fix(session): persist provider on model switch and use it on resume

[webtecnica]

Summary

When a session falls back from the primary model to a fallback on a different provider, and the user then switches to that fallback model with /model, the session persisted only the model name in state.db — never its provider. On resume, the runtime recombined the persisted model with the primary provider from config.yaml (which doesn't serve that model), producing a guaranteed 404 on every turn.

Root Cause

update_session_model() (in hermes_state.py) wrote the model name to the sessions.model column but never wrote model/provider keys into the model_config JSON blob — the provider/model pair was lost across restarts.

Change

• Write side (Option A): update_session_model(session_id, model, provider=None) now merges {"model": ..., "provider": ...} into the model_config JSON when a provider is passed (json_set/json_remove SQL preserving lineage markers and the browser_model_lock behavior). Both /model call sites in gateway/slash_commands.py pass the resolved target_provider.
• Read side (Option B, defensive): in tui_gateway/server.py::_stored_session_runtime_overrides, when model_config has no top-level provider, fall back to model_config.gateway_runtime.provider (written by _sync_session_model_from_agent on the last turn) instead of the config.yaml primary provider. Precedence: top-level → gateway_runtime → billing_provider → default.

Verification

• tests/test_hermes_state.py + tests/test_tui_gateway_server.py: 698 passed (pre-existing + new coverage for provider persistence and defensive resume).

Closes #79536

[webtecnica]

Addressed the merge note from the #79811 review (thanks @teknium1 for flagging it): WHEN model_config IS NULL THEN NULL no longer drops the provider for the common NULL-blob case. Both call sites in update_session_model now create a fresh json_object('model', ?, 'provider', ?) (or json_object('model', ?) without provider) when the blob is NULL, so every session keeps its provider across the switch — including the common case. Committed as 0ea74480f. Ready to land.

[kshitijk4poor]

Salvaged and merged in #85977 (combined with #85721, rebased onto current main, simplify-code findings folded in). Thank you for the original contribution!