feat: add lock toggle to pin API config across all modes in workspace

[hannesrudolph]

Summary

Add a lock/unlock toggle inside the API config selector popover (next to the settings gear icon) that, when enabled, pins the currently selected API configuration across all mode switches in the current workspace.

When unlocked (default), switching modes loads each mode's saved API configuration (existing behavior). When locked, mode switches skip per-mode config loading entirely — the current API config stays active regardless of mode. Per-mode config mappings are not modified; they are simply bypassed at read time. Disabling the lock restores normal per-mode sticky behavior with all original mappings intact.

The setting is stored in workspaceState (per-workspace), so locking in one workspace does not affect other workspaces.

How It Works

The lock is implemented as a read-time override, not a write-time fan-out:

• handleModeSwitch() checks the lock flag before loading per-mode config. If locked, it early-returns keeping the current API config active.
• createTaskWithHistoryItem() checks the lock flag before restoring mode-based API config from task history. If locked, the restoration is skipped.
• activateProviderProfile() has no lock-related logic — it writes to the current mode's config as normal, regardless of lock state.
• The lock toggle handler simply sets a boolean in workspaceState and posts state to the webview. No fan-out, no global side effects.

This design ensures the workspace-scoped lock never mutates the global per-mode config mappings, preventing cross-workspace data destruction.

Changes

Core Implementation

• packages/types/src/vscode-extension-host.ts — Added lockApiConfigAcrossModes to ExtensionState and WebviewMessage types
• src/core/webview/ClineProvider.ts — Reads lock state from workspaceState; handleModeSwitch() and createTaskWithHistoryItem() skip per-mode config loading when locked; getState() exposes lock flag
• src/core/webview/webviewMessageHandler.ts — Handler writes lock state to workspaceState and posts state to webview
• webview-ui/src/components/chat/ApiConfigSelector.tsx — Lock/unlock icon button in popover bottom bar next to settings gear
• webview-ui/src/components/chat/ChatTextArea.tsx — Passes lock state + callback props to ApiConfigSelector
• webview-ui/src/context/ExtensionStateContext.tsx — Default lockApiConfigAcrossModes: false

i18n (18 locales)

• All chat.json locale files updated with proper native translations for lock/unlock tooltip strings
• English strings explicitly mention "in this workspace" for clarity

Tests

• src/core/webview/__tests__/ClineProvider.lockApiConfig.spec.ts — Tests read-time override behavior (lock skips per-mode config, unlock preserves normal behavior)
• src/core/webview/__tests__/webviewMessageHandler.lockApiConfig.spec.ts — Tests handler sets flag without fan-out
• webview-ui/src/components/chat/__tests__/ChatTextArea.lockApiConfig.spec.tsx — UI component tests
• Fixed workspaceState mock gaps in 4 existing test files

[roomote]

Rooviewer   See task

No issues found. The latest commit refactors from write-fan-out to read-time override, which resolves the previous redundant getState() comment.

• Consolidate redundant getState() calls in ClineProvider.activateProviderProfile (comment) -- resolved: fan-out code removed entirely

Previous reviews

• fc49ed0: Review #1
• 7f74f5f: Review #2

_{Mention @roomote in a comment to request specific changes to this pull request or fix all unresolved issues.}