revert: undo teamless all-team-models denial from #32022 and #29746 (#32032) [backport 1.90.x]

[devin-ai-integration]

Relevant issues

Backports #32032 to stable/1.90.x. Original issue #30737

Linear ticket

Pre-Submission checklist

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review

Screenshots / Proof of Fix

This is a backport of the already-merged revert #32032; the end-to-end proof of fix (live proxy, teamless all-team-models key both listing and calling models) is covered by the source change and the dedicated e2e test in #32372. Here the guarantee is the hardened unit regression tests, which I mutation-tested against this branch: restoring either teamless denial (the _resolve_key_models_for_auth_check teamless branch returning the sentinel list, or the get_key_models team_id is not None guard) makes test_resolve_key_models_teamless_all_team_models_returns_empty and test_get_key_models_teamless_all_team_models_returns_unrestricted fail. The full auth + batch suites pass (219 passed) on this branch

Type

🐛 Bug Fix
✅ Test

Changes

A teamless key scoped to all-team-models must inherit the full proxy model list, exactly as if its models field were left empty; that is the intended contract per #30737. #29746 tightened this to deny such keys, and #32022 mirrored the denial on the inference path. Both were reverted on staging in #32032. This backports that revert to stable/1.90.x

The behavioral change is confined to two spots. _resolve_key_models_for_auth_check now returns [] (unrestricted) instead of the unresolved sentinel list for a teamless all-team-models key, and get_key_models drops the team_id is not None guard so the sentinel expands the same way regardless of team assignment. The inference skip check in user_api_key_auth.py already lacked the guard on this line, so it needed no change

Scope note: the source revert also carried staging-only test coverage (team-sentinel expansion for can_team_access_model, and expand_wildcard_deployments_for_model_info cases) that depends on code paths not present on stable/1.90.x. Those were omitted since they exercise behavior this line doesn't have; the ported tests are the ones that pin the teamless regression itself

Version bumped to 1.90.4 in its own commit

Link to Devin session: https://app.devin.ai/sessions/68804be8677b4a0c9033e7c2663281bc
Requested by: @mateo-berri

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring