fix(llm-pi-ai): withhold OAuth-only providers from the configurable directory

pi-ai resolves an OAuth provider from a stored OAuth credential alone, and
this adapter builds its Models collection with no credential store and runs
no login flow. `openai-codex` — the one installed provider declaring
`auth.oauth` with no `auth.apiKey` — was therefore offered on the Models page
with the keyless placeholder every pi-ai route carries, and every request on
it failed `Provider is not configured` before going out.

`catalogProviderTakesApiKey()` answers whether pi-ai's installed provider for
a route declares the one method this adapter can supply, and the directory
skips the catalog routes that fail it. Catalog membership is unchanged, so
`declared` still answers what pi-ai ships; the profile half of the union stays
unconditional, so a route a settings document already names keeps its entry
and can be edited or deleted.

Resolution is untouched: a profile naming `apiKeyEnv` on such a route still
builds a working provider.

apps/web/tests/snapshots/models-settings/empty.expected.md

@@ -44,7 +44,6 @@
     - option "moonshotai-cn"
     - option "nvidia"
     - option "openai"
-    - option "openai-codex"
     - option "opencode"
     - option "opencode-go"
     - option "openrouter"

apps/web/tests/snapshots/onboarding-usable-provider/dismissed.expected.md

@@ -48,7 +48,6 @@
     - option "moonshotai-cn"
     - option "nvidia"
     - option "openai"
-    - option "openai-codex"
     - option "opencode"
     - option "opencode-go"
     - option "openrouter"