fix(ui): refine model selection and account actions

[bobleer]

Summary

• keep the Hermes subscription account row consistent with the other providers by removing the extra subscription-management CTA
• show providers directly in the chat model picker, then open a provider-specific model flyout
• keep Combobox and MultiSelect popovers above modal forms so model options remain visible

Verification

• pnpm run i18n:audit
• pnpm --dir src/web-ui run test:run src/flow_chat/components/ModelSelectorProviderLevels.test.tsx src/flow_chat/components/ModelSelectorExternal.test.tsx
• pnpm run check:web
• pnpm run design-system:check

Remote scenarios

• not exercised; these changes are presentation-only and do not alter remote workspace, remote control, peer-device, or detached-dispatch behavior