#19994: fix(model-picker): filter models by auth when no allowlist configured [AI-assisted]

## Summary Fixes issue #4349: The TUI model picker was showing all 600+ models instead of only showing models from providers that the user has authenticated with. ## What & Why When no explicit model allowlist is configured (`allowAny = true`), the model picker now filters the catalog to only show models from providers that have authentication configured. This significantly improves the UX for users who only have a few providers set up. The default provider's models are always included in the filtered results to ensure users can still select the default model. ## Changes - Added auth-based filtering in `promptDefaultModel()` when `allowAny` is true - Filter keeps: (1) models from authed providers, (2) the default provider's models - Reused `hasAuth` checker to avoid creating multiple instances - Added `includeUnauthenticated` param to allow users to bypass the filter and see all models - Added try/catch around auth check to handle failures gracefully ## Testing - Lightly tested: Code compiles, logic follows existing patterns in the codebase - Manual testing would be needed to verify the full UX flow ## AI-assisted This PR was written with AI assistance (OpenClaw, minimax m2.5 model). --- - [x] Mark as AI-assisted in the PR title or description - [x] Note the degree of testing (lightly tested) - [x] Confirm you understand what the code does