feat: add model and group retry time budgets

[zijiren233]

Add elapsed-time retry budgets so slow failures stop scheduling new attempts when the configured budget is exhausted. Models and group model overrides can set a budget in seconds, and RETRY_BUDGET / RetryBudget provides the global default. Budgets are limited to 180 seconds.

• Count only preserves count-based retries. Budget only allows unlimited retries within the budget. With both configured, either limit stops retries.
• Model budgets inherit the global default when omitted and disable it when set to zero. An explicit positive model budget without a positive local count uses budget-only retries. Group overrides support disabling or restoring inherited budgets and clearing an inherited count.
• The budget starts with the first upstream attempt and includes calls and backoff. Expiration stops new retries and interrupts backoff; in-flight calls keep their existing timeout. Permission failures exclude the channel and now obey the configured retry count.
• Add model and group form controls, persistence and API validation, and configuration/API documentation.

Validation: all 2,078 core Go tests passed; 45 frontend tests passed; changed backend packages and frontend files passed lint; TypeScript and the frontend production build passed. Browser checks covered model/group budget save, zero, inheritance reset, and desktop/mobile layouts.