fix(setup): clarify model provider paths

[Sayt-0]

Summary

Clarifies the docker agent setup provider paths so built-in cloud providers are not confused with custom OpenAI-compatible endpoints.

• labels option 1 as the built-in provider path and names Groq and Hugging Face
• reserves option 3 for custom endpoints with their own base URL, such as vLLM and LiteLLM
• uses credential-neutral wording for built-in providers and documents ChatGPT, token, and AWS authentication cases
• aligns the CLI reference and model setup documentation with all four setup paths
• adds regression coverage for the menu distinction and built-in provider examples

Issue expectations

Expectation	Implementation
Option 1 clearly covers built-in providers	Menu and help label it as the built-in cloud provider path and include Groq and Hugging Face
Option 2 remains Docker Model Runner	Existing local-model wording and behavior are unchanged
Option 3 is only for custom OpenAI-compatible endpoints	Menu, help, and docs require the endpoint's own base URL and use vLLM/LiteLLM examples
Option 4 remains the Claude Code harness	Existing harness wording and behavior are unchanged
Authentication wording is not limited to API keys	Built-in flow uses “credential”; docs cover API keys, tokens, AWS credentials, and ChatGPT sign-in

Validation

• task build
• task lint
• task test
• npx --yes markdownlint-cli2@0.22.1 from docs/
• git diff --check

Closes #3805