chore(litellm): rename mog-sec aliases to sec / sec-reasoning

Operator's call: the pen-test seat is reached as `sec` (non-thinking) and
`sec-reasoning` (thinking). Backend and served-model-names (mog-sec-27b[-thinking]
on :8019) are unchanged; only the gateway alias name changes. Old mog-sec /
mog-sec-reasoning now 404.

stacks/litellm/conf/config.yaml

@@ -267,14 +267,14 @@ model_list:
   #     down, weights intact) if it is ever wanted back. Not repointed to mog-sec
   #     -- a security model is not an RP-reasoning model (no false aliases). ---
 
-  # --- mog-sec -> M.O.G.-SEC-27B pen-test seat (ana-ml2 GPU1 :8019, in the retired
+  # --- sec (was mog-sec, renamed 2026-08-21) -> M.O.G.-SEC-27B pen-test seat (ana-ml2 GPU1 :8019, in the retired
   #     fable slot). Blackfrost-Research/M.O.G.-SEC-27B-1M-CTX, stock-Qwen3.8-27B
   #     base, quantized in-house to mixed NVFP4+FP8 with MTP + vision preserved.
   #     Served at native 262K (NOT the card's 1M -- that needs YaRN + SGLang/DFlash2,
   #     not our vLLM path). presence_penalty deliberately 0.0, NOT the fleet's 1.5:
   #     this is a code/security tool and the anti-repetition penalty fights code
   #     structure (and upstream warns it can cause language mixing). Non-thinking. ---
-  - model_name: mog-sec
+  - model_name: sec
     litellm_params:
       model: hosted_vllm/mog-sec-27b
       api_base: http://10.250.50.54:8019/v1
@@ -290,10 +290,10 @@ model_list:
           enable_thinking: false
     model_info:
       mode: chat
-  # mog-sec-reasoning -> the SAME seat, thinking ON. Distinct served-name so a
+  # sec-reasoning -> the SAME seat, thinking ON. Distinct served-name so a
   #   thinking-off request can't mutate this deployment's enable_thinking (the
   #   shared-config clobber). Canonical Qwen3.8 thinking samplers (temp 1.0/top_p 0.95).
-  - model_name: mog-sec-reasoning
+  - model_name: sec-reasoning
     litellm_params:
       model: hosted_vllm/mog-sec-27b-thinking
       api_base: http://10.250.50.54:8019/v1