## Why
Servers can advertise cyber access programs without accepting them for API-key accounts. The TUI must account for server support before exposing those programs.
## What changed
- Check `features.api_key_cyber_access_programs` at startup and when loading models for API-key accounts, clearing `available_access_programs` when forwarding is unavailable.
- Use thread-scoped feature settings after thread creation and honor feature requirements and CLI overrides at startup.
- Refresh account-scoped models when switching to or from API-key authentication or changing API-key thread context, clearing cached access programs while the refresh is pending.
## Testing
Extend session tests to cover enabled and disabled server settings, CLI overrides, and catalog filtering before and after thread creation. Update account-change tests to handle the model refresh.
GitOrigin-RevId: c80de30a0063b84949098d137715d8678bd70587