fix(gui): address ds-review-bot findings on image attachments

- dsh web gains --provider/--model: a non-deepseek provider mounts the
  matching pi-ai catalog route (ambient credentials), making image input
  reachable from the shipped Web assembly; requires an explicit --model
- attachment-local syncs the publication directories after the hard-link
  publish so a reported durable reference survives a crash (POSIX; Windows
  relies on filesystem metadata journaling)
- the attachment seam gains storage-free validateImage; the host validates a
  complete multi-image prompt before persisting any member, so one malformed
  image cannot strand valid members as unreferenced objects
- startSession sends before navigating: a rejected first send keeps the empty
  state, its error strip, and the complete draft mounted
- the webserver rejects an undeclared-length body the moment it crosses the
  configured limit instead of draining a potentially endless stream to EOF

apps/cli/src/web.ts

@@ -49,6 +49,8 @@ export async function runWeb(argv: string[]): Promise<void> {
       host: { type: 'string', default: LOOPBACK_HOST },
       port: { type: 'string', default: '3080' },
       'max-request-body-bytes': { type: 'string' },
+      provider: { type: 'string' },
+      model: { type: 'string' },
       dev: { type: 'boolean', default: false },
     },
     allowPositionals: false,
@@ -77,12 +79,28 @@ export async function runWeb(argv: string[]): Promise<void> {
     process.exit(1)
   }
 
-  // A missing DEEPSEEK_API_KEY throws here (plugin load is fail-loud, uncaught by design).
+  // Default routing: --provider deepseek (implicit) keeps the DeepSeek-only
+  // assembly; any other --provider additionally mounts that pi-ai catalog
+  // route (credentials via the provider's ambient discovery, e.g.
+  // ANTHROPIC_API_KEY) so visual-capable models are reachable from the shipped
+  // Web app. A non-default provider requires an explicit --model — this shell
+  // has no evidence for inventing another provider's default.
+  const provider = values.provider ?? 'deepseek'
+  if (provider !== 'deepseek' && values.model === undefined) {
+    process.stderr.write(`dsh web: --provider ${provider} requires an explicit --model\n`)
+    process.exit(1)
+  }
+
+  // A missing DEEPSEEK_API_KEY throws here (plugin load is fail-loud, uncaught
+  // by design); an unknown --provider fails the pi-ai catalog check the same way.
   const host = await startHost({
     boot: {
       persistenceRoot: './.sessions',
       workspaceContext: { maxBytes: 65_536 },
       sessionTitleLlm: true,
+      ...provider === 'deepseek' ? {} : { piAiProviders: [{ provider }] },
+      ...values.provider === undefined ? {} : { provider: values.provider },
+      ...values.model === undefined ? {} : { model: values.model },
     },
   })
   const attachments = host.ctx.get('attachments')