feat: add dedicated GLM provider with JWT auth and GLM-4.7 support

The GLM/Zhipu provider was using the generic OpenAI-compatible provider,
which failed because:
- Zhipu requires JWT authentication (HS256 with sign_type: SIGN header),
  not raw Bearer tokens
- The endpoint uses /v4/chat/completions, not /v1/
- default_model_for_provider() had no GLM case, silently defaulting to
  a Claude model

Changes:
- Add src/providers/glm.rs with JWT token generation, caching, and
  correct Z.AI international endpoint
- Wire GLM provider into factory (mod.rs) replacing the broken
  OpenAI-compatible shim
- Add ring dependency for HMAC-SHA256 signing
- Add GLM-4.7 and GLM-4.7-Flash to onboarding wizard model list
- Fix default_model_for_provider() to return glm-4.7 for GLM provider

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Cargo.toml

@@ -46,6 +46,9 @@ chacha20poly1305 = "0.10"
 # Async traits
 async-trait = "0.1"
 
+# HMAC-SHA256 (Zhipu/GLM JWT auth)
+ring = "0.17"
+
 # Memory / persistence
 rusqlite = { version = "0.32", features = ["bundled"] }
 chrono = { version = "0.4", default-features = false, features = ["clock", "std"] }