fix: address admin panel review findings

- Security: test-model no longer resolves a stored secret when the
  request's baseUrl/provider differs from the stored entry, closing a
  path where a tampered baseUrl could exfiltrate a saved key
- Save failures are now visible: the save bar shows the error in red
  (was masked by the persistent 'Unsaved changes' text), and per-field
  validation errors from the settings API are surfaced under each field
- The Observability/Quota enable switch is now real: toggling off stages
  deletion of the group's saved values, and the toggle no longer snaps
  back to Enabled after saving
- Env provider's default star is hidden when a panel provider is the
  active default (no more double star)
- Clearing a credential field reverts to the stored value instead of
  silently deleting it; an explicit X button removes a stored secret
- Form inputs are disabled during an in-flight save

app/api/admin/providers/route.ts

@@ -17,15 +17,21 @@ async function payload() {
     // Env-based providers (AI_MODELS_CONFIG / ai-models.json) are shown
     // read-only in the panel; their credentials live in the environment
     const envConfig = await loadEnvServerModelsConfig()
+    const adminProviders = loadAdminProviders()
+    // A panel default overrides any env default (matches the merge in
+    // loadRawServerModelsConfig), so env stars must reflect that
+    const adminHasDefault = adminProviders.some(
+        (p) => p.isDefault && p.models.length > 0,
+    )
     return {
         writable: isSettingsWritable(),
-        providers: maskAdminProviders(loadAdminProviders()),
+        providers: maskAdminProviders(adminProviders),
         envProviders:
             envConfig?.providers.map((p) => ({
                 name: p.name,
                 provider: p.provider,
                 models: p.models,
-                isDefault: !!p.default,
+                isDefault: !!p.default && !adminHasDefault,
             })) ?? [],
     }
 }