feat(admin): expose group provider/model access

GET /admin/api/usage's group rows now carry the group's configured
Providers/Models/MCPServers/Agents (GroupConfig, llmgateway.go), echoed
exactly as configured -- never resolved/expanded to the full catalog
server-side. Empty/unset stays omitted (omitempty), matching
GroupConfig's own JSON convention and group.allowsX's empty-means-all
semantics (auth.go): the dashboard can tell 'restricted to these N' apart
from 'unrestricted' without the payload growing with catalog size.

groupSummary (auth.go) gains providers/models/mcpServers/agents, carried
through from authStore.snapshot unchanged. adminUsageEntryView (admin.go)
gains the matching JSON fields, populated only for group entries -- a
user or the total scope row never carries them, mirroring GroupName's
own user-only convention.

The Usage view's group accordion (webui/UsageView.vue) renders an Access
block above the existing stat grid: Badge chips for explicit providers,
ModelChip for explicit models (both shadcn/existing components, no
hand-rolled chips), or muted 'All providers'/'All models' text when
unrestricted. Display-only this round -- not wired into the user/group
search filter. types/api.ts's AdminUsageEntryView mirrors the new
optional fields.

Tests: admin_test.go's new table-driven TestAdminUsage_GroupAccessLists
covers a restricted group's exact lists, an unrestricted group's
empty/omitted lists, and that a user/total row never carries them.

webui/src/types/api.ts

@@ -67,6 +67,19 @@ export interface AdminUsageEntryView {
   kind: string
   id: string
   groupName?: string
+  /**
+   * The group's configured access lists (admin.go: adminUsageEntryView's
+   * Providers/Models/MCPServers/Agents) — set only on a group entry (kind
+   * === 'group'), never on a user or the total entry, mirroring groupName's
+   * own user-only convention above. Undefined/empty means unrestricted
+   * (GroupConfig's own empty-means-all semantics, llmgateway.go) — this is
+   * the group's configured glob list exactly as written, never expanded to
+   * the full provider/model catalog.
+   */
+  providers?: string[]
+  models?: string[]
+  mcpServers?: string[]
+  agents?: string[]
   requestsPerMinute: number
   requestsPerDay: number
   tokensInPerDay: number