BYOK universal gate rendered honestly: mid-chat setup flow, refusal-aware cards

- existing sessions: a send that lands the 503 models_not_configured envelope
  renders as the SETUP FLOW, never the error banner — the record refetch drops
  the refused orphan (the gate refuses before the write-ahead persist), the
  draft goes home to the composer, and Save auto-replays it (owner ruling);
  parseModelsRefusal reads the envelope from the transport's verbatim error
  text (exported pure, tested)
- persistent 'Set up your models' CTA above the chat composer while
  slotsConfigured is false (server-read seed via app/chat/[id]/page.tsx) —
  legacy per-chat overrides may still send with the pill present; the server
  gate stays the truth
- SetupDialog prefill + 'needed' marks (owner ruling): pinned tiers open with
  their pick (matched in the federated catalog — lapsed keys don't prefill),
  unpinned tiers carry the mark; Save still requires all three;
  prefillFromSlots exported pure, tested
- refused jobs read as INFO: dispatch card shows a quiet 'needs model setup'
  line + 'Set up models' deep-link (ChatActionsContext.openSetup); dock blobs'
  activity reads 'needs model setup' instead of 'failed'; real failures keep
  the red tone; isModelsRefusal added to the envelope's home module
- agent-section ModelsBody.slots type honest to the nullable contract

src/core/settings.ts

@@ -91,6 +91,14 @@ export function modelsNotConfigured(missing: ModelSlotName[]): ModelsNotConfigur
 		missing,
 	};
 }
+
+/** The refusal error text (BYOK, 2026-09-22): job/turn surfaces compose the
+ *  record wording around this prefix; UI consumers detect refused work by
+ *  it (info tone, not scary-error) — the envelope's home module owns the
+ *  string so the writer and the matcher can never drift. */
+export function isModelsRefusal(error: string | undefined): boolean {
+	return !!error && error.startsWith(modelsNotConfigured([]).error);
+}
 /** The typed throw for in-process seams (extraction pipeline): callers
  *  catch it to skip honestly (trigger) or surface the 503 envelope
  *  (routes) instead of logging a failure. */