chore: consolidate nightly hardening PRs into one reviewed change set

[brainsparker]

What this is

The open nightly hardening PRs overlap heavily: several are the same fix regenerated on different nights, and most touch promptlens/models/config.py, so merging them one by one means a rebase after nearly every merge. This branch merges the best version of each distinct improvement, resolves the cross-PR conflicts once, and passes the full suite.

Included (10 PRs, keeper of each family)

• feat: nightly hardening - robust HTTP response parsing #35 pydantic ConfigDict migration plus robust HTTP response parsing (supersedes refactor: nightly hardening - pydantic v2 compatibility #5, refactor: nightly hardening - pydantic config migration #15, refactor: nightly hardening - pydantic v2 config migration #30, feat: nightly hardening - pydantic config compatibility #33, feat: nightly hardening - HTTP plain-text response fallback #21, feat: nightly hardening - responses api content parsing #24)
• feat: nightly hardening - config validation guardrails #31 config field validators: temperature, max_tokens, parallelism, retries, output formats (supersedes feat: nightly hardening - configuration validation guardrails #6, fix: nightly hardening - config validation guardrails #26, fix: nightly hardening - config input bounds validation #17, fix: nightly hardening - config numeric bounds validation #22, and fix: nightly hardening - output format validation #20, whose formats validator feat: nightly hardening - config validation guardrails #31 already contains)
• fix: nightly hardening - unique model identity validation #25 unique model name validation
• fix: nightly hardening - HTTP endpoint URL validation #29 HTTP endpoint URL validation
• fix: nightly hardening - CLI config load guards #36 CLI config load guards for empty or non-mapping YAML (supersedes feat: nightly hardening - resilient cli config loading #7, fix: nightly hardening - CLI config shape validation #13, fix: nightly hardening - cli config top-level validation #14, fix: nightly hardening - cli config shape validation #16, fix: nightly hardening - cli config top-level guards #28, fix: nightly hardening - CLI config top-level validation #34)
• fix: nightly hardening - provider normalization #27 provider name normalization
• feat: nightly hardening - http provider endpoint normalization #11 HTTP endpoint normalization plus local model docs
• feat: nightly hardening - jittered retry backoff #32 jittered retry backoff
• fix: nightly hardening - retry parameter validation #19 retry parameter validation
• fix: nightly hardening - http empty-content error surfacing #23 HTTP empty-content error surfacing (supersedes fix: nightly hardening - HTTP empty-content response guard #18)

Not included: #10 (loader root validation, no longer applies; main already validates top-level mapping via merged #12).

Conflict resolutions worth reviewing

• config.py: kept the ConfigDict style from feat: nightly hardening - robust HTTP response parsing #35 and folded feat: nightly hardening - config validation guardrails #31's and fix: nightly hardening - unique model identity validation #25's validators into it; combined imports
• tests/test_provider_factory_hardening.py: fix: nightly hardening - provider normalization #27 and feat: nightly hardening - http provider endpoint normalization #11 both created this file; kept the union of both test sets
• One test-only fix: the fix: nightly hardening - provider normalization #27 normalization test constructs a real OpenAI provider, which requires an API key at init, so the test now sets a dummy OPENAI_API_KEY via monkeypatch

Validation

• Full suite: 36 passed, 0 failed (Python 3.9)
• Pushed via API as a single squashed commit; the per-PR merge history exists locally but the GitHub App push path cannot preserve it

After merging

Close the 28 open nightly hardening PRs with a pointer to this one. The originals stay browsable for attribution.