Merge feature/load-local-model-explicitly into development

Load the on-device model only on explicit request (/load or actively picking a model in /models); no automatic load on first launch or when a new ACP thread opens.