Add per-key model blacklist

[mylukin]

Summary

• add blocked_models to API key schema, stores, migrations, and admin key forms
• enforce blocked concrete models before direct execution and strip them from lane/alias/fallback chains
• hide blocked aliases and empty lanes from /v1/models, and cover chat/messages/images/interactions/replay paths

Validation

• pnpm exec vitest run packages/core/src/routing/route-request.test.ts apps/gateway/src/routes/messages-pipeline.test.ts apps/gateway/src/routes/admin/replay.test.ts
• pnpm exec vitest run packages/core/src/store/postgres/migrate.test.ts
• pnpm test
• pnpm typecheck
• pnpm lint
• pnpm build
• git diff --check

Co-Authored-By: Codex noreply@openai.com