Return the authoritative model catalog with an ETag for conditional GETs.

This is the source of truth the desktop backend fetches at startup and after every QUADRILLION_API_KEY change, so new models ship via a cloud redeploy without requiring a desktop release. Availability filtering by the user's own credentials happens on the desktop, with one exception: eap: true models are omitted server-side for accounts without the eap_access entitlement, because shipped desktop builds cannot be trusted to hide them. The ETag is therefore stable per entitlement variant rather than across all accounts.

Alias entries are gated the same way, on the capabilities the client declares rather than on an entitlement: a build that predates alias support would show the entry in its picker and fail to resolve it.

Server-only data is stripped first: listed: false billing-only models and the inline pricing block never leave the server.

The ETag is derived from the stripped catalog content; an unchanged catalog returns 304 Not Modified so the desktop leaves its local store untouched.