feat: implement Groq fallback for Gemini failures and update ops docs

add Groq dependency and NAS config entries for fallback provider
implement Gemini -> Groq fallback flow on quota, timeout, and API errors
validate Groq API key with models listing and runtime invocation path
update AI orchestration logic in runner and ai enrichment pipeline
update TODO document to mark Groq auth, integration, and verification as completed

config.nas.yaml

@@ -71,6 +71,12 @@ ai:
   model: gemini-3.6-flash
   max_papers_per_run: 20
 
+  fallback:
+    enabled: true
+    provider: groq
+    api_key_env: GROQ_API_KEY
+    model: llama-3.3-70b-versatile
+
 # NAS mode writes to Joplin through Joplin Terminal, not the desktop Data API.
 joplin:
   enabled: false