#1979 S2: amicode service model-reachability cache + scheduler + GET/POST routes #1985

Parent: #1979. Blocked by: #1984.

New packages/extension/src/amicode_service/model_reachability.ts:

• a locked file cache under AMICODE_OPS_DIR, shared across hub shards, keyed by {provider, model, credential_fp};
• a rate-limited scheduler that probes on connect, daily, and on demand, through S1;
• GET /amicode/model-reachability, POST /amicode/model-reachability/refresh and POST …/demote.

Unknown is reported as unchecked, never as working. Wire it in index.ts, extension.ts and amicode_service_runner.ts; the hub's headless path skips modelRouting today. Fleet clients proxy /amicode/* to the host, so one hub cache serves every machine. Pattern: model_routing.ts, connections.ts.

AC (RED first):

• test/amicode_service_model_reachability.test.ts: fake probe results are cached and served, and a credential_fp change invalidates them.
• Concurrent writers don't corrupt the cache.
• Refresh is rate-limited.