Fix provider API-key visibility and GPT-5.6 discovery

[ranade-oss]

What changed

• Keep the Anthropic, Gemini, and OpenAI credential fields mounted after the asynchronous model catalog loads.
• Continue showing OpenRouter only for self-hosted deployments.
• Preserve catalog governance for expanded providers such as xAI and Moonshot.
• Recognize OpenAI's public gpt-5.6 alias when /v1/models lists the underlying gpt-5.6-sol identifier.
• Add regression coverage for both credential-field stability and alias-aware model discovery.

Root causes

Credential fields

The API-key page initially rendered a fallback provider set containing Anthropic, Gemini, and OpenAI. After useModelCatalog() returned, the page filtered those fields through approvedProviders. On the hosted beta, that response currently narrows to OpenAI, so the Anthropic and Gemini inputs appeared briefly and then disappeared.

GPT-5.6 availability

ROSS's compatibility registry correctly contains gpt-5.6, but live discovery required /v1/models to return that exact string. OpenAI documents gpt-5.6 as an alias for gpt-5.6-sol; when the project lists the underlying model identifier, ROSS incorrectly marked the alias unavailable.

User impact

• Users can consistently enter personal Anthropic, Gemini, or OpenAI keys.
• GPT-5.6 becomes selectable when the configured OpenAI project exposes either gpt-5.6 or gpt-5.6-sol.
• Environment-provided keys remain disabled and identified by the existing server-configuration state.
• No key values, encryption behavior, request authentication, backend credential storage, or provider approval rules are changed.

Risk and review

This PR touches the provider-credential interface and backend model-availability logic. It remains intentionally draft pending human review. Exact-head Baseline verification is required after it is marked ready.

Validation

• Source diff is limited to the API-key page, model-discovery logic, and one baseline regression test.
• The regression rejects catalog-based removal of the three core credential inputs.
• The regression requires alias-aware GPT-5.6 discovery and rejects literal-only availability checks.
• Full exact-head Baseline remains pending.