AI: persist only the pinned field, not the whole config block

Adversarial review of the previous commit found a real regression it
introduced, reproduced against the actual code rather than inferred.

Changing _persist_active_ai_config from setdefault("configs", ...) to a
direct assignment made every backend switch write the whole in-memory
AI_CONFIGS over the settings file. Because AI_CONFIGS is now the built-in
defaults merged UNDER the file, that meant:

* an operator's hand edits were destroyed - and hand editing is the only
  way to change cheap_model / temperature / max_tokens, since
  set_active_model writes latest_model and there is no command for the rest,
* a config deliberately deleted from the file was re-seeded from the
  defaults and written back, permanently,
* pinning a model for one provider silently reverted another provider's
  entry,
* CONJURER_OLLAMA_MODEL stopped having any effect once the env-derived
  block had been persisted once.

The original motivation was still valid (plain setdefault would drop a
pinned model), so the fix is narrower rather than a revert: persist ONLY
the field this process actually changed. _persist_active_ai_config takes
model_for and writes back just that config's latest_model; everything else
in the on-disk block is left exactly as found. The constants.py merge stays
- it is what keeps a newly added provider visible after an upgrade - and is
now in-memory only, so it cannot reach the file.

Tests: the disk-write path had ZERO coverage, which is precisely how this
got in. Added four tests that drive the real _persist_active_ai_config
against a temp settings file: the pin lands while operator edits survive and
a deleted config is not resurrected; a plain switch leaves the configs block
byte-identical; a pin survives a re-read; a corrupt file does not raise.
Verified they have teeth - reintroducing the regression fails two of them.

Also hardened two weak tests the review caught: the pin test asserted on the
object set_active_model returns, which IS the mutated dict (so it passed
regardless), and the unconfigured-endpoint test monkeypatched OLLAMACLIENT
to None when it was already None, passing vacuously.

Suite: 72 unit + 70 integration green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker/env/bot.env.example

@@ -24,8 +24,11 @@ CONJURER_NETRC_FILE=/secrets/.netrc
 # DNS name; from outside, host:port. Port 11434 is Ollama's default.
 #   CONJURER_OLLAMA_URL=http://ollama.ollama.svc.cluster.local:11434
 # CONJURER_OLLAMA_URL=
-# Model used for normal replies. $modele_ai lists what the server actually has
-# pulled, and $gadaj_teraz ollama <model> pins one at runtime (persisted).
+# DEFAULT model for normal replies. $modele_ai lists what the server actually
+# has pulled. Pinning one at runtime with `$gadaj_teraz ollama <model>` is
+# persisted into system_gpt_settings.json and from then on WINS over this
+# variable - the pin is the more recent, more explicit choice. Clear the
+# "latest_model" of the ollama entry in that file to fall back to this default.
 # CONJURER_OLLAMA_MODEL=llama3.1:8b
 # Model used for the cheaper MUSIC path; defaults to CONJURER_OLLAMA_MODEL.
 # CONJURER_OLLAMA_CHEAP_MODEL=