Warn when stored credentials or removed AICTRL_MODELS_* vars reference providers outside the static catalog #203

Context

#202 (#40) replaces models.dev with a static catalog of 18 built-in providers. Any other provider (e.g. google, groq, mistral, deepseek, xai) must now be defined under provider in aictrl.json. The flags AICTRL_MODELS_URL, AICTRL_MODELS_PATH and AICTRL_DISABLE_MODELS_FETCH were removed.

Raised in the #202 review (finding "Dropped providers + AICTRL_MODELS_* vars vanish silently"):

• A user who has stored credentials for a provider that is no longer built in (for example aictrl auth login google or GEMINI_API_KEY) and no provider entry in config sees that provider disappear. The only signal is a debug log. If they reference a model of that provider, they get ProviderModelNotFoundError, which since feat(provider)!: replace models.dev with a static model catalog (#40) #202 includes the hint "Providers that are not built in must be defined under "provider" in aictrl.json". If they rely on the default model, they get a different provider or "no providers found".
• Setting one of the removed AICTRL_MODELS_* env vars now does nothing, with no warning.

Proposal

• Once per process, compare auth.json api-key entries and enabled_providers against the catalog plus config.provider. For each provider that is neither, print one warning to stderr (never to stdout, so run --format json stays clean): provider "<id>" is no longer built in; define it under "provider" in aictrl.json.
• If AICTRL_MODELS_URL, AICTRL_MODELS_PATH or AICTRL_DISABLE_MODELS_FETCH is set, print one stderr warning saying it was removed in this version and that config.provider replaces it. Do not restore any behaviour.
• Release notes for the minor release list the removed built-in providers and env vars.

Acceptance criteria

• A stored api-key credential for a provider outside the catalog and config gives exactly one stderr warning naming the provider and the config fix. stdout is unchanged in --format json.
• Setting any removed AICTRL_MODELS_* variable gives one stderr deprecation warning. The variable still has no effect.
• Tests cover both warnings and confirm stdout stays clean.
• The release notes for the minor bump list the removed providers and env vars.