fix: stabilize model catalogs and selector availability

[eddieparc]

Summary

• preserve the complete Cursor CLI OAuth reasoning catalog across cache reloads, prefer stale real catalogs when refresh fails, and expand the offline catalog (including Grok fast ids)
• add /model catalog views for All, Favorites, By Model, and configured Narrowed scopes, with provider drill-down for duplicate model ids
• persist expiring access-denied marks so subscription- or policy-gated models disappear from the picker for 24 hours and recover immediately after a successful call

Why

The cached Cursor catalog was re-normalized from already-grouped ids, which discarded thinkingLevelMap and compat.cursorReasoning. As a result, Shift+Tab effort cycling stopped working after a cache load. When live probing failed, the minimal offline catalog also omitted model ids used by OmO defaults and favorites, producing No models match pattern startup warnings.

Separately, /model mixed equivalent models from different providers into one flat list and continued to show models that had deterministically failed with HTTP 403 or policy acknowledgement errors.

Validation

• bun run check
• bun run build
• focused Vitest coverage for Cursor catalogs, cache round-trips, callability persistence/classification, hard-error lifecycle, and model-selector views
• full packages/coding-agent Vitest suite
• Senpi QA channels: common harness self-check, TUI smoke, zero-token mock loop, CLI smoke, and Cursor OAuth catalog refresh
• real xterm.js-rendered TUI captures for All, Favorites, By Model, provider drill-down, and Escape return at 120 columns; no overflow or border misalignment
• local OmO beta.30 startup and --list-models smoke with the patched runtime

Behavioral details

• access-denied matching is conservative: HTTP 403, explicit forbidden/access-denied wording, policy acknowledgement, entitlement, and permission failures
• marks are stored under the agent directory, expire after 24 hours, and clear after a later successful call
• providers with a single copy of a model select directly in By Model; duplicate ids drill into provider-specific rows
• existing favorite ordering remains frozen for the duration of one selector session while favorite markers update live

---

Summary by cubic

Stabilizes Cursor model catalogs so reasoning metadata and real model lists survive reloads and failures, and makes /model hide models that deterministically fail until they recover.

• Cache round-trips preserve thinkingLevelMap and compat.cursorReasoning; stale real catalogs serve when refresh fails; the offline catalog now covers current Cursor families including Grok fast ids.
• /model cycles All, Favorites, By Model, and configured Narrowed views; equivalent ids across providers group into one row and drill into provider choices with Enter/Escape.
• Models that return deterministic access-denied errors (403, policy acknowledgement, entitlement, permission) are hidden for 24 hours and cleared on expiry or a later successful call.

^{Written for commit 9c8b633. Summary will update on new commits.}

[eddieparc]

All required checks are green after rerunning the unrelated flaky footer-data-provider polling shard (15 successful, 1 neutral/skipped). Local check/build, focused tests, Senpi QA channels, real OmO startup, and xterm-rendered model-selector QA are also complete. Ready for maintainer merge; the author account does not have upstream merge permission.