refactor(providers): a provider is a vendor and a key, and the table is gone

The dropdown was listing "connections" — a row per adapter + model + key — which
made choosing a model an act of configuration, put a key icon and a bin inside a
menu item, and showed five accounts nobody had created.

A provider is now a vendor Officer curates. Every one is listed, set up or not,
because a vendor you have no key for is exactly what you need to see in order to
add one. The model is chosen per generation, from that provider's entry in the
catalogue, beside it.

With the model off the row, all that remained of a "provider" was the key for
OpenAI — and Officer already stores keys: one active value per purpose, 0600
inside a 0700 directory, outside the backup tarball, created on first use so
nothing needs provisioning. So `atelier_providers` is dropped, along with
`generations.provider_id` that pointed into it. `provider` and `model` stay as
text on each generation, which were always the historical fact rather than a
pointer to configuration.

`getSecret`, never `getKey`: this is a foreign credential, and getKey mints a
random value for a purpose it cannot find — which for someone else's API key
means authenticating with something invented.

Resolution follows: a request names a model, and the catalogue says whose it is,
rather than a database being asked which stored row served it. A model nobody
in the catalogue claims is still accepted — the catalogue is advisory, and a
model released today should work before we ship a file that mentions it.

Two routes replace five: PUT and DELETE on /providers/:name/key. Deleting a key
that came from the environment is refused rather than faked — it belongs to the
install, not to this screen.

web/lib/api.ts

@@ -7,19 +7,27 @@ import { getHeaders, useClient } from 'hooks/useClient';
 
 const ATELIER_API = '/api/atelier';
 
-/** A configured connection: adapter + model + key. Several may share one adapter. */
+/**
+ * A provider: a vendor Officer curates, and whether we hold a key for it.
+ *
+ * Every provider in the catalogue is listed, set up or not — a vendor you have no key for is exactly
+ * what you need to see in order to add one. There is no "configured provider" as a separate thing;
+ * `configured` is a fact about the key, and the model is chosen per generation.
+ */
 export type ProviderStatus = {
-  id: string;
   name: string;
-  adapter: string;
-  model: string;
-  enabled: boolean;
-  is_default: boolean;
+  label: string;
   configured: boolean;
-  key_source: 'database' | 'environment' | null;
+  key_source: 'store' | 'environment' | null;
   env_var: string;
-  created_at: string;
-  updated_at: string;
+  /** False when the catalogue lists a vendor this build has no adapter for. */
+  usable: boolean;
+  supports_edit: boolean;
+  refreshable: boolean;
+  default_model: string | null;
+  models: string[];
+  model_details: CatalogueModel[];
+  updated_at: string | null;
 };
 
 /** One model in the catalogue — what it makes, what it accepts, what it costs. */
@@ -36,26 +44,6 @@ export type CatalogueModel = {
   source?: 'shipped' | 'api' | 'scraped';
 };
 
-/**
- * What a new connection can be built on: a catalogue provider that has an adapter behind it.
- *
- * `models` is the flat list of ids; `model_details` carries the per-model facts, which is what lets a
- * form offer dall-e-2's three sizes rather than gpt-image-1's four. The catalogue is refreshed daily
- * in the sidecar — `updated_at` says when, and is null while only the shipped file has been read.
- */
-export type Adapter = {
-  name: string;
-  label: string;
-  models: string[];
-  model_details: CatalogueModel[];
-  default_model: string;
-  env_var: string;
-  supports_edit: boolean;
-  updated_at: string | null;
-  /** Whether the sidecar has a refresher for this provider — i.e. whether the refresh button does anything. */
-  refreshable: boolean;
-};
-
 /** Snake case, matching the server — one spelling per field across every endpoint. */
 export type GenerationRow = {
   id: string;
@@ -128,7 +116,13 @@ export function useAtelierClient() {
     ...client,
 
     listProviders: () => client.get<{ data: ProviderStatus[] }>('providers').then((r) => r.data),
-    listAdapters: () => client.get<{ data: Adapter[] }>('providers/adapters').then((r) => r.data),
+
+    /** Save a provider's key. Goes to the platform's secret store; nothing ever reads it back. */
+    setProviderKey: (name: string, apiKey: string) =>
+      client.put<{ data: ProviderStatus[] }>(`providers/${name}/key`, { apiKey }).then((r) => r.data),
+    /** Forget a stored key. Refused for a key that came from the environment — that one is the install's. */
+    clearProviderKey: (name: string) =>
+      client.delete<{ data: ProviderStatus[] }>(`providers/${name}/key`).then((r) => r.data),
 
     /**
      * Re-read one provider's models and prices from the vendor, or every provider when omitted.
@@ -138,7 +132,7 @@ export function useAtelierClient() {
      */
     refreshCatalogue: (provider?: string) =>
       client
-        .post<{ data: { updated_at: string | null; models: number } }>(
+        .post<{ data: { updated_at: string | null; providers: ProviderStatus[]; changed: boolean } }>(
           `providers/catalogue/refresh${provider ? `?provider=${encodeURIComponent(provider)}` : ''}`,
           {},
         )