fix(admin,ai): redirect admin.html + modèles fallback + picker provider/modèle par requête

Trois bugs corrigés + une amélioration demandée :

1. **fix(admin): /admin.html redirigeait toujours vers /**
   - admin.js _gateAdmin() lisait /api/auth/status qui ne contient PAS le rôle user
   - Remplacé par /api/auth/me (retourne username, role, vaults)
   - Le code distingue maintenant le cas 'auth désactivé' (admin anonyme) du
     cas 'auth requise non admin' (affiche écran forbidden)

2. **fix(ai): les modèles Nvidia/Xiaomi ne se chargeaient pas dans les dropdowns**
   - Xiaomi : l'endpoint public /v1/models est instable, échec réseau fréquent
   - Toutes les erreurs réseau/d'API renvoyaient models=[] → dropdown vide
   - Ajout d'un fallback curé : _FALLBACK_MODELS dict avec 4-8 modèles populaires
     par provider, TOUJOURS retourné si la clé manque OU si l'API distante échoue
   - Le frontend voit désormais 'fallback' vs 'live' comme hint pour l'utilisateur
   - Gemini parsing : strip du préfixe 'models/' retourné par l'API Gemini
   - 7 nouveaux tests pytest pour _FALLBACK_MODELS + endpoint /api/config/ai-models

3. **feat(ai): picker provider/model dans la toolbar AI + BooksLM**
   - Plusieurs providers peuvent maintenant être activés simultanément
   - Sélection provider+model par section (Forge, BooksLM, etc.) via dropdown
   - État persisté en localStorage (le choix suit l'utilisateur entre sections)
   - Chaque appel AI passe maintenant {provider, model} au backend
   - ai.js : aiAction() lit le picker et l'injecte dans le body
   - bookslm.js : envoie provider+model à /api/ai/bookslm/chat
   - ai_routes.py + bookslm_routes.py : AIRequest et BooksLMChatRequest
     acceptent provider+model, avec save/restore du modèle original
     pour ne pas affecter les autres requêtes concurrentes
   - 7 nouvelles clés i18n (ai.provider, ai.model, ai.model_loading, etc.)
   - 1 nouveau test bookslm vérifie que le schema accepte provider+model
   - validate-imports.mjs : fix faux positif sur 'export { X as Y }'

Vérifié :
- pytest : 502 passed, 5 skipped (494 baseline + 7 AI models + 1 BooksLM)
- frontend unit : 7 passed
- validate-imports : 30 modules / 204 exports / 0 erreur
- pane-manager JSDOM : 9/9
- ruff check backend/ : All checks passed

backend/main.py

@@ -4058,19 +4058,30 @@ async def api_test_ai_keys(current_user=Depends(require_admin)):
 
 @app.get("/api/config/ai-models")
 async def api_list_ai_models(provider: str = Query(...), current_user=Depends(require_admin)):
-    """List available models for a given AI provider."""
+    """List available models for a given AI provider.
+
+    Strategy:
+    1. Try the provider's public models endpoint (OpenAI-compatible /v1/models or Gemini).
+    2. If the network call fails (timeout, 4xx, 5xx, DNS, etc.), fall back to a
+       curated static list of known-good models for that provider.
+    3. Always return a non-empty list when the provider is known, so the UI
+       dropdown is never empty.
+    """
     provider = provider.lower()
 
     all_providers = ("deepseek", "openrouter", "gemini", "nvidia", "qwencloud", "xiaomi", "mistral")
     if provider not in all_providers:
-        return {"models": [], "error": f"Unknown provider: {provider}"}
+        return {"models": [], "error": f"Unknown provider: {provider}", "source": "validation"}
 
     key_name = f"{provider.upper()}_API_KEY"
     key = get_ai_key(key_name)
     if not key:
-        return {"models": [], "error": "API key not configured"}
+        # No key configured — return curated fallback list so the UI can
+        # still show what WOULD be available once a key is set.
+        return {"models": _FALLBACK_MODELS.get(provider, []), "source": "fallback",
+                "note": "API key not configured — showing default model list"}
 
-    # Build URL and request
+    # Build URL
     if provider == "gemini":
         url = f"https://generativelanguage.googleapis.com/v1beta/models?key={key}"
     elif provider == "deepseek":
@@ -4082,6 +4093,8 @@ async def api_list_ai_models(provider: str = Query(...), current_user=Depends(re
     elif provider == "qwencloud":
         url = "https://dashscope.aliyuncs.com/compatible-mode/v1/models"
     elif provider == "xiaomi":
+        # Xiaomi's public /v1/models endpoint is not stable — fetch if reachable,
+        # otherwise fall back to a curated list of mimo models.
         url = "https://api.xiaomi.com/v1/models"
     elif provider == "mistral":
         url = "https://api.mistral.ai/v1/models"
@@ -4096,13 +4109,86 @@ async def api_list_ai_models(provider: str = Query(...), current_user=Depends(re
             data = _json.loads(resp.read().decode())
 
         if provider == "gemini":
-            models = [m.get("name", "") for m in data.get("models", [])]
+            models = [m.get("name", "") for m in data.get("models", []) if m.get("name")]
+            # Gemini returns names like "models/gemini-1.5-flash" — strip prefix
+            models = [m.replace("models/", "") for m in models]
         else:
-            models = [m.get("id", "") for m in data.get("data", [])]
+            models = [m.get("id", "") for m in data.get("data", []) if m.get("id")]
 
-        return {"models": models}
+        if models:
+            # Prepend the configured default if not already present
+            default = PROVIDERS.get(provider, {}).get("model")
+            if default and default not in models:
+                models = [default] + models
+            return {"models": models, "source": "live", "count": len(models)}
+        # Empty list from API — fall through to fallback
+        raise ValueError("empty model list from provider API")
     except Exception as e:
-        return {"models": [], "error": str(e)}
+        # Network error, auth error, parsing error — use curated fallback
+        fallback = _FALLBACK_MODELS.get(provider, [])
+        return {"models": fallback, "source": "fallback", "error": str(e)[:200],
+                "note": "Could not reach provider API — showing default model list"}
+
+
+# ── Curated fallback model lists ──────────────────────────────────────────
+# Used when the provider API is unreachable or returns empty.
+# Keep these short and focused on models known to work with the
+# OpenAI-compatible chat completions interface (or Gemini's generateContent).
+_FALLBACK_MODELS: dict[str, list[str]] = {
+    "deepseek": [
+        "deepseek-chat",
+        "deepseek-reasoner",
+    ],
+    "openrouter": [
+        "openai/gpt-4o-mini",
+        "openai/gpt-4o",
+        "anthropic/claude-3.5-sonnet",
+        "anthropic/claude-3-haiku",
+        "google/gemini-2.0-flash-exp:free",
+        "meta-llama/llama-3.1-70b-instruct",
+        "meta-llama/llama-3.1-8b-instruct:free",
+        "mistralai/mistral-large-latest",
+    ],
+    "gemini": [
+        "gemini-2.0-flash",
+        "gemini-2.0-flash-exp",
+        "gemini-1.5-pro",
+        "gemini-1.5-flash",
+        "gemini-1.5-flash-8b",
+    ],
+    "nvidia": [
+        "meta/llama-3.1-405b-instruct",
+        "meta/llama-3.1-70b-instruct",
+        "meta/llama-3.1-8b-instruct",
+        "mistralai/mistral-large",
+        "google/gemma-2-27b-it",
+        "nvidia/llama-3.1-nemotron-70b-instruct",
+    ],
+    "qwencloud": [
+        "qwen-max",
+        "qwen-plus",
+        "qwen-turbo",
+        "qwen-long",
+        "qwen-vl-max",
+        "qwen-vl-plus",
+    ],
+    "xiaomi": [
+        # Xiaomi MiMo models — the public /v1/models endpoint is unreliable,
+        # so we ship a known-good list as fallback.
+        "mimo-v2-pro",
+        "mimo-v2-flash",
+        "mimo-v2-vl",
+        "mimo-v2-tts",
+    ],
+    "mistral": [
+        "mistral-large-latest",
+        "mistral-medium-latest",
+        "mistral-small-latest",
+        "open-mistral-7b",
+        "open-mixtral-8x7b",
+        "codestral-latest",
+    ],
+}
 
 
 # ---------------------------------------------------------------------------