fix(desktop): recover composer model pill after rapid profile switches

[LeonSGP43]

Summary

• retry forced composer model refreshes during profile swaps so transient backend startup races do not leave the model pill spinning forever
• ignore stale refresh completions from older profile switches so late responses cannot overwrite the latest profile default
• cover the retry path and stale-result race with focused desktop hook tests

Verification

• npm --workspace apps/desktop exec -- vitest run --environment jsdom src/app/session/hooks/use-model-controls.test.tsx
• npm --workspace apps/desktop exec -- eslint src/app/session/hooks/use-model-controls.ts src/app/session/hooks/use-model-controls.test.tsx
• git diff --check

Closes #47524.

[teknium1]

Thanks for the focused retry and request-ordering coverage. The current-main premise is still valid: the profile-switch effect calls refreshCurrentModel(true) in apps/desktop/src/app/desktop-controller.tsx:661-670, while the current hook silently drops a failed model-info request at apps/desktop/src/app/session/hooks/use-model-controls.ts:53-68.

Problems

• The new bounded loop still returns after its final failed request at apps/desktop/src/app/session/hooks/use-model-controls.ts:96-100 without changing state or exposing recovery. Since ModelPill renders an empty $currentModel as GlyphSpinner (apps/desktop/src/app/chat/composer/model-pill.tsx:56-60), this can still leave the user with an indefinite spinner. The new test at use-model-controls.test.tsx:212-235 covers recovery before exhaustion, but not this terminal path.

Suggested changes

• Add a retryable exhausted-refresh state and a visible action that re-runs the refresh, then cover the all-attempts-fail path. Keep the request-id ordering guard, which correctly addresses the overlapping-refresh case.

Automated hermes-sweeper review.

[teknium1]

On the fourth failed request retryDelays[attempt] is undefined, so this returns with $currentModel still empty; ModelPill then keeps rendering its spinner. Please surface a retryable failure/recovery action here and add an exhaustion-path test rather than leaving the terminal state indistinguishable from loading.