fix(dsh): read models saved by the provider editor

[dxcsmam]

Summary

• accept the DSH provider editor models[] shape and use its first model for the dedicated OpenGUI route
• preserve legacy single-value model settings and reuse the editor model during interactive credential completion
• add a Chinese quick-start and FAQ covering model setup, Android USB debugging, and the extra Xiaomi/Redmi/POCO security debugging switch
• include local Markdown screenshots for the OpenGUI model editor and ordinary Android USB debugging

Root cause

The DSH model editor persists configured models under coremate-mobile.models, while the plugin only read the legacy coremate-mobile.model field. The UI therefore showed a configured provider, but phone_agent could still enter the missing-model flow.

Validation

• regression test fails on current origin/main and passes with this change
• 46 Vitest files passed, 266/266 tests passed
• TypeScript compilation and tsdown bundle completed
• Codex plugin structure validation passed
• Markdown local links: 8/8 resolved
• git diff --check passed

The full suite was run from a no-space temporary checkout because several existing tests use URL pathnames directly and the maintainer checkout path contains spaces.