fix: refresh Access Settings policy from /access response

Reopening the Access Settings dialog after a save could leave the
radio on the wrong policy: the form initialized `access_policy`
from the route list's snapshot, but the list isn't refreshed when
the dialog closes, so the snapshot's value silently shadowed the
just-saved policy.

Backend now returns the route's authoritative `access_policy` on
`GET /v2/model-routes/{id}/access`. Use that value when the GET
resolves, falling back to the parent snapshot only as the initial
seed so the radio isn't briefly unselected.

While we're here, widen the `access_policy` type from a closed
union to `string` — plugins can contribute additional policy
values via the `accessControl.allowedUsersOverride` slot, so the
wire type shouldn't restrict to the OSS-side enum.

src/pages/llmodels/apis/index.ts

@@ -424,9 +424,14 @@ export async function queryBackendList(params?: { cluster_id: number }) {
 }
 
 export async function queryModelAccessUserList(id: number) {
-  return request<{ items: UserListItem[] }>(`${MODEL_ROUTES}/${id}/access`, {
-    method: 'GET'
-  });
+  // The response carries `access_policy` alongside `items` so the
+  // Access Settings dialog can refresh both halves from a single
+  // GET (the calling list snapshot may be stale after a prior
+  // save).
+  return request<{ items: UserListItem[]; access_policy?: string }>(
+    `${MODEL_ROUTES}/${id}/access`,
+    { method: 'GET' }
+  );
 }
 
 export async function updateModelAccessUser(params: {