test(integration): exercise passthrough model/path restriction under Yaegi

SHOULD-7, round 3, 2026-08-22 review -- a report-correction gap, not a
code defect (the reviewer verified peekPassthroughModel/
scanTopLevelModel and allowsPassthroughPath directly via the repo's own
Yaegi harness). Every group/user this integration suite drove native
passthrough through ("eng", "limited", "hotreload") left models and
passthroughPaths unset, so hasModelRestriction() was always false and
allowsPassthroughPath's non-empty-list branch was never reached -- the
suite itself never exercised security findings 2/3's enforcement code
under a real Traefik+Yaegi process, contrary to an earlier claim.

Added a dedicated "restricted" group (models: ["gpt-mock"],
passthroughPaths: ["v1/chat/completions"]) and its own user (dave),
isolated from every other group/test in this file, plus
TestPassthroughModelAndPathRestriction: an allowed model on the allowed
path (200, proxied for real), a denied model on that same allowed path
(403 -- proves the model peek runs), and an ALLOWED model on a path
outside the allowlist (403 -- proves the path check alone, not the
model check, is what fires there). Verified passing via `make
integration` against the real docker-compose stack.

integration/traefik/dynamic.yml.tmpl

@@ -80,6 +80,22 @@ http:
             hotreload:
               limits:
                 requestsPerMinute: 100000
+            # Dedicated to TestPassthroughModelAndPathRestriction
+            # (security review finding 2/3, round 3, 2026-08-22 report
+            # correction): every OTHER group in this file leaves models
+            # and passthroughPaths unset, so hasModelRestriction() is
+            # always false and allowsPassthroughPath's non-empty-list
+            # branch is never reached — meaning the native-passthrough
+            # model-peek (peekPassthroughModel/scanTopLevelModel) and
+            # path-allowlist (allowsPassthroughPath) code paths were
+            # NEVER exercised under real Yaegi interpretation by this
+            # suite, contrary to what an earlier report claimed. This
+            # group exists specifically to close that gap.
+            restricted:
+              limits:
+                requestsPerMinute: 1000
+              models: ["gpt-mock"]
+              passthroughPaths: ["v1/chat/completions"]
           users:
             inline:
               # limits.requestsPerDay is set (generously — every test in
@@ -114,6 +130,12 @@ http:
               - name: hotreload-probe
                 group: hotreload
                 apiKey: "sk-int-hotreload"
+              # TestPassthroughModelAndPathRestriction's dedicated
+              # identity — see the "restricted" group's own comment
+              # above.
+              - name: dave
+                group: restricted
+                apiKey: "sk-int-dave"
             file: "/users/users.json"
           redis:
             address: "redis:6379"