feat(lobe-chat): add the sec seats to the picker, drop two retired ones

Two independent gates kept the new `sec` family out of Lobe, and only one of
them was visible from the symptom.

The picker never auto-discovers. `OPENAI_MODEL_LIST=-all,+<names>` clears
Lobe's built-in OpenAI catalogue and re-adds one model per `+name`, so anything
added to LiteLLM stays invisible until this list is edited and the container
bounced. That pin is deliberate — an unpinned picker offers models that fail on
click — but it means the list rots in both directions, and it had:

- `sec` / `sec-reasoning` missing (hosted_vllm/mog-sec-27b{,-thinking} on
  ana-ml2:8019, added to config.yaml earlier today), and
- `char-rp-reasoning` / `char-rp-fable` still listed after being retired
  upstream, i.e. two picker entries that 400 on click. Verified: a call to
  char-rp-fable now returns 400 Bad Request.

The list is now curated to live, chat-capable, free-local seats — eleven, each
round-tripped through the container after the bounce. The paid family stays out
deliberately; that is now a picker decision rather than a key one.

Which is the other half of this commit: the `lobe-chat-esh` key is no longer
scoped to free local models. On the operator's instruction infra-ops swapped its
explicit array for the `all-proxy-models` access group, so it now reaches the
paid passthroughs with `max_budget: None`. The README documented the old posture
as current, which made it a security claim that was no longer true; it now
carries the change, what it costs, and the fact that the picker is the only
remaining gate.

stacks/lobe-chat/compose.yaml

@@ -69,7 +69,16 @@ services:
       - OPENAI_PROXY_URL=${OPENAI_PROXY_URL:-http://10.250.50.70:4000/v1}
       # Pin the visible model list so the picker shows fleet seats rather than
       # Lobe's built-in OpenAI catalogue (which would 404 against the gateway).
-      - OPENAI_MODEL_LIST=${OPENAI_MODEL_LIST:--all,+gen,+gen-reasoning,+char-rp,+char-rp-reasoning,+char-rp-fable,+summarizer,+summarizer-large,+classifier,+image-judge,+coder-fast,+chat-judge}
+      # ⚠️ THIS NEVER AUTO-DISCOVERS. `-all` clears Lobe's catalogue and each
+      # `+name` re-adds ONE model, so a seat added to LiteLLM stays invisible
+      # here until this list is edited and the container bounced. That is the
+      # price of the pin, paid deliberately: an unpinned picker offers models
+      # that fail on click. Two consequences to remember when editing:
+      #   - a RETIRED model left in this list becomes a visible entry that 400s
+      #     (char-rp-reasoning + char-rp-fable did exactly that until 2026-08-21)
+      #   - the list is curated to LIVE, CHAT-CAPABLE seats: no TTS, embedding or
+      #     reranker models (they cannot chat), and no paid passthroughs.
+      - OPENAI_MODEL_LIST=${OPENAI_MODEL_LIST:--all,+gen,+gen-reasoning,+char-rp,+summarizer,+summarizer-large,+classifier,+image-judge,+coder-fast,+chat-judge,+sec,+sec-reasoning}
       # SYSTEM AGENT — the background model Lobe uses for auto-naming
       # conversations (topic), history summarization, translation, query
       # rewrite, thread naming, and assistant-meta generation. ITS DEFAULT IS