refactor: drop request-body token override, keep env-only config

The unauthenticated /api/validate-model endpoint should not let callers
raise the token budget; the env var / admin setting alone fixes #883.
Also import the shared constants in the settings registry instead of
duplicating them, and move the setting to the Features group alongside
the other validation settings.

app/api/validate-model/route.ts

@@ -32,9 +32,6 @@ interface ValidateRequest {
     awsRegion?: string
     // Vertex AI specific
     vertexApiKey?: string // Express Mode API key
-    // Optional test token budget override
-    maxTokens?: number
-    max_tokens?: number
 }
 
 export async function POST(req: Request) {
@@ -52,8 +49,6 @@ export async function POST(req: Request) {
             vertexApiKey,
         } = body
         const validationMaxTokens = resolveModelValidationMaxTokens(
-            body.maxTokens,
-            body.max_tokens,
             process.env.MODEL_VALIDATION_MAX_TOKENS,
         )