Add model endpoint identity header controls

[Bionic711]

Motivation & Context

APIM and backend routing policies need a stable per-user key for counters, quotas, throttling, and routing without exposing raw SimpleChat user identifiers. This change adds an admin-governed model endpoint identity header that sends only a stable HMAC value derived from selected identity fields.

Description & Review Guide

• What are the major changes?
  • Adds a shared model endpoint identity-header helper that validates safe custom header names, normalizes identity inputs, resolves request/background user context, and emits HMAC-SHA256 header values.
  • Adds global Admin Settings controls plus per-model-endpoint inherit/enable/disable overrides for header name and identity value type.
  • Wires the header through configured model endpoint clients and legacy GPT/APIM model paths used by chat, workflows, metadata extraction, summaries, conversation export, agent instruction drafting, and Smart HTTP summarization.
  • Adds functional coverage, UI serialization coverage, feature documentation, release notes, and bumps the app version to 0.250.203.
• What is the impact of these changes?
  • Admins can enable APIM-friendly per-user policy keys without sending raw UPN, object ID, or tenant ID values to model backends.
  • The feature is disabled by default and omits the header when required identity values are unavailable.
  • Existing auth/protocol headers are protected from override by reserved-header validation.
• What do you want reviewers to focus on?
  • Please review the runtime coverage across model call paths and the safety behavior for endpoint overrides, reserved header names, and background/workflow identity resolution.
  • Validation completed locally: syntax compile for changed Python, node --check, identity-header functional test, route policy tests, swagger route guardrail, changed-line XSS/BAC guardrails, git diff --check, and the model endpoint UI test collection (skipped locally because UI env vars are not set).

Related Issue

Fixes #1250

Contribution Checklist

• I have read the contribution guidelines and followed the repository conventions.
• I have added or updated tests for the changes.
• I have updated documentation and release notes where appropriate.
• I have validated the change locally with targeted checks.
• This is not a breaking change.