fix(models): hide unauthenticated providers

[bobbyunknown]

What

Gate model discovery so /v1/models, /v1/models/{kind}, and /v1/models/info only expose models from providers that the tenant has authenticated and can use.

Why

This is related to #32. The OpenCode plugin added there fetches models from /v1/models; without this backend filter, OpenCode sees many catalog models from providers that have no configured auth/account, causing unusable models to appear in the picker.

How

• Added provider gating based on tenant accounts.
• Excludes providers whose account is disabled or marked NeedsReconnect.
• Keeps tenant-owned chains visible.
• Deduplicates static and live-discovered model entries.
• Applies the same gate to model metadata lookup and returns 404 for unconnected providers to avoid leaking provider availability.
• Added gateway tests for connected providers, disabled/reconnect accounts, chains, kind-filtered discovery, and model info gating.

Verification

• go test ./backend/internal/gateway
• go test ./backend/...
• Live local check: only configured Mimo providers were returned from /v1/models; unconfigured anthropic, openai, and kiro model info probes returned 404.

[mydisha]

Thanks for the findings, merged to main @bobbyunknown 🔥