Summary

Fixes #159 by making Ollama opt-in in Settings. Ollama (local) no longer appears as a default provider row on fresh configs; users can add it explicitly from the Add provider menu, and the keyless provider is persisted without writing an empty secret.

Type of change

• Bug fix
• New feature
• Refactor (no behavior change)
• Documentation
• Build / CI / tooling
• Breaking change

Linked issue

Closes #159

Root cause

toProviderRows() always injected keyless builtin providers into the rendered row set. Because Ollama is the only builtin with requiresApiKey: false, Settings showed it even when the user had never added or configured it.

What changed

• Removed automatic keyless builtin injection from provider row generation.
• Added regression coverage for hidden-until-persisted and visible-after-persisted Ollama behavior.
• Allowed the Settings add-provider IPC path to persist keyless Ollama without creating an empty secret.
• Added an explicit Ollama item to the Add provider menu, disabled after it is already present.
• Added English and Chinese labels for the new menu entry and toast.
• Added a changeset for the user-visible Settings behavior change.

Checklist

• I read CLAUDE.md before starting
• I read docs/VISION.md and docs/PRINCIPLES.md before starting (not present in this local checkout; docs/ only contains docs/research/)
• Commits are signed with DCO (git commit -s)
• Added/updated tests for the change
• Added a changeset (pnpm changeset) because behavior changed
• Updated docs if behavior changed (not needed; behavior is covered by Settings UI copy)

PRINCIPLES §5b checks

• Compatibility: Existing persisted provider/secret rows still render; keyless Ollama remains allowed after explicit add.
• Upgradeability: No schema changes; configs keep the same v3 shape.
• No bloat: No dependency additions; only targeted IPC/UI/tests/i18n changes.
• Elegance: The row list now reflects persisted state, while the add menu owns discovery.

Validation

• corepack pnpm --filter @open-codesign/desktop exec vitest run src/main/provider-settings.test.ts src/main/onboarding-ipc.test.ts src/renderer/src/components/Settings.test.ts — 57 passed
• corepack pnpm --filter @open-codesign/desktop typecheck — passed
• corepack pnpm lint — passed
• git diff --check — passed

I also attempted the full desktop test suite on Windows. It is currently blocked by environment/platform issues unrelated to this change: missing better-sqlite3 native binding after dependency install, POSIX /tmp path expectations on Windows, and symlink permission failures.

Screenshots / recordings (UI changes)

Not attached; this is a small Settings menu behavior change.