feat(models): clamp-on-write for pinned thinking levels + DEFAULT_THINKING_ORDER in the core barrel

Fix 1 — clamp, never reject (owner ruling, interlude 2026-09-22): a
model swap with a pinned thinking level must JUST WORK. The owner hit
the write-side 400 live (Claude Fable 5.1/xhigh → GLM 5.3 flash:
"z-ai/glm-5.3-flash does not support thinking level xhigh"). The
supported-level verdicts in validateChatSettings and
validateModelsSettings are DEAD — the WRITE clamps the pin to the new
model's nearest supported level (pi's clampThinkingLevel, the same
translation piEngineForSpec applies at runtime) and stores the clamped
result; the server is the truth — the record shows the clamped level
after write.

New pure helpers in model-catalog.ts, applied by ALL THREE write
routes (section, defaults, per-chat — one verdict seam, so every
surface that used the old 400 gets the clamp uniformly):
- clampModelsLevels: every slot's level clamps against the SLOT'S OWN
  model (the parser already requires a model on each slot write).
- clampChatLevel: the body's own model, else the record's resolved
  strong slot (the chain's fallback); no model anywhere → rides
  unchecked (runtime clamps at engine build; the turn gate refuses
  the model-less chat anyway).

Fix 2 — DEFAULT_THINKING_ORDER moves from config.ts to core/settings
(core barrel, AUTH_KEYS precedent — one source of truth, no drift).
The UI imports it to auto-populate a thinking level on FRESH model
picks; the ordering has no other client role. Legacy unset records
keep the runtime defaultThinkingLevel fallback at engine build
untouched. Import sites updated: agent/models.ts, tests.

Verified live on 3004: the owner's exact case stores max (not 400);
a bare chat-level write clamps to low against the strong slot's glm;
unknown provider/model still 400s with the provider list.

Tests: the level-verdict suites became clamp suites (the owner's case
pinned verbatim: xhigh→max, minimal→low, off→low, supported
pass-through, level-less slots ride); the machine-aware
expectBareLevelVerdict chain is retired — clampChatLevel takes the
strong slot as an explicit param, so the tests are pure again.

Gates: typecheck, lint, 839/839, build.

app/api/settings/[section]/route.ts

@@ -8,10 +8,13 @@
  *   section ∈ general | chat | agent | appearance | graph (else 404).
  *   Body: the complete desired section object. Parse + validate strictly
  *   (server/settings-body.ts): a bad shape/type is a 400 carrying the
- *   supported list where one exists, never a silent clamp. The chat
- *   section additionally passes the catalog gate (validateChatSettings —
- *   unknown provider/model or unsupported thinking level = 400), same as
- *   the defaults route. The agent section additionally validates prompt
+ *   supported list where one exists. The chat and models sections
+ *   additionally pass the catalog gate (validateChatSettings /
+ *   validateModelsSettings — unknown provider/model = 400). Thinking
+ *   levels never reject a write (owner, interlude 2026-09-22): a pinned
+ *   level CLAMPS to the named model's nearest supported level and the
+ *   clamped value is stored — model swaps just work, same as the
+ *   defaults route. The agent section additionally validates prompt
  *   switches: an ON switch must reference a CURRENT source segment with an
  *   existing override file (an OFF switch may reference anything — users
  *   cleaning up orphans must not be blocked).
@@ -25,6 +28,9 @@ import type { AgentSettings, ChatSettings, ModelsSettings } from "@/src/core";
 import {
 	SETTINGS_SECTIONS,
 	allSegmentPaths,
+	clampChatLevel,
+	clampModelsLevels,
+	effectiveSettings,
 	promptOverrides,
 	readSettingsRecord,
 	validateChatSettings,
@@ -87,10 +93,24 @@ export async function PUT(request: Request, ctx: { params: Promise<{ section: st
 		}
 	}
 
+	// Clamp-on-write (owner ruling, interlude 2026-09-22): a model swap
+	// with a pinned thinking level NEVER errors — the pin clamps to the
+	// new model's nearest supported level (pi's nearest-clamp, the same
+	// translation piEngineForSpec applies at runtime) and the clamped
+	// value is what lands in the record. The chat section's bare levels
+	// clamp against the record's resolved strong slot (the chain's
+	// fallback); the models section's slots each carry their own model.
+	const sectionOut =
+		section === "chat"
+			? clampChatLevel(parsed.settings as ChatSettings, effectiveSettings().models.strong)
+			: section === "models"
+				? clampModelsLevels(parsed.settings as ModelsSettings)
+				: parsed.settings;
+
 	// Read-modify-write ONE section of the record; everything else rides
 	// along untouched (other sections, unknown keys — sanitize preserves).
 	const record = readSettingsRecord() ?? { version: 1 };
-	const next = { ...record, [section]: parsed.settings };
+	const next = { ...record, [section]: sectionOut };
 	writeSettingsRecord(next);
 	return Response.json({ settings: next });
 }