Release b657

fix(models): resolve per-backend api_key for upstream /v1/models

Client Authorization/x-api-key now takes precedence, with each backend's
configured api_key as fallback, so authenticated upstreams work when the
client sends no credential.

The /v1/models cache key is now derived from the effective per-backend key
set instead of the raw client credential, preventing different upstream
credentials from sharing a cached list.