feat: per-role inject_mode, OTR fixes, hover metadata, send/stop tooltip

- inject_mode: per-role toggle (parallel to inject_datetime) gates the
  "Current mode: Off The Record" line in the system prompt; wired through
  model_registry, context_loader, chat router, orchestrator router, and
  local_llm settings UI

- OTR orchestrator fix: OrchestrateRequest now carries off_record;
  _finalize_job stores it per message and gates log_turn on it; JS
  orchestrate payload sends off_record correctly

- Per-message hover metadata: removed always-visible .model-tag; replaced
  with .msg-meta strip in the action bar (hover-only); shows model label,
  host, fallback indicator, and OTR badge; stored in session JSON

- Send/stop button tooltip: shows role + model and (when tools on)
  separate orchestrator model + engine label; live elapsed timer on stop
  button via startRunTimer/stopRunTimer

- OrchestratorResult.backend_label: new field; openai_orchestrator fills
  it; finalize_job propagates it to job dict and session messages

- GET /backend: exposes orchestrator_model label so the frontend tooltip
  can show both models separately

- TODO: session delete confirmation added

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cortex/model_registry.py

@@ -423,12 +423,13 @@ def set_role_config(
     system_append: str,
     tools: list[str] | None,
     inject_datetime: bool = True,
+    inject_mode: bool = True,
 ) -> None:
-    """Save system_append, tools allow-list, and inject_datetime flag for a role.
+    """Save system_append, tools allow-list, and per-injection flags for a role.
 
     tools=None clears the allow-list (role uses all accessible tools).
-    inject_datetime=False suppresses the current date/time from the system prompt
-    for this role — useful for pure processing roles (summarizer, classifier, etc.).
+    inject_datetime=False suppresses the date/time header for pure processing roles.
+    inject_mode=False suppresses the session mode (OTR) line for pure processing roles.
     """
     data = _load(username)
     roles = data.setdefault("roles", {})
@@ -436,6 +437,7 @@ def set_role_config(
         roles[role] = {}
     roles[role]["system_append"] = system_append.strip()
     roles[role]["inject_datetime"] = inject_datetime
+    roles[role]["inject_mode"] = inject_mode
     if tools is None:
         roles[role].pop("tools", None)
     else:
@@ -445,12 +447,13 @@ def set_role_config(
 
 def get_role_config(username: str, role: str) -> dict:
     """
-    Return supplemental config for a role: system_append, tools, and inject_datetime.
+    Return supplemental config for a role: system_append, tools, and injection flags.
 
     All keys are optional in the registry — missing means "use defaults":
       system_append: str   — appended to the system prompt for this role
       tools: list[str] | None — explicit tool allow-list (None = no restriction)
       inject_datetime: bool — whether to inject current date/time (default True)
+      inject_mode: bool — whether to inject session mode (OTR) line (default True)
     """
     registry = _load(username)
     role_cfg = registry.get("roles", {}).get(role, {})
@@ -458,6 +461,7 @@ def get_role_config(username: str, role: str) -> dict:
         "system_append":  role_cfg.get("system_append", ""),
         "tools":          role_cfg.get("tools") or None,
         "inject_datetime": role_cfg.get("inject_datetime", True),
+        "inject_mode":    role_cfg.get("inject_mode", True),
     }