fix(studio): refresh Ark API keys and show model permissions

[evanlowe]

Studio omitted custom-permission API Keys and could reuse an outdated key list after a page reload. This change fetches current key metadata, preserves distinct keys across pagination, and shows enabled/disabled status and permission scope in both traditional and quick VeADK Agent creation

Model dropdowns reflect the selected key’s permissions, retain explicitly granted video and shut-down models with an unavailable reason, and clear selections that lose permission. Permission details stay in the searchable model dropdown

Cloud failures preserve the upstream HTTP status, response body and request ID, with credential redaction if needed. Overlapping identical requests share a pending query, including failures, so concurrent refreshes do not multiply activation requests. Network client imports remain deferred until the first request

Validation:

• 1,209 frontend tests and 73 backend model-catalog tests passed
• Production build, packaged asset verification, i18n consistency, Pyright and full pre-commit checks passed
• Credential scan included source, tests and generated WebUI assets
• Real Volcengine and BytePlus checks covered complete key lists, one-key-per-page pagination and repeated reads; overlapping model requests issued one activation query per provider
• Local simulations covered 7,560 model requests across success, rate limits, timeouts and recovery, plus cancellation and fresh key-list reads

Volcengine can still return a cloud-side 429 for a single activation query; the exact quota consumer has not been identified. The original cloud response remains available for diagnosis