feat(p1x): de-hardcode VLM models/endpoints to vlm_config (DGX-ready)

Migre les call-sites VLM serveur vers la configuration centrale pour
fonctionner sur DGX (tunnel Ollama 11434), où gemma4:* est absent et le
port Docker 11435 est mort.

- task_planner, replay_verifier, domain_context, ir_builder, resolve_engine
  (popup): modele -> vlm_config.get_vlm_model(), defaut 11435 -> 11434
  (override GEMMA4_PORT legacy conserve)
- resolve_engine (grounding bbox x2): nouvel helper
  vlm_config.get_bbox_grounding_model() (var dediee RPA_BBOX_GROUNDING_MODEL,
  fallback RPA_GROUNDING_MODEL puis qwen2.5vl:7b-rpa) -> desambiguise le
  conflit D5-v3b, bbox_2d + num_ctx 4096 preserves
- safety_checks_provider: defaut -> get_vlm_model(), override
  RPA_SAFETY_CHECKS_LLM_MODEL preserve
- ui_detector: default_factory + resolution lazy (corrige aussi un gel a
  l'import), pas d'appel reseau a l'import
- field_extractor: property lazy via vlm_config

TDD strict (RED->GREEN), 305 tests verts, tests mockes HTTP (zero dependance
DGX reel), aucun alias Ollama.

Hors perimetre (arbitrage Dom): client Lea agent_v1/executor.py (gele),
chemin V4 observe_reason_act (RPA_REASONING_MODEL), core/config.py defaults.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/unit/test_safety_checks_provider.py

@@ -118,3 +118,50 @@ def test_empty_declarative_with_llm_returns_only_llm():
         )
     assert len(payload.checks) == 2
     assert all(c["source"] == "llm_contextual" for c in payload.checks)
+
+
+# ============================================================================
+#  Dé-hardcodage VLM (P1.x) : modèle safety-checks résolu via vlm_config
+# ============================================================================
+
+def _capture_generate(captured):
+    def fake_post(url, json=None, timeout=None):
+        captured["url"] = url
+        captured["model"] = (json or {}).get("model")
+        resp = MagicMock()
+        resp.status_code = 200
+        resp.json.return_value = {"response": '{"additional_checks": []}'}
+        return resp
+    return fake_post
+
+
+def test_safety_checks_model_default_via_vlm_config(monkeypatch):
+    """Sans RPA_SAFETY_CHECKS_LLM_MODEL, le modèle vient de vlm_config (pas gemma4 en dur)."""
+    monkeypatch.delenv("RPA_SAFETY_CHECKS_LLM_MODEL", raising=False)
+    captured = {}
+
+    import requests
+    monkeypatch.setattr(requests, "post", _capture_generate(captured))
+
+    from agent_v0.server_v1 import safety_checks_provider as scp
+    with patch.object(scp.vlm_config, "get_vlm_model", return_value="modele-resolu:test"):
+        scp._call_llm_for_contextual_checks({"parameters": {}}, {}, None, [])
+
+    assert captured["model"] == "modele-resolu:test"
+    assert ":11434" in captured["url"]
+
+
+def test_safety_checks_model_env_override_preserved(monkeypatch):
+    """RPA_SAFETY_CHECKS_LLM_MODEL reste prioritaire (override non cassé)."""
+    monkeypatch.setenv("RPA_SAFETY_CHECKS_LLM_MODEL", "mon-modele-pin")
+    captured = {}
+
+    import requests
+    monkeypatch.setattr(requests, "post", _capture_generate(captured))
+
+    from agent_v0.server_v1 import safety_checks_provider as scp
+    # get_vlm_model ne doit pas écraser l'override : on le fait lever pour le prouver
+    with patch.object(scp.vlm_config, "get_vlm_model", side_effect=AssertionError("ne doit pas être appelé")):
+        scp._call_llm_for_contextual_checks({"parameters": {}}, {}, None, [])
+
+    assert captured["model"] == "mon-modele-pin"