Refresh exactly one provider's account-aware model inventory. This is an explicit operation because it starts a CLI process (and, for Claude workspaces, creates or wakes the user's persistent sandbox). Authorization therefore matches the provider's chat execution requirement instead of requiring unrelated settings mutation access. The AI service applies a provider-scoped single-flight and cooldown before doing that work.