Secure AI providers and complete MCP tools

[newtontech]

Summary

• run the AI backend as a Python module and use the OpenAI Responses API plus Ollama generate API
• store OpenAI credentials in VS Code SecretStorage with set/clear commands; add cancellation, timeouts, bounded output, and secret-safe errors
• validate and route all five dependency-free MCP tools with preserved JSON-RPC IDs and normalized optional-dependency failures
• add unit, contract, and fake-HTTP end-to-end coverage; update README and changelog

Tests

• npm test -- --runInBand: 79 suites passed, 1553 passed, 2 skipped; coverage 91.28% statements / 95.85% functions
• PYTHONPATH=python python3 -m unittest discover -s tests/python -v: 18 passed
• npm run compile, npm run lint, npm run typecheck, npm run format:check: passed (lint retains 3 pre-existing warnings)
• make typecheck: passed
• make lint / make check: blocked by 544 pre-existing Ruff errors under core
• make test: Jest unit suite passed, then Makefile stopped because bare pytest is unavailable and core/tests/unit does not exist

No live OpenAI request or real credential was used.

Fixes #237