feat: first-run onboarding wizard (provider + model selection)

[raythurman2386]

Summary

Adds a clean first-run onboarding wizard that replaces the silent hardcoded default (ollama / gemma4:latest) with an interactive provider + model selection flow, persisting the choice so future runs need no prompts.

• Interactive wizard: pick a provider (local Ollama, Ollama Cloud, OpenRouter, or any custom OpenAI-compatible endpoint via name:base_url), select a model (live-listed when the endpoint is reachable, else a curated fallback), and enter an optional API key
• Secret-free ~/.raven/config.toml (0600) + API key in ~/.raven/.env (0600), ~/.raven dir locked to 0700
• Skips automatically for --headless/--yolo/--acp/CI (non-TTY) and any existing config or explicit --provider/--model/RAVEN_PROVIDER
• Loads ~/.raven/.env at startup so the persisted key is picked up in the same session
• Aligns the ollama builtin default model to qwen3.8:latest

Motivation

On a fresh install the very first model was chosen silently from a hardcoded builtin default — no onboarding, no config write-back, and the README claimed a first-run prompt that didn't exist. This PR makes the README true and gives users a real setup flow.

Changes

• src/config/onboarding.rs (new): gate (needs_onboarding), path helpers, custom-provider parsing, fallback model lists, secret-free config/env serialization, 0600/0700 write helpers, and the interactive run_onboarding wizard
• src/main.rs: loads ~/.raven/.env, runs the wizard when interactive + unconfigured + un-overridden, reloads the env after onboarding
• src/config/mod.rs: load_global_dotenv()
• src/config/provider.rs: ollama builtin default gemma4:latest → qwen3.8:latest
• src/tui/mod.rs: export fetch_live_provider_models as pub(crate)
• src/config/tests.rs: dotenv loader test
• README.md: first-run docs reflect the real wizard

Test Plan

• cargo test — 611 lib + 4 CLI, 0 failures
• cargo clippy --all-targets -- -D warnings clean
• cargo fmt --check clean
• cargo check --target x86_64-pc-windows-gnu clean
• Manual: wizard writes 0600 .env + 0700 dir; first-run key auth works in same session

Notes for Reviewers

• Independent review surfaced a TOCTOU 0600 race (fixed via OpenOptions::mode at creation), a first-run API-key-not-loaded bug (fixed by reloading env post-wizard), and a ~/.raven dir-perm gap (fixed to 0700) — all addressed in the review-fix commits.