fix(qoder): report usage to all clients and stop inlining large attachments

- Coalesce Qoder's empty finish-in-delta frame with the later choices:[] usage
  frame so OpenAI and Claude clients receive prompt_tokens, completion_tokens
  and cache-hit tokens (the dashboard already saw them)
- Upload inlined images through /api/v2/image/upload like qodercli, and stub
  oversized non-image files instead of stuffing 30MB+ data URIs into
  agent_chat_generation
- Emit response.completed -> response.usage for chat-native upstreams so
  /v1/responses clients (Codex CLI, sub2api) no longer log 0/0/0
- Keep Claude message_delta.usage working when usage arrives without choices[0]
- Escalate to the smallest advertised Qoder context tier (200K/400K/1M) when
  the estimated prompt no longer fits max_input_tokens
- Pass apiKey for PAT connections and list hidden enable:false catalog keys
  from /v1/models

open-sse/services/qoderModels.js

@@ -343,6 +343,30 @@ export async function resolveQoderModels(credentials, options = {}) {
   }
 }
 
+/**
+ * Every model key the chat endpoint accepts for this credential: the IDE-visible
+ * models first, then catalog entries flagged `enable:false` (hidden in the IDE
+ * picker, e.g. by an account policy, but still served by agent_chat_generation —
+ * see fetchQoderCatalogRaw). /v1/models uses this so the advertised list matches
+ * what the router will actually route instead of collapsing to one or two keys.
+ */
+export function routableQoderModels(catalog) {
+  if (!catalog) return [];
+  const out = [];
+  const seen = new Set();
+  for (const m of catalog.models || []) {
+    if (!m?.id || seen.has(m.id)) continue;
+    seen.add(m.id);
+    out.push({ id: m.id, name: m.name || m.id, hidden: false });
+  }
+  for (const [key, cfg] of catalog.rawConfigs || []) {
+    if (!key || seen.has(key)) continue;
+    seen.add(key);
+    out.push({ id: key, name: cfg?.display_name || key, hidden: true });
+  }
+  return out;
+}
+
 export function invalidateQoderCatalog(credentials) {
   if (!credentials) return;
   catalogCache.delete(cacheKey(credentials));