Fix custom no-auth model providers / 修复自定义免密模型接入

[GTC2080]

Problem

Fixes #4612.

Custom OpenAI-compatible providers could disappear from the desktop model switcher when they were configured as local/no-auth gateways. A common Settings path made this worse by auto-populating an api_key_env name even when the user did not save a key, so the provider looked keyless to the backend and the chat dropdown filtered out every model.

This also made /models discovery unusable for no-auth local gateways, because the fetch path required a key before attempting the request.

Root Cause

ProviderEntry.Configured() treated every provider as unavailable unless api_key_env resolved to a non-empty value. That was correct for official hosted providers, but too strict for local or private OpenAI-compatible gateways that intentionally do not require authentication.

The frontend provider editor also used the generated env-var placeholder as a saved value. For a custom provider with manually entered models and no key, saving through Settings persisted an env var such as LOCAL_API_KEY without a credential, which made the backend hide the provider on reload.

Fix

• Allow explicitly no-auth providers to be selected when api_key_env is blank.
• Allow loopback/private OpenAI-compatible endpoints to remain selectable even when a legacy/generated key env is present but unset.
• Keep official hosted endpoints such as DeepSeek, MiMo, MiniMax, and OpenAI behind the existing key requirement.
• Stop saving a generated api_key_env for custom providers unless the user actually supplies a key or an explicit env var.
• Allow no-auth /models discovery and omit empty Authorization headers for model fetches and chat requests.
• Add regression coverage for custom multi-model providers without context_window/price metadata, no-auth providers, loopback providers with missing key envs, and Settings key-env persistence.

Cache impact

None. This changes provider availability, credential handling, and request headers only when no API key is configured. It does not change prompts, tool schemas, model request bodies, compaction content, or cache-sensitive prefixes.

Verification

• go test ./internal/config -run 'TestProviderConfigured|TestValidateAllowsNoAuthProvider|TestProviderFetchModels' -count=1
• cd desktop && go test ./... -run 'TestModelsForTabLists(CustomMultiModelProviderWithoutMetadata|KeylessCustomMultiModelProvider|LoopbackCustomProviderWithMissingKeyEnv)' -count=1
• cd desktop/frontend && corepack pnpm exec tsx src/__tests__/provider-model-refresh.test.ts
• go test ./...
• cd desktop && go test ./...
• cd desktop/frontend && corepack pnpm run test:all
• cd desktop/frontend && corepack pnpm run build
• go vet ./...
• cd desktop && go vet ./...
• gofmt -l .
• git diff --check