fix(models,web): real cancellable downloads (commit-pinned, parallel); launch form respects user node picks

[webdevtodayjason]

The two majors from the final lifecycle verification on the 0.5.1 fleet:

• Download Cancel was a backend no-op — the cancel-checking callback was never passed to snapshot_download (which has no cancel hook anyway); a cancelled 15 GB download ran to completion. Rebuilt as per-file hf_hub_download with the cancel flag checked between files. Review then caught two regressions in the first cut, both fixed: commit pinning (repo_info resolves the sha once; every file fetch carries revision=<sha> — no more mixed-commit snapshots if the repo is pushed mid-download) and parallelism (bounded ThreadPoolExecutor via AINODE_DOWNLOAD_MAX_WORKERS, cancellable futures). Layout identical to snapshot_download by construction; progress/token/handler contracts unchanged.
• Launch form auto-recommend clobbered user node picks — selecting a model after picking a node reset the selection to the head (a node-targeted load landed on the head tonight and overwrote its config.model). User node toggles now set an intent flag that auto-recommend respects; untouched selections keep full auto-recommend.

665 passed, 1 xfailed; ruff clean; node --check OK. New tests: layout-identity + revision-pinning assertion, cancel-between-files, cancel-before-first-file.

🤖 Generated with Claude Code

https://claude.ai/code/session_017NziXzqT1L9kj2T1byA3Ak