Per-assistant Fly apps and MultiSelect overhaul

This patch release moves the assistant Fly runtime to one app per assistant (instead of one app per thread), surfaces exhausted OpenRouter credits as HTTP 402 to chat callers, and overhauls the dashboard MultiSelect component.

Bug fixes

• One Fly app per assistant #2721  - Assistant Fly runtime now provisions one app per assistant (with one machine per thread) instead of one app per thread. Reduces Fly app churn and speeds cold starts; reap continues to drain old per-thread apps automatically. (Author: @danielkov )
• OpenRouter exhausted credits as HTTP 402 #2726  - OpenRouter responses indicating exhausted credits now surface as 402 Payment Required to chat callers instead of a generic 5xx, and the chat-resolution analyzer stops burning retries against a request that cannot succeed. (Author: @danielkov )

Features

• MultiSelect component overhaul #2615  - Overhauled MultiSelect component with new onValueChange/defaultValue API, option grouping, per-option styling, and singleLine fixed-height mode. (Author: @alx-xo )
• Security Overview refresh #2705  - Refactor Security Overview to use Page.Section wrappers, scrollable tables, and a lighter category label. (Author: @alx-xo )