F1.C — Filter /v1/models by config + per-key scope

[HXYerror]

Part of #23. Depends on F1.A, F1.B, F2.B, F2.C.

Background

src/routes/models/route.ts:16-24 re-emits every upstream model verbatim. With aliases configured, clients should see only enabled aliases AND only those their key permits.

Goal

/v1/models returns the intersection of (config-enabled aliases) and (caller's allowed_models scope from F2.C auth middleware).

Tasks

• Replace upstream-passthrough with: for each alias where enabled && allowed_keys includes "*" || includes key.id) && key.allowed_models matches → emit alias entry with id=alias-name, owned_by, etc.
• Preserve OpenAI Model shape: {id, object: "model", created, owned_by}
• If --no-auth mode: caller has implicit ["*"] scope (synthetic admin key)
• Per-key scope check uses the user-facing alias name, not the resolved upstream name (per backend review Model-to-endpoint routing: chat-completions vs responses #14). Document this in code: scope check happens BEFORE alias resolution; alias rewriting happens AFTER auth.
• Add Anthropic /v1/models parity (if exposed)
• No upstream call needed once config is loaded (we only proxy what config allows)
• Tests: admin key sees all enabled aliases; restricted key sees subset; disabled alias hidden; revoked key gets 401 (auth middleware concern, but verify integration here)

Acceptance criteria

• curl -H "Authorization: Bearer sk-cap-…" /v1/models reflects config + scope
• Hot-reload of config (F1.A) propagates to next request without server restart
• No upstream /models call required once state.models is populated

File pointers

• Touch: src/routes/models/route.ts
• Reads from: src/lib/config-store.ts, request.context.key set by F2.C

Dependencies

Depends on F1.A, F1.B, F2.B, F2.C.

[HXYerror]

Implemented in 991a097 (feat) + 658b6dc (crew review fixes).

Changes shipped:

• src/routes/models/route.ts: when config has aliases, /v1/models returns only enabled alias entries (id=alias, owned_by=upstream-for-provider-inference); disabled aliases hidden; passthrough to upstream list when no aliases configured. Per-key scope check deferred (F2.C), documented in code.
• src/lib/config-store.ts: upstream field validated by regex — rejects URL-shaped values (SSRF prevention), requires model-ID format
• 5 new tests: passthrough mode, alias-only list, disabled alias hidden, all-disabled empty list, URL upstream rejected

Review findings addressed: owned_by disclosure documented, upstream URL SSRF guard added, test fixtures fixed, all-disabled test added, getModelMode comment. 266 tests pass.