fix: Model-router unauthenticated `GET /v1/models` leaks route metadata

[patil2001]

Summary

:833-844 returns ods.routedModel, backend, routeSeq with no auth.

Impact: Production user/operator failure on Osmantic/ODS main

Files:

• model-router/app/main.py
• manifest.yaml
• network policy
• tests

Repro

On a production-like Osmantic/ODS main checkout:

1. Hit the failure mode described in Summary (severity: Medium).
2. Observe the broken behavior / incorrect exit / missing guard from the root cause above.
3. Confirm no overlapping open PR (dedup: Distinct from network-exposure-policy: auth_required is never enforced, and internal-only services are outside its scope #2718 (policy framework).).

Fix

Implement a minimal, distro-/path-correct fix in the listed files (no scope creep).

• Address the root cause directly (do not paper over with || true / broad catches).
• Prefer resolving runtime values from the environment/repo (like apt-cache madison) over hardcoding distro-specific version strings when the same bug class applies.
• Add a regression test under ods/tests/ (or matching suite) that fails without the fix and passes with it.

Context

Filed from Desktop issues.md entry #26 via one-click scout pipeline.
Rationale: Unfiled Desktop issues.md #26 (no GitHub issue yet)