[P1][Plan 5] SF-021 — Prevent misleading ready states for owner-only model routes

[Ankit6149]

Confirmed problem

The client can mark custom, Ollama, or LM Studio routes ready when a base URL is present, but the server restricts these routes to owner sessions. A non-owner can see Ready, click Test, and only then receive authorization failure.

Scope

• Make provider readiness include current session permissions, deployment type, endpoint reachability, and server capability.
• Return route availability from one authoritative server contract.
• Hide or clearly disable owner-only/local routes for public non-owner sessions.
• Keep readiness and test-connection behavior consistent.

Acceptance criteria

• No route is shown as ready when the current session cannot execute it.
• Owner-only routes are visible only when useful and authorized.
• Hosted deployments do not advertise localhost endpoints as reachable.
• Readiness reasons are explicit and actionable.
• UI, provider-status API, generation API, and MCP agree.

Required verification

• Matrix tests for owner/non-owner, local/hosted, reachable/unreachable, server key/temporary key.
• UI regression test for misleading Ready state.
• Authorization and provider test integration tests.