Multi-model routing (Claude / OpenAI / local) with per-tenant fallback

[PAMulligan]

Summary

Abstract the model client behind a provider interface and let each tenant configure a primary model + ordered fallback list across Claude, OpenAI, and self-hosted (Ollama / vLLM) endpoints.

Motivation

Vendor lock-in concerns are the #1 blocker for some enterprise deals. A pluggable model layer also lets us route cheap intent classification to a small model and reserve Claude for the heavy lifting.

Acceptance Criteria

• ModelProvider interface: chat(messages, opts): AsyncIterable<Chunk> plus capability flags (streaming, tools, vision)
• Built-in providers: Anthropic, OpenAI, OpenAI-compatible (Ollama / vLLM)
• Per-tenant config: primary model, fallback chain, retry budget, capability requirements
• Automatic capability fallback (e.g., a tool-requiring turn skips a non-tool model)
• Cost telemetry: per-provider tokens in/out and dollar cost surfaced in analytics
• Documented contract for adding a custom provider

Breaking Change Notes

The internal model call site moves; downstream forks calling anthropic.messages.create directly will need to migrate to the provider interface.