Parent epic: #14 ## Scope - Enforce bridge-routed providers to soca-bridge and vps-holo only - Keep OpenAI/Anthropic/Gemini/OpenRouter direct when cloud mode is enabled - Add catalogMode/modelOrigin partitioning to prevent cross-provider model bleed - Validate refresh normalization for local, vps_holo, and cloud origins ## Acceptance - Local providers only show local or vps_holo models - Cloud providers only show cloud catalog entries - OpenRouter is no longer bridge-routed