refactor(openrouter): extract org model logic and use it in models API route

[kilo-code-bot]

Summary

Extracts the organization-aware model-listing logic (enterprise deny-list filtering, org-level BYOK, custom LLMs) from the `listAvailableModels` tRPC procedure into a shared helper `getAvailableModelsForOrganization` in `apps/web/src/lib/organizations/organization-models.ts`.

The `/api/openrouter/models` REST endpoint now uses this helper when the request includes an `x-kilocode-organizationid` header (i.e. `getUserFromAuth` returns an `organizationId`), so org members get the same filtered, org-aware model list through the REST API as they do via tRPC.

Changes:

• New file `organization-models.ts` encapsulates the shared logic (deny-list filtering, org BYOK, custom LLMs).
• `organization-settings-router.ts` `listAvailableModels` delegates to the new helper instead of duplicating the logic inline.
• `apps/web/src/app/api/openrouter/models/route.ts` calls the helper for org requests; falls back to the existing global model list + user BYOK path for non-org requests.
• Auth is fetched once at the top of the `GET` handler and reused, removing the internal `getUserFromAuth` call inside the BYOK helper.

Verification

• Ran pnpm typecheck — no errors.
• Reviewed that the tRPC `listAvailableModels` procedure behavior is unchanged (now delegates to the same helper).
• Confirmed the non-org fallback path in the REST route is identical to the previous behavior.

Visual Changes

N/A

Reviewer Notes

The extracted helper returns `null` when the organization is not found; the REST route falls back to the global list in that case (preserving the previous behavior), while the tRPC procedure still throws `NOT_FOUND` as before.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 files)

• apps/web/src/app/api/openrouter/models/route.ts

---

_{Reviewed by gpt-5.4-20260305 · 824,986 tokens}