fix: gate Model Prefs picker behind BYOK access (v0.73.1)

Settings -> AI's model-selection form (per-use-case provider + model
ID picker) had no access gate -- every user could see and use it,
regardless of whether they had a BYOK key to route calls to or any
reason to care which model served a request. Now gated behind
isByokEnabled, same reasoning as BYOK itself: picking a specific
provider/model only makes sense once you have your own key. Hidden
entirely for everyone else, not locked-and-teased -- there's nothing
for a non-BYOK user to unlock here.

GET/PUT /api/v1/users/me/model-prefs switched from requireSession to
requireByok to match.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/(app)/settings/ai/page.tsx

@@ -88,15 +88,17 @@ export default async function AiSettingsPage() {
         )}
       </section>
 
-      <section className="rounded-xl border p-6 space-y-4">
-        <div>
-          <h2 className="font-semibold text-lg">{m.settings.modelPrefs.title}</h2>
-          <p className="text-sm text-muted-foreground mt-1">
-            {m.settings.modelPrefs.description}
-          </p>
-        </div>
-        <ModelPrefsForm initialPrefs={modelPrefs ?? null} />
-      </section>
+      {dbUser?.isByokEnabled && (
+        <section className="rounded-xl border p-6 space-y-4">
+          <div>
+            <h2 className="font-semibold text-lg">{m.settings.modelPrefs.title}</h2>
+            <p className="text-sm text-muted-foreground mt-1">
+              {m.settings.modelPrefs.description}
+            </p>
+          </div>
+          <ModelPrefsForm initialPrefs={modelPrefs ?? null} />
+        </section>
+      )}
     </div>
   );
 }