- Add get_all_allowed_identifiers() to MultiModelManager returning all valid
  model identifiers (default model + short name + aliases, audio, tts, image,
  vision models, and custom aliases)
- Rewrite is_allowed_model() to check against the full allowed set with
  support for prefixed forms and short-name matching
- Add validation in request_model() that rejects unknown models with an error
  message listing all available models
- Fix get_model_for_request() to reject loading arbitrary models not in the
  allowed set
- Update all API endpoints (text, images, tts, transcriptions) to check for
  the error key and return HTTP 404 when a disallowed model is requested