feat: access-control modal seam to swap the allowed_users surface

The OSS Access Settings form hardcodes the `allowed_users` policy
(per-user explicit grants via the legacy transfer widget). Multi-
tenancy needs a different surface that grants by Org / Group / User
principals via the `/v2/model-routes/{id}/principals` endpoints, and
the enterprise plugin will ship that — but the OSS form should stay
visually unchanged when no plugin is loaded.

Add a plugin extension point on the form: if a registered plugin
exposes `accessControl.allowedUsersOverride: { policyValue, labelId,
tipsId?, Field }`, the form replaces the `allowed_users` radio entry
with the plugin's labelled option, swaps the access-scope tooltip
copy, and renders `<Field form routeId action />` for the override
policy. Without a plugin the form's radio / tooltip / content path
are unchanged.

`handleOnFinish` continues to send `users` only for `allowed_users`;
any other policy (including the plugin's value) goes through with
an empty users list, leaving the plugin's Field to manage its own
principal CRUD inline.

src/pages/llmodels/components/access-control-modal/index.tsx

@@ -23,8 +23,14 @@ const AccessControlModal: React.FC<
 
   const handleOnFinish = async (values: AccessControlFormData) => {
     try {
-      const data = {
+      const data: any = {
         access_policy: values.access_policy,
+        // `users` is only meaningful for the legacy `allowed_users`
+        // policy; for the plugin override (typically the principal-
+        // based policy) the plugin's Field manages its own state
+        // inline via the principal CRUD endpoints, so we send an
+        // empty list to clear any stale user grants from a prior
+        // policy switch.
         users:
           values.access_policy === 'allowed_users' ? values.users || [] : []
       };