## Why
The app server retains its startup model provider, but managed provider requirements can change while it is running. Catalog reads and background refreshes must check those requirements even when models are cached.
## What changed
- Gate `model/list` and background refreshes through a shared catalog that validates the startup provider against current requirements.
- Return JSON-RPC error `-32600` with restart guidance when the provider no longer complies, and skip background requests to that endpoint. Requirement load failures also block catalog access.
- Log only the error kind for blocked refreshes to avoid exposing credentials in parser diagnostics.
## Testing
Add coverage for cached catalog access after provider selection or definition changes, invalid requirements, cloud configuration load failures, and recovery when requirements allow the retained provider again. Extend refresh tests to cover startup provider overrides, blocked endpoint requests, and credential-safe logging.
GitOrigin-RevId: 03127bba46f1f59f2a8b1dc37391eab75f9be23c
alexsong-oai
75db67bbc6