Epoch #73 task 4 (bug-hunt on server-models.cpp).

Two race-condition latent bugs in router state machine. Both used
`std::map::operator[]` where `find()` was needed; silent default-insert
on miss produced false-positive predicate / phantom mapping entries.

## Bug 1: unload_lru() cv.wait predicate (line 762)

```
cv.wait(lk, [&]() {
    return mapping[lru_model_name].meta.status == SERVER_MODEL_STATUS_UNLOADED;
});
```

The default-init `server_model_meta` has `status = SERVER_MODEL_STATUS_UNLOADED`,
so this predicate is spuriously true if the model is missing — AND it
inserts a garbage entry into `mapping` as a side effect.

Race: another thread (or a reload) unloads/removes the model between
`unload(lru_model_name)` (which released its own lock) and our re-acquire.
Predicate returns true on the inserted default; we proceed thinking the
unload completed, but mapping is now polluted with a phantom entry.

Fix: `find()`; missing → treat as done.

## Bug 2: load() after cv.wait(!is_reloading) (line 779)

```
cv.wait(lk, [this]() { return !is_reloading; });
auto meta = mapping[name].meta;
if (meta.status != SERVER_MODEL_STATUS_UNLOADED) { ... return; }
```

`has_model()` was checked earlier under its own lock-cycle, then
`unload_lru()` cycled the lock, then we re-acquire here. If a reload
ran in that window and erased `name` from mapping, `mapping[name]`
silently inserts a default. The early-return is bypassed
(default status = UNLOADED) and we proceed to spawn a child with
empty preset args.

Fix: `find()`; missing → log + bail.

## Verified

- ✅ `cmake --build build --target llama-server` succeeds locally
- ✅ No behavior change on the non-racy path (find()+early-return on miss
   is operationally equivalent to operator[]+early-return on
   default-UNLOADED, minus the silent insertion)

## Out of scope

Other `mapping[]` sites in load() (lines 1020, 1031) are reachable only
while the lock is held continuously from the now-guarded read at 779, so
no race exists there. `mapping[name]` at line 1186 (`proxy_request`)
also reads under-lock after `get_meta()` confirmed presence.