feat: model registry V2 — provider-aware schema with multi-account support

Adds a providers section to the per-user model registry for Anthropic and
Google as first-class providers alongside local hosts. Google accounts
(API keys) are now stored as a list so multiple Google accounts can coexist.

Changes:
- model_registry.py: V2 schema, auto migration V1→V2 (pulls gemini_api_key
  from auth.json into providers.google.accounts), _resolve_model() merges
  account API key for gemini_api type models
- routers/orchestrator.py: uses model-resolved api_key when orchestrator
  role resolves to a gemini_api model with account_id
- ANTHROPIC_CATALOG and GOOGLE_CATALOG constants for model picker (Phase 2)
- New functions: get_google_api_key(), save/remove_google_account(), get_catalog()
- Documentation: ARCH__BACKENDS.md updated to V2 schema, DESIGN doc added

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cortex/routers/orchestrator.py

@@ -171,12 +171,18 @@ async def _run_job(job_id: str, req: OrchestrateRequest, user: str) -> None:
                 respond_with_final=req.respond_with_claude,
             )
         else:
+            # Use the API key embedded in the resolved model config (V2 registry with
+            # account_id), then fall back to the per-user key from auth.json, then .env.
+            gemini_key = (
+                (orch_model.get("api_key") if orch_model else None)
+                or get_user_gemini_key(user)
+            )
             result = await orchestrator_engine.run(
                 task=req.task,
                 system_prompt=system_prompt,
                 session_messages=session_messages,
                 respond_with_claude=req.respond_with_claude,
-                gemini_api_key=get_user_gemini_key(user),
+                gemini_api_key=gemini_key,
             )
 
         # Save the turn to the session store so it survives a page refresh