feat: block provider type changes when models still reference that provider

[coderabbitai]

Summary

When updating a provider via PUT /providers/{id}, the current implementation allows changing the provider type (e.g., from openai to bedrock) even when models reference that provider via provider_id. Since src/proxy/provider.rs dispatches by provider.provider_type(), such a change silently reroutes every referencing model through a different gateway without validating those model identifiers.

Expected Behavior

When a provider type change is attempted (i.e., the incoming provider.provider_type() differs from the stored provider's type), the update should be rejected with a 400/409 error if any model references that provider_id.

Proposed Solution

In the update helper in src/admin/providers.rs:

1. Fetch the existing provider before writing.
2. Compare the existing provider_type() with the incoming one.
3. If they differ, check whether any models reference this provider_id.
4. If so, reject the update with an appropriate API error.

This requires a built-in model registry (or an equivalent lookup mechanism) to be implemented first, so that models referencing a given provider_id can be efficiently queried.

References

• PR: feat: add llm provider entity #57
• Review comment: feat: add llm provider entity #57 (comment)

/cc @bzp2010