Deleting or renaming a Model removes every APIKey that names it #5

Problem

An APIKey whose allowed_models names a Model that no longer exists fails the gateway's cross-reference check (filesource/mod.rs#L820-L843). Assemble falls back to the served entry, which names the same Model, so the APIKey ends up Rejected (assemble.go#L247).

Reproduce

APIKey team with allowed_models: [a, b], both Models served.

• Delete Model b: APIKey/team is Rejected (allowed_models entry references unknown model "b"), and the file serves no api_keys. The caller loses access to a as well.
• Rename b to b2: same result.

Keys using globs (*, openai/*) are unaffected.

Gateway precedent

aisix's etcd path keeps such a key working: rows are validated without cross-references (aisix-etcd/src/loader.rs#L318-L328), and a dangling entry grants nothing while the rest still apply (models/apikey.rs#L248-L260).

Impact

Retiring or renaming a model locks out every caller that lists it by exact name. Fails closed.

Scores

Scores are out of 10. Higher is worse for likelihood and severity. Higher is better for mitigations, detectability, test coverage and cost vs benefit (10 = cheap fix, high value).

Fix

• In Assemble, every round, drop allowed_models entries that name no non-Rejected Model, for Applied and Retained entries alike. allowed_models: [] loads and denies everything.
• Report it on the APIKey, for example ResolvedRefs=False with reason UnknownModel, while serving the pruned entry.
• Keep Model routing, ensemble and semantic targets as hard rejects.
• Keeping a deleted Model served instead is the wrong trade: it keeps the model reachable for every glob key.

Tests to add

Delete, rename, and all entries pruned to [].