/skald-core/src/skald/bundles.rs

@@ -69,6 +69,8 @@ impl Models {
         provider_registry.register_builtin(crate::llm::providers::lm_studio::LmStudioProvider::new());
         provider_registry.register_builtin(crate::llm::providers::deepseek::DeepSeekProvider::new());
         provider_registry.register_builtin(crate::llm::providers::zai::ZaiProvider::new());
+        provider_registry.register_builtin(crate::llm::providers::moonshot::MoonshotProvider::new());
+        provider_registry.register_builtin(crate::llm::providers::moonshot::MoonshotCodeProvider::new());
         let provider_registry = Arc::new(provider_registry);
         info!("provider registry ready ({} built-in providers)", provider_registry.all().len());