feat(ai): sync model reads, explicit async refresh

Provider.getModels() is sync-only (last-known list; must not throw) with
an optional refreshModels() where dynamic providers fetch. The
sync-or-async union invited latent sync assumptions that would detonate
on the first dynamic provider; async-only reads would force sync
consumer surfaces (extension find/getAll) through Promises. Sync reads
plus an explicit refresh verb keeps the contract single and the
staleness visible.

Models.getModels()/getModel() are sync best-effort reads;
Models.refresh(provider?) rejects with ModelsError(model_source) for a
single provider and is concurrent best-effort across all providers.
createProvider() takes a models array plus an optional refreshModels
fetcher (stored on success, in-flight calls deduped, list unchanged on
rejection). forceRefresh options are gone.

Also finishes the in-progress AuthStorage fallbackResolver removal
(drops the now-unused includeFallback option from getApiKey).

packages/ai/test/scratch.ts

@@ -18,7 +18,7 @@ models.setProvider(anthropicProvider());
 // 2. Look up a model and check auth.
 // ---------------------------------------------------------------------------
 
-const model = await models.getModel("anthropic", "claude-haiku-4-5");
+const model = models.getModel("anthropic", "claude-haiku-4-5");
 if (!model) throw new Error("model not found");
 
 const auth = await models.getAuth(model);