fix(desktop): prevent MoA autosave defaults explosion from half-filled slots

[DavidMetcalfe]

Summary

Fixes #64156: MoA preset editor silently replaces user config with hardcoded defaults when a reference model's provider is changed.

What this PR does

Three changes in apps/desktop/src/app/settings/model-settings.tsx:

1. Filter incomplete reference slots before autosave (sanitizeMoaRefsForSave): when a user changes a reference model's provider, updateMoaSlot clears the model to "" and the 600ms debounced autosave was sending this half-filled slot to the backend. The backend's _clean_slot() rejects empty-model slots, and _normalize_preset() falls back to hardcoded DEFAULT_MOA_REFERENCE_MODELS — silently replacing the entire preset. The sanitizer strips slots with empty model before any save and skips presets that would end up with zero valid references.

2. Add withActive() to MoA provider dropdowns: the reference and aggregator provider Selects filtered to authenticated providers only, so unauthenticated current values (e.g. openai-codex, which requires OAuth) rendered as blank triggers. The parallel model dropdown already used withActive(). Mirror that pattern.

3. Add generation counter to scheduleMoaSave(): stale save responses could overwrite newer state (classic async race). Bump a counter on each save and skip setMoa if a newer save was scheduled in the meantime.

Test plan

• Open Settings → Model → Mixture of Agents
• Change a reference model's provider to any authenticated provider (Kilo, OpenRouter, etc.)
• Model dropdown should populate with that provider's models
• Wait >600ms without selecting a model — the autosave should NOT trigger the defaults explosion
• The reference should remain at the selected provider (with cleared model, waiting for model selection)
• Select a model — the autosave should persist the complete slot correctly

Notes

• The hardcoded defaults in moa_config.py:13-16 reference openai-codex (OAuth, unauthenticated by default), which practically guarantees the blank-provider symptom on fresh installs or wiped configs. This PR mitigates the explosion but a follow-up could make the fallback dynamically select from authenticated providers.

[teknium1]

Merged via PR #64976 — your commit was cherry-picked onto current main with your authorship preserved in git history (a61a0bc). Thanks for the sharp diagnosis: the half-filled-slot autosave → _clean_slot() rejection → defaults fallback chain was exactly right.

On top of your fix we hardened both sides of the wire:

• The backend PUT /api/model/moa now validates before normalizing and returns 422 naming the broken preset/slot, so no client (desktop, dashboard, or future) can trigger the silent defaults swap again — addressing the follow-up you suggested in your PR notes.
• The desktop autosave now holds while a slot is half-filled and flushes when the model pick completes, instead of stripping the mid-edit slot from the payload (which still repainted the row out from under the user).
• The payload schema also now round-trips fanout / reference_max_tokens / reasoning_effort, fixing a sibling data-loss hole where any client save erased those hand-set values.

Your generation-counter guard and withActive() provider-dropdown fix landed as-is. Much appreciated!