web: model discovery gives no feedback for a wrong/unsupported API key

Follow-up from PR #6578 (QwenCloud provider).

Model discovery swallows authentication failures into an empty model list (list_models_for_api catch-all → [] → 200 with <provider>_models: []). The user can't distinguish "wrong key", "unsupported key type", and "no key" — the dropdown just says "No models available. Type to enter a custom model name."

Two concrete sub-cases from the QwenCloud review:

• Invalid key: silent empty dropdown; the log only says "Could not list models from QwenCloud".
• Token Plan keys (sk-sp-): QwenCloud issues these from the same portal but they auth against a different endpoint; a user with one gets an empty list plus a generic 401 at research time. The research-page help text documents the constraint, but a prefix check at entry ("this looks like a Token Plan key — pay-as-you-go sk-ws- keys are supported") would prevent the confusion.

Suggested: return a per-provider discovery_status (ok / no-key / auth-failed) from the available-models route and surface it as an inline hint next to the model dropdown; optionally add key-format hints per provider.