[Neuron-Mr-White]

Summary

• add customizable provider-connection peak-hour protection windows in UTC
• support block/avoid modes and DeepSeek/Z.ai presets in the connection edit UI
• filter protected connections during credential selection before upstream credential use/request dispatch

Why

Some providers publish peak-hour periods where quota/cost behavior changes in provider-specific ways that are hard to model accurately. This PR adds an operator-controlled protection guard instead of attempting provider-specific multiplier math.

Behavior

• Protection is disabled unless an operator configures windows on a provider connection.
• Configured windows are stored under providerSpecificData.peakHourProtection.
• When a configured window is active, the connection is skipped before upstream credentials are materialized.
• If every eligible connection for that provider is protected, the request receives a retry-after style rate-limited response.
• Direct pinned requests are not silently rewritten to another provider/model.

Validation

• node --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --test tests/unit/peak-hour-protection.test.ts
• focused ESLint on changed files
• npm run typecheck:core -- --pretty false
• npm run check:dashboard-typecheck — passed with existing frozen baseline
• npm run check:open-sse-typecheck — passed with existing frozen baseline
• Prettier check on changed files
• Built and smoke-tested in a production-like standalone deployment on the operator's router before opening this PR

Notes

⚠️ base-red inherited: #11449