fix(backend): reject compound provider credentials

backend/test/list-models.test.ts

@@ -141,3 +141,25 @@ test("model-list spawn loads only the selected canonical provider credential", a
     rmSync(path.dirname(script), { recursive: true, force: true });
   }
 });
+
+test.each(["amazon-bedrock", "azure-openai-responses", "cloudflare-workers-ai", "cloudflare-ai-gateway"])(
+  "model listing rejects compound provider %s before spawning Pi", async (provider) => {
+    const script = scriptWith([]);
+    const secret = join(path.dirname(script), "model-key");
+    writeFileSync(secret, "selected-secret", { mode: 0o600 });
+    let spawns = 0;
+    const lister = createPiModelLister(loadConfig({
+      PI_PROVIDER: provider, THT_MODEL_API_KEY_FILE: secret,
+    }), {
+      spawnFn: () => { spawns += 1; throw new Error("must not spawn"); },
+    });
+    try {
+      await expect(lister()).rejects.toThrow(
+        "compound credential bundles are unsupported by THT_MODEL_API_KEY_FILE; dedicated provider configuration is required",
+      );
+      expect(spawns).toBe(0);
+    } finally {
+      rmSync(path.dirname(script), { recursive: true, force: true });
+    }
+  },
+);