fix(core,cli): avoid provider fallback on auth refresh

[liqiongyu]

TLDR

• Fixes same-authType auth refresh picking the first modelProviders model when the configured model.name is not registry-backed.
• Tightens env authType inference: only infer gemini/vertex/anthropic when required vars are present.

Dive Deeper

ModelsConfig.syncAfterAuthRefresh() previously fell back to ModelRegistry.getDefaultModelForAuthType() whenever the current modelId wasn’t in the registry, even if authType hadn’t changed. With settings.modelProviders configured, this meant “first provider model wins”, overriding explicit raw settings.model.name values and, in /auth flows, could effectively drop settings.model.generationConfig for the session.

This PR limits that fallback to auth-type switches (and keeps qwen-oauth strict), and preserves raw model IDs for same-authType refresh.

For env inference, getAuthTypeFromEnv() previously inferred from *_API_KEY alone (e.g. GEMINI_API_KEY), which then produced confusing “missing model env var” errors. This PR requires the corresponding *_MODEL (and for anthropic, base URL) before inferring.

Reviewer Test Plan

1. Run npx vitest packages/core/src/models/modelsConfig.test.ts packages/cli/src/utils/modelConfigUtils.test.ts.
2. Optional manual sanity check:
   • Configure at least one OpenAI provider model in settings.modelProviders.openai.
   • Set security.auth.selectedType = "openai" and set model.name to a raw model id that is not in modelProviders.
   • Start qwen and verify it does not switch to the first provider model during auth refresh.

Testing Matrix

	🍏	🪟	🐧
npm run	✅	❓	❓
npx	✅	❓	❓
Docker	❓	❓	❓
Podman	❓	-	-
Seatbelt	❓	-	-

Linked issues / bugs

Fixes #1506

[Mingholy]

#1510 is trying to resolve the issue and other relevant issues.

[liqiongyu]

Closing to avoid duplication: #1510 is already addressing the auth refresh / generationConfig preservation work around #1506 (with a more complete refactor). Also, this PR accidentally includes the MCP @server: resource expansion commit, which is tracked separately in #1531 (fixes #1511). I'll continue follow-ups in #1510/#1531. Sorry for the noise.