fix FindModel: prioritize canonical providers to prevent reseller limit overrides

FindModel iterates providers in random map order, so when deepseek-v4-pro
exists in both 'deepseek' (output=384000) and 'ollama-cloud' (output=1048576),
it sometimes returned the wrong metadata. The proxy then injected
max_tokens=1048576 into DeepSeek's API, which rejected it with 400
(valid range is [1, 393216]).

Fix: define CanonicalProviders list (deepseek, openai, google, xai, etc.)
and search them in priority order before falling back to all providers.
Each of the four lookup strategies (exact key, metadata ID, reverse fuzzy,
forward fuzzy) checks canonical providers first.

internal/models/registry_test.go

@@ -59,6 +59,35 @@ func TestModelRegistry_FindModel_NotFound(t *testing.T) {
 	}
 }
 
+func TestModelRegistry_FindModel_CanonicalPriority(t *testing.T) {
+	// Same model name in canonical (deepseek) and reseller (ollama-cloud).
+	// Canonical must win so the proxy uses authoritative limits.
+	r := &ModelRegistry{
+		Providers: map[string]ProviderInfo{
+			"ollama-cloud": {
+				Models: map[string]ModelMetadata{
+					"deepseek-v4-pro": {ID: "deepseek-v4-pro", Name: "DSv4 Pro (Ollama Cloud)", Limit: &ModelLimit{Context: 1048576, Output: 1048576}},
+				},
+			},
+			"deepseek": {
+				Models: map[string]ModelMetadata{
+					"deepseek-v4-pro": {ID: "deepseek-v4-pro", Name: "DeepSeek v4 Pro", Limit: &ModelLimit{Context: 1000000, Output: 384000}},
+				},
+			},
+		},
+	}
+	m := r.FindModel("deepseek-v4-pro")
+	if m == nil {
+		t.Fatal("expected to find deepseek-v4-pro")
+	}
+	if m.Name != "DeepSeek v4 Pro" {
+		t.Fatalf("expected DeepSeek v4 Pro (canonical), got %s", m.Name)
+	}
+	if m.Limit.Output != 384000 {
+		t.Fatalf("expected output limit 384000 (canonical), got %d", m.Limit.Output)
+	}
+}
+
 func TestModelRegistry_FindModel_ReverseFuzzy(t *testing.T) {
 	r := &ModelRegistry{
 		Providers: map[string]ProviderInfo{