feat(lobe-chat): add the sec seats to the picker, drop two retired ones

Two independent gates kept the new `sec` family out of Lobe, and only one of
them was visible from the symptom.

The picker never auto-discovers. `OPENAI_MODEL_LIST=-all,+<names>` clears
Lobe's built-in OpenAI catalogue and re-adds one model per `+name`, so anything
added to LiteLLM stays invisible until this list is edited and the container
bounced. That pin is deliberate — an unpinned picker offers models that fail on
click — but it means the list rots in both directions, and it had:

- `sec` / `sec-reasoning` missing (hosted_vllm/mog-sec-27b{,-thinking} on
  ana-ml2:8019, added to config.yaml earlier today), and
- `char-rp-reasoning` / `char-rp-fable` still listed after being retired
  upstream, i.e. two picker entries that 400 on click. Verified: a call to
  char-rp-fable now returns 400 Bad Request.

The list is now curated to live, chat-capable, free-local seats — eleven, each
round-tripped through the container after the bounce. The paid family stays out
deliberately; that is now a picker decision rather than a key one.

Which is the other half of this commit: the `lobe-chat-esh` key is no longer
scoped to free local models. On the operator's instruction infra-ops swapped its
explicit array for the `all-proxy-models` access group, so it now reaches the
paid passthroughs with `max_budget: None`. The README documented the old posture
as current, which made it a security claim that was no longer true; it now
carries the change, what it costs, and the fact that the picker is the only
remaining gate.

stacks/lobe-chat/.env.example

@@ -10,3 +10,9 @@ ACCESS_CODE=
 KEY_VAULTS_SECRET=
 # System-agent background model routing (avoids the gpt-5-mini default 403ing on the scoped key)
 SYSTEM_AGENT=topic=openai/summarizer,translation=openai/gen,agentMeta=openai/gen,queryRewrite=openai/summarizer,historyCompress=openai/summarizer,thread=openai/summarizer
+# Picker contents. NEVER auto-discovered: -all clears Lobe's built-in OpenAI
+# catalogue, then each +name re-adds one, so a seat added to LiteLLM stays
+# invisible until it is listed here AND the container is bounced. Keep it to
+# LIVE, CHAT-CAPABLE models: a retired name left here becomes a picker entry
+# that 400s on click, and TTS/embedding/reranker seats cannot chat at all.
+OPENAI_MODEL_LIST=-all,+gen,+gen-reasoning,+char-rp,+summarizer,+summarizer-large,+classifier,+image-judge,+coder-fast,+chat-judge,+sec,+sec-reasoning