refactor(access): fold allowed_users into allowed_principals

Move the model-route access modal off the deprecated allowed_users
policy/field onto the unified allowed_principals + principals surface,
persisting everything through a single /access POST.

- "specific users" radio now uses allowed_principals; a returned legacy
  allowed_users value is normalized so existing routes still select it.
- derive the picker's selection and the full grant set from `principals`
  in GET /access (fall back to legacy `items` if a backend doesn't
  return principals yet).
- save as `principals`: the principal-based override sends its staged
  set; the user picker maps its selection to USER-kind grants and
  preserves any non-user grants from the snapshot (no longer sends
  `users`).
- guard saving before the GET seeds principals (would wipe grants);
  share the ALLOWED_PRINCIPALS_POLICY constant.
- AccessControlFormData: `users` optional, add `principals`.

src/pages/llmodels/apis/index.ts

@@ -445,11 +445,18 @@ export async function queryModelAccessUserList(id: number) {
   // The response carries `access_policy` alongside `items` so the
   // Access Settings dialog can refresh both halves from a single
   // GET (the calling list snapshot may be stale after a prior
-  // save).
-  return request<{ items: UserListItem[]; access_policy?: string }>(
-    `${MODEL_ROUTES}/${id}/access`,
-    { method: 'GET' }
-  );
+  // save). `principals` is the full grant set (any kind) used by the
+  // principal-based override; `items` stays the USER-only subset.
+  return request<{
+    items: UserListItem[];
+    access_policy?: string;
+    principals?: {
+      principal_type: string;
+      principal_id: number;
+      principal_name?: string;
+      principal_display_name?: string;
+    }[];
+  }>(`${MODEL_ROUTES}/${id}/access`, { method: 'GET' });
 }
 
 export async function updateModelAccessUser(params: {