## Why

The Cloud Control Plane proxy currently reads its LLM provider, model, and
credentials from process environment variables. Changing a model therefore
requires a deployment change and cannot be audited or operated from the Cloud
Console, even though every cloud-transport Host Agent already depends on the
control plane for its planner decisions.

## What Changes

- Add a durable, Cloud-wide catalog of planner Provider profiles. Each profile
  records its supported provider kind (`anthropic` or `openai-compatible`),
  model, timeout, optional base URL, enabled state, and an
  encrypted API key.
- Add an administrator-only Cloud API and Cloud Console view to create, list,
  update, activate, disable, and retire Provider profiles. Read responses
  never expose an API key; writes can rotate a key without returning it.
- Make the cloud planner-decision endpoint resolve the active profile from the
  database for each request, so a newly activated profile applies to all
  cloud-transport Host Agents without changing their configuration or
  restarting them.
- Remove Cloud API environment-variable configuration for the planner
  provider, model, timeout, and Provider API keys. An absent active database
  profile fails closed instead of silently using a stale environment
  credential.
- Add an encryption-key configuration for protecting Provider API keys at rest
  and document deployment, rotation, and migration behavior.
- Extend the existing provider client construction so cloud-managed profiles
  pass their encrypted API key and configured base URL explicitly to the
  Anthropic or OpenAI SDK, while Host Agent direct transport continues to use
  its existing environment-based credentials.

## Capabilities

### New Capabilities
- `llm-provider-management`: Durable, administrator-managed Cloud-wide LLM
  Provider profiles, encrypted credential handling, and Console/API operations.

### Modified Capabilities
- `cloud-planner-proxy`: Cloud planner decisions select their provider,
  model, timeout, and credential from the active database profile once
  database management is enabled, rather than requiring a Cloud API restart
  and environment-variable change.

## Impact

- `packages/cloud-platform/cloud`: SQLAlchemy models, repository contract and
  implementation, Alembic migration, encrypted-secret service, and planner
  client construction from a resolved profile.
- `apps/cloud-api` and `cloud.sdk`: an authenticated management router and
  application composition for the new service.
- `cloud-console`: an administrator-only Provider management view, client API,
  and types.
- Cloud deployment configuration: the encryption key remains deployment-held,
  while planner Provider/model/timeout/API-key environment variables are
  removed.