feat(ai): sync model reads, explicit async refresh

Provider.getModels() is sync-only (last-known list; must not throw) with
an optional refreshModels() where dynamic providers fetch. The
sync-or-async union invited latent sync assumptions that would detonate
on the first dynamic provider; async-only reads would force sync
consumer surfaces (extension find/getAll) through Promises. Sync reads
plus an explicit refresh verb keeps the contract single and the
staleness visible.

Models.getModels()/getModel() are sync best-effort reads;
Models.refresh(provider?) rejects with ModelsError(model_source) for a
single provider and is concurrent best-effort across all providers.
createProvider() takes a models array plus an optional refreshModels
fetcher (stored on success, in-flight calls deduped, list unchanged on
rejection). forceRefresh options are gone.

Also finishes the in-progress AuthStorage fallbackResolver removal
(drops the now-unused includeFallback option from getApiKey).

packages/ai/test/lazy-module-load.test.ts

@@ -72,7 +72,7 @@ describe("lazy provider module loading", () => {
 		const result = runProbe(`
 			const all = await import(${JSON.stringify(providersAllUrl)});
 			const models = all.builtinModels();
-			await models.getModels();
+			models.getModels();
 		`);
 		expect(result.loadedSpecifiers).toEqual([]);
 	});