fix: persist provider on model switch and add billing_provider fallback

[kshitijk4poor]

Summary

Salvage of #79604 (webtecnica) + #85721 (pierrenode), combined and rebased onto current main with /simplify-code findings folded in.

#79604 — persist provider on model switch:
update_session_model() wrote the model name to sessions.model but never persisted the provider into model_config. On resume, the runtime recombined the persisted model with the config.yaml primary provider (which may not serve that model), producing auth errors. Fix: add optional provider parameter to update_session_model, merged into model_config via the shared _merge_model_config_json helper. Wire both gateway /model call sites to pass result.target_provider.

#85721 — billing_provider fallback in session_gateway_runtime:
session_gateway_runtime() had no billing_provider fallback. A CLI session that never ran /model has no gateway_runtime or top-level provider in model_config — billing_provider (written on every session's first accounted API call) is the only durable record. Fix: add billing_provider as the last-resort fallback, filtering bare billing buckets (auto/custom) that are not routable identities.

Simplify-code findings addressed (3-reviewer review on #85261/#85920):

• Use _merge_model_config_json instead of ~40 lines of hand-rolled branched SQL (json_set/json_object/json_remove) — collapses to ~8 lines and stays consistent with the codebase's merge discipline
• Share _BARE_BILLING_PROVIDERS from hermes_state.py (was duplicated as a set in tui_gateway/server.py)
• Merge None-filtering from fix: unify route dict or-None discipline in /model persist #85920 with the billing_provider fallback into one coherent return path

Test plan

• tests/cli/test_resume_model_restore.py — 22 passed (15 existing + 7 new)
• tests/cli/test_resume_display.py — passed
• tests/test_hermes_state.py — passed
• tests/gateway/test_model_switch_persistence.py — passed
• tests/test_tui_gateway_server.py — passed (822 total, 0 failures)

Closes #79536