fix: support custom providers across production web surfaces

[toller892]

Summary

• wire the custom-provider store and refresh hook into the production core server
• preserve /admin subpath routing when the admin UI is served through the portal
• include registered custom models in the web model picker and accept active custom models in web turns
• count an enabled custom provider with a stored key as a configured model provider in /v1/surface-config, so non-admin users are not blocked by the portal onboarding gate

Problem

An admin could successfully register and use an OpenAI-compatible custom provider locally, but a production portal deployment still had several broken handoffs: the core server omitted custom-provider dependencies, the admin proxy lost its subpath, the web picker/turn validator only accepted built-ins, and the portal readiness probe only counted built-in managed keys. The last issue allowed admins with personal overrides to work while ordinary members saw “This deployment isn't set up yet.”

Tests

node --experimental-test-module-mocks --test \
  test/custom-provider-route.test.ts \
  test/model-credential-route.test.ts \
  test/public-architecture-docs.test.ts \
  test/turn-options.test.ts

27 tests passed.

Also validated on a production-style single-host deployment with PostgreSQL, the portal/auth/admin/web processes, and the local Docker sandbox:

• admin custom-provider registration and catalog hydration
• ordinary-member portal access
• organization default/picker selection for the custom model
• a real member-scoped model turn returning successfully

Screenshots

Pending a clean post-fix capture from the live portal; opening as a draft until that is attached.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}