List models and model classes with reachability

Every model and model class the platform knows, annotated with provider, region, and why each is or is not reachable for this workspace under the live policy. This is the answer to "which models can touch our data", derived from the policy rather than from documentation that can drift away from it.

reason is one of allowed, model_denied, provider_floor, provider_not_allowed, region_not_permitted. A class's source is builtin, platform, or org. A deployment with custom_endpoint: true is a self-hosted or customer-operated inference endpoint declared at deployment level; no host and no credential detail is ever returned.