Integrate AI answer controls and interrupted-stream recovery

[Vinosaamaa]

Parent and scope

Follow-up to #248 after backend PR #317 and the responsive UI reconstruction in PR #314. Searches of open/closed issues found the earlier #100 streaming presentation and #120 Questions layout slices, but no owning issue for the new authenticated model catalog, answer-mode contract and interrupted-generation recovery. This child issue owns that bounded frontend integration.

Acceptance criteria

• Load the authorized Course channel model catalog and render only returned model choices and answer modes, with accessible controls in the modern Questions workspace.
• Distinguish Source only, Quoted evidence and unavailable Grounded explanation truthfully. Provider API consumption is not a native subscription; do not add Support user-owned native AI subscriptions through a secure local companion #316 companion scope.
• Label saved answers from their returned audit provider/model/LLM-used fields, including replay under a different current selection.
• Handle stream status and structured error events. EOF before an authoritative complete event is an interruption, never a completed answer; discard partial text/citations and offer clear recovery.
• For GENERATION_ALREADY_ATTEMPTED, do not offer another provider generation on the same question. Offer Source only recovery or existing Instructor/TA paths without a new provider call.
• Preserve session/account and channel/request ownership during streaming, cancellation, navigation and retry; release the reader on all exits.
• Observe focused regression failures before fixes, then pass lint, unit/build/loading budgets, real service journeys, responsive browser/visual checks and exact-head CI/review.
• Record the compact design, implementation/change log, system boundary review and numbered Engineering receipt. Keep the issue open through required merged-main and release verification.

Delivery boundary

One isolated frontend worktree and one issue-linked PR. Backend #319 framework repair may land independently without changing this UI contract. No model credentials in browser storage, no fabricated production data, no automatic paid-provider retries, and no native subscription/companion implementation.