fix(auto): exclude tos:avoid providers from auto by default (#15059)

[diegosouzapw]

Refs #15059

Scope note: this PR covers point 3 of the compound issue (ToS-avoid providers in auto by default). Points 1/4 need a live check, 5/6 are doc wording; see "Not in this PR".

Root cause

excludeTosAvoid shipped with default false (src/lib/db/settings.ts), so the auto-combo guard filterTosAvoidCandidates() was a no-op and providers tagged tos: "avoid" in the free-model catalog (Antigravity/agy, OpenCode, blackbox, ...) received auto traffic right after being connected.

Fix

Default excludeTosAvoid: true (owner decision 2026-09-29). Operators can opt out with PATCH /api/settings {"excludeTosAvoid": false}. CHANGELOG fragment carries the callout that this changes the auto pool on existing installs that never set the flag.

Tests (RED -> GREEN)

• New tests/unit/issue-15059-tos-avoid-auto-default.test.ts: RED on base (false !== true, 1 !== 0), GREEN after the fix (3/3), plus an explicit opt-out case.
• Aligned 3 existing tests that encoded the old default (noauth-autocombo-exclude-7622, noauth-autocombo-lockout-7623, virtual-auto-combo OpenCode-Free case): every opencode keyless model is tos: avoid, so they now set excludeTosAvoid: false explicitly; assertions are unchanged.
• 141/141 pass across the auto-combo/virtualFactory/free-catalog unit files.

Gates

typecheck:core, eslint (changed files), check-file-size, check-complexity, check-cognitive-complexity, prettier, pre-commit hooks: OK.

Not in this PR (follow-ups)

• Dashboard toggle for excludeTosAvoid (would need new i18n keys across 66 locales; sibling flags like hidePaidModels also have no UI).
• Consequence to review: all opencode keyless models are tos: avoid, so with the new default a fresh install's auto has no keyless target until the operator opts out or connects a provider. README hero claim (point 1) needs wording/live check accordingly; Cerebras figure in FREE-TIERS-GUIDE (point 5).
• Live checks (points 1, 4) need the VPS.

⚠️ base-red inherited: #15306 — unit/integration suite timeouts, vitest audit.test.ts, package-artifact, tarball boot-smoke, ai-attribution range (not caused by this PR)

[github-actions]

CI Coverage Report

• Coverage job: skipped
• PR test policy: success

Coverage artifact was not available for this run.