feat(providers): add Conol (conol.ai) web session provider

[artickc]

Add Conol (conol.ai) as a new web-session provider

Adds conol-web (alias cnl) as an unofficial/experimental browser-session provider, following the same pattern as the other web-session providers in the registry.

What this adds

• Executor — open-sse/executors/conol-web.ts, registered in providerRegistry.ts and executors/index.ts.
• Cookie auth — __Secure-better-auth.session_token, accepted as a raw token, a full Cookie: header, a JSON blob, or provider-specific data. Browser sign-in is supported via conolBrowserLogin.ts plus the /api/providers/[id]/login route.
• Model discovery — live catalog from GET /api/agent-servers, with a 30-model seed catalog as fallback. Upstream apiKey values are stripped from the parsed payload.
• Vision — per-model inputModalities drive supportsVision, so multimodal models bypass the vision bridge and text-only models still use it.
• Usage/balance — GET /api/billing/balance surfaced through conolUsage.ts and providerLimits.ts.
• Images — raw uploads to POST /api/assets, referenced as /api/assets/{id} message parts.
• Session stickiness — one Conol session per logical client chat, keyed off the client session ID (hashed, never stored raw), with a TTL + LRU cap. Only the newest user turn is forwarded; system prompts and tool traffic stay local since Conol owns its own agent loop.

Protocol notes

Conol keeps the HTTP stream open after emitting its terminal done event, so the reader is cancelled on done rather than waiting for the request timeout.

Critically, POST /api/sessions ignores agentModel/agentEffort — a new session always starts on the account default and reports modelDowngraded: true with an effectiveModel. Model selection therefore happens out-of-band against POST /api/sessions/{id}/model, which takes three payload shapes:

Call	Body
Preset	{"modelPreset":"pro","hasImageHistory":false}
Model	{"agentModel":"claude-fable-5","agentEffort":null}
Effort	{"agentEffort":"xhigh"}

Sessions are created empty and configured before the first turn is submitted, in preset → model → effort order. The ordering is load-bearing: the model call resets agentEffort to null server-side, so applying effort first would silently drop it.

Effort handling

• Defaults to xhigh when the caller does not pin one via the -<effort> model suffix.
• Clamped onto the ladder each model actually advertises — xhigh degrades to high on claude-sonnet-5, and a weak request climbs to high on deepseek-v4-pro.
• Skipped entirely for models with no effort ladder (e.g. openrouter/fusion).

Session binding

Model and effort are deliberately excluded from the session binding key, so switching models re-pins the existing session rather than stranding it and losing the conversation history. Re-pinning only fires on an actual change, so steady-state follow-ups cost no extra round trips. hasImageHistory is sticky once a session has carried an image.

Failures on the /model calls are logged but non-fatal — the turn still runs rather than hard-failing the request.

Testing

21 unit tests in tests/unit/conol-web.test.ts cover credential normalization, turn building, catalog/preset parsing, effort clamping, the preset → model → effort ordering and its precedence over the message turn, session reuse, model-switch re-pinning, session isolation, image uploads, and SSE output. Tests assert that neither the session cookie nor system/tool content leaks into upstream payloads.

Verified locally: tsc --noEmit clean, ESLint clean on all changed files, and the full unit suite shows no new failures (the 67 pre-existing failures are byte-identical with and without this branch's changes).