fix(auth): keep a provider wildcard inside the provider it names

[HouMinXi]

Summary

• A restricted key allowed cline/* matched every candidate starting with cline/. Alias expansion turns another provider's model into cline/openrouter/deepseek/..., which still starts with cline/, so the key received models it never allowed.
• A provider/* entry still covers that provider's own models, including ids whose model segment contains a slash. It no longer covers a different registered provider nested under the same prefix.

Related Issues

• Closes fix(api): restricted API-key allowlist leaks models from other providers when a model root collides after provider-alias expansion #15409

Validation

• Change type: other (API-key model allowlist)
• Focused tests: node --import tsx/esm --test tests/unit/allowlist-alias-root-collision.test.ts (2 pass)
• eslint on the changed files, with the repo suppression file
• Reconciled with release/v3.8.52 @ 23a1148486
• New test covers the change
• Defect injection: restoring the plain startsWith match makes the wildcard case fail, and the change was restored

Tests Added Or Updated

• tests/unit/allowlist-alias-root-collision.test.ts (added)

Coverage Notes

• The test allows one provider's model and asserts a different provider's model reached through the same prefix is rejected, while the named provider's own model stays allowed.

Reviewer Notes

• isModelAllowedForKey has six production callers. All of them pass a full model id and read a boolean, so tightening the match does not change their call shape.