feat(models): secure catalog and pin model versions

frontend/src/app/api/models/route.ts

@@ -1,6 +1,6 @@
 import { NextResponse } from "next/server";
 import { createServerSupabaseClient } from "@/lib/supabase/server";
-import { publicLanguageModelCatalog } from "@/mastra/model";
+import { loadLanguageModelCatalog } from "@/lib/model-catalog";
 
 export const runtime = "nodejs";
 
@@ -26,7 +26,11 @@ export async function GET() {
     );
   }
 
-  const catalog = publicLanguageModelCatalog();
+  const resolved = await loadLanguageModelCatalog();
+  const catalog = {
+    models: resolved.publicModels,
+    defaultModelId: resolved.defaultModelId,
+  };
   if (!catalog.defaultModelId || catalog.models.length === 0) {
     return NextResponse.json(
       { error: "模型服务尚未配置", message: "当前没有可用的咨询模型。" },