feat(pi): fetch and refresh upstream model lists, searchable model picker

- POST /pi/upstreams/{id}/models/refresh calls the provider's model list
  endpoint (OpenAI-shaped /models, Anthropic /v1/models, Google
  /v1beta/models, OpenRouter /api/v1/models; Radius via pi-ai refresh),
  normalizes {id, displayName, contextWindow, supportsVision,
  supportsTools, pricing} and stores it in pi_upstream.models (0044)
- GET .../models returns {source, fetchedAt, models[]}: remote merged
  with the static catalog (remote first); failures (401/network/
  unsupported) fall back to static with a one-line error
- POST /pi/models/probe for trying credentials before creating
- wizard and edit drawer: fetch button, searchable dropdown with
  vision/tool tags, manual id, source line; default upstream needs a model
- tests: mock /models, 401, network failure; smoke step; runbook

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/src/api.ts

@@ -1792,10 +1792,28 @@ export const Api = {
       method: "get",
       path: "/pi/upstreams/{id}/models",
       scope: "admin",
-      summary: "上游可用模型（静态目录；Radius 先动态刷新）",
+      summary: "上游模型列表：已获取过远程列表时返回远程与静态目录的合并（远程优先），否则静态目录",
       params: IdParam,
       response: pi.PiUpstreamModels,
     }),
+    modelsRefresh: ep({
+      method: "post",
+      path: "/pi/upstreams/{id}/models/refresh",
+      scope: "admin",
+      auth: "session",
+      summary: "获取模型列表：用该上游的凭证调 provider 的模型列表接口并存库；失败或不支持时回静态目录并给出原因",
+      params: IdParam,
+      response: pi.PiUpstreamModels,
+    }),
+    modelsProbe: ep({
+      method: "post",
+      path: "/pi/models/probe",
+      scope: "admin",
+      auth: "session",
+      summary: "新建上游前试拉模型列表（凭证只用于这一次请求，不落库）",
+      body: pi.PiModelsProbeRequest,
+      response: pi.PiUpstreamModels,
+    }),
     oauthStart: ep({
       method: "post",
       path: "/pi/upstreams/{id}/oauth/start",