refactor(gui): import PROVIDERS from src.ai_client; add audit script

Phase 2 tasks 2.3 (update 4 import sites) + 2.4 (audit script).

The 4 call sites in src/app_controller.py:3093 and src/gui_2.py
{2293, 2849, 5377} were using models.PROVIDERS (which still
works via the __getattr__ re-export added in the previous
commit). Updated them to use ai_client.PROVIDERS directly:
- Models.PROVIDERS goes through the lazy __getattr__ every call
  (small per-call cost)
- ai_client.PROVIDERS is a direct module-level lookup

Both files already had 'from src import ai_client' at the top,
so no new imports were needed.

scripts/audit_providers_source_of_truth.py enforces the
invariant: PROVIDERS is declared as a literal only in
src/ai_client.py. Catches accidental declarations creeping
back into src/models.py or other modules. Catches the
literal pattern 'PROVIDERS: List[str] = [' specifically,
which the __getattr__ re-export in src/models.py does not
match (it's 'from src.ai_client import PROVIDERS').

All 5 audit scripts pass:
- audit_main_thread_imports.py
- audit_weak_types.py
- audit_no_models_config_io.py
- audit_no_inline_tool_loops.py
- audit_providers_source_of_truth.py (new)

63 vendor + tool + provider + import-isolation tests pass.

src/app_controller.py

@@ -3090,7 +3090,7 @@ class AppController:
 
   def do_fetch() -> None:
    try:
-    for p in models.PROVIDERS:
+    for p in ai_client.PROVIDERS:
      try:
       self.all_available_models[p] = ai_client.list_models(p)
      except Exception as e: