fix: listmodels to always honor restricted models

fix: restrictions should resolve canonical names for openrouter
fix: tools now correctly return restricted list by presenting model names in schema
fix: tests updated to ensure these manage their expected env vars properly
perf: cache model alias resolution to avoid repeated checks

providers/registry.py

@@ -205,6 +205,18 @@ class ModelProviderRegistry:
                 logging.warning("Provider %s does not implement list_models", provider_type)
                 continue
 
+            if restriction_service and restriction_service.has_restrictions(provider_type):
+                restricted_display = cls._collect_restricted_display_names(
+                    provider,
+                    provider_type,
+                    available,
+                    restriction_service,
+                )
+                if restricted_display:
+                    for model_name in restricted_display:
+                        models[model_name] = provider_type
+                    continue
+
             for model_name in available:
                 # =====================================================================================
                 # CRITICAL: Prevent double restriction filtering (Fixed Issue #98)
@@ -227,6 +239,50 @@ class ModelProviderRegistry:
 
         return models
 
+    @classmethod
+    def _collect_restricted_display_names(
+        cls,
+        provider: ModelProvider,
+        provider_type: ProviderType,
+        available: list[str],
+        restriction_service,
+    ) -> list[str] | None:
+        """Derive the human-facing model list when restrictions are active."""
+
+        allowed_models = restriction_service.get_allowed_models(provider_type)
+        if not allowed_models:
+            return None
+
+        allowed_details: list[tuple[str, int]] = []
+
+        for model_name in sorted(allowed_models):
+            try:
+                capabilities = provider.get_capabilities(model_name)
+            except (AttributeError, ValueError):
+                continue
+
+            try:
+                rank = capabilities.get_effective_capability_rank()
+                rank_value = float(rank)
+            except (AttributeError, TypeError, ValueError):
+                rank_value = 0.0
+
+            allowed_details.append((model_name, rank_value))
+
+        if allowed_details:
+            allowed_details.sort(key=lambda item: (-item[1], item[0]))
+            return [name for name, _ in allowed_details]
+
+        # Fallback: intersect the allowlist with the provider-advertised names.
+        available_lookup = {name.lower(): name for name in available}
+        display_names: list[str] = []
+        for model_name in sorted(allowed_models):
+            lowered = model_name.lower()
+            if lowered in available_lookup:
+                display_names.append(available_lookup[lowered])
+
+        return display_names
+
     @classmethod
     def get_available_model_names(cls, provider_type: Optional[ProviderType] = None) -> list[str]:
         """Get list of available model names, optionally filtered by provider.