fix(routing): refuse un-prefixed passthrough model ids

[robmsmt]

Summary

Bare upstream ids like swiss-ai/Apertus-8B-Instruct-2509 were still silently routing to the first registered passthrough provider that advertised them (CSCS L1 today) — which provider won was an accident of registration order, and clients had no signal they were on a deprecated path beyond a server-side log.

This closes the deprecation window:

• resolve_model now returns None for un-prefixed ids, so they fall through to OpenTela and 404 under exactly the id the client sent — no silent rerouting, no cross-provider ambiguity.
• The log-only scan remains: a bare id that matches a provider's advertised set logs Refusing un-prefixed passthrough model id ...; use CSCS-Inference/... so operators can chase unmigrated clients.
• Prefixed ids (CSCS-Inference/..., RCP-AIaaS/...) and the platform namespace (SwissAI-Research/...) are unchanged.

Client impact

Anyone still calling with a bare id (e.g. the historical swiss-ai/Apertus-* curl) will now get a 404 and must switch to the prefixed id, e.g. CSCS-Inference/swiss-ai/Apertus-8B-Instruct-2509. These ids have been advertised via /v1/models since the prefix registry landed.

Tests

• test_bare_upstream_id_does_not_route — bare id resolves to None and logs the migration target.
• test_same_upstream_id_on_two_providers_lists_two_rows — same model on CSCS + RCP stays individually routable; the bare id routes to neither.
• Full suite: 127 passed.

🤖 Generated with Claude Code

[robmsmt]

Superseded by #127, which enforces the canonical 3-segment id shape at the request boundary for all model-forwarding endpoints (and removes the same back-compat loop this PR touched).