extproc: scope /v1/models by non-model exact-match headers

[rafaelgaspar]

Description

When AIGatewayRoute rules match on exact headers other than x-ai-eg-model (for example x-jwt-sub injected from JWT sub via Envoy Gateway SecurityPolicy with claimToHeaders and recomputeRoute: true), GET /v1/models now returns only models from rules whose scope headers match the incoming request. This mirrors the hostname scoping behavior added in #2160.

Previously the controller indexed only x-ai-eg-model values into the global model catalog, so tenants on a shared hostname saw the union of all declared models even when chat/completions routing was correctly scoped.

Changes:

• Add ModelsByHostAndScope / HeaderScopedModels to the filter config and wire it through runtime.
• Index models by canonical header scope key in the gateway controller.
• Filter /v1/models responses in extproc using request scope headers.
• Add unit tests for controller and extproc selection.
• Add e2e coverage reproducing /v1/models ignores x-jwt-sub when rules require it for routing #2452 with Envoy Gateway SecurityPolicy JWT claim projection.
• Document header-scoped /v1/models in supported-endpoints.md.

Related Issues/PRs (if applicable)

Fixes #2452

Related: #2160 (hostname scoping pattern)

Special notes for reviewers (if applicable)

• Header scoping composes with hostname scoping: rules with both hostnames and scope headers are indexed under the host bucket and filtered by scope at runtime.
• Rules without scope headers remain visible to all requests on the same host (same opt-in pattern as unscoped hostnames).
• Scope headers must be present on the request when extproc runs (e.g. JWT claimToHeaders + recomputeRoute, same as chat routing).
• E2e fixture: tests/e2e/testdata/models_header_scope_jwt.yaml + TestModelsHeaderScopeJWT.
• AI tooling was used to assist with implementation and tests; changes were reviewed and validated locally with make precommit and unit tests.

Test plan

• make precommit
• Unit tests: go test ./internal/controller/... -run HeaderScoped
• Unit tests: go test ./internal/extproc/... -run selectModels
• Unit tests: go test ./internal/filterapi/... -run HeaderScope
• TestModelsHeaderScopeJWT passed locally via make test-e2e

[dosubot]

📄 Knowledge review

Dosu skipped reviewing this PR because your organization has used its 200 included credits for the month. Your usage will reset on 2026-08-01. To have Dosu review this PR before then, ask your organization admin to upgrade to a pro account.

---