Every command that goes through buildAuthedContext (get / describe / run /
auth-devices / ...) now silently refreshes a per-host compat snapshot at
most every 24 h and shows one stderr line if the cached verdict is
'unsupported'. Banner is suppressed in pipeline mode (-o json|yaml|name),
when stdout is not a TTY, on first-ever invocation against a host, and
for 24 h after the last warning. No new env vars, no new flags, no new
config keys — purely behavior driven by what the user is already doing.

The existing 'difyctl version' command (explicit probe) is unaffected; it
does not go through authedCtx and keeps its own contract intact.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Aligns with the post-langgenius#36380 architecture: openapi-namespace types now
live in packages/contracts/generated/api/openapi/, generated alongside
console/service/web from the same Swagger spec. CLI imports rewrite to
'@dify/contracts/api/openapi/types.gen', the local
cli/src/types/data-contracts.ts is removed, and the orphan
'sync-models' npm script (its .sh file was already deleted upstream) is
dropped.

Behavioral: ServerVersionResponse + every other openapi type is now
sourced from the shared package. Zero runtime change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…ghter probe contract

Address review comments on the version + auto-nudge feature:

cache:
- Replace `compat-snapshot` (verdict + server-version cache) with `nudge-store`
  which only persists `lastWarnedAt` per host. The nudge probe is now realtime;
  the cache only throttles how often we warn. Removes the lost-update / clock-
  skew / stale-warn classes of bugs in one stroke, net −408 LoC.
- `markWarned` re-reads disk inside the write cycle so concurrent CLI
  invocations on different hosts can't clobber each other's timestamps.

nudge:
- Throttle-first decision tree: cheap checks (TTY, output format, silence
  window) run before any I/O. Probe failures are silently swallowed and never
  drive a warning.
- `clientVersion` is now injected via `NudgeDeps` instead of reached through
  the `versionInfo` global, keeping the banner pure.

probe / meta client:
- Drop `bearer` from `MetaProbe` signature. `/openapi/v1/_version` is
  intentionally unauth (mirrors `_health`); the bearer parameter was dead code.
- Move `META_PROBE_TIMEOUT_MS` from inside `MetaClient.serverVersion()` to
  the `createClient(...)` call at both probe sites (version command and
  per-command nudge). Both now also disable retry, so the default 30s × 3
  budget never leaks into version probes.

compat:
- Clamp malformed `serverVersion` strings to 80 chars before quoting them in
  the verdict detail, so a hostile server response can't flood stderr.

version command:
- Emit the formatted report on stdout *before* exiting on `--check-compat`.
  This makes `difyctl version -o json --check-compat | jq ...` work the same
  way on the failure path as on success — pipelines get the JSON envelope,
  stderr gets the one-line reason, exit code signals the verdict.