feat(magic-ai): managed platforms, managed from the CLI - #723

The installation can ship a managed platform whose key comes from
MAGIC_AI_MANAGED_API_KEY. That key is recognised wherever it is used, so
it is held to MAGIC_AI_MANAGED_MODELS and pinned to its provider and
endpoint on save, connection test and model fetch, including when the
form submits it masked. Without the pin, an edited endpoint would send
the stored key to any host. Generation swaps a model outside the list
for one on it. Any other key, including a client's own Concentrate AI
key, is unrestricted.

unopim:magic-ai:managed-platform creates or refreshes the platform and
makes it the default when none is set.

…naged flag

The hosting owner's Concentrate AI key no longer lives in .env. The
unopim:magic-ai:managed-platform command prompts for it (never an argv
option), stores it encrypted on the platform row and sets is_managed,
which is not fillable, so no admin request can set or forge it.

The managed platform is recognised by that flag instead of comparing
keys. While it runs on its stored key it stays pinned to the managed
provider, endpoint and model list, and it cannot be deleted. A client
entering their own key lifts the restriction and clears the flag; every
other platform stays unrestricted.

The managed platform no longer depends on MAGIC_AI_MANAGED_* settings.
unopim:magic-ai:managed-platform now collects a platform the way the
admin form does (provider, label, endpoint, key, Azure settings, models
fetched from the provider, default, status) plus the managed flag, and
saves it through the platform repository. It also runs unattended from
options, reading the key from standard input so it never lands in argv.

The form's checks move into a shared PlatformValidator used by both the
controller and the command, and model discovery goes through a
ModelDiscovery service so the command can be tested without the network.

A managed platform is now locked to its own saved provider, endpoint and
model list instead of config, so several managed platforms can coexist.

…ake it create-only

The command now only adds platforms: the target select, edit pre-fill,
--platform option and keep-stored-key path are gone, along with the
translations only they used.

…ead-only in the UI

Replace the single add command with unopim:magic-ai:platform:list, :add,
:edit, :delete and :default. They share a base command and traits, save
through the platform repository with the shared PlatformValidator, and run
unattended from options with the key read only from standard input.

A managed platform is now read-only in the admin panel apart from its
status and default flag: an update that changes any other field or submits
a new key is rejected, which closes the path where an admin could take
over the hosted key by typing their own. The edit modal shows every field
read-only for such a platform with a note that it is managed from the
server. Setting the default now goes through one repository method shared
by the controller and the CLI.

The literal key "0" kept the stored key in v3.1.1 and overwrote it here;
it keeps the stored key again. The guard ran on payloads that had
already failed validation, so an array provider or URL raised a 500
instead of a 422; it now stops there and only reads string input. The
after() hook drops its return type and the helpers take a managed
prefix, so a plugin subclass that already declares after() or a helper
of the same name does not hit a fatal signature mismatch.

…otes

Tenants of a hosted install have no server access, so pointing them at
the command line is noise; the notes now only say the platform is
managed for them and which settings they can still change.

…platform

# Conflicts:
#	packages/Webkul/AiAgent/tests/Unit/ModelSelectionConfigTest.php
#	packages/Webkul/MagicAI/src/Support/ModelRecommender.php