Title + tabular: fall back to local LLM when externals disabled

Title generation was hardcoded to pick from Gemini / OpenAI nano /
Claude Haiku regardless of policy. On a deployment where
EXTERNAL_AI_DISABLED=true and local Ollama is the only provider,
every title call (and every tabular call) threw "External AI
providers are disabled by organisation policy", surfacing as a
500 on POST /chat/<id>/generate-title even though the chat itself
worked.

userSettings.resolveTitleModel and a new resolveTabularModel now
consult the LlmPolicy: prefer external when explicitly allowed
AND a key is present, otherwise fall back to the first curated
local model (`local/<id>`), otherwise return null.

Callers updated:
- chat.generate-title: when title_model is null, write a trimmed
  message snippet as the title and return 200. Best-effort; the
  red error toast no longer fires when chat itself is fine.
- tabular.compose-column-prompt and the two cell-extraction paths:
  503 with a clear "ask an admin" message instead of throwing.
- tabular chat-title generation: skip silently rather than crash
  the tabular chat exchange.