feat(llm_local): add GET /v1/models for client preflight

[wehnsdaefflae]

Summary

Closes #82. Adds GET /v1/models to the llm_local mock.

#84 by @MRX-72 does the same thing. This one differs in two places, both open to discussion.

Changes

• app/mocks/openai.py: new GET /v1/models, returning a typed ModelList built from the sandbox's own config (OLLAMA_MODEL, default gpt-oss:20b). It does not call Ollama.
  • Reason: clients call this route to check whether the sandbox is alive. If the route needs the model backend, a sandbox that is up but still pulling a model comes back as a 500. That is the same false negative as the 404, one layer down.
  • Trade-off, noted in the docstring: listing from config can advertise a model that the first completion then fails on. POST /v1/chat/completions still returns backend failures as a 500.
• app/mocks/openai.py: verify_api_key now declares the header optional, so a request without Authorization gets 401 Missing Authorization header, expected: Bearer sk-mock-key instead of FastAPI's 422. That is the cause of llm_local: the mock requires Authorization: Bearer sk-mock-key and the README does not say so #83. The key is already public: make up prints it, both clients hardcode it, four READMEs list it.
• app/mocks/README.md: the endpoint table and mock credential that section 4 of that file asks every mock to document.
• tests/test_mock_routes.py: new. llm_local had no tests; this follows the layout mcp_local/tests/ uses.

How to test

cd sandboxes/llm_local
PYTHONPATH=. uv run pytest tests/ -q

Passes with Ollama switched off:

8 passed

Eight cases: response shape, the configured model id, that the route answers with no backend, the four auth paths, and module import.

curl http://localhost:8000/v1/models -H "Authorization: Bearer sk-mock-key"
# {"object":"list","data":[{"id":"gpt-oss:20b","object":"model","created":0,"owned_by":"ollama"}]}

curl -i http://localhost:8000/v1/models
# HTTP/1.1 401
# {"detail":"Missing Authorization header, expected: Bearer sk-mock-key"}

Notes

• No sandbox edits outside llm_local.
• Fine by me if Add GET /v1/models to the llm_local mock #84 lands instead with these two changes folded in.