[Astro-Han]

Summary

• Add Together AI as a first-class hosted provider across the registry, credentials, Desktop, CLI, storage, headless, and runtime paths.
• Vendor the byte-exact Together AI mark from @lobehub/icons-static-svg@1.91.0 and render it through the shared theme-aware provider mask.
• Lock account model discovery and a deterministic two-stage Chat Completions tool-call loop with exact model IDs.

Why

Maka needs a single registry-owned Together AI integration instead of relying on a generic OpenAI-compatible connection. This preserves Together-specific endpoint, authentication, account discovery, model snapshot, and tool-call behavior while reusing the existing compatible runtime seam.

Refs #860

Scope

This PR covers Together AI only. It does not add or change other hosted providers, introduce a parallel provider mask or notice pipeline, or implement Phase 7 work.

Verification

• npm run typecheck — passed for all workspaces.
• npm test — passed for all workspaces.
• Together runtime conformance — passed; verifies Bearer auth, /v1/models, exact MiniMaxAI/MiniMax-M3, and a deterministic two-request tool-call loop.
• Together brand governance — passed; verifies the vendored SVG SHA-256, provenance, MIT notice inventory, and shared ProviderAssetMask routing.
• npm --workspace @maka/desktop run build:renderer — passed, including third-party notice packaging.
• npm run check:stale — passed.
• git diff --check — passed.
• Independent reviewer — passed with no P0–P3 findings.
• Local Desktop E2E was not repeated after the final queue rebase per coordinator policy; the committed fake-backend Playwright journey verifies catalog/detail mask rendering, exact model selection, and credential flow, and CI E2E remains a merge gate.
• No screenshot is included because the user-visible change uses the existing provider catalog/detail layout; byte-exact asset governance plus the computed-style Playwright contract provide the relevant visual evidence.

Impact

Users can configure Together AI with an API key, discover account models, select checked-in fallback models offline, and run tool-calling chat through the existing runtime. No data migration is required. Existing provider IDs and saved connections are unchanged.

Reviewer notes

The provider ID is the models.dev stable ID togetherai. The official base URL is https://api.together.ai/v1. The brand asset is vendored byte-for-byte from lobehub/lobe-icons commit 32f4083f7a20b67ecdc7b29c0af031ada5a29c52, path packages/static-svg/icons/together.svg, under MIT; SHA-256 is b3ec218e7e0b0432a2ce07f5ec98a1dcd24f808c74d5fee624ab31e4947feef3.

Ready for review

• Verification is complete and the results above are current
• Impact, compatibility, migration, documentation, and release-note needs are addressed
• User-visible UI/UX changes include visual evidence, or Verification explains why it is not applicable