feat: nightly hardening - http provider endpoint normalization

[mouse-value-add]

problem

The http provider path was brittle and effectively misconfigured in common usage.

• HTTPProvider requires ProviderConfig.endpoint, but get_provider() did not map endpoint from ModelConfig.
• Existing docs/examples placed endpoint under additional_params, which meant the provider could fail to initialize or leak config-only keys into request payloads.

This weakens a foundational capability, local model evaluation, and creates avoidable runtime failures.

approach

• Added explicit endpoint and timeout fields to ModelConfig.
• Hardened provider construction in get_provider():
  • Normalize additional_params via a copy (no input mutation).
  • For http provider, accept legacy additional_params.endpoint as a backwards-compatible fallback.
  • Strip legacy endpoint from additional_params so it is not sent to inference APIs.
  • Pass normalized endpoint and timeout into ProviderConfig.
• Added focused tests covering:
  • Legacy endpoint fallback behavior.
  • Top-level endpoint behavior.
  • Endpoint key removal from outgoing additional params.
• Updated docs/example config to use top-level endpoint while preserving backward compatibility in code.

verification

• Ran test suite: python3 -m pytest -q
• Result: all tests passing (9 passed).
• New test file: tests/test_provider_factory_hardening.py

risks

• Low risk. Changes are additive and maintain backwards compatibility for existing configs using additional_params.endpoint.
• Small schema expansion (ModelConfig.timeout, ModelConfig.endpoint) may affect strict external schema consumers, but defaults preserve prior behavior.

rollback plan

1. Revert commit 091636b.
2. Restore prior ModelConfig schema and provider factory mapping behavior.
3. Re-run tests to confirm baseline behavior restored.