feat(08-04): add validate_provider_id helper to services/ai_config.py (D-11)

- Migrate inline provider_id validator to service layer per CLAUDE.md
- Raises ValueError (not HTTPException) — service-layer rule
- PROVIDER_DEFAULTS already imported; placed after load_provider_config helpers

backend/services/ai_config.py

@@ -196,6 +196,17 @@ async def load_provider_config_by_id(session: AsyncSession, provider_id: str) ->
     )
 
 
+# ── Provider ID validator (D-11 migration) ───────────────────────────────────
+
+def validate_provider_id(v: str) -> str:
+    """Service-layer provider_id validator; raises ValueError per CLAUDE.md service-vs-API rule."""
+    if v not in PROVIDER_DEFAULTS:
+        raise ValueError(
+            f"Unknown provider_id {v!r}. Must be one of: {list(PROVIDER_DEFAULTS.keys())}"
+        )
+    return v
+
+
 # ── Startup seed ──────────────────────────────────────────────────────────────
 
 async def seed_system_settings_from_env(session: AsyncSession) -> None: