refactor(model-routing): centralize explicit foreground fallback policy (#6020)

* refactor(model-routing): centralize explicit foreground fallback policy

Make foreground fallback an explicit per-user, availability-only policy shared by streaming Chat, non-stream Chat, and Agent runs.

Preserve strict defaults, owner/model and credential boundaries, pinned Agent routes, and truthful per-round provenance/accounting. Carry provider-reported model identifiers through native streaming adapters, non-stream responses, and caches, and keep legacy default_model_fallbacks as tombstoned raw storage that generic settings APIs and agent tools cannot expose or mutate.

* fix(agent-loop): restore rebase-dropped qwen routing, workspace prompt, and temperature clamp

* fix(model-routing): thread selected endpoint identity, fix cost classification and fallback eligibility

* fix(chat): restore stream helpers and harden run stop lifecycle

* fix(model-routing): let numeric provider codes win over symbolic rate-limit statuses

* fix(agent-loop): apply qwen temperature and notes-tool clamps per fallback candidate

* fix(chat): honor queued stop across resend and reload canonical terminal on EOF

* fix(chat): track stop queue and cleanup ownership by per-send generation

* fix(agent-loop): preserve requested temperature for non-qwen fallback candidates

* fix(chat): reserve send ownership before any await and scope stop to the current send

* fix(chat): clear the previous run identity at send reservation

---------

Co-authored-by: RaresKeY <158580472+RaresKeY@users.noreply.github.com>
Co-authored-by: StressTestor <212606152+StressTestor@users.noreply.github.com>

tests/test_resolve_session_auth_chatgpt.py

@@ -163,53 +163,3 @@ def test_chatgpt_subscription_clears_previously_persisted_bearer(monkeypatch):
         )
     finally:
         db.close()
-
-
-def test_chatgpt_subscription_fallback_auth_is_not_written_to_sessions_table(monkeypatch):
-    """Fallback endpoint selection must keep the resolved bearer request-local."""
-    TestSessionLocal = _mem_db(monkeypatch)
-    db = TestSessionLocal()
-    try:
-        db.add(ModelEndpoint(
-            id="ep1", name="ChatGPT Subscription", base_url=_CODEX_BASE,
-            provider_auth_id="auth1", owner="alice", is_enabled=True, api_key=None,
-            cached_models='["gpt-5.1-codex"]',
-        ))
-        db.add(DbSession(
-            id="sess1", name="chat", endpoint_url="https://old.example/v1",
-            model="old-model", owner="alice", headers={},
-        ))
-        db.commit()
-    finally:
-        db.close()
-
-    monkeypatch.setattr(
-        endpoint_resolver,
-        "resolve_endpoint_runtime",
-        lambda ep, owner=None: (_CODEX_BASE, "live-access-token"),
-    )
-
-    sess = types.SimpleNamespace(
-        id="sess1", endpoint_url="https://old.example/v1", model="old-model",
-        owner="alice", headers={},
-    )
-    result = chat_helpers.try_fallback_endpoint(sess, "sess1")
-
-    assert result == {
-        "model": "gpt-5.1-codex",
-        "endpoint_url": _CODEX_BASE + "/responses",
-        "endpoint_name": "ChatGPT Subscription",
-    }
-    assert sess.headers["Authorization"] == "Bearer live-access-token"
-
-    db = TestSessionLocal()
-    try:
-        row = db.query(DbSession).filter(DbSession.id == "sess1").first()
-        assert row.model == "gpt-5.1-codex"
-        assert row.endpoint_url == _CODEX_BASE + "/responses"
-        stored = row.headers or {}
-        assert not any(k.lower() == "authorization" for k in stored), (
-            f"ChatGPT fallback bearer leaked into sessions table: {stored}"
-        )
-    finally:
-        db.close()