feat: add buttonRef prop and focus management

[chenyme]

Summary

Fix the model picker showing two visually highlighted models when reopening it after selecting a model that is not first in its vendor list.

The picker previously used the same background for the selected model and the automatically focused first item. It now places the initial desktop focus on the currently selected model, keeping selection and focus aligned while preserving keyboard accessibility.

Change type

• Bug fix
• Feature
• Documentation
• Refactor
• Configuration / deployment
• Security hardening
• Other

Affected areas

• Frontend / UI
• Backend / API
• Authentication / authorization
• Conversations / streaming
• Files / RAG / extraction
• Model routing / providers
• MCP / tools
• Billing / payments
• Admin console
• Deployment / Docker / configuration
• Documentation

Verification

• cd frontend && pnpm lint
• cd frontend && pnpm exec tsc --noEmit
• git diff --check
• Frontend build not run; lint and TypeScript verification passed.

Screenshots, API examples, or logs

The reproduction screenshot is included in the linked issue. No API or backend behavior changed.

Configuration, migration, and compatibility notes

No configuration, migration, deployment, API contract, or model routing changes are required. Mobile model picker behavior remains unchanged.

Documentation

• Documentation is not needed for this change.
• Documentation was updated.
• Documentation still needs to be updated.

Security and privacy

• No secrets, tokens, credentials, local config, or personal data are included.
• User data access remains scoped by authenticated user context unless an admin-only path explicitly requires broader access.
• Security-sensitive behavior was reviewed, including authentication, authorization, provider routing, file processing, billing, and admin APIs where relevant.

Checklist

• I searched existing issues and pull requests.
• Changes are focused and do not include unrelated refactors.
• Tests or static verification were run where practical.
• User-facing behavior, deployment steps, API contracts, or configuration changes are documented.
• Generated artifacts are included only when this project explicitly requires them.
• Caches, build output, .pyc files, .env files, and local storage data are not committed.