feat: model registry Phase 3 — slot-based backend toggle

Backend toggle now cycles through chat role models by label instead of
cycling service type strings (auto/claude/gemini/local).

- model_registry: get_model_for_slot() — resolves a specific priority
  slot without walking the fallback chain
- llm_client: complete() gains slot param; explicit slot selection
  dispatches directly to that model with no silent fallback
- routers/chat.py: ChatRequest.slot; GET /backend returns chat_models
  [{slot, label, type}] for the UI; _stream_chat uses resolved model
  label for the response tag when a slot is pinned
- app.js: toggle loads chat_models from /backend, cycles by label,
  sends slot in chat payload; legacy model field removed from payload
- app.js: fix Gap B — agent mode placeholder no longer says "Gemini
  tool loop"; now says "orchestrator"
- DESIGN doc: updated to reflect phases 1+2 complete, catalog-as-code
  decision, Gap A/B documented, Phase 3 implementation details

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cortex/llm_client.py

@@ -49,14 +49,17 @@ async def complete(
     messages: list[dict],
     model: str | None = None,
     role: str = "chat",
+    slot: str | None = None,
     max_tokens: int = 2048,
 ) -> tuple[str, str]:
     """
     Returns (response_text, actual_backend_used).
 
-    model: explicit backend override ("claude" | "gemini" | "local") from UI toggle.
+    slot:  Phase 3 — specific role slot ("primary" | "backup_1" | "backup_2").
+           Resolves that exact slot, no fallback chain. Takes priority over model.
+    model: legacy backend override ("claude" | "gemini" | "local") from old toggle.
            None = resolve via model registry for the given role.
-    role:  registry role used when model is None (default: "chat").
+    role:  registry role used for slot/auto routing (default: "chat").
     """
     import model_registry as _reg
     from persona import _user
@@ -64,21 +67,31 @@ async def complete(
     username = _user.get()
     resolved_cfg: dict | None = None
 
-    if model in _EXPLICIT_BACKENDS:
-        # User explicitly selected a backend in the UI
-        if model == "local":
-            resolved_cfg = _reg.get_best_local_model(username, role)
-            if not resolved_cfg:
-                raise RuntimeError("No local model configured — add one at /settings/models")
-        primary = model
-    else:
-        # Role-based routing via model registry
-        resolved = _reg.get_model_for_role(username, role)
-        if resolved:
-            resolved_cfg = resolved
-            primary = _TYPE_TO_BACKEND.get(resolved["type"], "claude")
+    if slot is not None:
+        # Phase 3: explicit slot selection — no fallback within the role
+        resolved_cfg = _reg.get_model_for_slot(username, role, slot)
+        if resolved_cfg:
+            primary = _TYPE_TO_BACKEND.get(resolved_cfg["type"], "claude")
         else:
-            primary = settings.primary_backend
+            # Slot not configured — fall through to auto routing
+            slot = None
+
+    if slot is None:
+        if model in _EXPLICIT_BACKENDS:
+            # Legacy: explicit backend override from old UI toggle
+            if model == "local":
+                resolved_cfg = _reg.get_best_local_model(username, role)
+                if not resolved_cfg:
+                    raise RuntimeError("No local model configured — add one at /settings/models")
+            primary = model
+        else:
+            # Auto: role-based routing via model registry
+            resolved = _reg.get_model_for_role(username, role)
+            if resolved:
+                resolved_cfg = resolved
+                primary = _TYPE_TO_BACKEND.get(resolved["type"], "claude")
+            else:
+                primary = settings.primary_backend
 
     fallback = _FALLBACK.get(primary, "claude")
 
@@ -89,9 +102,7 @@ async def complete(
         err_str = str(e)
         if primary == "claude" and any(k in err_str for k in ("401", "authenticate", "expired", "OAuth")):
             await event_bus.publish({"type": "claude_auth_expired"})
-        # Only fall back when using a default/auto backend.
-        # If the user has explicitly configured a model via the registry,
-        # surface the error so they know something is wrong.
+        # Surface errors when a model is explicitly configured or a specific slot was pinned.
         if resolved_cfg is not None:
             logger.error("%s failed (no fallback — model explicitly configured): %s", primary, e)
             raise