feat: add dedicated GLM provider with JWT auth and GLM-4.7 support

The GLM/Zhipu provider was using the generic OpenAI-compatible provider,
which failed because:
- Zhipu requires JWT authentication (HS256 with sign_type: SIGN header),
  not raw Bearer tokens
- The endpoint uses /v4/chat/completions, not /v1/
- default_model_for_provider() had no GLM case, silently defaulting to
  a Claude model

Changes:
- Add src/providers/glm.rs with JWT token generation, caching, and
  correct Z.AI international endpoint
- Wire GLM provider into factory (mod.rs) replacing the broken
  OpenAI-compatible shim
- Add ring dependency for HMAC-SHA256 signing
- Add GLM-4.7 and GLM-4.7-Flash to onboarding wizard model list
- Fix default_model_for_provider() to return glm-4.7 for GLM provider

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Cargo.lock

@@ -2545,6 +2545,7 @@ dependencies = [
  "hostname",
  "http-body-util",
  "reqwest",
+ "ring",
  "rusqlite",
  "serde",
  "serde_json",