feat:nebius token factory provider

[amrrs]

Add Nebius Token Factory provider with dynamic model listing

Summary

Adds Nebius Token Factory (which hosts SoTA open models) as a built-in OpenAI-compatible provider, plus a general dynamic model listing capability so a provider's catalog can be fetched live from GET /v1/models?verbose=true at build time instead of being hardcoded. Nebius is the first consumer.

Changes

• tau_ai.models.list_openai_compatible_models — tolerant /models client (sends verbose=true, parses data[].id, extracts optional context windows, dedups). Supports a short timeout override for best-effort build-time use.
• dynamic_models flag — added to ProviderCatalogEntry and OpenAICompatibleProviderConfig (serialized in providers.json). When set, an empty models/default_model round-trips safely; non-dynamic providers keep strict validation.
• ensure_dynamic_provider_models — best-effort helper that fetches the live catalog for the targeted provider when credentials are usable, keeps the existing default model when still offered, merges context windows, and persists via the normal settings path.
• Startup wiring — TUI and print mode refresh only the targeted provider (--provider or default) before resolving the selection.
• Resilience — 10s listing timeout so a slow endpoint can't stall startup; providers.json rewritten only when the catalog changes; fetch failures logged at debug and never block startup.
• Docs — provider guide, configuration reference, and a dev-note; .env/.env.* added to .gitignore.

Testing

• uv run pytest tests/test_tau_ai.py tests/test_provider_config.py → 65 passed (verbose on/off, dedup, context windows, no-credentials no-op, non-dynamic untouched, persistence round-trip, change-only write).
• Full suite green except 3 pre-existing terminal-width rendering tests (unrelated; identical on base).
• uv run ruff check introduces no new errors.