[Bug]: Creating a provider from a disabled template is not blocked

[npamudika]

Please select the area the issue is related to

Area/Management (Management API or Management Portal UI)

Please select the aspect the issue is related to

Aspect/API (API backends, definitions, contracts, interfaces, OpenAPI)

Description

A template disabled via PATCH (enabled: false) still allows new LLM providers to be created referencing it. Disabling a template has no enforcement effect on the create-provider path — only the in-use check for further disabling is enforced.

Steps to Reproduce

Step 1: Disable a built-in template that has no providers (e.g. mistralai)

curl -sk -X PATCH 'https://localhost:9243/api/v0.9/llm-provider-templates/mistralai' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"enabled": false}'

Returns 200, enabled: false

Step 2: Create a new provider using the disabled template

curl -sk -X POST 'https://localhost:9243/api/v0.9/llm-providers' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{
    "id": "test-disabled-template-provider",
    "displayName": "Test Provider",
    "version": "v1.0",
    "context": "/test",
    "template": "mistralai",
    "upstream": {"main": {"url": "https://api.mistral.ai"}},
    "accessControl": {"mode": "allow_all", "exceptions": []}
  }'

Returns 201 — provider created successfully

Step 3: Re-enable and clean up

curl -sk -X PATCH 'https://localhost:9243/api/v0.9/llm-provider-templates/mistralai' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"enabled": true}'

curl -sk -X DELETE 'https://localhost:9243/api/v0.9/llm-providers/test-disabled-template-provider' \
  -H 'Authorization: Bearer <token>'

Severity Level of the Issue

Severity/Major (Important functionality is broken. Should be prioritized. Doesn't need immediate attention)

Environment Details (with versions)

No response