fix: address admin panel review findings

- Security: test-model no longer resolves a stored secret when the
  request's baseUrl/provider differs from the stored entry, closing a
  path where a tampered baseUrl could exfiltrate a saved key
- Save failures are now visible: the save bar shows the error in red
  (was masked by the persistent 'Unsaved changes' text), and per-field
  validation errors from the settings API are surfaced under each field
- The Observability/Quota enable switch is now real: toggling off stages
  deletion of the group's saved values, and the toggle no longer snaps
  back to Enabled after saving
- Env provider's default star is hidden when a panel provider is the
  active default (no more double star)
- Clearing a credential field reverts to the stored value instead of
  silently deleting it; an explicit X button removes a stored secret
- Form inputs are disabled during an in-flight save

app/api/admin/providers/route.ts

@@ -17,15 +17,21 @@ async function payload() {
     // Env-based providers (AI_MODELS_CONFIG / ai-models.json) are shown
     // read-only in the panel; their credentials live in the environment
     const envConfig = await loadEnvServerModelsConfig()
+    const adminProviders = loadAdminProviders()
+    // A panel default overrides any env default (matches the merge in
+    // loadRawServerModelsConfig), so env stars must reflect that
+    const adminHasDefault = adminProviders.some(
+        (p) => p.isDefault && p.models.length > 0,
+    )
     return {
         writable: isSettingsWritable(),
-        providers: maskAdminProviders(loadAdminProviders()),
+        providers: maskAdminProviders(adminProviders),
         envProviders:
             envConfig?.providers.map((p) => ({
                 name: p.name,
                 provider: p.provider,
                 models: p.models,
-                isDefault: !!p.default,
+                isDefault: !!p.default && !adminHasDefault,
             })) ?? [],
     }
 }

app/api/admin/test-model/route.ts

@@ -32,7 +32,20 @@ export async function POST(req: Request) {
         )
     }
 
-    const [resolved] = mergeSecrets([parsed.data], loadAdminProviders())
+    // SECURITY: a stored secret is only resolved from an {isSet} marker if
+    // the endpoint it would be sent to (provider + baseUrl) still matches
+    // the stored entry. Otherwise a tampered baseUrl could exfiltrate the
+    // stored key to an arbitrary host. Mismatches must re-supply plaintext.
+    const stored = loadAdminProviders().find((p) => p.id === parsed.data.id)
+    const sameEndpoint =
+        stored &&
+        stored.provider === parsed.data.provider &&
+        (stored.baseUrl ?? "") === (parsed.data.baseUrl ?? "") &&
+        (stored.awsRegion ?? "") === (parsed.data.awsRegion ?? "")
+    const [resolved] = mergeSecrets(
+        [parsed.data],
+        sameEndpoint && stored ? [stored] : [],
+    )
 
     return validateModel(
         new Request(new URL("/api/validate-model", req.url), {