fix: inject synthetic key on /api/models to prevent nil dereference

backend/internal/api/api.go

@@ -91,7 +91,7 @@ func (a *API) Mount(r chi.Router) {
 		r.Get("/api/me", a.apiMe)
 		// Dashboard test chat — OIDC auth, synthetic allow-all key injected.
 		r.With(a.dashboardKeyAuth).Post("/api/chat/completions", a.chatCompletions)
-		r.Get("/api/models", a.listModels)
+		r.With(a.dashboardKeyAuth).Get("/api/models", a.listModels)
 
 		r.Route("/api/admin", func(r chi.Router) {
 			// Keys and logs are user-scoped (admins see all via nil filter).