These two were the exception in the last commit: they are driven over a
stdin/stdout mux protocol, so there was no URL to redirect. This adds the
missing HTTP boundary.

tools/mux_service.py hosts a real MuxEngine (colibri or k3 — both use the
same class) and exposes /health, /run (NDJSON: text chunks then stats),
/pause and /resume. codai/api/mux_remote.RemoteMuxEngine is the client
and presents the exact surface the backends use — run/is_alive/pause/
resume/close/log_tail/family — so ensure_engine() can hand one back and
nothing downstream can tell local from remote. Cancellation travels as a
dropped connection: the service's write fails and it stops generating,
matching the local `cancelled` callback semantics.

`service_url` is now a real config field on all five engine backends
(ds4, colibri, k3, ktransformers, vllm), settable through the admin API
and persisted, rather than only an env var.

Tested end-to-end against a stub engine: streaming, stats, mid-stream
cancellation, pause/resume, and error propagation all round-trip.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0182DhR1eFNPQyGmDrpHbedY