feat(P3): Wave C BYOM — endpoint registry, validate-on-save, routing shim

REQ-006: configure BYOM endpoint (URL in DB, key in secret manager)
REQ-007: validate-on-save test inference call (OpenAI-compatible)
REQ-008: route all inference to BYOM (G-001: test-inference proxy endpoint)
REQ-009: reject when unconfigured/unreachable (ByomUnconfiguredError/ByomUnreachableError)

---ci---
phase: 3
milestone: v0.1
status: execute
---/ci---

pnpm-lock.yaml

@@ -14,6 +14,9 @@ importers:
 
   apps/control-plane:
     dependencies:
+      '@coreci/byom':
+        specifier: workspace:*
+        version: link:../../packages/byom
       '@coreci/config':
         specifier: workspace:*
         version: link:../../packages/config
@@ -52,6 +55,34 @@ importers:
         specifier: ^2.1.0
         version: 2.1.9(@types/node@22.20.1)(lightningcss@1.33.0)(supports-color@7.2.0)
 
+  packages/byom:
+    dependencies:
+      '@coreci/config':
+        specifier: workspace:*
+        version: link:../config
+      '@coreci/db':
+        specifier: workspace:*
+        version: link:../db
+      '@coreci/secrets':
+        specifier: workspace:*
+        version: link:../secrets
+    devDependencies:
+      '@types/node':
+        specifier: ^22.0.0
+        version: 22.20.1
+      eslint:
+        specifier: ^9.0.0
+        version: 9.39.5(supports-color@7.2.0)
+      tsx:
+        specifier: ^4.19.0
+        version: 4.23.12
+      typescript:
+        specifier: ^5.6.0
+        version: 5.9.3
+      vitest:
+        specifier: ^2.1.0
+        version: 2.1.9(@types/node@22.20.1)(lightningcss@1.33.0)(supports-color@7.2.0)
+
   packages/config:
     devDependencies:
       '@types/node':