feat(models): run the workshop on DeepSeek V4.1 Flash through OpenCode

New projects default to opencode-go/deepseek-v4.1-flash when OpenCode reports it. OpenCode holds the provider credential; the app never reads it. OpenCode reports this model as priced, so first use still needs explicit confirmation.

The private Render instance receives OpenCode's credential file from the OPENCODE_AUTH_JSON secret, written with mode 0600 before OpenCode starts. Invalid secrets stop startup without echoing the value. Redaction now covers JSON credential fields.