feat: add explicit enable/disable toggles for every provider in Settings

[victorhqc]

Summary

Every registered provider now has an enable/disable toggle in its Settings card. The ProviderRegistry gates all provider operations — fetch, setup, helper management, credential import — on enablement, and disabled providers never call into a provider module. The QuotaViewModel manages an observable set of enabled IDs, starts work only for enabled providers, and stops provider-owned tasks when a provider is disabled.

Why

Previously, a provider was implicitly activated when the user saved an API key or installed a CLI helper. The user had no way to keep a provider installed but prevent Filbert from reading it. This branch makes enablement an explicit, persistent choice that is independent of configuration. (ui 17)

What changed

• Sources/Core/ProviderEnablement.swift — new UserDefaults-backed enablement store. Missing values resolve to enabled for API-key providers with a saved key and disabled for all others. Provider-ID-neutral.
• Sources/Core/ProviderRegistry.swift — every method now checks enablement before calling into a provider. isConfigured and fetchRequest also gate on enablement, so no provider method runs for a disabled provider.
• Sources/App/QuotaViewModel.swift — added enabledProviderIds set and setProviderEnabled(). Refactored into four extensions (Lifecycle, Presentation, Results, Setup) so lifecycle and presentation logic is testable in isolation.
• Sources/App/APIKeyFreeSettingsRow.swift (new) — extracted the API-key-free provider card from SettingsView. Renders disabled guidance when the provider is off, and setup/install/remove controls only when it is on.
• Sources/App/SettingsView.swift — passes enablement state and toggle action into every provider card header. API-key cards keep their key field even while disabled, so the user can save a key and enable in one action.
• Sources/App/SettingsVisualComponents.swift (new) — shared visual helpers for provider cards.
• Sources/App/Resources/Localizable.xcstrings — new strings for the toggle, disabled status, and disabled guidance text.
• Tests — ProviderEnablementTests, ProviderEnablementViewModelTests, CredentialImportViewModelTests, ConfiguredProvidersOrderedTests, and ProviderRegistryProactiveRefreshTests cover AC3 through AC11 with isolated UserDefaults, keychain stubs, and provider spies.

Notes for review

• The QuotaViewModel refactor split one file into four extensions. Review the extracted files alongside the diff to QuotaViewModel.swift to confirm no logic changed during the split.
• saveKey now calls setProviderEnabled(true) after the Keychain write succeeds (AC4). Check that the failed-save path is tested.
• Disabling a provider cancels its refresh loop and fetch task but does not delete keys, helpers, or imported credentials (AC5).