feat: add System One proxy mode

[pengpeng]

Problem

Model Console only mounts the existing model modes, so a System One application cannot expose its typed decision endpoint or publish the capacity metadata Router needs.

Solution

• add model_mode=system_one and proxy POST /v1/systemone after application startup
• validate System One model-card limits
• declare explicit default eligibility in model metadata
• preserve the non-blocking install/download lifecycle

Verification

• go test ./...
• go vet ./...
• CGO_ENABLED=0 go build ./cmd/llm-init