Environment-level hidden models per provider instance (so mobile and every client respect them)

[shwig1]

Problem

Hiding a model is a per-client preference today: providerModelPreferences[instanceId].hiddenModels lives in client settings and is applied in apps/web/src/modelSelection.ts. The server still sends every model to every client, and the mobile app does not read hidden models at all. So there is no way to hide a model for an environment as a whole. #9350 asked for this on mobile and was closed with a pointer here.

This matters when a provider instance can only actually use some models. Our team routes Claude and Codex through a shared gateway (via the instance's ANTHROPIC_BASE_URL / Codex home), and the gateway refuses certain models for certain people. T3 still lists those models on every client. Someone picks one and the turn fails with a gateway error. On desktop we work around it by having a script write client-settings.json. That only takes effect after a reload, and nothing can reach the phone or a browser client.

Proposal (small, opt-in)

Add an optional hiddenModels: string[] to a provider instance's server settings (settings.json → providerInstances.<id>). The server applies it when it builds that instance's model list (around providerModelsFromSettings in apps/server/src/provider/providerSnapshot.ts), so every client — desktop, browser and mobile — receives the filtered list.

• The default is empty, so nothing changes for existing setups.
• Per-client hides keep working as they do now, on top of the server list.
• settings.json already hot-reloads, so an external tool can update the list without a restart.

Questions for maintainers

1. Should this live in the instance config, or in a top-level map keyed by instance id?
2. How should a thread that has already selected a now-hidden model behave? Keep it as is (like an unavailable selection today), or flag it?
3. settings.json only, or also a control in the provider settings UI?

If the direction and scope are acceptable, I'm happy to send a focused PR with tests covering the server snapshot and all three client types.

Environment: observed on T3 Code 0.0.42 (macOS and Linux desktop, iOS app); code references checked against main at 54084ae.