fix(plugin): stop requesting the retired virtual-entries route

[maxmad64bis]

Stacked on #15239. Only the last commit is this PR's; the branch contains its parent commit and I'll rebase once it lands.
⚠️ base-red inherited: #15306

Summary

Catalog change: auto and auto/lkgp are no longer published, because /v1/models doesn't list them; the other auto/* entries stay, now published as /v1/models serves them. The plugin used to fetch /api/combos/auto on every refresh and synthesize those entries from it, a slow route that stalled the gateway on large pools (#14889) and repeated what /v1/models already serves with the same limits. Refresh now uses three sources instead of four, and old configs and snapshots still load with the retired field ignored. Builds on @bilalsafdardev's diagnosis from #14889.

Related Issues

• Related to fix(api): GET /api/combos/auto rebuilds the full provider pool 40x serially (~49s per request) #14889

Validation

• Change type: provider
• Focused tests and category gates from the golden path
• npm run lint
• Reconciled with the current active release base; focused checks rerun afterward
• Production-code changes include a new or updated automated test in this PR

Tests Added Or Updated

• refresh-routes.test.ts (new): closed route table, exact-match guard, retired entries never published, legacy snapshot tolerated.
• publish-guard.test.ts: every requested path declared on full setup; two-key counts shape.
• catalog.test.ts, catalog-provider.test.ts: native rows published as served; legacy fetcher input ignored.
• shared-fingerprint.test.ts: content fingerprint over two entries; arity, order and membership cases.
• cache-ttl-snapshot.test.ts, disk-snapshot-atomicity.test.ts, snapshot-stale-entries.test.ts, warm-snapshot-identity.test.ts: legacy snapshot loads, retired field never rewritten, stable identity.
• management-token.test.ts, management-token-env.test.ts, refresh-failopen.test.ts, staged-refresh.test.ts: zero retired-route requests; staged upgrade over three tiers.
• Seven neighbor suites (api-package, parity, nested-combos, enrichment, usable-only, timeouts-logger, shared-anthropic-prefixes): counts, native entries.
• provider-filter.test.ts (retired block removed); deleted auto-combos.test.ts and shared-auto-combos.test.ts.

Coverage Notes

• src/index.ts — covered by staged-refresh.test.ts, refresh-routes.test.ts, publish-guard.test.ts.
• src/catalog.ts — covered by catalog.test.ts, catalog-provider.test.ts, refresh-routes.test.ts.
• src/cache.ts — covered by cache-ttl-snapshot.test.ts, disk-snapshot-atomicity.test.ts, snapshot-stale-entries.test.ts.
• src/options.ts — covered by timeouts-logger.test.ts, management-token.test.ts.
• src/provider-filter.ts — covered by provider-filter.test.ts, catalog-provider.test.ts.
• src/shared/auto-combos.ts (deleted) — absence pinned by refresh-routes.test.ts.
• src/shared/fingerprint.ts, src/shared/index.ts — covered by shared-fingerprint.test.ts, api-package.test.ts.
• src/legacy-model.ts — comment only; exercised via catalog.test.ts.

Reviewer Notes

• Merge: Stacked on feat(plugin): filter published catalog by provider with empty-result guard #15239; it also touches the same plugin files as feat(plugin): filter published catalog by capability presets #14554 (merge order: feat(plugin): filter published catalog by capability presets #14554 first, feat(plugin): filter published catalog by provider with empty-result guard #15239 reconnects on top — rebase on the release tip). With fix(auth): serve only catalogued free-access models on credits-exhausted OpenRouter connections #15436 (shared file): either order. With feat(plugin): publish useful catalog entries by default, full list on request #15484 (shared file): either order.
• Follow-up: Publishing auto and auto/lkgp again belongs in /v1/models on the server side, as a separate change; this one only stops the plugin from asking the slow route.