fix: derive an output ceiling from the window and answer a refused dial as not_ready

[pengpeng]

Why

A local chat card reporting max_output_tokens equal to its whole window (131072 of 131072) led clients to reserve the entire context for the reply, which the KV budget refused as kv_budget_exhausted. Separately, each card edit relaunches the engine, and during that gap a request that found nothing listening surfaced as 502 upstream_unreachable, which callers treat as a hard failure.

What changes

• Output ceiling. In chat mode, when max_output_tokens is unset or not smaller than context_size, it is derived as a quarter of the window, on boot and on PUT /api/model-spec, alongside the existing context_size derivation. A ceiling the author set below the window is kept.
• Relaunch gap. A refused dial (*net.OpError with Op == "dial") is now 503 not_ready with Retry-After: 5, matching the readiness gate. Nothing reached the engine, so resending is safe. A connection the engine accepted and then dropped is still 502 upstream_unreachable.

Compatibility

• Cards with an explicit ceiling below the window are unchanged.
• Clients that retried on 502 now see a 503 with Retry-After, which is the documented retryable shape.
• The default slot count is not changed here: the single slot observed came from the model application's own card (-np 1).

Verification

• go vet ./... and go test ./... pass.
• New and updated tests: TestSyncMaxOutputTokensFromContext, TestProxy_UpstreamErrorJSONEnvelope (now 503 not_ready with Retry-After), and TestProxy_DroppedConnectionStaysBadGateway.
• CHANGELOG updated under Unreleased.

Made with Cursor