Dashboard: provider shows Ready and models save, but Models tab empty when API key not resolvable

Summary

After configuring OpenRouter via the web dashboard (Add Provider → enter API key → enable models → Save), the provider card shows Ready and models are persisted in config.yaml, but they do not appear on the Models tab.

Environment

• macOS
• Abbenay v0.0.0-dev (local build from source)
• Dashboard: http://127.0.0.1:8787

Steps to reproduce

1. aby start (or node packages/daemon/dist/daemon/index.js start)
2. Dashboard → Providers → Add Provider → OpenRouter
3. Enter API key, discover models, enable 2 models, Save
4. Open Models tab → only local providers shown; OpenRouter models missing

Expected

• Models appear on Models tab after save, OR
• Clear warning if credentials are not resolvable (e.g. "Key missing — set OPENROUTER_API_KEY or store in keychain")

Actual

• Provider card shows Ready
• config.yaml contains enabled models under providers.openrouter.models
• /api/providers returns "configured": false for openrouter
• /api/models omits openrouter models entirely

Root cause (observed)

Config saved with credential source the daemon cannot resolve at runtime, e.g.:

openrouter:
  secret_store: env
  secret_name: OPENROUTER_API_KEY

without OPENROUTER_API_KEY exported in the daemon process.

Dashboard status (getProviderStatus) treats presence of api_key_keychain_name / api_key_env_var_name as "configured", but CoreState.resolveApiKey() returns null → listModels() skips the provider.

Suggested improvements

• Align dashboard status with daemon configured (call /api/providers or verify key after save)
• After wizard Save, validate credential resolution; block success or show explicit error
• Models tab: show disabled models with reason ("API key missing") instead of hiding them
• Don't silently swallow failures in wizardSave() when POST /api/secrets/... fails
• Env mode: warn that the var must be set before daemon start

Workaround

Re-edit provider → Keychain mode + re-enter key, OR: export OPENROUTER_API_KEY=... then restart daemon from that shell.

Start with dashboard getProviderStatus and wizardSave(), then trace /api/providers and /api/models through CoreState.resolveApiKey() and listModels(). Reproduce the env-mode case with the daemon started without OPENROUTER_API_KEY. Done means credential status and model visibility agree, and an unresolved key produces an explicit warning or error instead of silently hiding models.