feat: implémentation et QA ticket99 - agent model configuration v2

- backend A-C: VO Codex/Claude, renderers/projecteurs modèle, SecretRef/env, catalogues/use cases/Tauri commands
- frontend D: profils Codex/Claude provider->model->secret, validations, conservation SecretRef
- fix: app-tauri embedded_server isolant IDEA_WEB_ROOT

QA: backend 57/57 tests, frontend 74/74 tests OK

frontend/src/ports/index.ts

@@ -13,6 +13,9 @@ import type {
   AgentDrift,
   AgentProfile,
   AppExitWorkGuardState,
+  ClaudeProviderCatalogEntry,
+  CodexCustomProviderConfig,
+  CodexProviderCatalogEntry,
   CustomProviderConfig,
   DomainEvent,
   EmbedderEngines,
@@ -691,6 +694,24 @@ export interface ProfileGateway {
   saveOpenCodeProviderProfile(
     input: SaveOpenCodeProviderProfileInput,
   ): Promise<AgentProfile>;
+  /** Static catalogue of Codex providers/models (ticket #99). */
+  listCodexProviders(): Promise<CodexProviderCatalogEntry[]>;
+  /**
+   * Creates or replaces (by id) a Codex profile with provider/model/secret
+   * config. The literal API key is sealed backend-side and never returned.
+   */
+  saveCodexProviderProfile(
+    input: SaveCodexProviderProfileInput,
+  ): Promise<AgentProfile>;
+  /** Static catalogue of Claude providers/models (ticket #99). */
+  listClaudeProviders(): Promise<ClaudeProviderCatalogEntry[]>;
+  /**
+   * Creates or replaces (by id) a Claude profile with provider/model/secret
+   * config. The literal API key is sealed backend-side and never returned.
+   */
+  saveClaudeProviderProfile(
+    input: SaveClaudeProviderProfileInput,
+  ): Promise<AgentProfile>;
 }
 
 /** Input for {@link ProfileGateway.cloneOpenCodeProfileFromSeed}. */
@@ -719,6 +740,32 @@ export interface SaveOpenCodeProviderProfileInput {
   custom?: CustomProviderConfig;
 }
 
+/** Input for {@link ProfileGateway.saveCodexProviderProfile}. */
+export interface SaveCodexProviderProfileInput {
+  /** The profile to create or replace (by id). */
+  profile: AgentProfile;
+  /** Provider id used as Codex's `model_provider`. */
+  providerId: string;
+  /** Model name served by this provider. */
+  model: string;
+  /** Literal API key — sealed into the `SecretStore`, never persisted as-is. */
+  apiKey: string;
+  /** Optional custom endpoint config for a Codex provider. */
+  custom?: CodexCustomProviderConfig;
+}
+
+/** Input for {@link ProfileGateway.saveClaudeProviderProfile}. */
+export interface SaveClaudeProviderProfileInput {
+  /** The profile to create or replace (by id). */
+  profile: AgentProfile;
+  /** Provider id. V1 backend exposes `"anthropic"`. */
+  providerId: string;
+  /** Model name served by this provider. */
+  model: string;
+  /** Literal API key — sealed into the `SecretStore`, never persisted as-is. */
+  apiKey: string;
+}
+
 /**
  * Local model servers (F35). CRUD over the global registry of declared
  * `llama.cpp` servers an OpenCode profile can bind to via