Prevents infinite retry loop on /api/hermes/available-models when
accessing the app without a token, which triggers server-side 429
rate limiting. Both loadModels() and fetchProviders() now bail out
early if hasApiKey() returns false.
Closes#606
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>