[6.x] AI connections - #20006

Description

Adds AI connections: one place where core and plugins get AI provider access. Customers bring their own keys. Admins choose a provider and model per task under Settings → AI → Connections.

config/ai.php (laravel/ai, owned by the app)   ← provider keys from env vars
        │
Settings → AI → Connections (project config `ai`)  ← default provider/model per modality
        │                                           + per-task: enabled, provider, model ($ENV refs allowed)
        ▼
AiTasks registry ── plugin registers DescribeImage::class (handle, label, modality)
        │
Ai::task('altText:describe')
  ├─ resolve()      → ResolvedProvider (provider, model) or AiUnavailableException
  ├─ prompt()/stream()/queue()   (laravel/ai agents)
  └─ generate()/rerank()/classify()  (images, audio, transcription, embeddings, …)
        │
TaskRunning (cancelable) → TaskCompleted (usage, duration) | TaskFailed

• Off until configured: Craft never falls back to ai.default. A task is available only once Craft's settings choose a provider for it or for its modality.
• Host config untouched: connections are the app's ai.providers entries. Craft stores no keys.
• Tasks are classes registered through TypeRegistry (AiTasks). Labels are translated at render time.
• Queued prompts resolve the task when the job runs, so disabling or remapping a task affects queued work.
• Events let plugins track usage and cost, count failures, or enforce limits by canceling requests.
• Settings nav: a new AI section groups Connections and MCP. MCP moves out of System.
• Embeddings warning appears in the settings when a registered task uses embeddings, because remapping it invalidates stored vectors.
• Adds laravel/ai: ^1.2. laravel/mcp, a dev dependency through Boost, moves from 0.9.4 to 1.0.2 to satisfy its conflict rule.
• Plugin docs: docs/ai.md..

Evidence

Settings → AI → Connections in the workbench, with two workbench tasks registered locally (the workbench registration isn't part of this PR):

Tests (tests/Unit/Ai, tests/Feature/Ai):

host app has ai.default = openai, Craft has no default  → resolve() throws NoDefault, available() = false
task disabled after queue()                             → job throws TaskDisabled when it runs
TaskRunning listener sets cancel                        → no request sent, no TaskFailed
provider not in ai.providers                            → save rejected
provider '$AI_TEST_PROVIDER' (= anthropic)              → accepted, stored as written

composer ci passes locally (Pint, Rector, PHPStan, 10,906 core tests, adapter tests).