fix: accept custom models the web picker already offers

[siddiqueirshad]

Why

With no web-UI allowlist and no OpenRouter key, GET /v1/surface-config still lists admin-registered custom models (from builtInModelCatalog()). Sending a turn on one of those models was refused: validateWebTurnModelOptions fell back to DEFAULT_WEBUI_MODEL_IDS, which never includes custom ids. postTurn maps that refusal to HTTP 403.

That is the documented custom-provider path. The picker and the gate disagreed.

Fixes #952

What

• Default web-UI model ids now include the live custom catalog, matching overlays.
• When no allowlist is configured, web-turn validation uses the same catalog as the picker (builtInModelCatalog, or the OpenRouter catalog when that key is present) instead of leaving the allowlist null.
• An explicit Governance allowlist still refuses custom models that are not on it.

Tests

• Unit: fallback allowlist includes a registered custom model; an explicit allowlist still refuses it.
• Integration: register a custom provider with no OpenRouter/OpenAI env key, confirm the picker lists it, a web turn queues, then an allowlist that omits it refuses with that model is not enabled for the web UI.
• Focused suites: test/turn-options.test.ts, test/custom-providers.test.ts, test/custom-provider-route.test.ts, test/model-registry.test.ts — 33 passed.

Made with Cursor

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}