Fix routing and billing regressions; prepare 0.4.1

[BitL8-ByteShort]

Outcome

Prepare 0.4.1 with the four confirmed fixes:

• Zero token rates on plan-specific provider slots cannot authorize Free access, including saved catalogs, old metadata caches, and legacy panel shapes. Configured Paid still works when estimates are unavailable.
• OpenCode-listed beta and enabled alpha models remain available.
• Incomplete discovery preserves omitted routes and unchanged billing declarations and pins. Fresh endpoint changes still invalidate bindings.
• Usage accepts nested and regional model IDs containing @ and ~.

Update dependencies within their existing major versions, correct the public setup and policy docs, record the published 0.4.0 evidence, and preserve the original internal implementation plan in Git. Internal plans remain excluded from npm.

Verification

• npm run verify with isolated OpenCode 1.18.22 on PATH: 354 tests passed, zero skips; type checking and production build passed.
• npm run test:browser with installed Chrome: all 14 scenarios passed under Playwright 1.63.0.
• npm outdated --json: no outdated dependencies.
• npm audit --audit-level=high: zero vulnerabilities.
• npm pack --dry-run --ignore-scripts --json: 84 files; includes the new guard and built assets; excludes plans, tests, scripts, nested tarballs, and local state.
• Regression tests failed before each fix and passed after it. An independent review caught a legacy panel fallback; that was fixed and reviewed again.
• No real-provider inference requests. Full Linux/macOS and Node 22.12.0/24.x candidate acceptance will run in CI before merge. Final bytes will be produced once from clean protected main and retested before publication.

Safety and compatibility

• Free and legacy verified-price Paid reject unknown pricing; configured Paid checks connection identity, availability, and capabilities.
• Paid routing remains an explicit choice and cannot bypass capability gates.
• No credentials, private prompts, customer data, absolute user paths, or generated settings are included.
• Existing configuration ownership and recovery checks are unchanged.
• Failure-path regressions cover old caches, legacy panel data, changed endpoints, and incomplete discovery.
• Both commits have DCO sign-offs.

Publication is authorized by the maintainer's request to bring the repository and npm up to date. npm login is still required in the release environment; this PR does not claim 0.4.1 is published.