feat(models): clamp-on-write for pinned thinking levels + DEFAULT_THINKING_ORDER in the core barrel

Fix 1 — clamp, never reject (owner ruling, interlude 2026-09-22): a
model swap with a pinned thinking level must JUST WORK. The owner hit
the write-side 400 live (Claude Fable 5.1/xhigh → GLM 5.3 flash:
"z-ai/glm-5.3-flash does not support thinking level xhigh"). The
supported-level verdicts in validateChatSettings and
validateModelsSettings are DEAD — the WRITE clamps the pin to the new
model's nearest supported level (pi's clampThinkingLevel, the same
translation piEngineForSpec applies at runtime) and stores the clamped
result; the server is the truth — the record shows the clamped level
after write.

New pure helpers in model-catalog.ts, applied by ALL THREE write
routes (section, defaults, per-chat — one verdict seam, so every
surface that used the old 400 gets the clamp uniformly):
- clampModelsLevels: every slot's level clamps against the SLOT'S OWN
  model (the parser already requires a model on each slot write).
- clampChatLevel: the body's own model, else the record's resolved
  strong slot (the chain's fallback); no model anywhere → rides
  unchecked (runtime clamps at engine build; the turn gate refuses
  the model-less chat anyway).

Fix 2 — DEFAULT_THINKING_ORDER moves from config.ts to core/settings
(core barrel, AUTH_KEYS precedent — one source of truth, no drift).
The UI imports it to auto-populate a thinking level on FRESH model
picks; the ordering has no other client role. Legacy unset records
keep the runtime defaultThinkingLevel fallback at engine build
untouched. Import sites updated: agent/models.ts, tests.

Verified live on 3004: the owner's exact case stores max (not 400);
a bare chat-level write clamps to low against the strong slot's glm;
unknown provider/model still 400s with the provider list.

Tests: the level-verdict suites became clamp suites (the owner's case
pinned verbatim: xhigh→max, minimal→low, off→low, supported
pass-through, level-less slots ride); the machine-aware
expectBareLevelVerdict chain is retired — clampChatLevel takes the
strong slot as an explicit param, so the tests are pure again.

Gates: typecheck, lint, 839/839, build.

app/api/settings/defaults/route.ts

@@ -9,16 +9,25 @@
  * lives at data/default-settings.json (config.DEFAULT_SETTINGS_FILE).
  *
  *   GET → 200 {settings} once saved, 200 null on first boot ("no model").
- *   PUT → 200 {settings} — the VALIDATED copy persisted verbatim. The exact
- *         per-chat contract (parseSettingsBody + the catalog gate): unknown
- *         provider/model or an unsupported thinking level is a 400 carrying
- *         the supported list, never a silent clamp.
+ *   PUT → 200 {settings} — the VALIDATED copy, level-clamped, persisted.
+ *         The exact per-chat contract (parseSettingsBody + the catalog
+ *         gate): an unknown provider/model is a 400. Thinking levels
+ *         never reject (owner, interlude 2026-09-22): a pinned level
+ *         clamps to the named model's nearest supported and the clamped
+ *         value is stored — model swaps just work.
  *
  * Per-session settings (PUT /api/chats/:id/settings) are a separate record
  * untouched by this — the default still rides along on session creation
  * exactly as before.
  */
-import { readDefaultSettings, writeDefaultSettings, parseSettingsBody, validateChatSettings } from "@/src/server";
+import {
+	clampChatLevel,
+	effectiveSettings,
+	parseSettingsBody,
+	readDefaultSettings,
+	validateChatSettings,
+	writeDefaultSettings,
+} from "@/src/server";
 
 export const dynamic = "force-dynamic";
 
@@ -34,6 +43,11 @@ export async function PUT(request: Request) {
 	if (!verdict.ok) {
 		return Response.json({ error: verdict.error, supported: verdict.supported }, { status: 400 });
 	}
-	writeDefaultSettings(parsed.settings);
-	return Response.json({ settings: parsed.settings });
+	// Clamp-on-write (owner, interlude 2026-09-22): a pinned thinking
+	// level never rejects the write — it clamps to the named model's
+	// nearest supported level (body model, else the record's strong
+	// slot) and the clamped value is stored.
+	const settings = clampChatLevel(parsed.settings, effectiveSettings().models.strong);
+	writeDefaultSettings(settings);
+	return Response.json({ settings });
 }