## Why

AI providers are a required first-party platform area, but the backend and console currently expose only the generic core resource API and a placeholder page. Operators need a usable management workflow that configures model endpoints safely without exposing raw provider credentials to plugins or UI responses.

## What Changes

- Add AI-provider-specific backend management actions for update, enable/disable, configuration test, and configured model listing.
- Preserve the existing create/list/detail API while tightening response behavior around secret references and raw key rejection.
- Add service methods and DTOs for AI provider management without adding external provider calls or raw secret storage.
- Replace the `platform_web` placeholder AI provider page with a functional management view that lists providers, creates/edits provider metadata, toggles status, tests configuration, and displays model inventory.
- Add frontend API types/client methods and tests that assert raw keys are never part of returned provider shapes.

## Capabilities

### New Capabilities

- `ai-provider-management`: Safe platform and management-console workflows for creating, editing, enabling/disabling, testing, and viewing AI provider configuration.

### Modified Capabilities

- None.

## Impact

- Affects `platform/` and `platform_web/` only.
- Extends AI provider DTOs, service methods, API handlers, route catalog, frontend API contracts, and the AI provider page.
- Adds backend API tests, frontend rendering/client tests, and a browser walkthrough.
- Does not add raw key exposure, plugin-facing raw credentials, run-side behavior, external AI network invocation, billing, cloud host sales, or agent-provider/cloud-provider workflows.