fix(aibox): validate model profile schema at config source (H2)

Profiles previously had no validation, so config errors surfaced far
from their origin and cryptically:
- explicit profile missing `model` fell back to the profile NAME as the
  model (a profile named "local" would send "model": "local")
- default profile missing `model` with no model param produced
  "model": null -> API 400
- missing `api_url` surfaced as requests InvalidURL

_resolve_model_profile now runs _validate_profile (dict type + api_url)
before reading fields and _require_model on the effective model,
raising ValueErrors that name the profile, the missing field, and the
config.json path to fix. Bare model names still legally substitute for
a default profile's missing model field.

Tests: new TestH2SchemaValidation (6 cases: missing model/api_url,
null-model via default profile, bare-name substitution, non-dict
profile, e2e create_llm_client); full suite 282 passed.

aibox/README.md

@@ -546,8 +546,8 @@ AI 可以通过 `update_soul` 工具动态更新 `99_SOUL.md`，通过 `update_i
 
 | 字段 | 说明 |
 |---|---|
-| `api_url` | 端点 URL（OpenAI Chat Completions 协议） |
-| `model` | 该档案使用的模型名 |
+| `api_url` | **必填**。端点 URL（OpenAI Chat Completions 协议） |
+| `model` | **必填**（除非调用时传裸模型名）。该档案使用的模型名 |
 | `api_key_env` | API Key 环境变量名；**未配置回退 `api.api_key_env`；显式空串 `""` 为本地免密端点**（Ollama/vLLM）。档案端点环境变量取不到时**直接报错，绝不回退 `~/.cert/deepseek.key`**——该文件为 DeepSeek 专属凭据，跨厂商复用属于泄漏（key 文件回退仅对无档案的旧 `api` 扁平节生效） |
 | `reasoning_enabled` | 档案级思考模式开关（缺省回退 `api.reasoning_enabled`） |
 | `timeout` | 请求超时秒数 |