feat: graphical model management in admin panel

Replace the provider credential fields and raw AI_MODELS_CONFIG JSON
textarea with a Models section mirroring the in-app model settings UI:
provider instance list with logos, credential fields per provider type,
model add/remove with suggestions, per-model connectivity test, and a
default-provider star.

On save the server derives everything the runtime needs into
settings.json: credential env vars (with _2 suffixes for multiple
instances of one provider), AI_MODELS_CONFIG, and AI_PROVIDER/AI_MODEL
for the default. Secrets round-trip as masked markers and are never
sent back to the browser. The general settings registry now only
covers non-provider settings (generation, access, features,
observability, quota).

app/api/admin/test-model/route.ts

@@ -0,0 +1,46 @@
+import { POST as validateModel } from "@/app/api/validate-model/route"
+import { checkAdminAuth } from "@/lib/admin/auth"
+import { loadAdminProviders } from "@/lib/admin/providers"
+
+export const runtime = "nodejs"
+export const dynamic = "force-dynamic"
+
+// Test a stored admin provider's model. The client only has masked
+// secrets, so credentials are filled in server-side from settings.json
+// and passed to the existing validate-model handler.
+export async function POST(req: Request) {
+    const authError = checkAdminAuth(req)
+    if (authError) return authError
+
+    let body: { providerId?: string; modelId?: string }
+    try {
+        body = await req.json()
+    } catch {
+        return Response.json({ error: "Invalid JSON body" }, { status: 400 })
+    }
+
+    const stored = loadAdminProviders().find((p) => p.id === body.providerId)
+    if (!stored || !body.modelId) {
+        return Response.json(
+            { valid: false, error: "Unknown provider or model" },
+            { status: 400 },
+        )
+    }
+
+    return validateModel(
+        new Request(new URL("/api/validate-model", req.url), {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                provider: stored.provider,
+                apiKey: stored.apiKey,
+                baseUrl: stored.baseUrl,
+                modelId: body.modelId,
+                awsAccessKeyId: stored.awsAccessKeyId,
+                awsSecretAccessKey: stored.awsSecretAccessKey,
+                awsRegion: stored.awsRegion,
+                vertexApiKey: stored.vertexApiKey,
+            }),
+        }),
+    )
+}