feat(phase-13): add model routing and fallback

[lyxnbclass]

Summary

• add ordered primary/fallback model routing on one OpenAI-compatible endpoint
• fail over only for transport failures, HTTP 408/409/425/429, and 5xx responses
• preserve the normalized request, tool declarations, and token output limit across candidates
• redact route failures and reject unsafe model names or endpoint credentials
• document scope, threat model, limitations, and stage status

Validation

• stage-related tests: 101 passed
• full suite: 339 passed, 3 skipped
• branch coverage: 86.01% (threshold 85%)
• Ruff, Mypy, compileall, sdist/wheel build, and offline MockModel demo passed

Scope

Fallback candidates share one endpoint, API key, timeout, and protocol. This PR does not add cross-provider credential pools, load balancing, health checks, or parallel racing. Failed transient requests may still be billed when the provider returns no usage data.