feat: user-defined LLM committees

[duncanmcqueen]

Summary

Adds user-defined model committees: a committee answers one prompt with several
models at once and has a chair model synthesize their replies into the single
answer the user sees. Committees are built under Settings > Models, stored
on the profile (user_profiles.model_committees), and selected from a
Committee group in the model picker like any other model.

Stacked on #339 — the first commit here is that PR's foundation. Retarget or
rebase once it merges.

What changed

Backend

• lib/llm/committee.ts — members run concurrently against the ordinary
  provider layer, then the chair synthesizes. Guards against self-chairing,
  self-membership and cycles.
• lib/userCommittees.ts — normalization for reads (malformed rows are
  dropped, never thrown, so a bad row cannot lock a user out of Settings) and
  strict validation for writes (max 8 committees, 2–8 members).
• lib/llm/models.ts — missingCommitteeApiKeyModels / modelHasApiKey /
  resolveUsableModel: availability resolves recursively through a
  committee's members and chair.
• lib/routerModels.ts — resolveRequestedModel recognises committee ids and
  gates them on availability, taking committees the caller already loaded so
  no request reads the profile twice.
• lib/userSettings.ts, lib/chat/streaming.ts, routes/chat.ts,
  routes/tabular.ts — committees are loaded once with the rest of the
  profile and threaded to dispatch.
• routes/user.ts — modelCommittees on the profile (select / serialize /
  PATCH) plus GET /user/models. Profile reads get their own retry tier, so a
  database without the column keeps every other live column.
• migrations/20260823_02_user_model_committees.sql + schema.sql.

Frontend

• components/settings/CommitteeSettingsSection.tsx — create, edit and delete
  committees. Only models the user can actually run are offered as members.
• ModelToggle — a Committee group, shown only when every member and the
  chair is usable.
• mikeApi / UserProfileContext — committee types, profile state, save.

Design notes

Availability is all-or-nothing. A committee is hidden from the picker and
refused at request time unless every member and its chair is usable. Half a
committee is not a usable answer.

A deleted committee is an explicit error, not a silent fallback to another
model — quietly answering with a different model misrepresents which model
wrote the response.

No tool-calling loop. When the caller supplies tools (the main chat path
always does) they are dropped and the members are told so, rather than being
left to claim document or case-law work they could not do.

Cost. Members are separate model calls, so a committee costs roughly the
sum of its members plus the chair. Running them concurrently keeps the latency
close to the slowest member instead of the sum.

Why

Different models disagree in useful ways on legal questions. A committee makes
that disagreement visible to a synthesizing model rather than making the user
run the same prompt several times by hand.

Testing

• backend: tsc --noEmit clean; vitest run — 789 passed, 25 skipped
  (+25 over feat(llm): add model registry and OpenAI-compatible provider foundation #339's foundation, covering committee dispatch, concurrency,
  cycle/self-reference guards, and committee validation).
• frontend: tsc --noEmit clean; npm run lint 0 errors; vitest run —
  564 passed, 14 failed. All 14 failures are pre-existing on main
  (mikeApi.test.ts Blob handling, useSelectedModel,
  ChatInput.modelSelection) and were confirmed against the baseline before
  these changes.
• Migration follows the dated convention with schema.sql updated to match.

28 files changed in this commit (1681 insertions); 37 files and 3498 insertions
including #339's foundation.

[CLAassistant]

All committers have signed the CLA.