fix: harden model routing and request handling

[zyxtoworld]

Summary

• Discover models per active account and route requests only to the exact accounts that advertise the requested model.
• Refresh expiring access tokens before discovery, migrate cached capabilities across token rotation, retain stale capabilities on transient failures, and bound background refresh concurrency.
• Return a typed OpenAI-compatible 400 model_not_available error when no authenticated or anonymous route exists.
• Preserve caller message history instead of deleting duplicate or assistant messages during cache normalization; keep invalid-token fallback to the anonymous backend.
• Secure remote image loading with public-address validation on every redirect, DNS pinning, streaming byte limits, and credential rejection.
• Preserve the existing TLS contract: access-token and remote-image requests verify by default, OAuth/password/Sentinel keep their original per-flow behavior, and the explicit skip_ssl_verify setting remains authoritative.
• Add repeatable offline tests, deterministic Bun/Docker builds, PR CI, release test gates, and a container startup smoke test.

Validation

• python -m pytest -m "not live" -q: 160 passed, 18 deselected
• Focused TLS, proxy-runtime, and remote-image suite: 34 passed
• Focused model routing/error suite: 25 passed
• python -m compileall -q main.py api services utils test
• uv lock --check
• actionlint
• Bun 1.3.14 frozen install, Next.js production build, and TypeScript check
• Browser smoke test against an isolated local instance:
  • login and all seven shipped application routes rendered
  • skip_ssl_verify saved, survived reload, and was restored to its initial value
  • no browser console errors
• Earlier isolated real-account routing canary with refresh credentials removed:
  • two Free accounts advertised 7 models each; one Pro account advertised 19
  • Pro-only models were absent from Free capability sets
  • /v1/models returned the 23-model union
  • unknown model returned 400 / model_not_available
  • gpt-5-5-pro /v1/responses returned 200
  • /v1/chat/completions preserved duplicate user messages and assistant history
  • public image download succeeded; loopback, private redirect, and URL credentials were rejected

Remaining external limitation

The current WARP egress can list anonymous models, but the upstream anonymous conversation endpoint returns 403. Anonymous fallback behavior is covered offline; anonymous conversation success is not claimed by this PR.

[zyxtoworld]

Follow-up on the latest commit 740f6a1:

• Removed the require_tls_verification override because it bypassed the existing skip_ssl_verify configuration contract.
• Restored the project's original per-flow TLS behavior for OAuth, password login, and Sentinel requests.
• Access-token refresh and remote-image downloads still verify TLS by default, while an explicitly enabled skip_ssl_verify setting remains authoritative.
• Added regression coverage for token refresh, OAuth exchange, password login, Sentinel, proxy-runtime overrides, and remote-image sessions.

Validation on the updated branch:

• 160 passed, 18 deselected
• Focused TLS/proxy/image suite: 34 passed
• Next.js production build and TypeScript check passed
• Browser smoke test covered login, all seven application routes, and save/reload of the SSL setting with no console errors
• GitHub backend, frontend, and Docker checks all passed