Planning pane, menu bar, and the fixes from driving them

[wfaderhold21]

Commits the planning pane and menu bar (both were uncommitted in the working tree) together with a round of fixes from actually using them. They are not separable by file: several fixes change the pane's own types.

Menu bar
Down was wired to "open the submenu", which selects item 0
unconditionally, so every press re-selected the same row and
everything below the first item was unreachable by keyboard. Up now
walks back and pops out to the section row from the first item.

Model selection
The orchestrator's Model row cycled [orchestrator].models, unset in
most configs — a one-element list, so Enter set the model to what it
already was. It opens a picker over the endpoint's /v1/models now.
The planning picker already probed that endpoint but used the result
for nothing but a count in the corner; Enter/-> descends into the
model list, <- backs out, r re-probes. The configured model stays
listed even when the server does not report it, so a model that
fails to load cannot strand the picker. Shared probe in
App::probe_models, skipping hosted catalogues and filtering
embedding/reranker ids.

Planning backends
Every [agents.NAME] and an API-class [orchestrator] are now offered
as planning backends under their own names, with an explicit
[planning.backends.NAME] shadowing the derived one. A config with no
[planning.backends.*] — every config predating the pane — previously
offered nothing to select at all. Derived entries are serde(skip) so
save() cannot write them back as though the user had authored them.

Turn budget
40 tool round-trips instead of a hardcoded 10, per-backend and
inherited from an API-class orchestrator's own setting. Ten hops is
a couple of files, and grounding a plan in a codebase is a
grep-read-grep-read walk. Hitting the ceiling no longer discards the
turn: the final pass runs with the tools removed, so the reply comes
from what was gathered.

Context meter
Reported ~0k for anything under 1000 tokens (integer division), and
measured only the transcript — which by design carries no tool
traffic, so reading half the repository barely moved it. Sub-1k
counts keep their digits, and each reply carries back the peak
request size: ~868/131k (peak 5.4k).

Fullscreen
alt-shift-p gives the pane the whole output region. The session bar
and status panel stay, so the sessions being planned against remain
visible and keep updating; no PTY is resized.

Local-backend errors
"api error: unknown" for any server sending error as a bare string
rather than {"error": {"message": ...}} — the one class of backend
whose failures most need debugging was the one reporting nothing.

Verified in a tmux harness against LM Studio on localhost:1234: the model pickers list real models and apply the selection, fullscreen leaves the status panel live, and the context meter reads ~129/131k (peak 5.4k) after a turn that read two files.