fix(image-recognition): keep the vision key on its own ref; add clear-key

Image recognition and the chat model shared DEEPSEEK_API_KEY: the
image-recognition bundle defaulted apiKeyEnv to the model key, so saving one
overwrote the other. Point the bundle at IMAGE_RECOGNITION_API_KEY and guard
both the provider and the settings card against a stale model ref, so vision
never reads or writes the chat key. Also add a clear-key button, default the
model to qwen3-vl-flash on the DashScope compatible-mode endpoint, and send
file images as base64 with a normalized base URL.

Co-Authored-By: Claude <noreply@anthropic.com>

packages/bundle/image-recognition/cordis.patch.yml

@@ -16,7 +16,10 @@
     - id: image-recognition-http
       name: '@deepseek-ai/dsh-image-recognition-http'
       config:
-        apiKeyEnv: DEEPSEEK_API_KEY
+        # Image recognition has its own credential plane, distinct from the
+        # chat model's. Pointing this at DEEPSEEK_API_KEY would let a save here
+        # overwrite the model's key (and vice versa); use the dedicated ref.
+        apiKeyEnv: IMAGE_RECOGNITION_API_KEY
 
     - id: tool-image-recognition
       name: '@deepseek-ai/dsh-tool-image-recognition'